Security

Question 1

Which feature of an NGFW is designed to protect the network against malware infections?
NGIPS
SPI
AVC
AMP

Answer 1

AMP (Advanced Malware Protection). Uses set of signatures to verify file transfers and block malware infections before they reach end devices.

Question 2

Which two devices are deployed inline to actively prevent attacks?

Answer 2

Firewall

IPS

Question 3

What format other than the default ASCII can be used when configuring a WPA2 PSK in the Cisco Wireless LAN Controller GUI?
Base64
Hexadecimal
Decimal
Binary

Answer 3

Hexadecimal

Question 4

In a wireless network protected by WPA3, which algorithm is used to check the integrity of a message?
SHA
GMAC
CBC-MAC
AES

Answer 4

GMAC (Galois Message Authentication Code) used for Integrity

AES used for encryption

Question 5

Gratuitous ARP messages can be exploited to make which two kinds of attacks?
Eavesdropping
Reconnaissance Attack
Spoofing Attack
DDoS
DoS
Amplification Attack

Answer 5

Eavesdropping

Spoofing Attack

Question 6

Which two combinations of authentication methods are considered MFA?
PIN and Password
PIN and Smart card
Fingerprint and retina
Password and fingerprint
Username and password

Answer 6

PIN and smart card

Password and fingerprint

Question 7

What is the main security reason behind deprecating the wireless TKIP standard?

Answer 7

Using RC4

RC4 is a legacy cipher that is susceptible to offline and dictionary attacks.

Question 8

What will be the result of installing an IPS sensor using the promiscuous mode?

Answer 8

The sensor receives a copy of the traffic only.

Promiscuous Mode = Makes IPS into an IDS and only alerts the administrator
In-Line Mode = Allows IPS to analyze traffic and actively block attacks.

Question 9

A network has experienced a number of MitM attacks. Which three mitigation techniques could be used to secure the network?

Answer 9

Encryption
User Training
DAI

Question 10

Match an AAA concept with its basic usage.
Authentication
Authorization
Accounting

Answer 10

Authentication: Network access is granted or denied
Authorization: A dedicated VLAN is assigned
Accounting: Sessions are recorded

Question 11

Which set of commands should be used to enable DHCP snooping on a switch.

Answer 11

ip dhcp snooping
ip dhcp snooping vlan
interface fa/g
ip dhcp snooping trust