Module 21 Flashcards by Michelle Korsah

What are examples of the ASA command line interface being similar to the router IOS?

-Command prompts are similar
-Supports abbreviation of commands and keywords
-Use of the Tab key to complete a partial command
-Use of the help key (?) after a command to view more syntax

How well did you know this?

Not at all

Perfectly

The ASA 5506-X with FIREPOWER Services ships with a default config that is sometimes sufficient for?

Basic SOHO deployment

How well did you know this?

Not at all

Perfectly

What are different ways config changes can be made with ASAs?

-Manually using CLI
-Interactively using CLI Setup Initialization wizard
-Using the Adaptive Security Device Manager (ASDM) setup wizard

How well did you know this?

Not at all

Perfectly

How can an ASA be restored to its factory default global config mode command?

By using the configure factory-default global config mode command

How well did you know this?

Not at all

Perfectly

What is the privileged EXEC password automatically configured with?

MD5

How well did you know this?

Not at all

Perfectly

What must happen in order for a stronger encryption using AES to be enabled?

A primary passphrase must e configured and AES encryption must be enabled

How well did you know this?

Not at all

Perfectly

What command is used to change the primary passphrase?

key config-key password-encryption

How well did you know this?

Not at all

Perfectly

What is the G1/1 interface frequently configured as on the ASA?

The outside interface to the ISP

How well did you know this?

Not at all

Perfectly

What are the basic configurations of interfaces on the ASA?

IP addressing, naming, and setting the security level

How well did you know this?

Not at all

Perfectly

What is a BVI (bridged virtual interfaces)?

Interfaces grouped together

How well did you know this?

Not at all

Perfectly

What can you do with a BVI?

You can configure it with a single name and IP address

How well did you know this?

Not at all

Perfectly

Do you still need to configure other settings on individual interfaces in a BVI?

Yes

How well did you know this?

Not at all

Perfectly

What are ways interfaces can be configured with addresses?

Manually, by DHCP, or over PPPoE

How well did you know this?

Not at all

Perfectly

What happens when an interface is configured with DHCP on an ASA?

A default route from an upstream device can automatically be configured

How well did you know this?

Not at all

Perfectly

When must a default route be manually configured on an ASA?

If DHCP is not configured

How well did you know this?

Not at all

Perfectly

What connections can ASA be configured to accept for remote management on an ASA?

Connections over Telnet or SSH

How well did you know this?

Not at all

Perfectly

What are objects?

reusable components for use in configuration

How well did you know this?

Not at all

Perfectly

How are objects used?

They make it easy to maintain configurations in the place of inline IP addresses, services, names, and so on

How well did you know this?

Not at all

Perfectly

How do objects make it easy to maintain configurations?

It can be modified in one place and the change will be reflected in all other places that are referencing it

How well did you know this?

Not at all

Perfectly

What are the two types of objects?

Network objects and service objects

What do network objects include?

-Host addresses
-Subnets
-Ranges of addresses
-FQDNs (fully qualified domain name)

What do service objects refer to?

Different network services and protocols

What are object groups?

Collection of objects that are related

Where can network objects groups be used?

In configurations including ACLs and NAT

What are the five types of objects groups?

Network User Service ICMP-Type Security

How many values can objects hold?

One

How many values can object groups hold?

Multiple values, including in-line values as well as previously created objects

How do ACLs control access in a network?

By preventing defined traffic from entering or exiting

How do ASA ACLs different from IOS ACLs?

They use network masks rather than wildcard masks

What are the five types of ACLs?

-Extended access list -Standard access list -EtherType access list -Webtype access list -IPv6 access list

All ASA ACLs are named. (T/F)

True

How can ASA ACLs be used with object groups?

They can be used to limit the number of ACEs that are required in a list

What are the three types of deployment methods?

-Inside NAT -Outside NAT -Bidirectional NAT

What is inside NAT used for?

For translating inside addresses on secure networks to outside addresses on less secure networks

What is outside NAT?

traffic from a lower security network is translated for a higher security network

What is outside NAT used for?

To make internal enterprise hosts available to outside users

What is Bidirectional NAT?

Inside and outside NAT together

What are the four types of NAT that ASA supports?

-Dynamic NAT with overload -Static NAT -Policy NAT -Identity NAT

What must be used to configure NAT?

Network objects

What do ASA device not support without using AAA?

Local authentication

Cisco ASAs can be configured to authenticate access using..?

Local user database or an external server for authentication or both

What does Server-based AAA authentication use?

AN external database server by leveraging the Radius or TACACS+ protocols

What does MPF configuration (Modular Policy Framework) do?

defines a set of rules for applying firewall features such as traffic inspection and QoS, to the traffic that traverses the ASA

MPF allows..

detailed classification of traffic flows to apply different advanced policies to different flows

What are class maps used for?

To identify traffic that will be processed by MPF

What do Policy maps do?

They define what will be done to the identified traffic

What do Service policies do?

They identify which interfaces the policy map should be applied to

What layers does the ASA support

Layer 5 to Layer 7

How might the ASA MPF feature be used?

To match HTTP URLs and request methods, prevent users from surfing to specific sites during specific times, or prevent users from downloading music and video files via HTTP/FTP or HTTPS/SFTP