Cisco Final Exam

Frage 1 von 86

1

ACLs are used primarily to filter traffic. What are two additional uses of ACLs? (Choose two.):

Wähle eine oder mehr der folgenden:

specifying internal hosts for NAT
identifying traffic for QoS
specifying source addresses for authentication
reorganizing traffic into VLANs
filtering VTP packets

Erklärung

Frage 2 von 86

1

What two features are added in SNMPv3 to address the weaknesses of previous versions of SNMP? (Choose two.)

Wähle eine oder mehr der folgenden:

authentication
authorization with community string priority
bulk MIB objects retrieval
ACL management filtering
encryption

Erklärung

Frage 3 von 86

1

What network testing tool is used for password auditing and recovery?

Wähle eine der folgenden:

Nessus
Metasploit
L0phtcrack
SuperScan

Erklärung

Frage 4 von 86

1

Which type of firewall makes use of a server to connect to destination devices on behalf of clients?

Wähle eine der folgenden:

packet filtering firewall
proxy firewall
stateless firewall
stateful firewall

Erklärung

Frage 5 von 86

1

Refer to the exhibit. What will be displayed in the output of the show running-config object command after the exhibited configuration commands are entered on an ASA 5506-X?

Wähle eine der folgenden:

host 192.168.1.4
range 192.168.1.10 192.168.1.20
host 192.168.1.3, host 192.168.1.4, and range 192.168.1.10 192.168.1.20
host 192.168.1.3
host 192.168.1.3 and host 192.168.1.4
host 192.168.1.4 and range 192.168.1.10 192.168.1.20

Erklärung

Frage 6 von 86

1

Refer to the exhibit. According to the command output, which three statements are true about the DHCP options entered on the ASA? (Choose three.)

Wähle eine oder mehr der folgenden:

The dhcpd address [ start-of-pool ]-[ end-of-pool ] inside command was issued to enable the DHCP server.
The dhcpd address [ start-of-pool ]-[ end-of-pool ] inside command was issued to enable the DHCP client.
The dhcpd enable inside command was issued to enable the DHCP server.
The dhcpd auto-config outside command was issued to enable the DHCP client.
The dhcpd auto-config outside command was issued to enable the DHCP server.
The dhcpd enable inside command was issued to enable the DHCP client.

Erklärung

Frage 7 von 86

1

Which two statements describe the characteristics of symmetric algorithms? (Choose two.)

Wähle eine oder mehr der folgenden:

They are commonly used with VPN traffic.
They use a pair of a public key and a private key.
They are commonly implemented in the SSL and SSH protocols.
hey provide confidentiality, integrity, and availability.
They are referred to as a pre-shared key or secret key.

Erklärung

Frage 8 von 86

1

A web server administrator is configuring access settings to require users to authenticate first before accessing certain web pages. Which requirement of information security is addressed through the configuration?

Wähle eine der folgenden:

availability
integrity
scalability
confidentiality

Erklärung

Frage 9 von 86

1

The use of 3DES within the IPsec framework is an example of which of the five IPsec building blocks?

Wähle eine der folgenden:

authentication
nonrepudiation
integrity
Diffie-Hellman
confidentiality

Erklärung

Frage 10 von 86

1

What function is provided by Snort as part of the Security Onion?

Wähle eine der folgenden:

to generate network intrusion alerts by the use of rules and signatures
to normalize logs from various NSM data logs so they can be represented, stored, and accessed through a common schema
to display full-packet captures for analysis
to view pcap transcripts generated by intrusion detection tools

Erklärung

Frage 11 von 86

1

What are two drawbacks to using HIPS? (Choose two.)

Wähle eine oder mehr der folgenden:

With HIPS, the success or failure of an attack cannot be readily determined.
With HIPS, the network administrator must verify support for all the different operating systems used in the network.
HIPS has difficulty constructing an accurate network picture or coordinating events that occur across the entire network.
If the network traffic stream is encrypted, HIPS is unable to access unencrypted forms of the traffic.
HIPS installations are vulnerable to fragmentation attacks or variable TTL attacks.

Erklärung

Frage 12 von 86

1

In an AAA-enabled network, a user issues the configure terminal command from the privileged executive mode of operation. What AAA function is at work if this command is rejected?

