Cisco Final Exam

Question 1 of 86

1

ACLs are used primarily to filter traffic. What are two additional uses of ACLs? (Choose two.):

Select one or more of the following:

specifying internal hosts for NAT
identifying traffic for QoS
specifying source addresses for authentication
reorganizing traffic into VLANs
filtering VTP packets

Explanation

Question 2 of 86

1

What two features are added in SNMPv3 to address the weaknesses of previous versions of SNMP? (Choose two.)

Select one or more of the following:

authentication
authorization with community string priority
bulk MIB objects retrieval
ACL management filtering
encryption

Explanation

Question 3 of 86

1

What network testing tool is used for password auditing and recovery?

Select one of the following:

Nessus
Metasploit
L0phtcrack
SuperScan

Explanation

Question 4 of 86

1

Which type of firewall makes use of a server to connect to destination devices on behalf of clients?

Select one of the following:

packet filtering firewall
proxy firewall
stateless firewall
stateful firewall

Explanation

Question 5 of 86

1

Refer to the exhibit. What will be displayed in the output of the show running-config object command after the exhibited configuration commands are entered on an ASA 5506-X?

Select one of the following:

host 192.168.1.4
range 192.168.1.10 192.168.1.20
host 192.168.1.3, host 192.168.1.4, and range 192.168.1.10 192.168.1.20
host 192.168.1.3
host 192.168.1.3 and host 192.168.1.4
host 192.168.1.4 and range 192.168.1.10 192.168.1.20

Explanation

Question 6 of 86

1

Refer to the exhibit. According to the command output, which three statements are true about the DHCP options entered on the ASA? (Choose three.)

Select one or more of the following:

The dhcpd address [ start-of-pool ]-[ end-of-pool ] inside command was issued to enable the DHCP server.
The dhcpd address [ start-of-pool ]-[ end-of-pool ] inside command was issued to enable the DHCP client.
The dhcpd enable inside command was issued to enable the DHCP server.
The dhcpd auto-config outside command was issued to enable the DHCP client.
The dhcpd auto-config outside command was issued to enable the DHCP server.
The dhcpd enable inside command was issued to enable the DHCP client.

Explanation

Question 7 of 86

1

Which two statements describe the characteristics of symmetric algorithms? (Choose two.)

Select one or more of the following:

They are commonly used with VPN traffic.
They use a pair of a public key and a private key.
They are commonly implemented in the SSL and SSH protocols.
hey provide confidentiality, integrity, and availability.
They are referred to as a pre-shared key or secret key.

Explanation

Question 8 of 86

1

A web server administrator is configuring access settings to require users to authenticate first before accessing certain web pages. Which requirement of information security is addressed through the configuration?

Select one of the following:

availability
integrity
scalability
confidentiality

Explanation

Question 9 of 86

1

The use of 3DES within the IPsec framework is an example of which of the five IPsec building blocks?

Select one of the following:

authentication
nonrepudiation
integrity
Diffie-Hellman
confidentiality

Explanation

Question 10 of 86

1

What function is provided by Snort as part of the Security Onion?

Select one of the following:

to generate network intrusion alerts by the use of rules and signatures
to normalize logs from various NSM data logs so they can be represented, stored, and accessed through a common schema
to display full-packet captures for analysis
to view pcap transcripts generated by intrusion detection tools

Explanation

Question 11 of 86

1

What are two drawbacks to using HIPS? (Choose two.)

Select one or more of the following:

With HIPS, the success or failure of an attack cannot be readily determined.
With HIPS, the network administrator must verify support for all the different operating systems used in the network.
HIPS has difficulty constructing an accurate network picture or coordinating events that occur across the entire network.
If the network traffic stream is encrypted, HIPS is unable to access unencrypted forms of the traffic.
HIPS installations are vulnerable to fragmentation attacks or variable TTL attacks.

Explanation

Question 12 of 86

1

In an AAA-enabled network, a user issues the configure terminal command from the privileged executive mode of operation. What AAA function is at work if this command is rejected?

