CH 5

Question 1

technology originally created by Cisco that provides comprehensive visibility
into all network traffic that traverses a Cisco-supported device

Answer 1

netflow

Question 2

a unidirectional series of packets between a given source and destination

Answer 2

flow

Question 3

This is often referred to as the five-tuple

Answer 3

source and destination ip address, source and destination ports, and ip protocol

Question 4

can track a wide range of Layer 2, IPv4,
and IPv6 flow information

Answer 4

flexible netflow

Question 5

list 3 things that netflow can provide

Answer 5

non-repudiation, anomaly detection, investigative capabilities

Question 6

(NIST) created the following
methodology on security incident handling, which has been adopted by many organizations,
including service providers, enterprises, and government organizations:

Answer 6

1) Preparation
2) Detection and Analysis
3) Containment, eradication and recovery
4) Post-incident activity (postmortem and lessons learned)

Question 7

augments visibility where NetFlow is not available in the infrastructure device (router, switch,
and so on) or where NetFlow is available but you want deeper visibility into performance
metrics and packet data.

Answer 7

Cisco Stealthwatch Flow Sensor

Question 8

a network flow standard led by
the Internet Engineering Task Force (IETF) created for a common, universal
standard of export for the flow information from routers, switches, firewalls, and other
infrastructure devices.

Answer 8

IPFIX (Internet Protocol Flow Information Export)

Question 9

describes the structure of flow data records within a data set, composed of (information element [IE] and length) pairs

Answer 9

IPFIX template

Question 10

provide field
type information for each template.

Answer 10

IE (information element)

Question 11

provides a packet transport service designed to support several
features beyond TCP or UDP capabilities including Packet streams, Partial reliability (PR) extension, Unordered delivery of packets or records, and Transport layer multihoming

Answer 11

SCTP (Stream Control Transmission Protocol)

Question 12

a collection of services available
in several Cisco network infrastructure devices to provide application-level classification,
monitoring, and traffic control.

Answer 12

AVC (Cisco Application Visibility and Control)

Question 13

what are the 4 capabilities of AVC

Answer 13

■ Application recognition
■ Metrics collection and exporting
■ Management and reporting systems
■ Network traffic control

Question 14

what does Cisco AVC use to to provide deep packet inspection (DPI) technology to identify a wide variety of applications
within the network traffic flow, using Layer 3 to Layer 7 data

Answer 14

NBAR2

Question 15

List 6 netflow deployment scenarios

Answer 15

user access layer
wireless LAN
INET edge
Data Center
Site to Site VPN
Cloud Environments

Question 16

collects network flow information from an endpoint on or off premises

Answer 16

NVM (network visibility module for anyconnect)

Question 17

uses NetFlow telemetry and contextual information
from the Cisco network infrastructure. This solution allows network administrators and
cybersecurity professionals to analyze network telemetry in a timely manner to defend
against advanced cyber threats

Answer 17

Cisco Stealthwatch

Question 18

the concept of “proactively” or “actively” searching for advanced threats
that may evade your security products and capabilities.

Answer 18

threat hunting

Question 19

can identify malicious (malware) communications in encrypted traffic through
passive monitoring, the extraction of relevant data elements, and a combination of behavioral
modeling and machine learning

Answer 19

Cisco ETA (encrypted traffic analytics)

Question 20

a cloud-based Cisco solution that uses machine
learning and statistical modeling of networks to creates a baseline of the traffic in your network and identify anomalies

Answer 20

Cisco CTA (Cisco Cognitive Threat Analytics)

Question 21

the process of logically grouping network assets, resources,
and applications

Answer 21

Network Segmentation

Question 22

A micro-segment in ACI is also often referred to as a

Answer 22

uSeg EPG

Question 23

a control plane protocol used to convey
IP-to-SGT mappings to network devices when you cannot perform inline tagging

Answer 23

SXP (Scalable Group Tag Exchange Protocol)