Network Security (Version1.0) Practice Final Test Online

Hint

ASA standard ACLs are used to identify the destination IP addresses, unlike IOS ACLs where a standard ACL identifies the source host/network. They are typically only used for OSPF routes and can be used in a route map for OSPF redistribution. Standard access lists cannot be applied to interfaces to control traffic.

Hint

On an ASA, both the pool of addresses that will be used as inside global address and the range of internal private addresses that should be translated are configured through network objects.

Hint

Many applications use the X.509 standard format of digital certificates to authenticate websites, public key distribution, and end devices connected to switch ports. User email agents use the S/MIME protocol to support email protection. S/MIME uses X.509 certificates.

Hint

WANs span a wide area and commonly have connections from a main site to remote sites including a branch office, regional site, SOHO sites, and mobile workers. WANs typically connect over a public internet connection. Each site commonly has a firewall and VPNs used by remote workers between sites.

Hint

The CA class number determines how rigorous the procedure was that verified the identity of the holder when the certificate was issued. The higher the class number, the more trusted the certificate. Class numbers range from 0 to 5. A class 5 certificate is the most trusted, and class 0 the least trusted. Class 5 is used for private organizations or government security.

Hint

The type of end user interaction required to launch a virus is typically opening an application, opening a web page, or powering on the computer. Once activated, a virus may infect other files located on the computer or other computers on the same network.

Hint

The service password-encryption command encrypts plaintext passwords in the configuration file so that they cannot be viewed by unauthorized users.

Hint

SSH provides secure access to a network device for remote management. It uses a stronger password authorization than Telnet does and encrypts any data that is transported during the session.

Hint

When the username name privilege 10 command is issued, access to commands with a privilege level of 10 or less (0-10) is permitted to the user.

Hint

The Secure Copy (SCP) feature provides a secure and authenticated method for copying and saving router configuration files by using SSH.

Hint

The severity level is used to provide an explanation for the event or error that is occurring within the Cisco IOS. The smaller the number of the severity level, the more critical the event. A Syslog message with a level 5 is considered a notification message.

Hint

Routers that will serve as NTP masters must be configured with the ntp master command. A client is configured with the ntp server command so that the client can locate the NTP master. The ntp broadcast client command allows NTP to use to broadcast messages. The clock set command is used to set the time on a router.

Hint

Accounting records what users do and when they do it, including what is accessed, the amount of time the resource is accessed, and any changes that were made. Accounting keeps track of how network resources are used.

Hint

There are three types of Role-based CLI views:

1. root view
2. CLI view
3. superview

Hint

To configure OSPF MD5 authentication globally, the ip ospf message-digest-key key md5 password interface configuration command and the area area-id authentication message-digest router configuration command are issued. To configure OSPF MD5 authentication per interface, the ip ospf message-digest-key key md5 password interface configuration command and the ip ospf authentication message-digest interface configuration command are issued. Authentication does not encrypt OSPF routing updates. The requirements to establish OSPF router neighbor adjacencies are separate from authentication.​

Hint

The use of the local-case keyword means that the authentication is case-sensitive. It does not enable or apply the AAA configuration to router interfaces or lines.​

Hint

RADIUS authentication supports the following features:

• RADIUS authentication and authorization as one process
• Encrypts only the password
• Utilizes UDP
• Supports remote-access technologies, 802.1X, and Session Initiation Protocol (SIP)

Hint

The lt and gt keywords are used for defining a range of port numbers that are less than a particular port number or greater than a particular port number.

Hint

One of the major differences between IPv6 and IPv4 ACLs are two implicit permit statements at the end of any IPv6 ACL. These two permit statements allow neighbor discovery operations to function on the router interface.

Hint

The ACL configuration guidelines recommend placing extended access control lists as close to the source of network traffic as possible and placing standard access control lists as close to the destination of network traffic as possible.

Hint

Packet filtering firewalls can always filter Layer 3 content and sometimes TCP and UDP-based content. Stateful firewalls monitor connections and thus have to be able to support up to the session layer of the OSI model.

Hint

The advanced threat control and containment services of an ASA firewall are provided by integrating special hardware modules with the ASA architecture. These special modules include:

• Advanced Inspection and Prevention (AIP) module – supports advanced IPS capability.
• Content Security and Control (CSC) module – supports antimalware capabilities.
• Cisco Advanced Inspection and Prevention Security Services Module (AIP-SSM) and Cisco Advanced Inspection and Prevention Security Services Card (AIP-SSC) – support protection against tens of thousands of known exploits.

Hint

The Cisco ASA assigns security levels to distinguish among different networks it connects. Security levels define the level of trustworthiness of an interface. The higher the level, the more trusted the interface. The security level numbers range between 0 (untrustworthy) to 100 (very trustworthy). Therefore, the interface connecting to the Internet should be assigned the lowest level. The interface connecting to the internal network should be assigned the highest level. The interface connecting to the DMZ network should be assigned a level between them.

Hint

There are several advantages of using a packet filtering firewall:

• ​allows for implementing simple permit or deny rule sets.
• has a low impact on network performance
• is easy to implement, and is supported by most routers
• provides an initial degree of security at the network layer
• performs almost all the tasks of a high-end firewall at a much lower cost

Hint

A stateless firewall uses a simple policy table look-up that filters traffic based on specific criteria. These firewalls are usually part of a router firewall. They permit or deny traffic based on Layer 3 and Layer 4 information.

Hint

Most traffic within an organization originates from a private IP address. The amount of inspection done to that traffic depends on its destination or whether traffic that is going to that private IP address originated the connection. The demilitarized zone typically holds servers. Traffic that is destined to those servers is filtered based on what services are being provided by the server (HTTP, HTTPS, DNS, etc.).

Hint

There are several benefits of a ZPF:

• It is not dependent on ACLs.
• The router security posture is to block unless explicitly allowed.
• Policies are easy to read and troubleshoot. This provides scalability because one policy affects any given traffic, instead of needing multiple ACLs and inspection actions for different types of traffic.
• Virtual and physical interfaces can be grouped into zones.
• Policies are applied to unidirectional traffic between zones.
• Both IOS Classic Firewalls and ZPFs can be enabled concurrently on a Cisco router.
• However, the models cannot be combined on a single interface

Hint

The steps for configuring zones in a Zone-Based Policy Firewall are as follows:

• Step 1. Determine the zones.
• Step 2. Establish policies between zones.
• Step 3. Design the physical infrastructure.
• Step 4. Identify subsets within zones and merge traffic requirements.​

Hint

Both the IDS and the IPS are deployed as sensors and use signatures to detect malicious traffic. The IDS analyzes copies of network traffic, which results in minimal impact on network performance. The IDS also relies on an IPS to stop malicious traffic. ​​

Hint

The three actions that can be applied are inspect, drop,and pass.​

• Inspect – This action offers state-based traffic control.
• Drop – This is the default action for all traffic. Similar to the implicit deny any at the end of every ACL, there is an explicit drop applied by the IOS to the end of every policy map.
• Pass – This action allows the router to forward traffic from one zone to another.

Hint

There are two types of IPS signatures:

• Atomic – This is the simplest type of signature because it does not require the IPS to maintain state information and it can identify an attack with a single packet, activity, or event.
• Composite – This is a stateful type of signature. It requires that the IPS maintain state information to match an attack signature.

Hint

Storage devices can be encrypted to protect data from unauthorized access. Windows BitLocker provides drive encryption.

Hint

Encapsulation of EAP data between the authenticator and the authentication server is performed using RADIUS.

Hint

802.1X prevents unauthorized devices from gaining access to the network. The authentication port-control auto command turns on 802.1X access control. Until the client is authenticated, 802.1X only allows Extensible Authentication Protocol over LAN (EAPOL), Cisco Discovery Protocol (CDP), and Spanning Tree Protocol (STP) traffic to pass through the port. EAPOL messages are sent between the client and the authenticator such as a switch. If authentication is successful, normal traffic can be sent and received through the port.

Hint

Error-disabled mode is a way for a switch to automatically shut down a port that is causing problems, and usually requires manual intervention from an administrator to restore the port. When port security is configured to use the shutdown violation mode, it will put the port into the error-disabled mode when the maximum number of MAC addresses is exceeded. Likewise, BPDU guard will put the port into error-disabled mode if a BPDU arrives on a PortFast enabled interface. Storm control will only put the port into the error-disabled mode when configured with the shutdown option. The trap option will simply create an SNMP log message.

Hint

Mitigating a VLAN hopping attack can be done by disabling Dynamic Trunking Protocol (DTP), manually setting ports to trunking mode, and by setting the native VLAN of trunk links to VLANs not in use.

Hint

DAI can be configured to check for destination MAC, source MAC, and IP addresses. However, only one ip arp inspection validate command can be configured. Entering multiple ip arp inspection validate commands overwrites the previous command.

Hint

MD5 and SHA are hash-generating algorithms that guarantee that no one intercepted the message and altered it. Advanced Encryption Standard (AES) is a popular symmetric encryption algorithm where each communicating party needs to know the pre-shared key. Public key infrastructure (PKI) is an asymmetric encryption algorithm based on the assumption that the two communicating parties have not previously shared a secret key. HMAC is a hash message authentication code that guarantees that the message is not a forgery and actually comes from the authentic source.

Hint

The Enigma machine was an electromechanical encryption device that created the Enigma cipher and was developed during World War II. The device depended on the distribution of pre-shared keys that were used to encrypt and decrypt messages.

Hint

Frequency analysis uses the fact that some characters in the English alphabet are used more often than others. The letters E, T, and A are the most popular letters and J, Q, X, and Z are the least popular.

Hint

Weak keys, whether part of an existing encryption algorithm or manually generated, reveal regularities in encryption. This creates a shortcut by which a hacker can break the encryption. DES has four keys for which encryption is identical to decryption.

Hint

Because this is a service object group, the keyword should indicate which protocol is used. The options are tcp, udp, tcp-udp, icmp, and icmpv6. The subsequent commands indicate that the services in the group are WWW, FTP, and SMTP. Because all of these protocols use TCP, the keyword in the service object group should be tcp .

Hint

The differences between ASA devices and Cisco IOS routers include the following:

• An ASA device configured with ACLs is configured with a subnet mask.
• An ASA device supports interface security levels.
• An ASA device configured with an ACL is always named.
• ASA devices and Cisco IOS routers are similar in that they both support an implicit deny within an ACL.

Hint

The nat (inside,outside) dynamic interface command indicates that inside hosts are overloading the outside address of the mapped interface.

Hint

There are many tests that are used by security specialists to assess the status of a system. They include the following:

• penetration testing to determine the feasibility of attacks
• network scanning to scan for and identify open TCP ports
• integrity checking to check for changes that have occurred in the system
• vulnerability scanning to detect potential weaknesses in systems

Hint

Nmap is a low-level network scanner that is available to the public and that has the ability to perform port scanning, to identify open TCP and UDP ports, and which can also perform system identification. It can also be used to identify Layer 3 protocols that are running on a system. Zenmap is the GUI version of Nmap.

Hint

Jailbreaking is a term used when breaking into an Apple iOS device, whereas rooting is the term used for doing the same to an Android device. Both must be concerns in the corporate environment where so many people bring their own devices and access the corporate networks.

Hint

A benefit of VPNs is scalability because organizations can use the Internet and easily add new users without adding significant infrastructure. Security is provided by using encryption and authentication protocols to protect data. Another benefit is compatibility because VPNs can be implemented across a wide variety of WAN connections. Organizations also benefit from cost savings because VPNs reduce connectivity costs while simultaneously increasing remote connection bandwidth.

Hint

Asymmetric algorithms can use very long key lengths in order to avoid being hacked. This results in the use of significantly increased resources and time compared to symmetric algorithms.

Hint

Digital signatures provide assurance of the authenticity and integrity of software codes. They provide the ability to trust code that is downloaded from the Internet.

Hint

A digital certificate class is identified by a number. The higher the number, the more trusted the certificate. The classes include the following:Class 0 is for testing purposes in which no checks have been performed.

• Class 1 is for individuals with a focus on verification of email.
• Class 2 is for organizations for which proof of identity is required.
• Class 3 is for servers and software signing for which independent verification and checking of identity and authority is done by the issuing certificate authority.
• Class 4 is for online business transactions between companies.
• Class 5 is for private organizations or governmental security.

Hint

The x.509 standard is for a PKI infrastructure and x.500 if for directory structures.​

Hint

Remote access VPNs are designed to provide for the needs of telecommuters and mobile users through the use of software that is installed on the client to encrypt and encapsulate the data. Remote access VPNs can be used across a variety of WAN connections. Users must access the client software to initiate the VPN connection.

Hint

The IPsec framework uses various protocols and algorithms to provide data confidentiality, data integrity, authentication, and secure key exchange. Two popular algorithms used to ensure that data is not intercepted and modified (data integrity and authenticity) are MD5 and SHA.

Hint

A crypto ACL can define “interesting traffic” that is used to build a VPN, and forward that “interesting traffic” across the VPN to another VPN-enabled router. Multiple crypto ACLs are used to define multiple different types of traffic and utilize different IPsec protection corresponding to the different types of traffic.

Hint

ASA protects Network/Zone C (Inside) from unauthorized access by users on a Network/Zone B (Outside). It also denies traffic from Network/Zone A (DMZ) to access the Network/Zone C (Inside).

Hint

A network tap is used to capture traffic for monitoring the network. The tap is typically a passive splitting device implemented inline on the network and forwards all traffic including physical layer errors to an analysis device. SPAN is a port mirroring technology supported on Cisco switches that enables the switch to copy frames and forward them to an analysis device.

Hint

Snort is the IPS detection and enforcement engine that is included in the SEC license for 4000 Series ISRs.