Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNP Core > Chap 25 - Secure Network Access Control > Flashcards

Chap 25 - Secure Network Access Control Flashcards

1
Q

What is Cisco SAFE?

A

Security Architecture For the Enterprise

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are PINs?

A

Places In the Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are 6 PINs

A
  • Branch
  • Campus
  • Data Center
  • Edge
  • Cloud
  • WAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the 4 top threats on PIN Branches?

A
  • Endpoint malware (point-of-sale [POS] malware)
  • Wireless infrastructure exploits such as rogue APs and man-in-the-middle (MitM) attacks
  • Unauthorized/malicious client activity
  • Exploitation of trust
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are 5 things that campuses are easy targets for?

A
  • Phishing
  • Web-based exploits
  • Unauthorized network access
  • Malware propagation
  • Botnet infestations.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are 7 popular threats to data centers?

A
  • Data extraction
  • Malware propagation
  • Unauthorized network access (application compromise)
  • Botnet infestation (scrumping)
  • Data loss
  • Privilege escalation
  • Reconnaissance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the highest risk PIN

A

Edge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are 4 popular threats to the Edge Network?

A
  • Web server vulnerabilities
  • Distributed denial-of-service (DDoS) attacks
  • Data loss
  • MitM attacks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 4 primary threats in the Cloud?

A
  • Web server vulnerabilities
  • Distributed denial-of-service (DDoS) attacks
  • Data loss
  • MitM attacks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are 4 typical threats seen in the WAN?

A
  • Malware propagation
  • Unauthorized network access
  • WAN sniffing
  • MitM attacks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 6 Security Concepts used to evaluate each PIN?

A
  • Management
  • Security Intelligence
  • Compliance
  • Segmentation
  • Threat Defense
  • Secure Services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the Management security concept?

A

Centralized device management is critical for consistent policy deployment, change management, and patching systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the Security Intelligence security concept?

What does Security Intelligence provide?
What does it enable the infrastructure to do?
What 2 things does this enable?

A
  • Security intelligence provides detection of emerging malware and cyber threats
  • It enables an infrastructure to enforce policy dynamically, as reputations are augmented by the context of new threats.
  • This enables accurate and timely security protection.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are 3 examples of the Compliance security concept?

A
  • PCI
  • DSS 3.0
  • HIPAA.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the Segmentation security concept?

What does it reduce?
How does it reduce that?

A
  • Establishing boundaries for both data and users
  • Reduces operational challenges
  • By using identity-aware infrastructure to enforce policies in an automated and scalable manner
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the Threat Defense security concept provide?

What 3 things does it use to provide that?

A
  • Visibility into the most dangerous cyber threats
  • Network traffic telemetry
  • File reputation
  • Contextual information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What 3 technologies does the Secure Services security concept include?

What 3 things does this protect?

A
  • Technologies include
    • access control
    • VPNs
    • Encryption.
  • Applications
  • Collaboration
  • Wireless
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is provided by implementing the Cisco SAFE framework in an organization?

A

Advanced threat defense protection that spans the full attack continuum before, during, and after an attack for all the PINs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What 2 things are required in the ‘Before’ phase?

A
  • Full knowledge of all the assets that need to be protected
  • Identification of the types of threats that could target those assets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What 3 actions happen during the ‘Before’ phase?

A
  • Control
  • Enhance
  • Harden
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What 5 Cisco solutions are used in the ‘Before’ phase?

A
  • Next-generation firewalls
  • Network access control
  • Network security analysis
  • Identity services
  • Advanced Malware Protection (AMP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is defined in the ‘During’ phase?

A

The abilities and actions that are required when an attack gets through.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What 5 activities occur in the ‘During’ phase?

A
  • Threat analysis
  • Incident response
  • Detect
  • Block
  • Defend
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What 4 things can organizations leverage in the ‘During’ phase?

A
  • Next-gen IPS (NGIPS)
  • Next-gen firewalls (NGFW)
  • AMP
  • Email and web security solutions with AMP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What do the systems used in the ‘During’ phase provide?

A

They make it possible to detect, block, and defend against attacks that have penetrated the network and are in progress.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is defined in the ‘After’ phase?

A

The ‘After’ phase is defined by the ability to detect, scope, contain, and remediate an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

In the ‘After’ phase what needs to be incorporated into the existing security solution?

A

Any lessons learned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What 4 things can organizations leverage in the ‘After’ phase?

A
  • Cisco Advanced Malware Protection (AMP)
  • Next-generation firewalls (NGFW)
  • Malicious network behavior analysis using Stealthwatch
  • Security Analytics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

In the ‘After’ phase what can the leveraged tools accomplish?

A

The will quickly and effectively scope, contain, and remediate an attack to minimize damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is Cisco TALOS?

What do they have that supports them?
What does it create?
What 3 things do they do with it?

A
  • A team of security experts
  • Sophisticated security systems
  • Creates threat intelligence
  • Detects known and emerging threats
  • Analyzes known and emerging threats
  • Protects known and emerging threats
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What 3 teams comprise TALOS?

A
  • IronPort Security Applications (SecApps)
  • Sourcefire Vulnerability Research Team (VRT)
  • The Cisco Threat Research, Analysis, and Communications (TRAC) team
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What 6 intelligence feeds go into TALOS?

A
  • Advanced Microsoft and industry disclosures
  • AMP community
  • Honeypots
  • The Sourcefire Awareness, Education, Guidance, and Intelligence Sharing (AEGIS) program
  • Private and public threat feeds
  • Dynamic analysis
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What 7 user communities does TALOS leverage?

A
  • ClamAV
  • Snort
  • Immunet
  • SpamCop
  • SenderBase
  • Threat Grid, and Talos user communities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What does TALOS do with the intelligence from their feeds?

A

It is fed into a wide range of security products and solutions to provide protection against an extensive range of threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is Cisco Threat Grid?

A

A solution the can perform static and dynamic file analysis to determine if the file is malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What does Cisco Threat Grid do when it identifies a file as malware?

A

It begins to understand what it is doing or attempting to do, the scope of the threat it poses, and how to defend against it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are 3 examples of some of the things Threat Grid looks at for static file analysis?

A
  • Filenames
  • MD5 checksums
  • File types
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What 3 ways is Threat Grid made available?

A
  • Appliance
  • Cloud-based
  • Integrated into other Cisco security products
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are 2 places where Threat Grid get files to analyze?

A
  • Automatic submission from products integrated with Threat Grid
  • Files can be manually uploaded
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is Cisco Advanced Malware Protection (AMP)?

A

It is a malware analysis and protection solution that goes beyond point-in-time detection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How is AMP leveraged ‘Before’ an attack?

A

Global threat intelligence from Cisco Talos and Cisco Threat Grid feeds into AMP to protect against known and new emerging threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How is AMP leveraged ‘During’ an attack?

A

File reputation to determine whether a file is clean or malicious as well as sandboxing are used to identify threats during an attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How is AMP leveraged ‘After’ an attack?

A

Cisco AMP provides retrospection, indicators of compromise (IoCs), breach detection, tracking, analysis, and surgical remediation after an attack, when advanced malware has slipped past other defenses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are the 3 main components of the AMP architecture?

A
  • AMP Cloud (public or private)
  • AMP Connectors
  • Threat intelligence from Cisco Talos and Cisco Threat Grid
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are the AMP Connectors?

A
  • AMP for Endpoints (Microsoft Windows, macOS X, Google Android, Apple iOS, and Linux)
  • AMP for Networks (NGFW, NGIPS, ISRs)
  • AMP for Email (ESA)
  • AMP for Web (WSA)
  • AMP for Meraki MX
  • Cisco Security Connector (AMP for Apple iOS)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the most important component of AMP architecture?

A

The AMP Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What does the AMP Cloud contain?

A

The database of files and their reputations (malware, clean, unknown, and custom), also referred to as file dispositions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What happens if an AMP connector uploads a sample file to AMP Cloud and the file’s reputation is deemed to be malicious?

A

it is stored in the cloud and reported to AMP connectors that see the same file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What happens if an AMP connector uploads a sample file to AMP Cloud and the file’s reputation is deemed to be unknown?

A

The file is sent to Threat Grid, where its behavior is analyzed in a secure sandbox environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

How does AMP go beyond point-in-time detection?

A

AMP Cloud performs decision making in real time, evolving constantly based on the data that is received. AMP Cloud is capable of identifying malware on files that were previously deemed to be clean.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

How do AMP connectors remain lightweight?

A

By sending a hash to the cloud and allowing the cloud to make the intelligent decisions and return a verdict (about reputation or file disposition) of clean, malicious, or unknown.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is Cisco AnyConnect Secure Mobility Client?

A
  • It is a modular endpoint software product
  • VPN client using Transport Layer Security (TLS)/ Secure Sockets Layer (SSL) and IPsec IKEv2
  • Enhanced security through various built-in modules, such as a VPN Posture (HostScan) module and an ISE Posture module.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What do the modules do in AnyConnect?

A

They enable Cisco AnyConnect to assess an endpoint’s compliance for things like antivirus, antispyware, and firewall software installed on the host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What does AnyConnect do if an endpoint is found not to be compliant?

A

Network access can be restricted until the endpoint is in compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Along with the modules what other capabilities does AnyConnect have?

A
  • Web security through Cisco Cloud Web Security
  • Network visibility into endpoint flows within Stealthwatch
  • Roaming protection with Cisco Umbrella
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What platforms does AnyConnect support?

A
  • Windows
  • macOS
  • iOS
  • Linux
  • Android
  • Windows Phone/ Mobile
  • BlackBerry * ChromeOS.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is SSL/TLS?

A

SSL has been deprecated so it really means TLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What does Cisco Umbrella do?

A

Cisco Umbrella provides the first line of defense against threats on the Internet by blocking requests to malicious Internet destinations (domains, IPs, URLs) using the Domain Name System (DNS) before an IP connection is established or a file is downloaded.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

How is Cisco Umbrella delivered?

A

It is 100% cloud delivered, with no hardware to install or software to maintain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Where is Cisco Umbrella located?

A

30 data centers around the world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

How does Cisco Umbrella maintain 100% uptime?

A

It uses Anycast DNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

How is DNS traffic routed to the closest Cisco Umbrella site?

A

It has an Anycast Infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What does Cisco Umbrella do with the data it gathers?

A

It is fed in real time into Umbrella’s massive graph database, where statistical and machine learning models are continuously run against it. * It’s also analyzed by Umbrella researchers and TALOS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

How is Cisco Umbrella installed?

A

By the corporate network changing the DHCP configuration on all Internet gateways (that is, routers, access points) so that all devices, including guest devices, forward their DNS traffic to Umbrella’s global network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

How can a laptop off the network use Umbrella?

A

In the Cisco AnyConnect client, there is an option to enable a roaming security module, which allows for all DNS requests to be sent to Umbrella’s global network even when the VPN is turned off, and it does this without requiring an additional agent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

If a laptop is not using AnyConnect can it still access Umbrella?

A

The other option is to deploy the Umbrella roaming client, which tags, encrypts, and forwards DNS queries bound for the Internet to the Umbrella global network so per-device security policies can be enforced everywhere without latency or complexity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What is Cisco’s Web Security Appliance?

A

(WSA) is an all-in-one web gateway that includes a wide variety of protections that can block hidden malware from both suspicious and legitimate websites by leveraging real-time threat intelligence from Cisco Talos and Cisco AMP Threat Grid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What does WSA do Before an attack?

A

It actively detects and blocks potential threats before they happen by applying web reputation filters and URL filtering and by controlling web application usage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are 3 tools used by WSA Before an attack?

A
  • Web reputation filters (TALOS)
  • Web Filtering (traditional, also from TALOS)
  • Cisco Application Visibility and Control (AVC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What does WSA do During an attack?

A

It uses security intelligence from cloud access security broker (CASB) providers, Talos, and AMP for networks to identify and block zero-day threats that managed to infiltrate the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What are 5 tools used by WSA during an attack?

A
  • Cloud access security
  • Parallel antivirus (AV) scanning
  • Layer 4 traffic monitoring
  • File reputation and analysis with Cisco AMP
  • Data loss prevention (DLP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What does WSA do After an attack?

A

WSA inspects the network continuously for instances of undetected malware and breaches.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

What 3 tools does WSA use after an attack and what does it do with the information gathered using those tools?

A
  • Global Threat Analytics (GTA) analyzes web traffic
  • Endpoint data from Cisco AMP for Endpoints
  • Network data from Cisco Stealthwatch Enterprise.
  • It then uses machine learning to identify malicious activity before it can exfiltrate sensitive data.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

How is WSA deployed?

A
  • Cloud
  • Virtual appliance on-premises, or in a hybrid arrangement.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is the Cisco Email Security Appliance (ESA)?

A

It enables users to communicate securely via email and helps organizations combat email security threats with a multilayered approach across the attack continuum.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What threat protection capabilities are used by ESA?

A
  • Global threat intelligence (TALOS and Threat Grid)
  • Reputation filtering (TALOS)
  • Spam protection
  • Forged email detection
  • Cisco Advanced Phishing Protection (CAPP)
  • Cisco Domain Protection (CDP)
  • Malware defense
  • Graymail detection and Safe Unsubscribe
  • URL-related protection and control
  • Outbreak filters
  • Web interaction tracking
  • Data security for sensitive content in outgoing emails
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is the Cisco Firepower Next Generation Intrusion Prevention System (NGIPS)?

A

It is a system that provides IDS functions and also automatically blocks intrusion attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What are some of the capabilities included with Firepower?

A
  • Real-time contextual awareness
  • Advanced threat protection and remediation
  • Intelligent security automation
  • Unparalleled performance and scalability
  • Application Visibility and Control (AVC)
  • URL filtering
  • Centralized management
  • Global threat intelligence from the Cisco Talos
  • Snort IPS detection engine
  • High availability and clustering
  • Third-party and open-source ecosystem
  • Integration with Cisco ISE (Quarantine, Unquarantine, Shutdown)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

What 3 platforms does Firepower NGIPS come in?

A
  • Appliance
  • Firepower Threat Defense (FTD) for ISR
  • NGIPS Virtual (NGIPSv)
80
Q

What is Cisco Firepower NGFW?

A
  • The integration of existing ASA software with Firepower NGIPS
  • The industry’s first fully integrated, threat-focused NGFW with unified management
81
Q

What 2 hardware appliances support Firepower NGFW?

A
  • Firepower series appliances
  • All ASA5500-x appliances (except 5585-x)
82
Q

What software does the Firepower NGFW appliances support?

A
  • ASA software image
  • ASA software image with Firepower Services software image (NGIPS)
  • Firepower Threat Defense (FTD) software image
83
Q

What platforms is Firepower Threat Defense (FTD) supported?

A

* ISR Modules * Firepower virtual NGFW (NGFWv) appliances, supported in VMware, KVM, Amazon Web Services (AWS), and Microsoft Azure environments

84
Q

What management options are available for NGFW - FTD or Firepower Services software?

A
  • Firepower Management Center (FMC)
  • Firepower Device Manager (FDM) for small appliances
85
Q

What management options are available for NGFW - ASA software?

A
  • CLI
  • Cisco Security Manager (CSM)
  • Adaptive Security Device Manager (ASDM)
  • Cisco Defense Orchestrator
86
Q

Is CLI supported on FTD or Firepower Services software?

A

No, only for initial setup and troubleshooting.

87
Q

What is Cisco Firepower Management Center (FMC) ?

A

A centralized management platform that aggregates and correlates threat events, contextual information, and network device performance data. It can be used to monitor information that Firepower security devices are reporting to each other and examine the overall activity occurring in the network.

88
Q

What Firepower Security Solutions does FMC handle event and policy mgmt for?

A
  • Firepower NGFW and NGFWv
  • Firepower NGIPS and NGIPSv
  • Firepower Threat Defense for ISR
  • ASA with Firepower Services
  • Advanced Malware Protection (AMP)
89
Q

What is Cisco Stealthwatch?

A

It is is a collector and aggregator of network telemetry data that performs network security analysis and monitoring to automatically detect threats that manage to infiltrate a network as well as the ones that originate from within a network.

90
Q

What is unique about Stealthwatch?

A

It is the only product that can detect malware in encrypted traffic and ensure policy compliance without decryption.

91
Q

What are the 2 Stealthwatch products?

A
  • Stealthwatch Enterprise
  • Stealthwatch Cloud
92
Q

What 3 components does Stealthwatch require?

A
  • Flow rate license
  • Flow collector (hardware or VM)
  • Stealthwatch Management Console (hardware or VM)
93
Q

For Stealthwatch Enterprise what are the 3 optional but recommended components?

A
  • Cisco Stealthwatch Threat Intelligence
  • Cisco Stealthwatch Endpoint
  • Cisco Stealthwatch Cloud
94
Q

What are 5 benefits of Stealthwatch Enterprise?

A
  • Real-time threat detection
  • Incident response and forensics
  • Network segmentation
  • Network performance and capacity planning
  • Ability to satisfy regulatory requirements
95
Q

What are 2 optional Stealthwatch Enterprise components?

A
  • Flow Sensor
  • UDP Director
96
Q

What 2 offerings of Stealthwatch Cloud?

A
  • Public cloud monitoring
  • Private cloud monitoring
97
Q

What is Cisco Identity Services Engine (ISE)?

A

(ISE) is a security policy management platform that provides highly secure network access control (NAC) to users and devices across wired, wireless, and VPN connections. It allows for visibility into what is happening in the network, such as who is connected (endpoints, users, and devices), which applications are installed and running on endpoints (for posture assessment), and much more.

98
Q

What are the features/benefits of ISE?

A
  • Streamlined network visibility
  • Cisco DNA center integration
  • Centralized secure NAC
  • Centralized device access control
  • TrustSec
  • Guest lifecycle mgmt
  • Streamlined device onboarding
  • Internal certificate authority
  • Device profiling
  • Endpoint posture service
  • Active Directory support
  • Cisco Platform Exchange Grid (pxGrid) versions 1.0 and 2.0
99
Q

What are 5 methods of Network Access Control (NAC)?

A
  • 802.1x
  • MAB
  • WebAuth
  • TrustSec
  • MACSec
100
Q

What is 802.1x?

A

Dot1x) is a standard for port-based network access control (PNAC) that provides an authentication mechanism for local area networks (LANs) and wireless local area networks (WLANs).

101
Q

What 4 components comprise 802.1x?

A
  • Extensible Authentication Protocol (EAP)
  • EAP Method (or Type)
  • EAP over LAN (EAPoL)
  • RADIUS
102
Q

What are the 3 802.1x roles?

A
  • Supplicant
  • Authenticator
  • Authentication server
103
Q

What is Step 1 of the 802.1x authentication flow?

A

When the authenticator notices a port coming up, it starts the authentication process by sending periodic EAP-request/ identify frames. The supplicant can also initiate the authentication process by sending an EAPoL-start message to the authenticator.

104
Q

What is Step 2 of the 802.1x authentication flow?

A

The authenticator relays EAP messages between the supplicant and the authentication server, copying the EAP message in the EAPoL frame to an AV-pair inside a RADIUS packet and vice versa until an EAP method is selected. Authentication then takes place using the selected EAP method.

105
Q

What is Step 3 of the 802.1x authentication flow?

A

If authentication is successful, the authentication server returns a RADIUS access-accept message with an encapsulated EAP-success message as well as an authorization option such as a downloadable ACL (dACL). When this is done, the authenticator opens the port.

106
Q

What are 4 categories of EAP methods?

A
  • EAP challenge-based authentication method
  • EAP TLS authentication method
  • EAP tunneled TLS authentication method
  • EAP inner authentication methods
107
Q

What is an example of the EAP challenge-based authentication method?

A

Extensible Authentication Protocol-Message Digest 5 (EAP-MD5)

108
Q

What are examples of the EAP TLS authentication methods?

A
  • Extensible Authentication Protocol Flexible Authentication via Secure Tunneling (EAP-FAST)
  • Extensible Authentication Protocol Tunneled Transport Layer Security (EAP-TTLS)
  • Protected Extensible Authentication Protocol (PEAP)
109
Q

What are 3 examples of the EAP inner authentication methods?

A
  • EAP Generic Token Card (EAP-GTC)
  • EAP Microsoft Challenge Handshake Authentication Protocol Version 2( EAP-MSCHAPv2)
  • EAP-TLS
110
Q

How does EAP-MD5 work?

A

This algorithm uses the MD5 message-digest algorithm to hide the credentials in a hash. The hash is sent to the authentication server, where it is compared to a local hash to validate the accuracy of the credentials.

111
Q

Why is EAP-MD5 a poor choice?

A

It lacks mutual authentication. It can’t authenticate the authentication server.

112
Q

How does EAP-TLS work?

A

It uses the TLS Public Key Infrastructure (PKI) certificate authentication mechanism to provide mutual authentication of supplicant to authentication server and authentication server to supplicant. With EAP-TLS, both the supplicant and the authentication server must be assigned a digital certificate signed by a certificate authority (CA) that they both trust.

113
Q

What is the downside to EAP-TLS?

A

EAP-TLS is the most difficult to deploy due to the administrative burden of having to install a certificate on the supplicant side.

114
Q

What is the most secure authentication method?

A

EAP-TLS because both the supplicant and the authentication server need to have certificates.

115
Q

How do authentication methods in the PEAP category work?

A

In PEAP, only the authentication server requires a certificate, which reduces the administrative burden of implementing EAP. PEAP forms an encrypted TLS tunnel between the supplicant and the authentication server. After the tunnel has been established, PEAP uses one of the EAP authentication inner methods to authenticate the supplicant through the outer PEAP TLS tunnel

116
Q

How does EAP-MSCHAPv2 (PEAPv0) work?

A

The client’s credentials are sent to the server encrypted within an MSCHAPv2 session. This is the most common inner method, as it allows for simple transmission of username and password, or even computer name and computer password, to the RADIUS server, which can then authenticate them using Microsoft’s Active Directory.

117
Q

How does EAP-GTC (PEAPv1) work?

A

This inner method was created by Cisco as an alternative to MSCHAPv2 to allow generic authentications to virtually any identity store, including OTP token servers, LDAP, NetIQ eDirectory, and more.

118
Q

How does EAP-TLS work?

A

This is the most secure EAP authentication since it is essentially a TLS tunnel within another TLS tunnel. It is rarely used due to its deployment complexity because it requires certificates to be installed on the supplicants.

119
Q

What is EAP-FAST?

A
  • Developed by Cisco Systems as an alternative to PEAP
  • It allows faster re-authentications and support for faster wireless roaming * Supports EAP chaining
120
Q

How does EAP-FAST work?

A

EAP-FAST forms a TLS outer tunnel and then transmits the client authentication credentials within that outer TLS tunnel

121
Q

what is the major difference between PEAP and EAP-FAST?

A

EAP-FAST has the ability to re-authenticate faster by using protected access credentials (PACs).

122
Q

What is a PAC?

A
  • Protected Access Credentials
  • Similar to a cookie
  • Stored locally on the host as proof of having been successfully authenticated.
123
Q

What is a major difference between PEAP and EAP-TTLS?

A

PEAP only supports EAP inner authentication methods, while EAP-TTLS can support additional inner methods such as legacy Password Authentication Protocol (PAP), Challenge Handshake Authentication Protocol (CHAP), and Microsoft Challenge Handshake Authentication Protocol (MS-CHAP).

124
Q

What is EAP-TTLS?

A
  • Similar in functionality to PEAP
  • Not as widely supported as PEAP.
125
Q

What is EAP Chaining?

A

EAP Chaining supports machine and user authentication inside a single outer TLS tunnel. It enables machine and user authentication to be combined into a single overall authentication result. This allows the assignment of greater privileges or posture assessments to users who connect to the network using corporate-managed devices.

126
Q

What is MAB?

A

MAC Authentication Bypass - it enables port-based access control using the MAC address of an endpoint, and it is typically used as a fallback mechanism to 802.1x. A MAB-enabled port can be dynamically enabled or disabled based on the MAC address of the endpoint that connects to it.

127
Q

What is Step 1 of MAB?

A

The switch initiates authentication by sending an EAPoL identity request message to the endpoint every 30 seconds by default. After three timeouts (a period of 90 seconds by default), the switch determines that the endpoint does not have a supplicant and proceeds to authenticate it via MAB.

128
Q

What is Step 2 of MAB?

A

The switch begins MAB by opening the port to accept a single packet from which it will learn the source MAC address of the endpoint. Packets sent before the port has fallen back to MAB (that is, during the IEEE 802.1x timeout phase) are discarded immediately and cannot be used to learn the MAC address. After the switch learns the source MAC address, it discards the packet. It crafts a RADIUS access-request message using the endpoint’s MAC address as the identity. The RADIUS server receives the RADIUS access-request message and performs MAC authentication.

129
Q

What is Step 3 of MAB?

A

The RADIUS server determines whether the device should be granted access to the network and, if so, what level of access to provide. The RADIUS server sends the RADIUS response (access-accept) to the authenticator, allowing the endpoint to access the network. It can also include authorization options such as dACLs, dVLANs, and SGT tags.

130
Q

What can be done to speed up MAB?

A

Disable 802.1x. If 802.1x is not enabled, MAB authentication starts immediately after linkup instead of waiting for IEEE 802.1x to time out.

131
Q

What is a downside to MAB?

A

MAC addresses are easily spoofed.

132
Q

When using MAB if the authenticator is a Cisco switch what authorization options are available?

A
  • Downloadable ACLs (dACLs)
  • Dynamic VLAN Assignment (dVLAN)
  • Security Group Tags (SGTs)
133
Q

How does WebAuth work?

A

With WebAuth, endpoints are presented with a web portal requesting a username and password. The username and password that are submitted through the web portal are sent from the switch (or wireless controller, firewall, and so on) to the RADIUS server in a standard RADIUS access-request packet.

134
Q

What are the 2 types of WebAuth?

A
  • Local Web Authentication
  • Centralized Web Authentication with Cisco ISE
135
Q

What is Local WebAuth (LWA)?

A
  • Switch or WLC redirects web traffic to web portal hosted on the switch or WLC.
  • End user enters name/password.
  • Switch forwards to creds to RADIUS server
136
Q

What cannot be done with Local WebAuth?

A
  • Not customizable
  • No support for an Acceptable Use Policy page
  • No password change capability
  • No device registration
  • No self registration
  • No VLAN assignment
  • No posture or profiling
137
Q

Can Local WebAuth and defaulting to a Guest VLAN be done at the same time?

A

No, the two are mutually exclusive.

138
Q

How does Central WebAuth with Cisco ISE work?

A
  • The switch performs MAB, sending the RADIUS access-request to Cisco ISE.
  • ISE sends RADIUS result and redirect to portal on ISE
  • Endpoint gets IP, DNS and def gtwy from DHCP
  • End user opens web page located on iSE, enters creds.
  • ISE sends re-authentication Change of Authorization (CoA-reauth) to the switch.
  • Switch sends new MAB req with same session ID to ISE.
  • ISE sends final auth result to switch for end user including an authorization option such as a dowloadable ACL (dACL).
139
Q

What is a difference between LWA and Central WebAuth on ISE?

A

With Central WebAuth with ISE ISE stores the credentials and ties the MAC address to the credentials.

140
Q

What can Central WebAuth do that LWA cannot?

A

Central WebAuth supports:

  • CoA for posture profiling
  • dACL
  • VLAN authorization options
  • Client provisioning
  • Posture assessments
  • Acceptable use policies
  • Password changing
  • Self registration
  • Device registration.
141
Q

By default what is the order in which a Cisco switch attempts authentication?

A
  • 802.1x authentication first
  • followed by MAB
  • and then WebAuth.
142
Q

What is Enhanced Flexible Authentication (FlexAuth)?

A

FlexAuth allows multiple authentication methods concurrently (for example, 802.1x and MAB) so that endpoints can be authenticated and brought online more quickly.

143
Q

What is FlexAuth a key component of?

A

Cisco Identity-Based Networking Services (IBNS) 2.0 which offers authentication, access control, and user policy enforcement.

144
Q

What is Cisco Identity Based Networking Service (IBNS)?

A

It is an integrated solution that offers authentication, access control, and user policy enforcement with a common end-to-end access policy that applies to both wired and wireless networks.

145
Q

What 3 components make up IBNS?

A
  • Enhanced FlexAuth
  • Cisco Common Classification Policy Language (C3PL)
  • Cisco ISE
146
Q

What is Cisco TrustSec?

A

It is a next-generation access control enforcement solution developed by Cisco to address the growing operational challenges related to maintaining firewall rules and ACLs by using Security Group Tag (SGT) tags.

147
Q

In general how does TrustSec work?

A
  • Cisco ISE assigns SGT tags to users/devices that are authenticated and authorized through 802.1x, MAB, or WebAuth.
  • The SGT tag assignment is delivered to the authenticator as an authorization option (in the same way as a dACL).
  • After the SGT tag is assigned, an access enforcement policy (allow or drop) based on the SGT tag can be applied at any egress point of the TrustSec network.
148
Q

What is the purpose of TrustSec?

A

TrustSec uses SGT tags to perform ingress tagging and egress filtering to enforce access control policy.

149
Q

What are SGT Tags and what do they represent?

A
  • Scalable Group Tag
  • the context of the user, device, use case, or function
150
Q

Are endpoints aware of the SGT tag?

A

No, endpoints are not aware of the SGT tag. The SGT tag is only known and applied in the network infrastructure.

151
Q

What are the 3 phases during which TrustSec is configured?

A
  • Ingress Classification
  • Propogation
  • Egress Enforceent
152
Q

What is TrustSec Ingress Classification?

A

Ingress classification is the process of assigning SGT tags to users, endpoints, or other resources as they ingress the TrustSec network.

153
Q

What are the 2 ways TrustSec Ingress Classification can occur?

A
  • Dynamic assignment
  • Static assignment
154
Q

What happens during the Dynamic assignment of the SGT tag?

A

The SGT is assigned dynamically and can be downloaded as an authorization option from ISE when authenticating using 802.1x, MAB, or WebAuth.

155
Q

What is Static assignment of SGT tags?

A

Usually done in data centers. SGT tags can be statically mapped on SGT-capable network devices.

156
Q

What are the 7 ways to statically assign an SGT to a device?

A
  • IP to SGT tag
  • Subnet to SGT tag
  • VLAN to SGT tag
  • L2 Interface to SGT tag
  • L3 logical interface to SGT tag
  • Port to SGT tag
  • Port Profile to SGT tag
157
Q

What is an alternative to assigning an SGT tag to a port?

A
  • Cisco ISE added the ability to centrally configure a database of IP addresses and their corresponding SGT tags
  • Network devices that are SGT capable can download the list from Cisco ISE
158
Q

What is SGT tag propagation?

A

The process of communicating the mappings to the TrustSec network devices that will enforce policy based on SGT tags.

159
Q

What are the 2 methods for propagating an SGT tag?

A
  • Tag— inline tagging (also referred to as native tagging)
  • Cisco-created protocol SGT Exchange Protocol (SXP)
160
Q

How does inline tagging (native tagging) work?

A

With inline tagging, a switch inserts the SGT tag inside a frame to allow upstream devices to read and apply policy. Native tagging is completely independent of any Layer 3 protocol (IPv4 or IPv6), so the frame or packet can preserve the SGT tag throughout the network infrastructure (routers, switches, firewalls, and so on) until it reaches the egress point.

161
Q

What is the downside to native tagging of SGT tags?

A

It is supported only by Cisco network devices with ASIC support for TrustSec.

162
Q

What would happen if a device that didn’t support TrustSec received an SGT tagged frame?

A

The frame would be dropped.

163
Q

What is SXP?

A
  • SGT Exchange Protocol (SXP)
  • Cisco TCP-based peer-to-peer protocol used for network devices that do not support SGT inline tagging in hardware.
  • Using SXP, IP-to-SGT mappings can be communicated between non-inline tagging switches and other network devices.
  • Non-inline tagging switches also have an SGT mapping database to check packets against and enforce policy.
164
Q

What is the SXP peer that sends IP-to-SGT bindings called?

A

The speaker.

165
Q

What is the IP-to-SGT binding receiver is called ?

A

The listener.

166
Q

Are SXP connections single hop only?

A

No, they can be single or multihop.

167
Q

What are the 2 types of SGT egress enforcement?

A
  • Security Group ACL (SGACL)
  • Security Group Firewall (SGFW)
168
Q

What is Security Group ACL?

A

Provides enforcement on routers and switches. Access lists provide filtering based on source and destination SGT tags.

169
Q

What is Security Group Firewall?

A

Provides enforcement on firewalls (such as Cisco ASA and NGFW). Requires tag-based rules to be defined locally on the firewall.

170
Q

What is MACsec?

A

It is an IEEE 802.1AE standards-based Layer 2 hop-by-hop encryption method.

171
Q

What does MACsec do?

A

Traffic is encrypted only on the wire between two MACsec peers and is unencrypted as it is processed internally within the switch.

172
Q

What is the purpose of MACsec?

A

It allows the switch to look into the inner packets for things like SGT tags to perform packet enforcement or QoS prioritization.

173
Q

What does a switch use to encrypt and decrypt MACsec frames?

A

The switch leverages onboard ASICs to perform the encryption and decryption

174
Q

What does MACsec do to a normal Ethernet frame?

A

MACsec adds:

  • An additional 16-byte MACsec Security Tag field (802.1AE header)
  • A 16-byte Integrity Check Value (ICV) field.
175
Q

What 2 authentication methods are used by MACsec?

A
  • Galois Method Authentication Code (GMAC)
  • Authenticated encryption using Galois/ Counter Mode Advanced Encryption Standard (AES-GCM).
176
Q

Do all devices in the flow of the MACsec communications need to support MACsec?

A

Yes, they have to support MACsec so they can recognize and use the fields added to the Ethernet frame.

177
Q

What are the 5 fields in the 16-byte MACsec Security Tag?

A
  • MACsec EtherType (first two octets)
  • TCI/ AN (third octet)
  • SL (fourth octet)
  • Packet Number (octets 5– 8)
  • SCI (octets 9– 16)
178
Q

What does the MACsec EtherTYpe field do?

A

Set to 0x88e5, designating the frame as a MACsec frame

179
Q

What does the MACsec TCI/ AN field do?

A

Tag Control Information/ Association Number field, designating the version number if confidentiality or integrity is used on its own

180
Q

What does the MACsec SL field do?

A

Short Length field, designating the length of the encrypted data

181
Q

What does the MACsec Packet Number field do?

A

The packet number for replay protection and building of the initialization vector

182
Q

What does the MACsec SCI field do?

A

Secure Channel Identifier, for classifying the connection to the virtual port

183
Q

What are the 2 MACsec keying mechanisms?

A
  • Security Association Protocol (SAP)- this is a proprietary Cisco keying protocol used between Cisco switches
  • MACsec Key Agreement (MKA) protocol
184
Q

What does the keying mechanism MACsec Key Agreement Protocol (MKA) provide?

A

MKA provides the required session keys and manages the required encryption keys. The 802.1AE encryption with MKA is supported between endpoints and the switch as well as between switches.

185
Q

What is Downlink MACsec?

A

It is the term used to describe the encrypted link between an endpoint and a switch.

186
Q

How is the encryption between the endpoint and the switch handled?

A

By the MKA keying protocol.

187
Q

What is required for there to be encryption between endpoint and switch?

A

MACsec-capable switch and a MACsec-capable supplicant on the endpoint (such as Cisco AnyConnect).

188
Q

How is encryption handled on the endpoint?

A

The encryption on the endpoint may be handled in hardware (if the endpoint possesses the correct hardware) or in software, using the main CPU for encryption and decryption.

189
Q

What options does a MACsec switch have regarding encryption?

A

The Cisco switch has the ability to force encryption, make encryption optional, or force non-encryption.

190
Q

What are 2 ways MACsec encryption can be configured?

A
  • It can be configured manually per port (which is not very common)
  • Dynamically as an authorization option from Cisco ISE (which is much more common).
191
Q

If the MACsec encryption setting on the switch is different than ISE what happens?

A

The policy issued by ISE overrides anything set using the switch CLI.

192
Q

What is Uplink MACsec?

A

This is the term for encrypting a link between switches with 802.1AE.

193
Q

What encryption is used between MACsec switches?

A

MACsec uses Cisco proprietary SAP encryption. The encryption is the same AES-GCM-128 encryption used with both uplink and downlink MACsec.

194
Q

How is Uplink MACsec achieved?

A

Uplink MACsec may be achieved manually or dynamically. Dynamic MACsec requires 802.1x authentication between the switches.

195
Q

Which 2 authentication methods were developed by Cisco?

A
  • LEAP
  • EAP-FAST

CCNP Core (46 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions