DECK Flashcards
What is the attack vector used in a phishing attack?
A. Email
B. Phone
C. LAN
D. Modem
A. Email
A phishing attack is an email-based attack in which an email is sent to a user in hopes of convincing him to click in a link to a web site, which will appear to be a web site the user trusts. When the user logs into the fake site, the hacker collects his login credentials.
Some other common social engineering attacks are:
- Should surfing - watching someone when they enter sensitive data.
- Tailgating - following someone through a door unlocked with someone else’s credentials.
- Vishing - a special type of phishing that uses VoIP.
- Whaling - a special type of phishing that targets a single power user.
Which of the following instances of malware was deliberately deployed against critical IT targets? A. Hearbleed B. Flame C. Melissa D. Michelangelo
B. Flame
Both the Flame and Stuxnet viruses are examples of cyber warfare, supposedly a part of the US cyberattack strategy codenamed Olympic Games. Discovered in 2012, Flame is a scanning and capture malware deployed across computers in the Middle East. Stuxnet was a coordinated mulit-zero-day Windows exploit, is believed to have been used to degrade the nuclear program of Iran in 2010.
Heartbleed attacks web sites using TLS security, and is otherwise known as the OpenSSL heartbeat extension vulnerability.
Melissa was a mass-mailing macro virus that originated in Microsoft Word and spread through the victim?s Outlook address book.
Michelangelo was a boot sector virus that launched annually on March 6. None of these attacks was targeted at a state or country?s critical military infrastructure, so they are not considered cyber warfare.
Threat mitigation is a security control that best supports which of the following? A. Defense in depth B. Least privilege C. Need to know D. Dual control
A. Defense in depth
Defense in depth is a concept that prescribes the application of layers of security controls. One of those is performing threat mitigation, which reduces the attack surface of the organization.
Least privilege is a concept that should drive the granting of permissions and privileges. It calls for only granting the minimum privileges for the user to get his job done. It is not supported by threat mitigation.
Need to know is a concept that prescribes that information should only be revealed to those who need to know the information to do their job. It is not supported by threat mitigation.
Dual control is one application of the separation of duties concept, which calls for multiple users to be present to perform sensitive operations. It is not supported by threat mitigation.
Which of the following provides business partners with secure access to your network? A. DMZ B. Extranet C. Intranet D. Stuxnet
B. Extranet
An extranet is a logical portion of your network to which you allow access to other companies, vendors, or customers. You would place resources for these groups access in your extranet. An extranet is created for the purpose of hosting resources for a specific group of outsiders, such as business partners or high-end clients. Access to an extranet is typically controlled by use of a VPN.
A demilitarized zone (DMZ) is a logical portion of the network that contains publically accessible computers. That means it should contain no sensitive information and should be securely separated from the extranet and the intranet. Firewalls are used to protect local networks and create demilitarized zones (DMZs).
The intranet is the interior part of your network to which only authorized employees should have access. An intranet is a local area network (LAN) add-on that is restricted to certain users, usually a company’s employees. The data contained on it is usually private in nature. An extranet, on the other hand, has a wider boundary because it usually allows two or more companies to communicate and share private information.
Stuxnet is a computer virus and is not a type of network.
Which statement is true of symmetric key algorithms?
A. They are slower than asymmetric key
B. They use different keys on each end
C. They use the same key on both ends
D. They are typically used for key exchange
C. They use the same key on both ends
Symmetric key algorithms use the same key on both ends to encrypt and decrypt.
Symmetric key algorithms are not slower. They are actually faster than asymmetric algorithms.
Symmetric algorithms do not use different keys on each end. That is a characteristic of asymmetric algorithms.
Symmetric algorithms are not used for key exchange; they are used to encrypt data. Asymmetric algorithms are used for key exchange. In asymmetric encryption, which is sometimes referred to as public key encryption, a user creates a public key and a private key pair. The user distributes the public key and retains the private key. Another user can then use the distributed public key to encrypt a file before sending that file to the owner of the private key. The owner then uses the private key to decrypt the received file.
Which of the following is NOT a cloud service model? A. SaaS B. IaaS C. PaaS D. GaaS
D. GaaS
There is no cloud service model that uses the acronym GaaS.
Software as a Service (SaaS) is a model that delivers an entire solution including the infrastructure, platform, and the application.
Infrastructure as a Service (IaaS) is a model that delivers only the hardware and access to the hardware to the customer. The customer is responsible for managing applications, data, runtime, middleware, and OSes.
Platform as a Service is a model that delivers the hardware and software required to use the platform as a development environment.
What command could you use to determine if a read-only string was used to attempt a write operation? A. show snmp host B. show snmp community C. show snmp location D. show snmp
D. show snmp
The show snmp command can be used. Below is a partial output of the command:
Router# show snmp
Chassis: 12161083
0 SNMP packets input
0 Bad SNMP version errors 0 Unknown community name 5 Illegal operation for community name supplied 0 Encoding errors 0 Number of requested variables 0 Number of altered variables 0 Get-request PDUs 0 Get-next PDUs 0 Set-request PDUs 0 Input queue packet drops (Maximum queue size 1000)
0 SNMP packets output
0 Too big errors (Maximum packet size 1500) 0 No such name errors 0 Bad values errors 0 General errors 0 Response PDUs 0 Trap PDUs
In the above output, you would look at the only the line with a value of 5 (Illegal operation for community name supplied) to find this information.
The show snmp host command displays details such as IP address of the Network Management System (NMS), notification type, SNMP version, and the port number of the NMS. It does not show illegal operations related to the community string.
The show snmp location command displays the snmp-server location. It does not show illegal operations related to the community string.
The show snmp community displays the Simple Network Management Protocol (SNMP) community access strings. It does not show illegal operations related to the community string.
Examine the following output:
Router > show clock detail
15:29:03.158 PST Mon Mar 3 2015
Time source is NTP
Which of the following statements is true?
A. The time is user configured
B. The time is authoritative and the time source is NTP
C. The time source is not authoritative
D. The time source is a hardware clock
B. The time is authoritative and the time source is NTP
The output indicates the time source is authoritative and the time source is an NTP server. The time source will be listed in the output (in this case NTP) and the area to the left of the listed time will indicate one of three conditions:
Time is not authoritative. ( *)
Time is authoritative. ( Blank)
Time is authoritative, but NTP is not synchronized ( .)
In this case, there is nothing to the left of the time or it is blank, which includes the time is authoritative.
The output does not indicate that the time source is user configured. If that were the case, it would be listed as below, stating this fact.
Router > show clock detail
*15:29:03.158 PST Mon Mar 3 2015
Time source is user configured
The output does not indicate that the time source is not authoritative. If that were the case, it would be listed as below with an asterisk before the time, indicating the time is not authoritative.
Router > show clock detail
*15:29:03.158 PST Mon Mar 3 2015
Time source is NTP
The output does not indicate that the time source is a hardware clock. If that were the case, it would be listed as below, stating this fact.
Router > show clock detail
*15:29:03.158 PST Mon Mar 3 2015
Time source is hardware calendar
.
Which task can be completed on the AAA Summary page of CCP?
A. Create AAA server groups
B. Create policies to control authentication
C. Configure AAA servers
D. Enable AAA
D. Enable AAA
The only listed task that can be performed on this page is to enable AAA. In the screenshot below you can see it has the Enable AAA button.
See screen shot CCP_aaa-enable-1.jpg
Which statement is FALSE with regard to the Cisco ACS?
A. ACS servers can be clustered
B. ACS servers cannot support multiple Active Directory forests
C. ACS can use multiple authorization profiles to allow or deny requests
D. ACS allows for the disabling of NetBIOS
B. ACS servers cannot support multiple Active Directory forests
One of the new features of ACS for Windows 4.2 is the ability to support multiple AD forests.
ACS servers can be clustered to provide scalability.
ACS servers can use multiple profiles when allowing or denying traffic.
Another new feature of ACS 4.2 for Windows is the ability to disable NetBIOS.
Which of the following must be installed on a wireless Windows device to make remote locking of the device possible with ISE? A. NAC agent for Windows B. NAC Web Agent C. Cisco Agent Desktop D. Cisco Security Agent
A. NAC agent for Windows
The Network Access Control agent (NAC) for Windows must be installed. This agent installs and remains on the client and must be present to accept a remote wipe or remote lock.
The NAC Web Agent only provides temporal posture assessment and, as such, does not install itself on the device. Therefore, it cannot be used for this purpose.
The Cisco Agent Desktop is a computer telephony integration (CTI) solution for single- and multisite IP-based contact centers. It has nothing to do with ISE.
The Cisco Security Agent is an endpoint intrusion prevention system agent and has nothing to do with ISE.
Which of the following commands will result in maintaining a record of failed authentication attempts?
A. aaa accounting commands 15 ACCCMDS stop-only group tacacs+
B. aaa accounting commands 15 ACCCMDS start-stop group tacacs+ groups radius
C. aaa accounting commands 15 ACCCMDS none grop tacacs+ groups radius
D. aaa accounting commands 15 ACCCMDS stop group tacacs+ groups radius
A. aaa accounting commands 15 ACCCMDS stop-only group tacacs+
The only listed command that will result in the maintaining of a record of failed authentication attempts is:
aaa accounting commands 15 ACCCMDS stop-only group tacacs+
This command includes the parameter stop-only. This parameter will record the end of processes, which will include failed authentications.
The command aaa accounting commands 15 ACCCMDS start-stop group tacacs+ groups radius uses the start-stop parameter, which records the start and stop of processes. However, it only records authenticated processes, so it will not record failed authentications.
The command aaa accounting commands 15 ACCCMDS none group tacacs+ groups radius uses the parameter none, which disables accounting services on a line or interface.
The command aaa accounting commands 15 ACCCMDS stop group tacacs+ groups radius uses the parameter stop, which is not a valid parameter with the accounting command.
When EAP-FAST is deployed, what is the function of the PAC? A. Authenticates the device B. Establishes the secured tunnel C. Authenticates the user D. Performs mutual authentication
B. Establishes the secured tunnel
The Protected Access Credential (PAC) is used to establish a secure tunnel prior to the authentication process. This allows it to support the use of passwords rather than certificates, while still protecting the passwords.
The PAC is not used to authenticate either the user or the device. EAP-GTC, TLS, and MS-CHAP are supported as inner authentication EAP methods.
The PAC does not perform mutual authentication. It merely is used to establish the secure tunnel.
Your assistant configured the default ACL to apply to Access layer switches. It is intended to allow wired BYOD devices to supply valid credentials and connect to the network:
Extended IP access list ACL-DEFAULT
10 permit udp any eq bootpc any eq bootps log
20 permit udp any host 10.230.1.45 eq domain
30 permit icmp any any
50 deny ip any any log
Once implemented, how does this ACL affect wired BYOD devices?
A. It does not allow SSL, which is required.
B. It does not allow DNS, which is required.
C. It allows ICMP, which interferes with the process.
D. It does not allow TFTP, which is required.
E. It allows wired BYOD devices to connect to the network.
D. It does not allow TFTP, which is required.
This ACL will not allow TFTP, which is required. There are three protocols that, according to best practices, should be allowed in this list. They are:
BOOTP TFTP DNS
This line would add the required configuration to permit TFTP:
permit udp any any eq tftp
SSL is not required for this connection type, and so its block it will not be an issue.
DNS is required, but line 20 permits DNS as shown below:
20 permit udp any host 10.230.1.45 eq domain
Which feature is enabled with the following command?
R2(config)# same-security-traffic permit intra-interface
A. NAT
B. Hairpinning
C. Split Tunneling
D. NAT traversal
B. Hairpinning
The same-security-traffic permit intra-interface global configuration command enables hairpinning. In hairpinning, IPSec-protected traffic from a VPN client is sent to another VPN user by allowing such traffic in and out of the same interface.
In the ASDM, you can enable hairpinning on the Configuration page. To do so, highlight the interface to be enabled for the feature and select the check box at the bottom of the screen that says “Enable traffic between two or more hosts connected to the same interface” as shown below: (see screen shot 210-260_2-hairpin.jpg)
The command does not enable Network Address Translation (NAT). Enabling NAT requires multiple steps, the specifics of which depend on the type of NAT to be deployed.
The command does not enable split tunneling. Split tunneling allows a VPN client to access the Internet directly without using the VPN, while using the VPN only to access specified subnets in the Intranet. It involves creating an ACL that specifies the network destinations that should use the VPN, specifying a split tunnel mode, and adding it to the policy controlling the VPN connection. On the ASDM, this is added to the policy, as shown below. In this case, there is a list named Split_Tunnel_List that specifies the only network destinations that should use the VPN. (see screen shot 210-260_3-split_tunnel.jpg)
The command does not enable NAT traversal. NAT traversal makes it possible to send IPsec traffic through a NAT interface. When NAT Traversal or NAT-T is used to allow IPsec to function in a NAT environment, IPsec traffic is encapsulated in UDP packets that are sourced from UDP port 4500. This is why part of the configuration of NAT-T is to create an ACL that allows traffic through UDP port 4500. The configuration is shown below:
ASA(config)# crypto isakmp nat-traversal
Examine the command string:
ASA(config)# group-policy sales attributes
ASA(config-group-policy)# webvpn
ASA(config-group-policy)# anyconnect keep-installer installed none
What will be the result of executing the commands?
A. All VPN users will experience a longer connection time.
B. AnyConnect VPN users under the sales policy will experience slower connection times.
C. All AnyConnect clients will have a faster connection time.
D. All VPN users will experience a shorter connection time.
B. AnyConnect VPN users under the sales policy will experience slower connection times.
With these commands executed all Anyconnect VPN users under the sales policy will experience slower connection times. This is because the anyconnect keep-installer none command prevents the permanent installation of the AnyConnect client. This means the client will be downloaded at every connection, slowing the connection time.
It will not cause all VPN users to experience a longer connection time. Only Anyconnect users that are controlled by the Sales policy will have an issue. The fact that the command was executed after entering configuration mode for the Sales policy limits it to the Sales policy, and since they executed the webvpn command as well, that restricts it to Anyconnect clients.
It will not cause all AnyConnect clients to have a faster connection time. If the setting were left at the default, the client will install permanently the first time and then subsequent connections would be faster. Moreover, this command will not affect all Anyconnect clients, but only those controlled by the Sales policy.
It will not cause all VPN users to experience a shorter connection time. For one, it only applies to all Anyconnect clients controlled by the Sales policy. Secondly, it causes connections to be slower not faster.