Wähle eine der folgenden:

authorization
authentication
auditing
accounting

Erklärung

Frage 13 von 86

1

A company has a file server that shares a folder named Public. The network security policy specifies that the Public folder is assigned Read-Only rights to anyone who can log into the server while the Edit rights are assigned only to the network admin group. Which component is addressed in the AAA network service framework?

Wähle eine der folgenden:

automation
accounting
authentication
authorization

Erklärung

Frage 14 von 86

1

What is a characteristic of a DMZ zone?

Wähle eine der folgenden:

Traffic originating from the inside network going to the DMZ network is not permitted.
Traffic originating from the outside network going to the DMZ network is selectively permitted.
Traffic originating from the DMZ network going to the inside network is permitted.
Traffic originating from the inside network going to the DMZ network is selectively permitted.

Erklärung

Frage 15 von 86

1

Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?

Wähle eine der folgenden:

Use a Syslog server to capture network traffic.
Deploy a Cisco SSL Appliance.
Require remote access connections through IPsec VPN.
Deploy a Cisco ASA.

Erklärung

Frage 16 von 86

1

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

Wähle eine der folgenden:

Frames from PC1 will be forwarded since the switchport port-security violation command is missing.
Frames from PC1 will be forwarded to its destination, and a log entry will be created.
Frames from PC1 will be forwarded to its destination, but a log entry will not be created.
Frames from PC1 will cause the interface to shut down immediately, and a log entry will be made.
Frames from PC1 will be dropped, and there will be no log of the violation.
Frames from PC1 will be dropped, and a log message will be created.

Erklärung

Frage 17 von 86

1

What security countermeasure is effective for preventing CAM table overflow attacks?

Wähle eine der folgenden:

DHCP snooping
Dynamic ARP Inspection
IP source guard
port security

Erklärung

Frage 18 von 86

1

What are two examples of DoS attacks? (Choose two.)

Wähle eine oder mehr der folgenden:

SQL injection
ping of death
port scanning
phishing
buffer overflow

Erklärung

Frage 19 von 86

1

Which method is used to identify interesting traffic needed to create an IKE phase 1 tunnel?

Wähle eine der folgenden:

transform sets
a permit access list entry
hashing algorithms
a security association

Erklärung

Frage 20 von 86

1

When the CLI is used to configure an ISR for a site-to-site VPN connection, which two items must be specified to enable a crypto map policy? (Choose two.)

Wähle eine oder mehr der folgenden:

the hash
the peer
encryption
the ISAKMP policy
a valid access list
IP addresses on all active interfaces
the IKE Phase 1 policy

Erklärung

Frage 21 von 86

1

How does a firewall handle traffic when it is originating from the public network and traveling to the DMZ network?

Wähle eine der folgenden:

Traffic that is originating from the public network is inspected and selectively permitted when traveling to the DMZ network.
Traffic that is originating from the public network is usually permitted with little or no restriction when traveling to the DMZ network.
Traffic that is originating from the public network is usually forwarded without inspection when traveling to the DMZ network.
Traffic that is originating from the public network is usually blocked when traveling to the DMZ network.

Erklärung

Frage 22 von 86

1

A client connects to a Web server. Which component of this HTTP connection is not examined by a stateful firewall?

Wähle eine der folgenden:

the source IP address of the client traffic
the destination port number of the client traffic
the actual contents of the HTTP connection
the source port number of the client traffic

Erklärung

Frage 23 von 86

1

Which network monitoring technology uses VLANs to monitor traffic on remote switches?

Wähle eine der folgenden:

IPS
IDS
TAP
RSPAN

Erklärung

Frage 24 von 86

1

Which rule action will cause Snort IPS to block and log a packet?

Wähle eine der folgenden:

log
drop
alert
Sdrop

Erklärung

Frage 25 von 86

1

What is typically used to create a security trap in the data center facility?

Wähle eine der folgenden:

IDs, biometrics, and two access doors
high resolution monitors
redundant authentication servers
a server without all security patches applied

Erklärung

Frage 26 von 86

1

A company is concerned with leaked and stolen corporate data on hard copies. Which data loss mitigation technique could help with this situation?

Wähle eine der folgenden:

strong PC security settings
strong passwords
shredding
encryption

Erklärung

Frage 27 von 86

1

Upon completion of a network security course, a student decides to pursue a career in cryptanalysis. What job would the student be doing as a cryptanalyst?

Wähle eine der folgenden:

cracking code without access to the shared secret key
creating hashing codes to authenticate data
making and breaking secret codes
creating transposition and substitution ciphers

Erklärung

Frage 28 von 86

1

What command is used on a switch to set the port access entity type so the interface acts only as an authenticator and will not respond to any messages meant for a supplicant?

Wähle eine der folgenden:

dot1x pae authenticator
authentication port-control auto
aaa authentication dot1x default group radius
dot1x system-auth-control

Erklärung

Frage 29 von 86

1

What are two disadvantages of using an IDS? (Choose two.)

Wähle eine oder mehr der folgenden:

The IDS does not stop malicious traffic.
The IDS works offline using copies of network traffic.
The IDS has no impact on traffic.
The IDS analyzes actual forwarded packets.
The IDS requires other devices to respond to attacks.

Erklärung

Frage 30 von 86

1

Refer to the exhibit. The ip verify source command is applied on untrusted interfaces. Which type of attack is mitigated by using this configuration?

Wähle eine der folgenden:

DHCP spoofing
DHCP starvation
STP manipulation
MAC and IP address spoofing

Erklärung

Frage 31 von 86

1

What ports can receive forwarded traffic from an isolated port that is part of a PVLAN?

Wähle eine der folgenden:

other isolated ports and community ports
only promiscuous ports
all other ports within the same community
only isolated ports

Erklärung

Frage 32 von 86

1

A user complains about being locked out of a device after too many unsuccessful AAA login attempts. What could be used by the network administrator to provide a secure authentication access method without locking a user out of a device?

Wähle eine der folgenden:

Use the login delay command for authentication attempts.
Use the login local command for authenticating user access.
Use the aaa local authentication attempts max-fail global configuration mode command with a higher number of acceptable failures.
Use the none keyword when configuring the authentication method list.

Erklärung

Frage 33 von 86

1

What are two drawbacks in assigning user privilege levels on a Cisco router? (Choose two.)

Wähle eine oder mehr der folgenden:

Only a root user can add or remove commands.
Privilege levels must be set to permit access control to specific device interfaces, ports, or slots.
Assigning a command with multiple keywords allows access to all commands using those keywords.
Commands from a lower level are always executable at a higher level.
AAA must be enabled.

Erklärung

Frage 34 von 86

1

Refer to the exhibit. Which conclusion can be made from the show crypto map command output that is shown on R1?

Wähle eine der folgenden:

The crypto map has not yet been applied to an interface.
The current peer IP address should be 172.30.2.1.
There is a mismatch between the transform sets.
The tunnel configuration was established and can be tested with extended pings.

Erklärung

Frage 35 von 86

1

What are two reasons to enable OSPF routing protocol authentication on a network? (Choose two.)

Wähle eine oder mehr der folgenden:

to prevent data traffic from being redirected and then discarded
to ensure faster network convergence
to provide data security through encryption
to prevent redirection of data traffic to an insecure link
to ensure more efficient routing

Erklärung

Frage 36 von 86

1

Which three functions are provided by the syslog logging service? (Choose three.)

Wähle eine oder mehr der folgenden:

gathering logging information
authenticating and encrypting data sent over the network
retaining captured messages on the router when a router is rebooted
specifying where captured information is stored
distinguishing between information to be captured and information to be ignored
setting the size of the logging buffer

Erklärung

Frage 37 von 86

1

What two ICMPv6 message types must be permitted through IPv6 access control lists to allow resolution of Layer 3 addresses to Layer 2 MAC addresses? (Choose two.)

Wähle eine oder mehr der folgenden:

neighbor solicitations
echo requests
neighbor advertisements
echo replies
router solicitations
router advertisements

Erklärung

Frage 38 von 86

1

Which three services are provided through digital signatures? (Choose three.)

Wähle eine oder mehr der folgenden:

accounting
authenticity
compression
nonrepudiation
integrity
encryption

Erklärung

Frage 39 von 86

1

A technician is to document the current configurations of all network devices in a college, including those in off-site buildings. Which protocol would be best to use to securely access the network devices?

Wähle eine oder mehr der folgenden:

FTP
HTTP
SSH
Telnet

Erklärung

Frage 40 von 86

1

An administrator is trying to develop a BYOD security policy for employees that are bringing a wide range of devices to connect to the company network. Which three objectives must the BYOD security policy address? (Choose three.)

Wähle eine oder mehr der folgenden:

All devices must be insured against liability if used to compromise the corporate network.
All devices must have open authentication with the corporate network.
Rights and activities permitted on the corporate network must be defined.
Safeguards must be put in place for any personal device being compromised.
The level of access of employees when connecting to the corporate network must be defined.
All devices should be allowed to attach to the corporate network flawlessly.

Erklärung

Frage 41 von 86

1

What is the function of the pass action on a Cisco IOS Zone-Based Policy Firewall?

Wähle eine der folgenden:

logging of rejected or dropped packets
inspecting traffic between zones for traffic control
tracking the state of connections between zones
forwarding traffic from one zone to another

Erklärung

Frage 42 von 86

1

Refer to the exhibit. Based on the security levels of the interfaces on ASA1, what traffic will be allowed on the interfaces?

Wähle eine der folgenden:

Traffic from the Internet and DMZ can access the LAN.
Traffic from the Internet and LAN can access the DMZ.
Traffic from the Internet can access both the DMZ and the LAN.
Traffic from the LAN and DMZ can access the Internet.

Erklärung

Frage 43 von 86

1

What network testing tool can be used to identify network layer protocols running on a host?

Wähle eine der folgenden:

SIEM
Nmap
L0phtcrack
Tripwire

Erklärung

Frage 44 von 86

1

In the implementation of security on multiple devices, how do ASA ACLs differ from Cisco IOS ACLs?

Wähle eine der folgenden:

Cisco IOS routers utilize both named and numbered ACLs and Cisco ASA devices utilize only numbered ACLs.
Cisco IOS ACLs are configured with a wildcard mask and Cisco ASA ACLs are configured with a subnet mask.
Cisco IOS ACLs are processed sequentially from the top down and Cisco ASA ACLs are not processed sequentially.
Cisco IOS ACLs utilize an implicit deny all and Cisco ASA ACLs end with an implicit permit all.

Erklärung

Frage 45 von 86

1

Which statement describes an important characteristic of a site-to-site VPN?

Wähle eine der folgenden:

It must be statically set up.
It is ideally suited for use by mobile workers.
It requires using a VPN client on the host PC.
After the initial connection is established, it can dynamically change connection information.
It is commonly implemented over dialup and cable modem networks.

Erklärung

Frage 46 von 86

1

Which two options are security best practices that help mitigate BYOD risks? (Choose two.)

Wähle eine oder mehr der folgenden:

Use paint that reflects wireless signals and glass that prevents the signals from going outside the building.
Keep the device OS and software updated.
Only allow devices that have been approved by the corporate IT team.
Only turn on Wi-Fi when using the wireless network.
Decrease the wireless antenna gain level.
Use wireless MAC address filtering.

Erklärung

Frage 47 von 86

1

Refer to the exhibit. A network administrator configures AAA authentication on R1. Which statement describes the effect of the keyword single-connection in the configuration?

Wähle eine der folgenden:

R1 will open a separate connection to the TACACS+ server for each user authentication session.
The authentication performance is enhanced by keeping the connection to the TACACS+ server open.
The TACACS+ server only accepts one successful try for a user to authenticate with it.
R1 will open a separate connection to the TACACS server on a per source IP address basis for each authentication session.

Erklärung

Frage 48 von 86

1

A recently created ACL is not working as expected. The admin determined that the ACL had been applied inbound on the interface and that was the incorrect direction. How should the admin fix this issue?

Wähle eine der folgenden:

Delete the original ACL and create a new ACL, applying it outbound on the interface.
Add an association of the ACL outbound on the same interface.
Fix the ACE statements so that it works as desired inbound on the interface.
Remove the inbound association of the ACL on the interface and reapply it outbound.

Erklärung

Frage 49 von 86

1

What characteristic of the Snort term-based subscriptions is true for both the community and the subscriber rule sets?

Wähle eine der folgenden:

Both have a 30-day delayed access to updated signatures.
Both use Cisco Talos to provide coverage in advance of exploits.
Both are fully supported by Cisco and include Cisco customer support.
Both offer threat protection against security threats.

Erklärung

Frage 50 von 86

1

A security analyst is configuring Snort IPS. The analyst has just downloaded and installed the Snort OVA file. What is the next step?

Wähle eine der folgenden:

Verify Snort IPS.
Configure Virtual Port Group interfaces.
Enable IPS globally or on desired interfaces.
Activate the virtual services.

Erklärung

Frage 51 von 86

1

The security policy in a company specifies that employee workstations can initiate HTTP and HTTPS connections to outside websites and the return traffic is allowed. However, connections initiated from outside hosts are not allowed. Which parameter can be used in extended ACLs to meet this requirement?

Wähle eine der folgenden:

dscp
precedence
eq
established

Erklärung

Frage 52 von 86

1

A researcher is comparing the differences between a stateless firewall and a proxy firewall. Which two additional layers of the OSI model are inspected by a proxy firewall? (Choose two.)

Wähle eine oder mehr der folgenden:

Layer 3
Layer 4
Layer 5
Layer 6
Layer 7

Erklärung

Frage 53 von 86

1

Refer to the exhibit. A network administrator is configuring a VPN between routers R1 and R2. Which commands would correctly configure a pre-shared key for the two routers?

Wähle eine der folgenden:

R1(config)# username R2 password 5tayout!
R2(config)# username R1 password 5tayout!
R1(config)# crypto isakmp key 5tayout! address 64.100.0.2
R2(config)# crypto isakmp key 5tayout! address 64.100.0.1
R1(config)# crypto isakmp key 5tayout! hostname R1
R2(config)# crypto isakmp key 5tayout! hostname R2
R1(config-if)# ppp pap sent-username R1 password 5tayout!
R2(config-if)# ppp pap sent-username R2 password 5tayout!

Erklärung

Frage 54 von 86

1

Refer to the exhibit. Which statement is true about the effect of this Cisco IOS zone-based policy firewall configuration?

Wähle eine der folgenden:

The firewall will automatically drop all HTTP, HTTPS, and FTP traffic.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from s0/0/0 to g0/0 and will track the connections. Tracking the connection allows only return traffic to be permitted through the firewall in the opposite direction.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from s0/0/0 to g0/0, but will not track the state of connections. A corresponding policy must be applied to allow return traffic to be permitted through the firewall in the opposite direction.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from g0/0 to s0/0/0 and will track the connections. Tracking the connection allows only return traffic to be permitted through the firewall in the opposite direction.
return traffic to be permitted through the firewall in the opposite direction.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from g0/0 to s0/0/0, but will not track the state of connections. A corresponding policy must be applied to allow return traffic to be permitted through the firewall in the opposite direction.

Erklärung

Frage 55 von 86

1

Which privilege level has the most access to the Cisco IOS?

Wähle eine der folgenden:

level 0
level 15
level 7
level 16
level 1

Erklärung

Frage 56 von 86

1

Refer to the exhibit. A network administrator has configured NAT on an ASA device. What type of NAT is used?

Wähle eine der folgenden:

inside NAT
static NAT
bidirectional NAT
outside NAT

Erklärung

Frage 57 von 86

1

A network analyst is configuring a site-to-site IPsec VPN. The analyst has configured both the ISAKMP and IPsec policies. What is the next step?

Wähle eine der folgenden:

Configure the hash as SHA and the authentication as pre-shared.
Apply the crypto map to the appropriate outbound interfaces.
Issue the show crypto ipsec sa command to verify the tunnel.
Verify that the security feature is enabled in the IOS.

Erklärung

Frage 58 von 86

1

When an inbound Internet-traffic ACL is being implemented, what should be included to prevent the spoofing of internal networks?

Wähle eine der folgenden:

ACEs to prevent traffic from private address spaces
ACEs to prevent broadcast address traffic
ACEs to prevent ICMP traffic
ACEs to prevent HTTP traffic
ACEs to prevent SNMP traffic

Erklärung

Frage 59 von 86

1

Which two types of attacks are examples of reconnaissance attacks? (Choose two.)

Wähle eine oder mehr der folgenden:

brute force
port scan
ping sweep
man-in-the-middle
SYN flood

Erklärung

Frage 60 von 86

1

Which Cisco solution helps prevent ARP spoofing and ARP poisoning attacks?

Wähle eine der folgenden:

Dynamic ARP Inspection
IP Source Guard
DHCP Snooping
Port Security

Erklärung

Frage 61 von 86

1

When the Cisco NAC appliance evaluates an incoming connection from a remote device against the defined network policies, what feature is being used?

Wähle eine der folgenden:

posture assessment
remediation of noncompliant systems
authentication and authorization
quarantining of noncompliant systems

Erklärung

Frage 62 von 86

1

Which two steps are required before SSH can be enabled on a Cisco router? (Choose two.)

Wähle eine oder mehr der folgenden:

Give the router a host name and domain name.
Create a banner that will be displayed to users when they connect.
Generate a set of secret keys to be used for encryption and decryption.
Set up an authentication server to handle incoming connection requests.
Enable SSH on the physical interfaces where the incoming connection requests will be received.

Erklärung

Frage 63 von 86

1

The network administrator for an e-commerce website requires a service that prevents customers from claiming that legitimate orders are fake. What service provides this type of guarantee?

Wähle eine der folgenden:

confidentiality
authentication
integrity
nonrepudiation

Erklärung

Frage 64 von 86

1

What functionality is provided by Cisco SPAN in a switched network?

Wähle eine der folgenden:

It mirrors traffic that passes through a switch port or VLAN to another port for traffic analysis.
It protects the switched network from receiving BPDUs on ports that should not be receiving them.
It prevents traffic on a LAN from being disrupted by a broadcast storm.
It copies traffic that passes through a switch interface and sends the data directly to a syslog or SNMP server for analysis.
It inspects voice protocols to ensure that SIP, SCCP, H.323, and MGCP requests conform to voice standards.
It mitigates MAC address overflow attacks.

Erklärung

Frage 65 von 86

1

Which three statements are generally considered to be best practices in the placement of ACLs? (Choose three.)

Wähle eine oder mehr der folgenden:

Filter unwanted traffic before it travels onto a low-bandwidth link.
Place standard ACLs close to the destination IP address of the traffic.
Place standard ACLs close to the source IP address of the traffic.
Place extended ACLs close to the destination IP address of the traffic.
Place extended ACLs close to the source IP address of the traffic.
For every inbound ACL placed on an interface, there should be a matching outbound ACL.

Erklärung

Frage 66 von 86

1

What function is performed by the class maps configuration object in the Cisco modular policy framework?

Wähle eine der folgenden:

identifying interesting traffic
applying a policy to an interface
applying a policy to interesting traffic
restricting traffic through an interface

Erklärung

Frage 67 von 86

1

In an attempt to prevent network attacks, cyber analysts share unique identifiable attributes of known attacks with colleagues. What three types of attributes or indicators of compromise are helpful to share? (Choose three.)

Wähle eine oder mehr der folgenden:

IP addresses of attack servers
changes made to end system software
netbios names of compromised firewalls
features of malware files
BIOS of attacking systems
system ID of compromised systems

Erklärung

Frage 68 von 86

1

What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)

Wähle eine oder mehr der folgenden:

The code is authentic and is actually sourced by the publisher.
The code contains no errors.
The code has not been modified since it left the software publisher.
The code contains no viruses.
The code was encrypted with both a private and public key.

Erklärung

Frage 69 von 86

1

Refer to the exhibit. What algorithm is being used to provide public key exchange?

Wähle eine der folgenden:

SHA
RSA
Diffie-Hellman
AES

Erklärung

Frage 70 von 86

1

Which two statements describe the use of asymmetric algorithms? (Choose two.)

Wähle eine oder mehr der folgenden:

Public and private keys may be used interchangeably.
If a public key is used to encrypt the data, a public key must be used to decrypt the data.
If a private key is used to encrypt the data, a public key must be used to decrypt the data.
If a public key is used to encrypt the data, a private key must be used to decrypt the data.
If a private key is used to encrypt the data, a private key must be used to decrypt the data.

Erklärung

Frage 71 von 86

1

Which statement is a feature of HMAC?

Wähle eine der folgenden:

HMAC uses a secret key that is only known to the sender and defeats man-in-the-middle attacks.
HMAC uses protocols such as SSL or TLS to provide session layer confidentiality.
HMAC uses a secret key as input to the hash function, adding authentication to integrity assurance.
HMAC is based on the RSA hash function.

Erklärung

Frage 72 von 86

1

What is the purpose of the webtype ACLs in an ASA?

Wähle eine der folgenden:

to inspect outbound traffic headed towards certain web sites
to restrict traffic that is destined to an ASDM
to monitor return traffic that is in response to web server requests that are initiated from the inside interface
to filter traffic for clientless SSL VPN users

Erklärung

Frage 73 von 86

1

Which two statements describe the effect of the access control list wildcard mask 0.0.0.15? (Choose two.)

Wähle eine oder mehr der folgenden:

The first 28 bits of a supplied IP address will be matched.
The last four bits of a supplied IP address will be matched.
The first 28 bits of a supplied IP address will be ignored.
The last four bits of a supplied IP address will be ignored.
The last five bits of a supplied IP address will be ignored.
The first 32 bits of a supplied IP address will be matched.

Erklärung

Frage 74 von 86

1

Which type of firewall is the most common and allows or blocks traffic based on Layer 3, Layer 4, and Layer 5 information?

Wähle eine der folgenden:

stateless firewall
packet filtering firewall
next generation firewall
stateful firewall

Erklärung

Frage 75 von 86

1

Which protocol or measure should be used to mitigate the vulnerability of using FTP to transfer documents between a teleworker and the company file server?

Wähle eine der folgenden:

SCP
TFTP
ACLs on the file server
out-of-band communication channel

Erklärung

Frage 76 von 86

1

Refer to the exhibit. The IPv6 access list LIMITED_ACCESS is applied on the S0/0/0 interface of R1 in the inbound direction. Which IPv6 packets from the ISP will be dropped by the ACL on R1?

Wähle eine der folgenden:

HTTPS packets to PC1
ICMPv6 packets that are destined to PC1
packets that are destined to PC1 on port 80
neighbor advertisements that are received from the ISP router

Erklärung

Frage 77 von 86

1

What tool is available through the Cisco IOS CLI to initiate security audits and to make recommended configuration changes with or without administrator input?

Wähle eine der folgenden:

Control Plane Policing
Cisco AutoSecure
Cisco ACS
Simple Network Management Protocol

Erklärung

Frage 78 von 86

1

Refer to the exhibit. Which pair of crypto isakmp key commands would correctly configure PSK on the two routers?

Wähle eine der folgenden:

R1(config)# crypto isakmp key cisco123 address 209.165.200.227
R2(config)# crypto isakmp key cisco123 address 209.165.200.226
R1(config)# crypto isakmp key cisco123 address 209.165.200.226
R2(config)# crypto isakmp key cisco123 address 209.165.200.227
R1(config)# crypto isakmp key cisco123 hostname R1
R2(config)# crypto isakmp key cisco123 hostname R2
R1(config)# crypto isakmp key cisco123 address 209.165.200.226
R2(config)# crypto isakmp key secure address 209.165.200.227

Erklärung

Frage 79 von 86

1

Which two technologies provide enterprise-managed VPN solutions? (Choose two.)

Wähle eine oder mehr der folgenden:

Layer 3 MPLS VPN
Frame Relay
site-to-site VPN
remote access VPN
Layer 2 MPLS VPN

Erklärung

Frage 80 von 86

1

What are the three components of an STP bridge ID? (Choose three.)

Wähle eine oder mehr der folgenden:

the date and time that the switch was brought online
the hostname of the switch
the MAC address of the switch
the extended system ID
the bridge priority value
the IP address of the management VLAN

Erklärung

Frage 81 von 86

1

What are two differences between stateful and packet filtering firewalls? (Choose two.)

Wähle eine oder mehr der folgenden:

A packet filtering firewall will prevent spoofing by determining whether packets belong to an existing connection while a stateful firewall follows pre-configured rule sets.
A stateful firewall provides more stringent control over security than a packet filtering firewall.
A packet filtering firewall is able to filter sessions that use dynamic port negotiations while a stateful firewall cannot.
A stateful firewall will provide more logging information than a packet filtering firewall.
A statefull firewall will examine each packet individually while a packet filtering firewall observes the state of a connection.

Erklärung

Frage 82 von 86

1

Which portion of the Snort IPS rule header identifies the destination port?

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS

Wähle eine der folgenden:

any
$HTTP_PORTS
$HOME_NET
tcp

Erklärung

Frage 83 von 86

1

What port state is used by 802.1X if a workstation fails authorization?

Wähle eine der folgenden:

disabled
down
unauthorized
blocking

Erklärung

Frage 84 von 86

1

Refer to the exhibit. Which two ACLs, if applied to the G0/1 interface of R2, would permit only the two LAN networks attached to R1 to access the network that connects to R2 G0/1 interface? (Choose two.)

Wähle eine oder mehr der folgenden:

access-list 3 permit 192.168.10.128 0.0.0.63
access-list 1 permit 192.168.10.0 0.0.0.127
access-list 4 permit 192.168.10.0 0.0.0.255
access-list 2 permit host 192.168.10.9
access-list 2 permit host 192.168.10.69
access-list 5 permit 192.168.10.0 0.0.0.63
access-list 5 permit 192.168.10.64 0.0.0.63

Erklärung

Frage 85 von 86

1

Which two characteristics apply to role-based CLI access superviews? (Choose two.)

Wähle eine oder mehr der folgenden:

A specific superview cannot have commands added to it directly.
CLI views have passwords, but superviews do not have passwords.
A single superview can be shared among multiple CLI views.
Deleting a superview deletes all associated CLI views.
Users logged in to a superview can access all commands specified within the associated CLI views.

Erklärung

Frage 86 von 86

1

What are two security features commonly found in a WAN design? (Choose two.)

Wähle eine oder mehr der folgenden:

WPA2 for data encryption of all data between sites
firewalls protecting the main and remote sites
outside perimeter security including continuous video surveillance
port security on all user-facing ports
VPNs used by mobile workers between sites

	Erstellt von Alejandro Lujan vor 8 Tage

Educación Quiz am Cisco Final Exam, erstellt von Alejandro Lujan am 24/11/2024.

Cisco Final Exam

Cisco Final Exam

Frage 1 von 86

ACLs are used primarily to filter traffic. What are two additional uses of ACLs? (Choose two.):

Wähle eine oder mehr der folgenden:

Erklärung

Frage 2 von 86

What two features are added in SNMPv3 to address the weaknesses of previous versions of SNMP? (Choose two.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 3 von 86

What network testing tool is used for password auditing and recovery?

Wähle eine der folgenden:

Erklärung

Frage 4 von 86

Which type of firewall makes use of a server to connect to destination devices on behalf of clients?

Wähle eine der folgenden:

Erklärung

Frage 5 von 86

Refer to the exhibit. What will be displayed in the output of the show running-config object command after the exhibited configuration commands are entered on an ASA 5506-X?

Wähle eine der folgenden:

Erklärung

Frage 6 von 86

Refer to the exhibit. According to the command output, which three statements are true about the DHCP options entered on the ASA? (Choose three.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 7 von 86

Which two statements describe the characteristics of symmetric algorithms? (Choose two.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 8 von 86

A web server administrator is configuring access settings to require users to authenticate first before accessing certain web pages. Which requirement of information security is addressed through the configuration?

Wähle eine der folgenden:

Erklärung

Frage 9 von 86

The use of 3DES within the IPsec framework is an example of which of the five IPsec building blocks?

Wähle eine der folgenden:

Erklärung

Frage 10 von 86

What function is provided by Snort as part of the Security Onion?

Wähle eine der folgenden:

Erklärung

Frage 11 von 86

What are two drawbacks to using HIPS? (Choose two.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 12 von 86

In an AAA-enabled network, a user issues the configure terminal command from the privileged executive mode of operation. What AAA function is at work if this command is rejected?

Wähle eine der folgenden:

Erklärung

Frage 13 von 86

Wähle eine der folgenden:

Erklärung

Frage 14 von 86

What is a characteristic of a DMZ zone?

Wähle eine der folgenden:

Erklärung

Frage 15 von 86

Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?

Wähle eine der folgenden:

Erklärung

Frage 16 von 86

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

Wähle eine der folgenden:

Erklärung

Frage 17 von 86

What security countermeasure is effective for preventing CAM table overflow attacks?

Wähle eine der folgenden:

Erklärung

Frage 18 von 86

What are two examples of DoS attacks? (Choose two.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 19 von 86

Which method is used to identify interesting traffic needed to create an IKE phase 1 tunnel?

Wähle eine der folgenden:

Erklärung

Frage 20 von 86

When the CLI is used to configure an ISR for a site-to-site VPN connection, which two items must be specified to enable a crypto map policy? (Choose two.)