Select one of the following:

authorization
authentication
auditing
accounting

Explanation

Question 13 of 86

1

A company has a file server that shares a folder named Public. The network security policy specifies that the Public folder is assigned Read-Only rights to anyone who can log into the server while the Edit rights are assigned only to the network admin group. Which component is addressed in the AAA network service framework?

Select one of the following:

automation
accounting
authentication
authorization

Explanation

Question 14 of 86

1

What is a characteristic of a DMZ zone?

Select one of the following:

Traffic originating from the inside network going to the DMZ network is not permitted.
Traffic originating from the outside network going to the DMZ network is selectively permitted.
Traffic originating from the DMZ network going to the inside network is permitted.
Traffic originating from the inside network going to the DMZ network is selectively permitted.

Explanation

Question 15 of 86

1

Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?

Select one of the following:

Use a Syslog server to capture network traffic.
Deploy a Cisco SSL Appliance.
Require remote access connections through IPsec VPN.
Deploy a Cisco ASA.

Explanation

Question 16 of 86

1

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

Select one of the following:

Frames from PC1 will be forwarded since the switchport port-security violation command is missing.
Frames from PC1 will be forwarded to its destination, and a log entry will be created.
Frames from PC1 will be forwarded to its destination, but a log entry will not be created.
Frames from PC1 will cause the interface to shut down immediately, and a log entry will be made.
Frames from PC1 will be dropped, and there will be no log of the violation.
Frames from PC1 will be dropped, and a log message will be created.

Explanation

Question 17 of 86

1

What security countermeasure is effective for preventing CAM table overflow attacks?

Select one of the following:

DHCP snooping
Dynamic ARP Inspection
IP source guard
port security

Explanation

Question 18 of 86

1

What are two examples of DoS attacks? (Choose two.)

Select one or more of the following:

SQL injection
ping of death
port scanning
phishing
buffer overflow

Explanation

Question 19 of 86

1

Which method is used to identify interesting traffic needed to create an IKE phase 1 tunnel?

Select one of the following:

transform sets
a permit access list entry
hashing algorithms
a security association

Explanation

Question 20 of 86

1

When the CLI is used to configure an ISR for a site-to-site VPN connection, which two items must be specified to enable a crypto map policy? (Choose two.)

Select one or more of the following:

the hash
the peer
encryption
the ISAKMP policy
a valid access list
IP addresses on all active interfaces
the IKE Phase 1 policy

Explanation

Question 21 of 86

1

How does a firewall handle traffic when it is originating from the public network and traveling to the DMZ network?

Select one of the following:

Traffic that is originating from the public network is inspected and selectively permitted when traveling to the DMZ network.
Traffic that is originating from the public network is usually permitted with little or no restriction when traveling to the DMZ network.
Traffic that is originating from the public network is usually forwarded without inspection when traveling to the DMZ network.
Traffic that is originating from the public network is usually blocked when traveling to the DMZ network.

Explanation

Question 22 of 86

1

A client connects to a Web server. Which component of this HTTP connection is not examined by a stateful firewall?

Select one of the following:

the source IP address of the client traffic
the destination port number of the client traffic
the actual contents of the HTTP connection
the source port number of the client traffic

Explanation

Question 23 of 86

1

Which network monitoring technology uses VLANs to monitor traffic on remote switches?

Select one of the following:

IPS
IDS
TAP
RSPAN

Explanation

Question 24 of 86

1

Which rule action will cause Snort IPS to block and log a packet?

Select one of the following:

log
drop
alert
Sdrop

Explanation

Question 25 of 86

1

What is typically used to create a security trap in the data center facility?

Select one of the following:

IDs, biometrics, and two access doors
high resolution monitors
redundant authentication servers
a server without all security patches applied

Explanation

Question 26 of 86

1

A company is concerned with leaked and stolen corporate data on hard copies. Which data loss mitigation technique could help with this situation?

Select one of the following:

strong PC security settings
strong passwords
shredding
encryption

Explanation

Question 27 of 86

1

Upon completion of a network security course, a student decides to pursue a career in cryptanalysis. What job would the student be doing as a cryptanalyst?

