Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

31 Days to CCNA > Day 20 - LAN Security & Device Hardening > Flashcards

Day 20 - LAN Security & Device Hardening Flashcards

1
Q

What are the two content security appliance products Cisco offers?

A

Cisco Email Security Appliance (ESA)
Cisco Web Security Appliance (WSA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
1
Q

Endpoints are best protected by what host based Cisco product?

A

Cisco Advanced Malware Protection (AMP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

This is a Cisco proprietary special device designed to monitor email’s primary protocol, SMTP

A

ESA (Email Security Appliance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This Cisco proprietary device can block known threats, remediate against stealth malware that evades initial detection, discard emails with bad links, block access to newly infected sites and encrypt content in outgoing email to prevent data loss

A

ESA (Email Security Appliance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

This Cisco proprietary device combines advanced malware protection, application visibility and control, acceptable use policy controls, and reporting

A

WSA (Web Security Appliance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What can the Cisco WSA perform?

A

Blacklisting of URLs
URL filtering
Malware scanning
URL categorization
Web app filtering
Encryption and decryption of traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the issue with this bit of command?

R1(config)#line vty 0 4
R1(config-line)#password ci5c0
R1(config-line)#login

A

The password will be in plaintext and there is no accountability to who has logged in

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

This command requires the use of a username/password pair on vty, console and aux ports

A

login local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the correct commands to set up a username/password secret and have it be required to login and have access to the console and vty lines?

A

username {username} secret {secret}

line con 0
login local
no password

line vty 0 15
login local
no password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This protocol uses plaintext, insecure transmission of both the login and data across the connection

A

Telnet (port 23)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This protocol is more secure over Telnet

A

SSH (port 22)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why is SSH more secure over Telnet?

A

Required username and password, both of which are encrypted during transmission

Username and password can be auth’d using the local database method

Username is recorded when a user logs in leading to accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What command would you use to verify SSH?

A

show ip ssh

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What commands would you use to set up SSH for the domain cisco.com with a username/secret pair for lines VTY 0 15?

A

ip domain cisco.com
crypto key generate rsa
1024 (bits in the modulus)

line vty 0 15
login local
transport input ssh
username hmolinar secret cisco

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How would you remove the RSA key pair?

A

crypto key zeroize rsa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the minimum modulus size that Cisco recommends?

A

1024

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Router interfaces must be activated with what command?

A

no shutdown

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False:

With Cisco switches, an interface is activated when a device is connected to the port

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some security best practices for unused interface on Cisco devices?

Perform the commands on int fa0/1

A

Administratively disable unused ports

Prevent VLAN trunking by putting the port into switchport mode access

Assign the port to an unused VLAN

Change the native VLAN from VLAN 1 to an unused custom VLAN

int fa0/1
shut
sw acc mode
sw acc vlan 999
sw trunk native vlan 999

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What commands would you use to create a black hole VLAN and apply it to a range of interfaces fa0/20 to fa0/24?

A

vlan 999
name BlackHole

int range fa0/20 - 24
shut
switchport mode acc
switchport acc vlan 999

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What Cisco framework helps secure device access?

A

AAA

Authentication, authorization and accounting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What two AAA authentication methods does Cisco support?

A

TACACS+
RADIUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What transport protocol and port does TACACS+ use?

A

TCP 49

23
Q

What transport protocol and port(s) does RADIUS use?

A

UDP 1645, 1812

24
Q

True or False:

Both RADIUS and TACACS+ encrypt passwords

A

True

25
Q

True or False:

Both RADIUS and TACACS+ encrypt the entire packet

A

False. Only TACACS+ encrypts the entire packet

26
Q

This protocol is a standard port based access control and authentication protocol

A

802.1X

27
Q

This standard port based access control and auth protocol is ideal for restricting unauthorized access through publicly available LAN devices, such as switches and wireless APs

A

802.1X

28
Q

802.1X defines three roles for devices in the network. What are they?

A

Client (Supplicant)
Switch (Authenticator)
Authentication Server

29
Q

For port security, one of the steps is to make the port an access port which means the port is not doing any what?

A

VLAN trunking

30
Q

What are the basic commands to throw port security onto an interface?

A

int {int}
switchport mode access
switchport port-security

31
Q

What command overrides the maximum number of allowed MAC addresses associated with the interface?

A

switchport port-security maximum {number}

32
Q

What command predefines any allowed source MAC address(es) for an interface?

A

int {int}
switchport port-security mac-address {mac-address}

33
Q

What command will allow an interface to dynamically learn and configure the MAC addresses of currently connected hosts?

A

int {int}
switchport port-security mac-address sticky

34
Q

True or False:

In regards to port security violations – protect, restrict and shutdown all discard offending traffic

A

True

35
Q

True or False:

In regards to port security violations – protect, restrict and shutdown all send log and SNMP messages?

A

False. Only restrict and shutdown do this

36
Q

True or False:

In regards to port security violations – protect, restrict and shutdown all disable the interface discarding all traffic

A

False. Only shutdown does this.

37
Q

What is a general command to show port security configuration?

A

show port-security

38
Q

What is a more granular command to show port security of an interface?

A

show port-security interface {int}

39
Q

This protocol can be used to set the aging time for static and dynamic secure addresses on a port

A

Port Security Aging

40
Q

What two types of aging are supported per port?

A

Absolute and Inactivity

41
Q

This port aging type deletes secure addresses on the port after the specified aging time

A

Absolute

42
Q

This port aging type deletes secure addresses only if they are inactive for the specified aging time

A

Inactivty

43
Q

What two ways can a port security violation occur?

A

Max number of secure MAC addresses has been added to the MAC address table for that interface

An address learned is seen on another secure interface in the same VLAN

44
Q

What three ways can VLAN attacks be launched?

A

Spoofing DTP messages
Introducing a rogue switch and enabling trunking
Mounting a double tagging attack

45
Q

What are some ways to avoid VLAN hopping attacks?

Give the commands to achieve this on Fa0/1

A

Disable DTP

Disable unused ports and put them in an unused VLAN

Manually enable the trunk link on a trunk port instead of having DTP do it

Set the native vlan to another VLAN other than 1

vlan 1000
name Native

int fa0/1
sw nonegotiate
shut
sw trunk native vlan 1000

46
Q

What are the two types of DHCP attacks?

A

Starvation and spoofing

47
Q

This type of DHCP attack aims to create a DOS condition for connecting clients

A

Starvation attack

48
Q

This type of DHCP attack occurs when a rogue DHCP server is connected to the network and provides false IP configuration parameters to legitimate clients

A

Spoofing attack

49
Q

To protect against DHCP attacks, __________ ___________ uses the concept of Trusted and __________ ports

A

DHCP snooping
Trusted
Untrusted

50
Q

What are 4 critical features of DHCP snooping configuration?

A

Trusted ports
Untrusted ports, server messages
Untrusted ports, client messages
Rate limiting

51
Q

What would be the commands to:

Enable DHCP snooping
Trust DHCP messages on Fa0/1
Limit the rate of DHCP messages to 6 on ports fa0/5 - 24
Enable DHCP snooping on VLAN 5,10,50,51,52

A

ip dhcp snooping

int fa0/1
ip dhcp snooping trust
exit

int range fa0/5 - 24
ip dhcp snooping limit rate 6
exit

ip dhcp snooping vlan 5,10,50-52

52
Q

On Ethernet LANs, hosts are allowed to send unsolicited ARP replies known as what?

A

Gratuitous ARP message

53
Q

Dynamic ARP inspection (DAI) requires what other feature to be enabled to work?

A

DHCP snooping

54
Q

What 3 ways could you mitigate the chances of ARP spoofing and ARP poisoning?

A

Enable DHCP snooping
Enable DAI on selected VLANs
Configure trusted interfaces for DHCP snooping and ARP inspection

55
Q

What commands would you use to enable DAI configuration for VLAN 10 while trusting int fa0/24?

A

ip dhcp snooping
ip dhcp snooping vlan 10
ip arp inspection vlan 10

int fa0/24
ip dhcp snooping trust
ip arp inspection trust

31 Days to CCNA (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions