CCNA Security v2.0 Certification Practice Test Online

During the AAA process, when will authorization be implemented?

What is the primary function of the Diffie-Hellman algorithm?

When configuring SSH on a router to implement secure network management, a network engineer has issued the login local and transport input ssh line vty commands. What three additional configuration actions have to be performed to complete the SSH configuration? (Choose three.)

Which functionality does ​the TACACS single-connection keyword provide to AAA services?

In what situation would a network administrator most likely implement root guard?

What type of algorithms require sender and receiver to exchange a secret key that is used to ensure the confidentiality of messages?

A network administrator is configuring an AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication? (Choose two.)

What is a characteristic of a role-based CLI view of router configuration?

What service or protocol does the Secure Copy Protocol rely on to ensure that secure copy transfers are from authorized users?

Which three functions are provided under Cisco NAC framework solution? (Choose three.)

A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication? (Choose two.)

What is the next step in the establishment of an IPsec VPN after IKE Phase 1 is complete?

A security technician uses an asymmetric algorithm to encrypt messages with a private key and then forwards that data to another technician. What key must be used to decrypt this data?

Which IPS signature trigger type is based on a defined profile of normal network activity?

Which condition describes a true positive IPS signature alarm?

In the implementation of secure network management, what are two services or functions of the management plane of a Cisco router that should be configured? (Choose two.)

Which two characteristics describe a virus? (Choose two.)

Which network attack is mitigated by enabling BPDU guard?

When is a security association (SA) created if an IPsec VPN tunnel is used to connect between two sites?

How is asymmetric encryption used to provide confidentiality for VPN traffic?

Which AAA component can be established using token cards?

In the implementation of network security, how does the deployment of a Cisco ASA firewall differ from a Cisco IOS router?

What function is performed by the class maps configuration object in the Cisco modular policy framework?

In the implementation of security on multiple devices, how do ASA ACLs differ from Cisco IOS ACLs?

In configuring a Cisco router to prepare for IPS and VPN features, a network administrator opens the file realm-cisco.pub.key.txt, and copies and pastes the contents to the router at the global configuration prompt. What is the result after this configuration step?

When dynamic NAT on an ASA is being configured, what two parameters must be specified by network objects? (Choose two.)

A system analyst is configuring and tuning a recently deployed IPS appliance. By examining the IPS alarm log, the analyst notices that the IPS does not generate alarms for a few known attack packets. Which term describes the lack of alarms by the IPS?

An administrator is comparing multiple implementations of AAA. Which AAA method is server-based and considered the most secure?

What can be implemented to help mitigate the threat of a rogue switch becoming the root bridge in an STP domain?

Consider the following configuration on a Cisco ASA: crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac What is the purpose of this command?

What is negotiated in the establishment of an IPsec tunnel between two IPsec hosts during IKE Phase 1?

Which type of IPS signature alarm occurs from normal traffic that should not have triggered an alarm?

Which two options provide secure remote access to a router? (Choose two.)

What action can a network administrator take to help mitigate the threat of VLAN hopping attacks?

What type of data does the DLP feature of Cisco Email Security Appliance scan in order to prevent customer data from being leaked outside of the company?

A security specialist configures an IPS so that it will generate an alert when an attack is first detected. Alerts for the subsequent detection of the same attack are suppressed for a pre-defined period of time. Another alert will be generated at the end of the period indicating the number of the attack detected. Which IPS alert monitoring mechanism is configured?

Which transform set provides the best protection?

A syslog server has received the message shown. *Mar 1 00:07:18.783: %SYS-5-CONFIG_I: Configured from console by vty0 (172.16.45.1) What can be determined from the syslog message?

What are three attributes of IPS signatures? (Choose three.)

What mitigation plan is best for thwarting a DoS attack that is creating a switch buffer overflow?

An administrator assigned a level of router access to the user ADMIN using the commands below.

Router(config)# privilege exec level 14 show ip route
Router(config)# enable algorithm-type scrypt secret level 14 cisco-level-10
Router(config)# username ADMIN privilege 14 algorithm-type scrypt secret cisco-level-10

Which two actions are permitted to the user ADMIN? (Choose two.)​

What is an effective deployment of IPS and IDS appliances in a corporate network?

Which antispoofing technology is used to mitigate DoS attacks?

What mitigation method is effective against CAM table overflow attacks?

A network administrator notices that unsuccessful login attempts have caused a router to enter quiet mode. How can the administrator maintain remote access to the networks even during quiet mode?

Which statement describes the function of the SPAN tool used in a Cisco switch?

What function is provided by the Cisco IOS Resilient Configuration feature?

What does the TACACS+ protocol provide in a AAA deployment?

Which two UDP port numbers may be used for server-based AAA RADIUS authentication? (Choose two.)

Which two options can limit the information discovered from port scanning? (Choose two.)

What function is provided by the RADIUS protocol?

What is the role of the Cisco NAC Agent in implementing a secure networking infrastructure?

What level of syslog is associated with Log_Alert?

Refer to the exhibit. Based on the security levels of the interfaces on ASA1, what traffic will be allowed on the interfaces?

Refer to the exhibit. An administrator issues these IOS login enhancement commands to increase the security for login connections. What can be concluded about them?

What are two diffrences between an ASA 5505 and an ASA 5506-X with FirePower Device? (Choose two)

A network analyst needs to reset an ASA 5506-X device to its defualt as-shipped state after the next reboot. What is the minimun length of time the RESET pin should be pressed to take the this effect?