Select one of the following:

cracking code without access to the shared secret key
creating hashing codes to authenticate data
making and breaking secret codes
creating transposition and substitution ciphers

Explanation

Question 28 of 86

1

What command is used on a switch to set the port access entity type so the interface acts only as an authenticator and will not respond to any messages meant for a supplicant?

Select one of the following:

dot1x pae authenticator
authentication port-control auto
aaa authentication dot1x default group radius
dot1x system-auth-control

Explanation

Question 29 of 86

1

What are two disadvantages of using an IDS? (Choose two.)

Select one or more of the following:

The IDS does not stop malicious traffic.
The IDS works offline using copies of network traffic.
The IDS has no impact on traffic.
The IDS analyzes actual forwarded packets.
The IDS requires other devices to respond to attacks.

Explanation

Question 30 of 86

1

Refer to the exhibit. The ip verify source command is applied on untrusted interfaces. Which type of attack is mitigated by using this configuration?

Select one of the following:

DHCP spoofing
DHCP starvation
STP manipulation
MAC and IP address spoofing

Explanation

Question 31 of 86

1

What ports can receive forwarded traffic from an isolated port that is part of a PVLAN?

Select one of the following:

other isolated ports and community ports
only promiscuous ports
all other ports within the same community
only isolated ports

Explanation

Question 32 of 86

1

A user complains about being locked out of a device after too many unsuccessful AAA login attempts. What could be used by the network administrator to provide a secure authentication access method without locking a user out of a device?

Select one of the following:

Use the login delay command for authentication attempts.
Use the login local command for authenticating user access.
Use the aaa local authentication attempts max-fail global configuration mode command with a higher number of acceptable failures.
Use the none keyword when configuring the authentication method list.

Explanation

Question 33 of 86

1

What are two drawbacks in assigning user privilege levels on a Cisco router? (Choose two.)

Select one or more of the following:

Only a root user can add or remove commands.
Privilege levels must be set to permit access control to specific device interfaces, ports, or slots.
Assigning a command with multiple keywords allows access to all commands using those keywords.
Commands from a lower level are always executable at a higher level.
AAA must be enabled.

Explanation

Question 34 of 86

1

Refer to the exhibit. Which conclusion can be made from the show crypto map command output that is shown on R1?

Select one of the following:

The crypto map has not yet been applied to an interface.
The current peer IP address should be 172.30.2.1.
There is a mismatch between the transform sets.
The tunnel configuration was established and can be tested with extended pings.

Explanation

Question 35 of 86

1

What are two reasons to enable OSPF routing protocol authentication on a network? (Choose two.)

Select one or more of the following:

to prevent data traffic from being redirected and then discarded
to ensure faster network convergence
to provide data security through encryption
to prevent redirection of data traffic to an insecure link
to ensure more efficient routing

Explanation

Question 36 of 86

1

Which three functions are provided by the syslog logging service? (Choose three.)

Select one or more of the following:

gathering logging information
authenticating and encrypting data sent over the network
retaining captured messages on the router when a router is rebooted
specifying where captured information is stored
distinguishing between information to be captured and information to be ignored
setting the size of the logging buffer

Explanation

Question 37 of 86

1

What two ICMPv6 message types must be permitted through IPv6 access control lists to allow resolution of Layer 3 addresses to Layer 2 MAC addresses? (Choose two.)

Select one or more of the following:

neighbor solicitations
echo requests
neighbor advertisements
echo replies
router solicitations
router advertisements

Explanation

Question 38 of 86

1

Which three services are provided through digital signatures? (Choose three.)

Select one or more of the following:

accounting
authenticity
compression
nonrepudiation
integrity
encryption

Explanation

Question 39 of 86

1

A technician is to document the current configurations of all network devices in a college, including those in off-site buildings. Which protocol would be best to use to securely access the network devices?

Select one or more of the following:

FTP
HTTP
SSH
Telnet

Explanation

Question 40 of 86

1

An administrator is trying to develop a BYOD security policy for employees that are bringing a wide range of devices to connect to the company network. Which three objectives must the BYOD security policy address? (Choose three.)

Select one or more of the following:

All devices must be insured against liability if used to compromise the corporate network.
All devices must have open authentication with the corporate network.
Rights and activities permitted on the corporate network must be defined.
Safeguards must be put in place for any personal device being compromised.
The level of access of employees when connecting to the corporate network must be defined.
All devices should be allowed to attach to the corporate network flawlessly.

Explanation

Question 41 of 86

1

What is the function of the pass action on a Cisco IOS Zone-Based Policy Firewall?

Select one of the following:

logging of rejected or dropped packets
inspecting traffic between zones for traffic control
tracking the state of connections between zones
forwarding traffic from one zone to another

Explanation

Question 42 of 86

1

Refer to the exhibit. Based on the security levels of the interfaces on ASA1, what traffic will be allowed on the interfaces?

Select one of the following:

Traffic from the Internet and DMZ can access the LAN.
Traffic from the Internet and LAN can access the DMZ.
Traffic from the Internet can access both the DMZ and the LAN.
Traffic from the LAN and DMZ can access the Internet.

Explanation

Question 43 of 86

1

What network testing tool can be used to identify network layer protocols running on a host?

Select one of the following:

SIEM
Nmap
L0phtcrack
Tripwire

Explanation

Question 44 of 86

1

In the implementation of security on multiple devices, how do ASA ACLs differ from Cisco IOS ACLs?

Select one of the following:

Cisco IOS routers utilize both named and numbered ACLs and Cisco ASA devices utilize only numbered ACLs.
Cisco IOS ACLs are configured with a wildcard mask and Cisco ASA ACLs are configured with a subnet mask.
Cisco IOS ACLs are processed sequentially from the top down and Cisco ASA ACLs are not processed sequentially.
Cisco IOS ACLs utilize an implicit deny all and Cisco ASA ACLs end with an implicit permit all.

Explanation

Question 45 of 86

1

Which statement describes an important characteristic of a site-to-site VPN?

Select one of the following:

It must be statically set up.
It is ideally suited for use by mobile workers.
It requires using a VPN client on the host PC.
After the initial connection is established, it can dynamically change connection information.
It is commonly implemented over dialup and cable modem networks.

Explanation

Question 46 of 86

1

Which two options are security best practices that help mitigate BYOD risks? (Choose two.)

Select one or more of the following:

Use paint that reflects wireless signals and glass that prevents the signals from going outside the building.
Keep the device OS and software updated.
Only allow devices that have been approved by the corporate IT team.
Only turn on Wi-Fi when using the wireless network.
Decrease the wireless antenna gain level.
Use wireless MAC address filtering.

Explanation

Question 47 of 86

1

Refer to the exhibit. A network administrator configures AAA authentication on R1. Which statement describes the effect of the keyword single-connection in the configuration?

Select one of the following:

R1 will open a separate connection to the TACACS+ server for each user authentication session.
The authentication performance is enhanced by keeping the connection to the TACACS+ server open.
The TACACS+ server only accepts one successful try for a user to authenticate with it.
R1 will open a separate connection to the TACACS server on a per source IP address basis for each authentication session.

Explanation

Question 48 of 86

1

A recently created ACL is not working as expected. The admin determined that the ACL had been applied inbound on the interface and that was the incorrect direction. How should the admin fix this issue?

Select one of the following:

Delete the original ACL and create a new ACL, applying it outbound on the interface.
Add an association of the ACL outbound on the same interface.
Fix the ACE statements so that it works as desired inbound on the interface.
Remove the inbound association of the ACL on the interface and reapply it outbound.

Explanation

Question 49 of 86

1

What characteristic of the Snort term-based subscriptions is true for both the community and the subscriber rule sets?

Select one of the following:

Both have a 30-day delayed access to updated signatures.
Both use Cisco Talos to provide coverage in advance of exploits.
Both are fully supported by Cisco and include Cisco customer support.
Both offer threat protection against security threats.

Explanation

Question 50 of 86

1

A security analyst is configuring Snort IPS. The analyst has just downloaded and installed the Snort OVA file. What is the next step?

Select one of the following:

Verify Snort IPS.
Configure Virtual Port Group interfaces.
Enable IPS globally or on desired interfaces.
Activate the virtual services.

Explanation

Question 51 of 86

1

The security policy in a company specifies that employee workstations can initiate HTTP and HTTPS connections to outside websites and the return traffic is allowed. However, connections initiated from outside hosts are not allowed. Which parameter can be used in extended ACLs to meet this requirement?

Select one of the following:

dscp
precedence
eq
established

Explanation

Question 52 of 86

1

A researcher is comparing the differences between a stateless firewall and a proxy firewall. Which two additional layers of the OSI model are inspected by a proxy firewall? (Choose two.)

Select one or more of the following:

Layer 3
Layer 4
Layer 5
Layer 6
Layer 7

Explanation

Question 53 of 86

1

Refer to the exhibit. A network administrator is configuring a VPN between routers R1 and R2. Which commands would correctly configure a pre-shared key for the two routers?

Select one of the following:

R1(config)# username R2 password 5tayout!
R2(config)# username R1 password 5tayout!
R1(config)# crypto isakmp key 5tayout! address 64.100.0.2
R2(config)# crypto isakmp key 5tayout! address 64.100.0.1
R1(config)# crypto isakmp key 5tayout! hostname R1
R2(config)# crypto isakmp key 5tayout! hostname R2
R1(config-if)# ppp pap sent-username R1 password 5tayout!
R2(config-if)# ppp pap sent-username R2 password 5tayout!

Explanation

Question 54 of 86

1

Refer to the exhibit. Which statement is true about the effect of this Cisco IOS zone-based policy firewall configuration?

Select one of the following:

The firewall will automatically drop all HTTP, HTTPS, and FTP traffic.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from s0/0/0 to g0/0 and will track the connections. Tracking the connection allows only return traffic to be permitted through the firewall in the opposite direction.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from s0/0/0 to g0/0, but will not track the state of connections. A corresponding policy must be applied to allow return traffic to be permitted through the firewall in the opposite direction.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from g0/0 to s0/0/0 and will track the connections. Tracking the connection allows only return traffic to be permitted through the firewall in the opposite direction.
return traffic to be permitted through the firewall in the opposite direction.
The firewall will automatically allow HTTP, HTTPS, and FTP traffic from g0/0 to s0/0/0, but will not track the state of connections. A corresponding policy must be applied to allow return traffic to be permitted through the firewall in the opposite direction.

Explanation

Question 55 of 86

1

Which privilege level has the most access to the Cisco IOS?

Select one of the following:

level 0
level 15
level 7
level 16
level 1

Explanation

Question 56 of 86

1

Refer to the exhibit. A network administrator has configured NAT on an ASA device. What type of NAT is used?

Select one of the following:

inside NAT
static NAT
bidirectional NAT
outside NAT

Explanation

Question 57 of 86

1

A network analyst is configuring a site-to-site IPsec VPN. The analyst has configured both the ISAKMP and IPsec policies. What is the next step?

Select one of the following:

Configure the hash as SHA and the authentication as pre-shared.
Apply the crypto map to the appropriate outbound interfaces.
Issue the show crypto ipsec sa command to verify the tunnel.
Verify that the security feature is enabled in the IOS.

Explanation

Question 58 of 86

1

When an inbound Internet-traffic ACL is being implemented, what should be included to prevent the spoofing of internal networks?

Select one of the following:

ACEs to prevent traffic from private address spaces
ACEs to prevent broadcast address traffic
ACEs to prevent ICMP traffic
ACEs to prevent HTTP traffic
ACEs to prevent SNMP traffic

Explanation

Question 59 of 86

1

Which two types of attacks are examples of reconnaissance attacks? (Choose two.)

Select one or more of the following:

brute force
port scan
ping sweep
man-in-the-middle
SYN flood

Explanation

Question 60 of 86

1

Which Cisco solution helps prevent ARP spoofing and ARP poisoning attacks?

Select one of the following:

Dynamic ARP Inspection
IP Source Guard
DHCP Snooping
Port Security

Explanation

Question 61 of 86

1

When the Cisco NAC appliance evaluates an incoming connection from a remote device against the defined network policies, what feature is being used?

Select one of the following:

posture assessment
remediation of noncompliant systems
authentication and authorization
quarantining of noncompliant systems

Explanation

Question 62 of 86

1

Which two steps are required before SSH can be enabled on a Cisco router? (Choose two.)

Select one or more of the following:

Give the router a host name and domain name.
Create a banner that will be displayed to users when they connect.
Generate a set of secret keys to be used for encryption and decryption.
Set up an authentication server to handle incoming connection requests.
Enable SSH on the physical interfaces where the incoming connection requests will be received.

Explanation

Question 63 of 86

1

The network administrator for an e-commerce website requires a service that prevents customers from claiming that legitimate orders are fake. What service provides this type of guarantee?

Select one of the following:

confidentiality
authentication
integrity
nonrepudiation

Explanation

Question 64 of 86

1

What functionality is provided by Cisco SPAN in a switched network?

Select one of the following:

It mirrors traffic that passes through a switch port or VLAN to another port for traffic analysis.
It protects the switched network from receiving BPDUs on ports that should not be receiving them.
It prevents traffic on a LAN from being disrupted by a broadcast storm.
It copies traffic that passes through a switch interface and sends the data directly to a syslog or SNMP server for analysis.
It inspects voice protocols to ensure that SIP, SCCP, H.323, and MGCP requests conform to voice standards.
It mitigates MAC address overflow attacks.

Explanation

Question 65 of 86

1

Which three statements are generally considered to be best practices in the placement of ACLs? (Choose three.)

Select one or more of the following:

Filter unwanted traffic before it travels onto a low-bandwidth link.
Place standard ACLs close to the destination IP address of the traffic.
Place standard ACLs close to the source IP address of the traffic.
Place extended ACLs close to the destination IP address of the traffic.
Place extended ACLs close to the source IP address of the traffic.
For every inbound ACL placed on an interface, there should be a matching outbound ACL.

Explanation

Question 66 of 86

1

What function is performed by the class maps configuration object in the Cisco modular policy framework?

Select one of the following:

identifying interesting traffic
applying a policy to an interface
applying a policy to interesting traffic
restricting traffic through an interface

Explanation

Question 67 of 86

1

In an attempt to prevent network attacks, cyber analysts share unique identifiable attributes of known attacks with colleagues. What three types of attributes or indicators of compromise are helpful to share? (Choose three.)

Select one or more of the following:

IP addresses of attack servers
changes made to end system software
netbios names of compromised firewalls
features of malware files
BIOS of attacking systems
system ID of compromised systems

Explanation

Question 68 of 86

1

What two assurances does digital signing provide about code that is downloaded from the Internet? (Choose two.)

Select one or more of the following:

The code is authentic and is actually sourced by the publisher.
The code contains no errors.
The code has not been modified since it left the software publisher.
The code contains no viruses.
The code was encrypted with both a private and public key.

Explanation

Question 69 of 86

1

Refer to the exhibit. What algorithm is being used to provide public key exchange?

Select one of the following:

SHA
RSA
Diffie-Hellman
AES

Explanation

Question 70 of 86

1

Which two statements describe the use of asymmetric algorithms? (Choose two.)

Select one or more of the following:

Public and private keys may be used interchangeably.
If a public key is used to encrypt the data, a public key must be used to decrypt the data.
If a private key is used to encrypt the data, a public key must be used to decrypt the data.
If a public key is used to encrypt the data, a private key must be used to decrypt the data.
If a private key is used to encrypt the data, a private key must be used to decrypt the data.

Explanation

Question 71 of 86

1

Which statement is a feature of HMAC?

Select one of the following:

HMAC uses a secret key that is only known to the sender and defeats man-in-the-middle attacks.
HMAC uses protocols such as SSL or TLS to provide session layer confidentiality.
HMAC uses a secret key as input to the hash function, adding authentication to integrity assurance.
HMAC is based on the RSA hash function.

Explanation

Question 72 of 86

1

What is the purpose of the webtype ACLs in an ASA?

Select one of the following:

to inspect outbound traffic headed towards certain web sites
to restrict traffic that is destined to an ASDM
to monitor return traffic that is in response to web server requests that are initiated from the inside interface
to filter traffic for clientless SSL VPN users

Explanation

Question 73 of 86

1

Which two statements describe the effect of the access control list wildcard mask 0.0.0.15? (Choose two.)

Select one or more of the following:

The first 28 bits of a supplied IP address will be matched.
The last four bits of a supplied IP address will be matched.
The first 28 bits of a supplied IP address will be ignored.
The last four bits of a supplied IP address will be ignored.
The last five bits of a supplied IP address will be ignored.
The first 32 bits of a supplied IP address will be matched.

Explanation

Question 74 of 86

1

Which type of firewall is the most common and allows or blocks traffic based on Layer 3, Layer 4, and Layer 5 information?

Select one of the following:

stateless firewall
packet filtering firewall
next generation firewall
stateful firewall

Explanation

Question 75 of 86

1

Which protocol or measure should be used to mitigate the vulnerability of using FTP to transfer documents between a teleworker and the company file server?

Select one of the following:

SCP
TFTP
ACLs on the file server
out-of-band communication channel

Explanation

Question 76 of 86

1

Refer to the exhibit. The IPv6 access list LIMITED_ACCESS is applied on the S0/0/0 interface of R1 in the inbound direction. Which IPv6 packets from the ISP will be dropped by the ACL on R1?

Select one of the following:

HTTPS packets to PC1
ICMPv6 packets that are destined to PC1
packets that are destined to PC1 on port 80
neighbor advertisements that are received from the ISP router

Explanation

Question 77 of 86

1

What tool is available through the Cisco IOS CLI to initiate security audits and to make recommended configuration changes with or without administrator input?

Select one of the following:

Control Plane Policing
Cisco AutoSecure
Cisco ACS
Simple Network Management Protocol

Explanation

Question 78 of 86

1

Refer to the exhibit. Which pair of crypto isakmp key commands would correctly configure PSK on the two routers?

Select one of the following:

R1(config)# crypto isakmp key cisco123 address 209.165.200.227
R2(config)# crypto isakmp key cisco123 address 209.165.200.226
R1(config)# crypto isakmp key cisco123 address 209.165.200.226
R2(config)# crypto isakmp key cisco123 address 209.165.200.227
R1(config)# crypto isakmp key cisco123 hostname R1
R2(config)# crypto isakmp key cisco123 hostname R2
R1(config)# crypto isakmp key cisco123 address 209.165.200.226
R2(config)# crypto isakmp key secure address 209.165.200.227

Explanation

Question 79 of 86

1

Which two technologies provide enterprise-managed VPN solutions? (Choose two.)

Select one or more of the following:

Layer 3 MPLS VPN
Frame Relay
site-to-site VPN
remote access VPN
Layer 2 MPLS VPN

Explanation

Question 80 of 86

1

What are the three components of an STP bridge ID? (Choose three.)

Select one or more of the following:

the date and time that the switch was brought online
the hostname of the switch
the MAC address of the switch
the extended system ID
the bridge priority value
the IP address of the management VLAN

Explanation

Question 81 of 86

1

What are two differences between stateful and packet filtering firewalls? (Choose two.)

Select one or more of the following:

A packet filtering firewall will prevent spoofing by determining whether packets belong to an existing connection while a stateful firewall follows pre-configured rule sets.
A stateful firewall provides more stringent control over security than a packet filtering firewall.
A packet filtering firewall is able to filter sessions that use dynamic port negotiations while a stateful firewall cannot.
A stateful firewall will provide more logging information than a packet filtering firewall.
A statefull firewall will examine each packet individually while a packet filtering firewall observes the state of a connection.

Explanation

Question 82 of 86

1

Which portion of the Snort IPS rule header identifies the destination port?

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS

Select one of the following:

any
$HTTP_PORTS
$HOME_NET
tcp

Explanation

Question 83 of 86

1

What port state is used by 802.1X if a workstation fails authorization?

Select one of the following:

disabled
down
unauthorized
blocking

Explanation

Question 84 of 86

1

Refer to the exhibit. Which two ACLs, if applied to the G0/1 interface of R2, would permit only the two LAN networks attached to R1 to access the network that connects to R2 G0/1 interface? (Choose two.)

Select one or more of the following:

access-list 3 permit 192.168.10.128 0.0.0.63
access-list 1 permit 192.168.10.0 0.0.0.127
access-list 4 permit 192.168.10.0 0.0.0.255
access-list 2 permit host 192.168.10.9
access-list 2 permit host 192.168.10.69
access-list 5 permit 192.168.10.0 0.0.0.63
access-list 5 permit 192.168.10.64 0.0.0.63

Explanation

Question 85 of 86

1

Which two characteristics apply to role-based CLI access superviews? (Choose two.)

Select one or more of the following:

A specific superview cannot have commands added to it directly.
CLI views have passwords, but superviews do not have passwords.
A single superview can be shared among multiple CLI views.
Deleting a superview deletes all associated CLI views.
Users logged in to a superview can access all commands specified within the associated CLI views.

Explanation

Question 86 of 86

1

What are two security features commonly found in a WAN design? (Choose two.)

Select one or more of the following:

WPA2 for data encryption of all data between sites
firewalls protecting the main and remote sites
outside perimeter security including continuous video surveillance
port security on all user-facing ports
VPNs used by mobile workers between sites

	Created by Alejandro Lujan 11 months ago

Educación Quiz on Cisco Final Exam, created by Alejandro Lujan on 24/11/2024.

Cisco Final Exam

Question 1 of 86

ACLs are used primarily to filter traffic. What are two additional uses of ACLs? (Choose two.):

Select one or more of the following:

Explanation

Question 2 of 86

What two features are added in SNMPv3 to address the weaknesses of previous versions of SNMP? (Choose two.)

Select one or more of the following:

Explanation

Question 3 of 86

What network testing tool is used for password auditing and recovery?

Select one of the following:

Explanation

Question 4 of 86

Which type of firewall makes use of a server to connect to destination devices on behalf of clients?

Select one of the following:

Explanation

Question 5 of 86

Refer to the exhibit. What will be displayed in the output of the show running-config object command after the exhibited configuration commands are entered on an ASA 5506-X?

Select one of the following:

Explanation

Question 6 of 86

Refer to the exhibit. According to the command output, which three statements are true about the DHCP options entered on the ASA? (Choose three.)

Select one or more of the following:

Explanation

Question 7 of 86

Which two statements describe the characteristics of symmetric algorithms? (Choose two.)

Select one or more of the following:

Explanation

Question 8 of 86

A web server administrator is configuring access settings to require users to authenticate first before accessing certain web pages. Which requirement of information security is addressed through the configuration?

Select one of the following:

Explanation

Question 9 of 86

The use of 3DES within the IPsec framework is an example of which of the five IPsec building blocks?

Select one of the following:

Explanation

Question 10 of 86

What function is provided by Snort as part of the Security Onion?

Select one of the following:

Explanation

Question 11 of 86

What are two drawbacks to using HIPS? (Choose two.)

Select one or more of the following:

Explanation

Question 12 of 86

In an AAA-enabled network, a user issues the configure terminal command from the privileged executive mode of operation. What AAA function is at work if this command is rejected?

Select one of the following:

Explanation

Question 13 of 86

Select one of the following:

Explanation

Question 14 of 86

What is a characteristic of a DMZ zone?

Select one of the following:

Explanation

Question 15 of 86

Which measure can a security analyst take to perform effective security monitoring against network traffic encrypted by SSL technology?

Select one of the following:

Explanation

Question 16 of 86

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

Select one of the following:

Explanation

Question 17 of 86

What security countermeasure is effective for preventing CAM table overflow attacks?

Select one of the following:

Explanation

Question 18 of 86

What are two examples of DoS attacks? (Choose two.)

Select one or more of the following:

Explanation

Question 19 of 86

Which method is used to identify interesting traffic needed to create an IKE phase 1 tunnel?

Select one of the following:

Explanation

Question 20 of 86

When the CLI is used to configure an ISR for a site-to-site VPN connection, which two items must be specified to enable a crypto map policy? (Choose two.)

Select one or more of the following: