Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNP Core > Chap 26 - Network Device Access Control and Infrastructure Security > Flashcards

Chap 26 - Network Device Access Control and Infrastructure Security Flashcards

1
Q

What are 5 types of ACLs?

A
  • Numbered Standard
  • Numbered Extended
  • Named ACLs
  • Port ACLs (PACLs)
  • VLAN ACLs (VACLs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the range for Standard Numbered ACLs?

A
  • 1 - 99
  • 1300 - 1999
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the range for Numbered Extended ACLs?

A
  • 100 - 199
  • 2000 - 2699
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the only thing a Numbered Standard ACL can filter on?

A

Source IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the command to enter ACL command mode?

A

ip access-list extended NAME_OF_ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 4 restrictions for PACLs?

A
  • They only filter inbound traffic
  • They cannot filter L2 control packets (CDP, VTP, DTP, PAgP, UDLD, STP)
  • They are only supported in hardware
  • They do not support filtering IPv6, ARP, and MPLS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does the Port ACL feature provide?

A

It provides the ability to perform access control on specific Layer 2 ports. A Layer 2 port is a physical LAN or trunk port that belongs to a VLAN. Port ACLs are applied only on the ingress traffic. The port ACL feature is supported only in hardware (port ACLs are not applied to any packets routed in software).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 2 modes supported by PACLs?

A
  • Prefer port mode
  • Merge mode (default)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Prefer Port mode?

A

If a PACL is configured on a Layer 2 interface, the PACL takes effect and overwrites the effect of other ACLs (Cisco IOS ACL and VACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Merge mode?

A

The PACL, VACL, and Cisco IOS ACLs are merged in the ingress direction following the logical serial model shown in Figure 51-2. This is the default access group mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

If a PACL, VACL, and RACL are applied on the same VLAN and incoming traffic is bridged what order are they processed?

A
  1. Inbound PACL on the switchport
  2. Inbound VACL on the VLAN 3
  3. Outbound VACL on the VLAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

If a PACL, VACL, and RACL are applied on the same VLAN and incoming traffic is routed what order are they processed?

A
  1. Inbound PACL on the switchport
  2. Inbound VACL on the VLAN
  3. Inbound ACL on the SVI 4) Outbound ACL on the SVI 5) Outbound VACL on the VLAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the 3 methods of gaining access to the CLI on an IOS device?

A
  • Console (cty) port - line con 0
  • Aux (aux) port - line aux 0
  • Virtual Terminal (vty) lines - line vty 0 4
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 3 ways to password-protect the lines?

A
  • password configured directly on the line
  • username-based authentication
  • Using a AAA server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Type 0 password?

A
  • configured with ‘enable password’
  • clear text
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Type 5 password?

A

These passwords use an improved Cisco proprietary encryption algorithm that makes use of the MD5 hashing algorithm. Only crackable by brute force attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a Type 7 password?

A

These passwords use a Cisco proprietary Vigenere cypher encryption algorithm and are known to be weak. There are multiple online password utilities available that can decipher type 7 encrypted passwords in less than a second. Enabled with service password-encryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a Type 8 password?

A

Type 8 passwords specify a Password-Based Key Derivation Function 2 (PBKDF2) with a SHA-256 hashed secret and are considered to be uncrackable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is a Type 9 password?

A

These use the SCRYPT hashing algorithm. Just like type 8 passwords, they are considered to be uncrackable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

To enable a password on line con, aux, or vty what 2 commands are required?

A
  • password MYPASS
  • login
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are 3 ways to enable username password authentication?

A
  • username password
  • username secret
  • username algorithm type secret
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What 2 commands will enable username password authentication on line con, aux, vty?

A
  • global config username password
  • under line configuration ‘login local’
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are 3 privilege levels?

A
  • privilege level 0
  • privilege level 1
  • privilege level 15
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What can you do with privilege level 0?

A
  • disable
  • enable
  • exit
  • help
  • logout
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What can you do with privilege level 1?

A
  • User exec level
  • Everything except configuration changes.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What can you do with privilege level 15?

A
  • Privileged EXEC mode
  • Highest privilege level
  • You can do everything
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 2 versions of SSH?

A
  • SSHv1
  • SSHv2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the 3 steps required to enable SSHv2?

A
  • Configure a hostname
  • Configure a domain name (ip domain-name yum.tgr.net)
  • Generate crypto keys (crypto key generate 768)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What determines the version of SSH in use?

A

A modulus of 768 or greater enables SSHv2

30
Q

What is SSH 1.99?

A

Means that both SSHv1 and SSHv2 are enabled.

31
Q

How do you make sure only SSHv2 is used?

A

Use the command ‘ip ssh version 2’

32
Q

What is the command to disable the AUX port?

A
  • line aux 0
  • no exec
33
Q

What does the command ‘exec timeout’ by itself do?

A

Times out the session after 10 minutes

34
Q

What is the command to kick someone out after a certain amount of time whether the line is in use or not?

A

absolute-timeout (minutes) The command ‘logout warning (seconds)’ should be used in conjunction with absolute-timeout

35
Q

Why is TACACS+ the protocol of choice for network device administration?

A

After authenticating a user it can authorize every command the user types in. RADIUS can’t do that.

36
Q

Why is RADIUS the protocol of choice for secure network access?

A

It supports EAP. TACACS does not.

37
Q

What is a stateful firewall?

A

A firewall capable of looking into Layers 4 through 7 of a network packet to verify the state of the transmission. A stateful firewall can detect whether a port is being piggybacked and can mitigate DDoS intrusions.

38
Q

What is a Zone-based Firewall (ZBFW)?

A

Integrated stateful firewall technology included in IOS. It reduces the need for a branch office to have a firewall. Assigns interfaces to zones (Inside, Outside, DMZ)

39
Q

What are the 2 system-built zones in a ZBFW?

A
  • Self
  • Default
40
Q

What is the Self zone?

A

It is a system-level zone and includes all the routers’ IP addresses. By default, traffic to and from this zone is permitted to support management (for example, SSH protocol, SNMP) and control plane (for example, EIGRP, BGP) functions.

41
Q

What happens after a policy is applied to the self zone and another security zone?

A

All interzone communication must be explicitly defined.

42
Q

What is the Default zone?

A

The default zone is a system-level zone, and any interface that is not a member of another security zone is placed in this zone automatically.

43
Q

If an interface is in the Default zone can other zones communicate with it?

A

Yes, when the unassigned interfaces are in the default zone, a policy map can be created between the two security zones.

44
Q

What is the command for creating a class-map for a ZBFW?

A

class-map type inspect

45
Q

What is an Inspection Policy Map?

A

A policy-map which applies firewall policy actions to the class maps defined in the policy map.

46
Q

What makes a firewall stateful?

A

The router maintains connection/ session information and permits return traffic from the destination zone without the need to specify it in a second policy.

47
Q

What is the command to create a security zone?

A

zone security (zone-name)

48
Q

What is the command to create class-maps for the purpose of inspection?

A

class-map type inspect [match-all | match-any] (class-name)

49
Q

Under class-map configuration what does ‘match access-group name’ do?

A

It is used to match against previously created ACLs. (match access-group name MYACL)

50
Q

What is the command to create policy maps for inspection purposes?

A

policy-map type inspect (policy-name)

51
Q

What is the difference between the policy map actions PASS and INSPECT?

A
  • PASS - forwards traffic in one direction only. Another policy map would be needed for return traffic
  • INSPECT - The router maintains connection/ session information and permits return traffic from the destination zone without the need to specify it in a second policy.
52
Q

What is the command to create a zone-pair?

A

zone-pair security MYZONEPAIR source OUTSIDE destination SELF

53
Q

What is the command to associate a policy-map with a zone-pair?

A

In zone-pair configuration mode - ‘service-policy type inspect MYPOLICY’

54
Q

What is the command to associate an interface with a security zone?

A

zone-member security OUTSIDE

55
Q

What is Control Plane Policing (CoPP)?

A

A control plane policing (CoPP) policy is a QoS policy that is applied to traffic to or sourced by the router’s control plane CPU.

56
Q

What are CoPP policies used for?

A

CoPP policies are used to limit known traffic to a given rate while protecting the CPU from unexpected extreme rates of traffic that could impact the stability of the router.

57
Q

What is Cisco EPC?

A

Cisco Embedded Packet Capture

58
Q

How do you tell which protocols need policing on the control plane?

A

Documentation and Cisco EPC captures

59
Q

What are the 5 steps to follow to do CoPP?

A
  • Determine what traffic to police
  • Create ACLs to match the traffic
  • Create class-maps to categorize the traffic
  • Create a policy-map referencing the class-maps
  • Apply the policy-map to the control plane
60
Q

When performing CoPP what should you do at first to ensure that CoPP doesn’t cause problems?

A

In order to guarantee that CoPP does not introduce issues, in the policy-map the violate action is set to transmit for all the vital classes until a baseline for normal traffic flows is established.

61
Q

In a CoPP policy-map what is the purpose of the class-default?

A

By allowing a minimal amount of traffic within this class and monitoring the policy permits discovery of new or unknown traffic that would have otherwise been denied.

62
Q

To harden a router what 7 things should be disabled?

A
  • CDP on outside interface
  • TCP and UDP small servers
  • IP Redirects
  • Proxy ARP
  • no service config
  • MOP
  • PAD service
63
Q

What should be done if you disable TCP and UDP small servers?

A

Add the commands service tcp-keepalive-in and service tcp-keepalive-out ensure that devices send TCP keepalives for inbound/ outbound TCP sessions. This ensures that the device on the remote end of the connection is still accessible and that half-open or orphaned connections are removed from the local device.

64
Q

Why should the ‘no service config’ command be used to harden a router?

A

It prevents the router from trying to pull a configuration from a TFTP server on bootup.

65
Q

What is MOP?

A

Maintenance Operation Protocol - part of the DECnet suite, allows access to a device that can only operate at the datalink layer.

66
Q

What is PAD?

A

Packet Assembler/Disassembler - used for x.25 connections only

67
Q

Determine if a vty line is in use

A

show line (the line in use has an asterisk)

68
Q

Verify the inspect class-map configuration

A

show class-map type inspect

69
Q

Verify the inspection policy-map

A

show policy-map type inspect

70
Q

Verify the zone pair policy-map

A

show policy-map type inspect zone-pair

71
Q

Verify the policy for CoPP

A

show policy-map control-plane input

CCNP Core (46 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions