Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNP Security Core > CH 6 & 7 > Flashcards

CH 6 & 7 Flashcards

1
Q

feature where If BPDUs show up where they should not, the switch protects itself.

A

BPDU Guard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Controls which ports are not allowed to become root ports to remote
root switches

A

root guard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Limits the number of MAC addresses to be learned on an access
switch port

A

port security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Prevents rogue DHCP servers from impacting the network.

A

DHCP snooping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Prevents spoofing of Layer 2 information by hosts.

A

dynamic arp inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Prevents spoofing of Layer 3 information by hosts

A

IP Source Guard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

you can authenticate
users before allowing their data frames into the network

A

802.1x

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Limits the amount of broadcast or multicast traffic flowing through
the switch

A

storm control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Used for traffic control and to enforce policy

A

ACL’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

a security feature that acts like a firewall between untrusted hosts and
trusted DHCP servers

A

DHCP snooping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings

A

DAI (dynamic arp inspection)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

breaking the infrastructure down into smaller components and then
systematically focusing on how to secure each of those components

A

Network Foundation Protection
(NFP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what 2 features can be used to protect the control plane

A

CoPP and CPPr

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

uses UDP port 123, and it allows network devices to
synchronize their time

A

NTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This feature maintains a secure working copy of the router IOS image and the startup configuration files at all times. Once the
feature is enabled, the administrator cannot disable it remotely (but can if connected directly
on the console)

A

Secure Bootset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

IPv6 link local addresses begin with what?

A

FE80

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How many bits in an IPv6 Addrss

A

128

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What characters are added to the 48 bit MAC address to arrive at a 64 bit host ID in a link local IPv6 address

A

FFFE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

::1 what type of IPv6 address is this?

A

Link local (same as 127.0.0.1in IPv4)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The IPv6 multicast group that all IPv6 devices join is

A

FF02::1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In addition to the multicast group address of FF02::1
that is joined by all devices configured for IPv6, routers that have had routing enabled
for IPv6 also join which multicast group?

A

FF02:2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Global
IPv6 unicast addresses have the first four characters in the range of ?

A

2000 - 3FFF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the 2 types of process switched traffic

A

receive adjacency traffic, data plane traffic requiring special processing by CPU

24
Q

List the types of data plane traffic that require special processing by the CPU

A

ACLs, URPF, IP options, Fragmentations, TTL expired, ICMP unreachable, Traffic requiring ARP request, Non-IP Traffic

25
Q

When creating an ACL for use with a CoPP policy, what does a deny rule in the ACL do?

A

Packets that match a deny rule are excluded from that class
and cascade to the next class (if one exists) for classification.

26
Q

CPPr can restrict traffic with finer granularity by dividing the aggregate control plane into
three separate control plane categories known as sub-interfaces, what are the 3 subinterfaces

A

■ Host sub-interface
■ Transit sub-interface
■ CEF-Exception sub-interface

27
Q

List some shortcomings of legacy IPS

A

■ They often need to be operated in conjunction with other products or tools (firewalls,
analytics, and correlation tools).
■ They are sometimes not very effective and may be ignored.
■ Their operation costs and the operating resources they need are high.
■ They can leave infrastructures imperfectly covered against attackers.

28
Q

List some of the newer capabilities of NGIPS

A

application awareness and control, content awareness, contextual awareness, host and user awareness, automated tuning and recommendations, impact and vulnerability assessment of the events taking place

29
Q

originally created by SourceFire, is an open source IPS tool that is widely used in the industry

A

Snort

30
Q

a collection of one or more inline, passive, switched, or routed interfaces
(or ASA interfaces) that you can use to manage and classify traffic in different policies.

A

security zone

31
Q

a solution that allows you to manage your firewalls from the cloud. You can write a policy once and enforce it consistently across multiple
Cisco ASA and Cisco FTD devices

A

Cisco Defense Orchestrator (CDO)

32
Q

a stateful firewall used in Cisco
IOS devices

A

Zone Based Firewall (ZBFW)

33
Q

what type of firewalls can also be implemented in an SD-WAN solution

A

ZBFW

34
Q

What type of traffic can transparent FW’s inspect that routed FW’s can’t.

A

Traffic on the same LAN segment

35
Q

Cisco ASA acts as a secured bridge that
switches traffic from one interface to another.

A

single mode transparent firewall

36
Q

In a multimode transparent firewall (MMTF), Cisco ASA acts in a similar fashion to how it
performs in single mode, with two major exceptions:

A

1) An interface can’t be shared between 2 context in this mode
2) you must configure an IP address to the bridge virtual interface
(BVI) in each context for administration and management purposes

37
Q

For failover configuration, which device can’t do active/active…ASA or FTD

A

FTD

38
Q

Which models of FTD can be configured as a cluster

A

9300 and 4100

39
Q

When you deploy a cluster, the FTD devices create a cluster-control link. By default, what port-channel number is assigned

A

port-channel 48

40
Q

FTD 9300’s are capable of intra-chassis clustering which utilizes the backplane for cluster communications. When deploying inter-chassis clustering, what is required for cluster communication?

A

Physical interface in etherchannel configuration.

41
Q

How should the cluster control link be sized?

A

The cluster control link should be sized to match the throughput of each cluster participant because both data and control traffic are forwarded over the cluster control link.

42
Q

An ACL is a collection of security rules or policies that allows or denies packets after looking at the packet headers and other attributes. Each permit or deny statement in the ACL
is referred to as an?

A

Access Control Entry (ACE)

43
Q

List the 5 tuples of an ACL

A

Source port
Source Address
Destination port
Destination Address
Protocol

44
Q

The Cisco ASA supports four different types of ACLs to provide a flexible and scalable
solution to filter unauthorized packets into the network, what are they?

A

Standard
Extended
Ether-type
Web-type

45
Q

Standard ACLs are used to identify packets based on their destination IP addresses. These
ACLs can be used in which scenarios?

A

split-tunnel ACL
route-redistribution in route-maps

46
Q

An
EtherType ACL can be configured only if?

A

ASA is in transparent mode

47
Q

A Webtype ACL allows Cisco ASA administrators to restrict traffic coming through?

A

SSL VPN Tunnels

48
Q

what can be added to the end of an access-group command to specify an ACL as a management access rule

A

control-plane

49
Q

True or False. Management-specific protocols provide their own control-plane protection and have
higher precedence than a to-the-box traffic-filtering ACL

A

True

50
Q

If you deploy interface ACLs to block all ICMP traffic, the security appliance, by default,
does not restrict the ICMP traffic that is destined to its own interface. How can you filter ICMP traffic to the ASA’s interfaces?

A

ICMP policy or control plan ACLs

51
Q

Cisco ASA supports which 4 methods for translating an address?

A

■ Static NAT/PAT
■ Dynamic NAT/PAT
■ Policy NAT/PAT
■ Identity NAT

52
Q

examines decoded
packets for attacks based on patterns and can block or alter malicious traffic

A

intrusion policy

53
Q

attempt to make the streams of packets as much as possible like the
reassembled packets that will be seen by the endpoints receiving them

A

preprocessor

54
Q

list a few examples of preprocessors that FTD has

A

DNS, HTTP, SIP, FTP & Telnet, SSH, SMTP, POP & IMAP, Network preprocessors, Threat preprocessors

55
Q

provides next-generation security services that go beyond pointin-time detection. It provides continuous analysis and tracking of files and also retrospective
security alerts so that a security administrator can take action during and after an attack

A

Cisco AMP for Networks

CCNP Security Core (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions