Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cisco CCNP ENCOR > Security Theory > Flashcards

Security Theory Flashcards

Access Control, CoPP, AAA

1
Q

What is the name of the Cisco Security Architectural Framework?

A

Cisco SAFE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the PINs (Places In Network) where you would see Cisco SAFE deployed?

A
  • Branch
  • Campus
  • Data Center
  • Edge
  • Cloud
  • WAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the operational domains that Cisco SAFE defines?

A
  • Management
  • Security Intelligence
  • Compliance
  • Segmentation
  • Threat Defense
  • Secure Services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What three intelligence teams make up Cisco Talos?

A
  • Ironport Security Applications
  • Sourcefire Vulnerability Research Team (VRT)
  • Cisco Threat Research, Analysis, and Communications Team (TRAC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Cisco Threat Grid?

A

A complex virtual sandbox that that observes and analyzes static files for the behavior of malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Cisco AMP?

A

Advanced Malware Protection - comprehensive malware protection across the full attack continuum: Before, During, and After a breach occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the key components of the Cisco AMP architecture?

A
  • AMP Cloud
  • Threat intelligence from Talos and Threat Grid
  • AMP Connectors (Endpoints, Networks, Email, Web, Meraki)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Cisco Umbrella?

A

A Cloud-based secure DNS solution that blocks malicious Internet destinations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Cisco WSA?

A

Web Security Appliance - URL filtering, malware-block, Data Loss Prevention, Anti-Virus scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Cisco ESA?

A

Email Security Appliance - includes global threat intelligence, spam protection, reputation filtering, forged email protection, domain protection, DLP, Phishing protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is NGIPS?

A

Next Generation Intrusion Protection System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the name of Cisco’s NGIPS?

A

Firepower

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the key characteristics of any NGIPS?

A
  • Real time contextual awareness
  • Advanced threat protection
  • Intelligent security automation
  • Performance and scalability
  • Application Visibility and Control (AVC)
  • URL filtering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the key characteristics of a Next Generation Firewall (NGFW)?

A
  • Stateful packet inspection
  • Integrated IPS
  • Application level packet inspection
  • leverages external security intelligence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Cisco Stealthwatch?

A

Collector of network telemetry data that can perform security analysis on the network data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Cisco ISE?

A

Identity Services Engine - a security policy management platform that performs Network Access Control (NAC) and 802.1x functions and more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some of the key benefits to Cisco ISE?

A
  • Network Access Control
  • DNA Center integration
  • Device Access Control, onboarding, and profiling
  • Cisco TrustSec
  • Guest Lifecycle Management
  • Internal Certificate Authority
  • Endpoint posture service
  • Cisco Platform Exchange Grid (pxGrid)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is pxGrid and what role does ISE play in pxGrid?

A

Platform Exchange Grid - an IETF framework that uses a single API to exchange security information to mitigate and remediate security threats across the network. Cisco ISE acts as the pxGrid Controller (aka server).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

List the five most prolific types of Network Access Control (NAC)

A
  • 802.1X
  • Mac Address Bypass (MAB)
  • WebAuth
  • TrustSec
  • MacSec
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the four main components of 802.1x?

A
  • Extensible Authentication Protocol (EAP)
  • EAP Method aka EAP Type
  • EAP over LAN (Layer 2)
  • RADIUS protocol
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is 802.1X?

A

An IEEE Standard for authenticating devices that are trying to connect to a network. AAA, Radius, WLCs, and/or Cisco ISE are core components in an 802.1X deployment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the device roles in an 802.1x deployment?

A
  • Supplicant
  • Authenticator
  • Authentication Server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the role of a Supplicant in an 802.1x deployment?

A

The software on the endpoint that is attempting to authenticate to the network. This could be the Operating system or a Cisco AnyConnect client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the role of a Authenticator in an 802.1x deployment?

A

The network access device (NAD) such as a switch or WLC. The authenticator accepts EAP encapsulated Layer 2 frames from the supplicant and encapsulates them into RADIUS packets before sending them to the Authentication Server.

25
Q

What are the most common methods of EAP?

A
  • EAP-MD5
  • EAP-TLS
  • EAP-FAST
  • EAP-TTLS
  • PEAP
  • EAP-GTC
  • EAP-MSCHAPv2
26
Q

Describe the EAPOL 4-way handshake.

A
  • Step 1 When the authenticator notices a port coming up, it starts the authentication process by sending periodic EAP-request/identify frames. The supplicant can also initiate the authentication process by sending an EAPoL-start message to the authenticator.
  • Step 2 The authenticator relays EAP messages between the supplicant and the authentication server, copying the EAP message in the EAPoL frame to an AV-pair inside a RADIUS packet and vice versa until an EAP method is selected. Authentication then takes place using the selected EAP method.
  • Step 3 If authentication is successful, the authentication server returns a RADIUS access-accept message with an encapsulated EAP-success message as well as an authorization option such as a downloadable ACL. When this is done, the authenticator opens up the port.
27
Q

What is MAB?

A

MAC Address Bypass - typically used when 802.1X authentication is unavailable. A port can be enabled or disabled based on the MAC address of the endpoint trying to connect.

28
Q

What is WebAuth?

A

Endpoints are directed to a web page where they can use the web server to authenticate to the network.

29
Q

What are the two types of WebAuth?

A

Local Web Auth (LWA) - switch or WLC redirects endpoint to a local web server running IN the switch

Central Web Auth (CWA) using ISE

30
Q

What are dACLs, dVLAN, and SGT

A
  • downloadable Access Control List
  • dynamic VLANs
  • Security Group Tags
31
Q

What is Cisco TrustSec?

A

Next generation Access Control solution developed by Cisco based on the use of Security Group Tags (SGT).

32
Q

What are the three phases of TrustSec?

A

1.) Ingress Classification - assigning the SGT
2.) Propagation - communicates the SGT mappings through the network
3.) Egress Enforcement - enforcing the policy based on the SGT

33
Q

What are the two methods of TrustSec Propagation?

A

1.) Inline tagging - SGT tags inserted into frames
2.) SXP Propagation - TCP-based peer-to-peer protocol

34
Q

What are the two major methods of TrustSec Enforcement?

A
  • Security Group ACLs (SGACL)
  • Security Group Firewall (SGFW)
35
Q

What is MACSec?

A

An IEEE standards-based Layer 2 encryption method.

36
Q

What is the IEEE Standard designation for MACSec?

A

802.1AE

37
Q

What are the two keying methods available for MACSec?

A
  • Security Association Protocol (SAP)
  • MACSec Key Agreement (MKA) protocol
38
Q

What is the difference between Downlink MACSec and Uplink MACSec?

A
  • Downlink is between and endpoint and switch.
  • Uplink is between two switches
39
Q

What does AAA mean?

A

Authentication, Authorization and Accounting:

Authentication - login
Authorization - privilege
Accounting - logging the activity

40
Q

What is TACACS+?

A

Terminal Access Controller Access Control System: A security protocol developed by Cisco for Authentication and Authorization to a device. TACACS can give a very granular level of authorization specific to what commands a user can enter on a device.

41
Q

What is Radius?

A

An industry standard security protocol for centralized network access control (NAC) authentication.

42
Q

When referring to RADIUS, what ports does Cisco use for default compared to industry standards?

A
  • Cisco: UDP-1645 for authorization and authentication; UDP-1646 for accounting
  • Industry Standard: UDP-1812 for authentication and authorization; UDP-1813 for accounting
43
Q

Why is RADIUS typically chose over TACACS+ for AAA deployments?

A

TACACS does not support EAP

44
Q

When configuring TACACS+ in a Cisco environment, what is typically the best choice for a TACACS server?

A

Cisco ISE (2.0)

45
Q

What is ZBFW?

A

Zone Based Firewall - an integrated stateful firewall now included on IOS.

46
Q

What are the two “automatic” zones used in ZBFW?

A
  • Self-Zone
  • Default Zone
47
Q

What is the command to verify ZBFW zone configurations on a Cisco router?

A

show policy-map type inspect zone-pair PAIR_NAME

48
Q

What is the Windows Server role that allows a domain controller to be used as a RADIUS server?

A

Network Policy and Access Services

49
Q

When configuring privilege levels for a user account, what do the built-in privilege levels 0, 1, and 15 mean?

A

0 - only allows five commands: logout, enable, disable, help and exit.
1 - read only and “ping”
15 - full access to all commands

50
Q

When configuring privilege levels for a user account, what do levels 2 through 14 do?

A

Privilege 2 through 14 are custom configurable levels. In theory the higher levels would have more access but this depends on what was configured.

51
Q

What is CoPP?

A

Control Plane Policing - the concept of controlling what and how much traffic is handled by a routing device’s CPU so it does not get overloaded. (and DDoS prevention)

52
Q

What is MQC?

A

Modular Quality of Service Command Line Interface - the basic structure of QoS configuration from the command line. This model fits well for CoPP.

53
Q

What is Cisco EPC?

A

Embedded Packet Capture

54
Q

What are the general steps to create a CoPP policy on a Cisco device?

A

1.) Create ACLs to match traffic for treatment. Note: some traffic like ICMP may want to be allowed but rate limited
2.) Create class-maps to match on all the ACLs
3.) Create policy maps to police/treat the traffic
4.) Apply the policy map to the control-plane

55
Q

In wireless security, what is PSK?

A

Pre-Shared Key - essentially it is like a password that an endpoint device will use to gain access to an SSID over a wireless AP

56
Q

In wireless security, what is EAP?

A

Extensible Authentication Protocol - a set of protocols and functions that leverage backend databases, user accounts, and device IDs to authenticate an endpoint to a wireless network. This is a common 802.1X framework (supplicant, authenticator, authentication server)

57
Q

In a Wireless LAN Controller GUI, how would you go to configure a Pre-Shared Key?

A

WLANs (Node) > Create New (Go) > Set Name; SSID; ID > Apply (Button)

WLAN > NAME > Security (Tab) > Layer 2 (Tab) > Layer 2 Security > WPA + WPA2

Select Policy; Enable PSK; Set Key > Apply (Button)

58
Q

In a Wireless LAN Controller GUI, how would you go to configure EAP?

A

Security (Node) > Radius > New (Button) > Set Radius Server Details

WLAN (Node) > New (or existing) > Security (Tab) > Layer 2 (Tab) > Set WAP+WPA2; Enable 802.1X; Set AES; Set WPA2 Policy

WLAN > Security (Tab) > AAA Servers (Tab) > Set Server Defined in Step 1

59
Q

In a Wireless LAN Controller GUI, how would you go to configure Web Auth?

A

Security (Node) > (Left Navigation) Web Auth > Web Login Page: choose Internal, Custom, or External Page

WLANs > WLAN_ID > Security (Tab) > Layer 2 (Tab) > Set to None
WLANs > WLAN_ID > Security (Tab) > Layer 3 (Tab) > Layer 3 Security Set to “Web Policy”; Set options as needed {Passthrough, Authentication, etc)

NOTE: If using “Authentication” then AAA Server needs to be configured from AAA Servers (Tab)

Cisco CCNP ENCOR (27 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions