Copy and Edit

CCNA Security Chapter 4 Exam

Description

Chapter 4 Exam
d94829 d94829
Quiz by d94829 d94829, updated more than 1 year ago
d94829 d94829
Created by d94829 d94829 over 6 years ago
1024
3
0

Resource summary

Question 1

Question
Refer to the exhibit. If a hacker on the outside network sends an IP packet with source address 172.30.1.50, destination address 10.0.0.3, source port 23, and destination port 2447, what does the Cisco IOS firewall do with the packet?
Image:
Ccna Security Chapter 4 P1 (binary/octet-stream)
Answer
  • The initial packet is dropped, but subsequent packets are forwarded
  • The packet is forwarded, and an alert is generated
  • The packet is forwarded, and no alert is generated
  • The packet is dropped

Question 2

Question
To facilitate the troubleshooting process, which inbound ICMP message should be permitted on an outside interface?
Answer
  • echo request
  • time-stamp request
  • echo reply
  • time-stamp reply
  • router advertisement

Question 3

Question
Which command is used to activate an IPv6 ACL named ENG_ACL on an interface so that the router filters traffic prior to accessing the routing table
Answer
  • ipv6 access-class ENG_ACL in
  • ipv6 traffic-filter ENG_ACL out
  • ipv6 traffic-filter ENG_ACL in
  • ipv6 access-class ENG_ACL out

Question 4

Question
Which statement describes a typical security policy for a DMZ firewall configuration
Answer
  • Traffic that originates from the inside interface is generally blocked entirely or very selectively permitted to the outside interface
  • Traffic that originates from the DMZ interface is selectively permitted to the outside interface
  • Traffic that originates from the outside interface is permitted to traverse the firewall to the inside interface with few or no restrictions
  • Return traffic from the inside that is associated with traffic originating from the outside is permitted to traverse from the inside interface to the outside interface
  • eturn traffic from the outside that is associated with traffic originating from the inside is permitted to traverse from the outside interface to the DMZ interface

Question 5

Question
Refer to the exhibit. Which statement describes the function of the ACEs
Image:
Og4 Wbp Zt S Clqdvrq7 Aa Tfe J Ik Wpz A2 He Xa Hbfff4 Z Wt Hm0jq Hp Tc Qf Aj Xu Euy Xe Ndn Unvuu Ik Qkq0gyjvwe8 K7 Em Y Zzhf Qs8 Nthnq5 Bp Zbw Cc Whd6h K Eg6 M0h9 Kt0uy9 Eqyg2 Vbu3i F Txs3 Yza B83q Aj3fy Ad X Pid Es2 Z Rl Jn O An O Ypb Rcl Qv6g0 Qk Usve K (image/png)
Answer
  • These ACEs allow for IPv6 neighbor discovery traffic
  • These ACEs automatically appear at the end of every IPv6 ACL to allow IPv6 routing to occur
  • These are optional ACEs that can be added to the end of an IPv6 ACL to allow ICMP messages that are defined in object groups named nd-na and nd-ns
  • These ACEs must be manually added to the end of every IPv6 ACL to allow IPv6 routing to occur

Question 6

Question
When an inbound Internet-traffic ACL is being implemented, what should be included to prevent the spoofing of internal networks
Answer
  • ACEs to prevent traffic from private address spaces
  • ACEs to prevent broadcast address traffic
  • ACEs to prevent ICMP traffic
  • ACEs to prevent HTTP traffic
  • ACEs to prevent SNMP traffic

Question 7

Question
In addition to the criteria used by extended ACLs, what conditions are used by a classic firewall to filter traffic
Answer
  • TCP/UDP source and destination port numbers
  • TCP/IP protocol numbers
  • IP source and destination addresses
  • application layer protocol session information

Question 8

Question
A router has been configured as a classic firewall and an inbound ACL applied to the external interface. Which action does the router take after inbound-to-outbound traffic is inspected and a new entry is created in the state table
Answer
  • When traffic returns from its destination, it is reinspected, and a new entry is added to the state table
  • The internal interface ACL is reconfigured to allow the host IP address access to the Internet
  • The entry remains in the state table after the session is terminated so that it can be reused by the host
  • A dynamic ACL entry is added to the external interface in the inbound direction

Question 9

Question
If the provided ACEs are in the same ACL, which ACE should be listed first in the ACL according to best practice
Answer
  • permit udp 172.16.0.0 0.0.255.255 host 172.16.1.5 eq snmptrap
  • deny udp any host 172.16.1.5 eq snmptrap
  • deny tcp any any eq telnet
  • permit ip any any
  • permit udp any any range 10000 20000
  • permit tcp 172.16.0.0 0.0.3.255 any established

Question 10

Question
A company is deploying a new network design in which the border router has three interfaces. Interface Serial0/0/0 connects to the ISP, GigabitEthernet0/0 connects to the DMZ, and GigabitEthernet/01 connects to the internal private network. Which type of traffic would receive the least amount of inspection (have the most freedom of travel)
Answer
  • traffic that is going from the private network to the DMZ
  • traffic that is returning from the DMZ after originating from the private network
  • traffic that originates from the public network and that is destined for the DMZ
  • traffic that is returning from the public network after originating from the private network

Question 11

Question
Refer to the exhibit. The ACL statement is the only one explicitly configured on the router. Based on this information, which two conclusions can be drawn regarding remote access network connections?(Choose two.)
Image:
O U Btm A Izh Ci Dp Uj K7 Lw8j Z9 Ng Vsk Ny Q0qucom He Jmt Oje Sq Xieb A Dmw98kzwoofxxiilvy5xuc Tw Tl Pk F1 N Ga6y D3 F Onan Vp En Dqdof4 Xce C Wl2h P Ma3e Kh40 E0 Kds It N2 Of Cf As Jy P2n17 Cmb Wb44 X2 65f1 V4n Yt Gs Bmqp8 Aq Bvyrju541 Xof Ki072 M780ohk (image/png)
Answer
  • SSH connections from the 192.168.2.0/24 network to the 192.168.1.0/24 network are allowed
  • Telnet connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are allowed
  • Telnet connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are blocked
  • SSH connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are allowed
  • SSH connections from the 192.168.1.0/24 network to the 192.168.2.0/24 network are blocked
  • Telnet connections from the 192.168.2.0/24 network to the 192.168.1.0/24 network are allowed

Question 12

Question
Consider the following access list. access-list 100 permit ip host 192.168.10.1 any access-list 100 deny icmp 192.168.10.0 0.0.0.255 any echo access-list 100 permit ip any any Which two actions are taken if the access list is placed inbound on a router Gigabit Ethernet port that has the IP address 192.168.10.254 assigned? (Choose two.)
Answer
  • Devices on the 192.168.10.0/24 network are not allowed to reply to any ping requests
  • A Telnet or SSH session is allowed from any device on the 192.168.10.0 into the router with this access list assigned
  • Only Layer 3 connections are allowed to be made from the router to any other network device
  • Devices on the 192.168.10.0/24 network can sucessfully ping devices on the 192.168.11.0 network
  • Only the network device assigned the IP address 192.168.10.1 is allowed to access the router

Question 13

Question
What is one benefit of using a stateful firewall instead of a proxy server
Answer
  • ability to perform user authentication
  • better performance
  • ability to perform packet filtering
  • prevention of Layer 7 attacks

Question 14

Question
What is one limitation of a stateful firewall
Answer
  • weak user authentication
  • cannot filter unnecessary traffic
  • not as effective with UDP- or ICMP-based traffic
  • poor log information

Question 15

Question
When a Cisco IOS Zone-Based Policy Firewall is being configured via CLI, which step must be taken after zones have been created
Answer
  • Assign interfaces to zones
  • Establish policies between zones
  • Identify subsets within zones
  • Design the physical infrastructure

Question 16

Question
A network administrator is implementing a Classic Firewall and a Zone-Based Firewall concurrently on a router. Which statement best describes this implementation
Answer
  • An interface must be assigned to a security zone before IP inspection can occur
  • Both models must be implemented on all interfaces
  • The two models cannot be implemented on a single interface
  • A Classic Firewall and Zone-Based Firewall cannot be used concurrently

Question 17

Question
Which two rules about interfaces are valid when implementing a Zone-Based Policy Firewall? (Choose two.)
Answer
  • If one interface is a zone member, but the other is not, all traffic will be passed.
  • If neither interface is a zone member, then the action is to pass traffic.
  • If both interfaces are members of the same zone, all traffic will be passed
  • If one interface is a zone member and a zone-pair exists, all traffic will be passed
  • If both interfaces belong to the same zone-pair and a policy exists, all traffic will be passed

Question 18

Question
Which command will verify a Zone-Based Policy Firewall configuration
Answer
  • show interfaces
  • show zones
  • show running-config
  • show protocols

Question 19

Question
Refer to the exhibit. The network “A” contains multiple corporate servers that are accessed by hosts from the Internet for information about the corporation. What term is used to describe the network marked as “A”?
Image:
P Bjm3zj B8k D Luj Lj Gk1 Ka Rd0c Zf2d Jw Nt Pkp Nf Z1 Zc Kqp Sy Dw St9i6 X7 2 P0 Mg Ct0c D3608 Jo7cqb Ldu C F8cf4t5 Wdia C Lkob He T Sy6vpvs Nv Un V Vq Qq2 Ku Xa3g0yx Wpt Bjg Q Ir Wj Fd8 T Vd Iy Ob6 Xp Ybyswt J5 Xw00wybp Lh Gzfi Xqscdy Va Incfj S Pz9 Ej5 (image/png)
Answer
  • internal network
  • untrusted network
  • perimeter security boundary
  • DMZ

Question 20

Question
Which type of packet is unable to be filtered by an outbound ACL
Answer
  • multicast packet
  • ICMP packet
  • broadcast packet
  • router-generated packet

Question 21

Question
When a Cisco IOS Zone-Based Policy Firewall is being configured, which two actions can be applied to a traffic class? (Choose two.)
Answer
  • drop
  • log
  • forward
  • hold
  • inspect
  • copy

Question 22

Question
Fill in the blank. A ____ firewall monitors the state of connections as network traffic flows into and out of the organization.
Answer
  • stateful
  • nonstateful

Question 23

Question
Fill in the blank. The ____ action in a Cisco IOS Zone-Based Policy Firewall is similar to a permit statement in an ACL.
Answer
  • pass
  • nonpass
Show full summary Hide full summary

Want to create your own Quizzes for free with GoConqr? Learn more.

Similar

CCNA Security Final Exam
Maikel Degrande
Security Guard Training
Summit College
ISACA CISM Exam Glossary
Fred Jones
Security
annelieserainey
Securities Regulation
harpratap_singh
2W151 Volume 1: Safety and Security - Quiz 7
Joseph Whilden J
Security Quiz Review
Rylan Blah
Security Policies
indysingh7285
2W151 Volume 1: Safety and Security - Quiz 6
Joseph Whilden J
Security (2)
Daniel Freedman
Certified Security Compliance Specialist
jnkdmls
Browse Library