Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

210-260 > 210-260 Dump > Flashcards

210-260 Dump Flashcards

1
Q

Which three ESP fields can be encrypted during transmission?

A

Padding

Pad Length

Next Header

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What mechanism does asymmetric cryptography use to secure data?

A

a public/private key pair

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which feature allows a dynamic PAT pool to select the next address in the PAT pool instead of the next port of an existing address?

A

round robin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which label is given to a person who uses existing computer scripts to hack into computers lacking the expertise to write their own?

A

script kiddy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When Cisco IOS zone-based policy firewall is configured, which three actions can be applied to a traffic class?

A

pass

inspect

drop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which type of security control is defense-in-depth?

A

Threat mitigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which statement about a PVLAN isolated port configured on a switch is true?

A

The isolated port can communicate only with the promiscuous port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which statement about Cisco ACS authentication and authorization is true?

A

ACS servers can be clustered to provide scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

If a supplicant supplies incorrect credentials for all authentication methods configured on the switch, how will the switch respond?

A

The supplicant will fail to advance beyond the webauth method

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What configure mode you used for the command ip ospf authentication-key c1$c0?

A

interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which two features are commonly use CoPP and CPPr to protect the control plane?

A

QoS Traffic classification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is one requirement for locking a wired or wireless device from ISE?

A

The ISE agent must be installed on the device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which three statements are characteristics of DHCP Spoofing?

A

Arp Poisoning modify traffic in transit used to perform man-in-the-middle attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which statement correctly describes the function of a private VLAN?

A

a private VLAN partitions the layer 2 broadcast domain of a VLAN into subdomains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which feature allows from dynamic NAT pool to choose next IP address and not a port on a used IP address?

A

round robin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which type of encryption technology has the broadcast platform support?

A

Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When an IPS detects an attack, which action can the IPS take to prevent the attack from spreading?

A

deny the connection inline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which four tasks are required when you configure Cisco IOS IPS using the Cisco Configuration Professional IPS Wizard?

A

Select the interface to apply the IPS rule Select the traffic flow direction that should be applied by the IPS rule Specify the signature file and the Cisco public key Specify the configuration location and select the category of signatures to be applied to the selected interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An attacker installs a rogue switch that sends superior BPDUs on your network. What is a possible result of this activity?

A

The switch could become the root bridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the effect of the given command sequence?

A

It configures IKE Phase 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which 2 NAT types allows only objects or groups to reference an IP address?

A

dynamic NAT

static NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which FirePOWER preprocessor engine is used to prevent SYN attacks?

A

Rate-Based Prevention

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the advantage of implementing a Trusted Platform Module for disk encryption?

A

It provides hardware authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the Cisco preferred countermeasure to mitigate CAM overflows?

A

Dynamic port security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which security measure can protect the control plane of a Cisco router?

A

CCPr

CoPP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

All ports on switch 1 have a primary VLAN of 300. Which devices can host 1 reach?

A

Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

If a router configuration includes the line aaa authentication login default group tacacs enable, which events will occur when the tacacs server returns an error?

A

The user will be prompted to authenticate using the enable password Authentication attempts to the router will be denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What IPSec mode is used to encrypt traffic between a server and VPN endpoint?

A

Transport

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which three statements about host-based IPS are true?

A

It can view encrypted files It can have more restrictive policies than network-based IPS It can generate alerts based on behavior at the desktop level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which statement about reflexive access lists are true?

A

Reflexive access lists support UDP sessions Reflexive access lists can be attached to extended named IP ACLs Reflexive access lists support TCP sessions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Where OAKLEY and SKEME come to play

A

IKE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which command helps user1 to use enable, disable, exit & etc commands?

A

username user1 privilege 0 secret us1pass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

The admin user is unable to enter configuration mode on a device with the given configuration. What change can you make to the configuration to correct the problem?

A

Remove the autocommand keyword and arguments from the username admin privilege line

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Which network device does NTP authenticate?

A

Only the time source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

In which type of attacker attempts to overload the CAM table on a switch so that the switch acts as a hub?

A

MAC flooding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

If you change the native VLAN on the trunk port to an unused VLAN, what happens if an attacker attempts a double-tagging attack?

A

A VLAN hopping attack would be prevented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

If a switch port goes directly into a blocked state only when a superior BPDU is received, what mechanism must be in use?

A

STP BPDU guard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which statement provides the best definition of malware?

A

Malware is unwanted software that is harmful or destructive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which are two valid TCP connection states?

A

SYN-RCVD

Closed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which option is the cloud-based security service from Cisco that provides URL filtering web browsing content security, and roaming user protection?

A

Cloud web security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What type of firewall would use the given configuration line?

A

a stateful firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the effect of the ASA command crypto isakmp nat-traversal?

A

It opens port 4500 on all interfaces that are IPSec enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the effect of the given command sequence?

A

It defines IPSec policy for traffic sourced from 1.1.1.0/24 with a destination of 2.2.20/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What type of algorithm uses the same key to encrypt and decrypt data?

A

symmetric algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which type of address translation should be used when a Cisco ASA is in transparent mode?

A

Static NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

With which technology do apply integrity, confidentially, authenticate the source?

A

IPSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is true about the Cisco IOS Resilient Configuration feature?

A

The feature can be disabled through a remote session

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Which two characteristics apply to an Intrusion Prevention System (IPS)?

A

Cabled directly inline with the flow of the network traffic Can drop traffic based on a set of rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What VPN feature allows Internet traffic and local LAN/WAN traffic to use the same network connection?

A

split tunneling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What feature can protect the data plane?

A

ACLs antispoofing DHCP-snooping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What show command can see vpn tunnel establish with traffic passing through?

A

show crypto ipsec sa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the effect of the send-lifetime local 23:59:00 31 December 31 2013 infinite command?

A

It configures the device to begin transmitting the authentication key to other devices at 23:59:00 local time on December 31, 2013 and continue using the key indefinitely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What information does the key length provide in an encryption algorithm?

A

the hash block size

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Which of the following statements about access lists are true?

A

Extended access lists should be placed as near as possible to the source Standard access lists should be placed as near as possible to the destination Standard access lists filter on the source address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

In which two situations should you use in-band management?

A

when management applications need concurrent access to the device when you require administrator access from multiple locations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Which type of layer 2 attack enables the attacker to intercept traffic that is intended for one specific recipient?

A

MAC address spoofing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are the primary attack methods of VLAN hopping?

A

Switch spoofing Double tagging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What feature defines a campus area network?

A

It has a single geographic location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Which command initializes a lawful intercept view?

A

li-view cisco user cisco1 password cisco

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

When a switch has multiple links connected to a downstream switch, what is the first step that STP takes to prevent loops?

A

STP elects the root bridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

A Cisco ASA appliance has three interfaces configured. The first interface is the inside interface with a security level of 100. The second interface is the DMZ interface with a security level of 50. The third interface is the outside interface with a security level of 0. By default, without any access-list configured, which five types of traffic are permitted?

A

outbound traffic initiated from the inside to the DMZ outbound traffic initiated from the DMZ to the outside outbound traffic initiated from the inside to the outside HTTP return traffic originating from the inside network and returning via the outside interface HTTP return traffic originating from the inside network and returning via the DMZ interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Which type of Cisco ASA access list entry can be configured to match multiple entries in a single statement?

A

object groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What’s the technology that you can use to prevent non-malicious program to run on the computer that is disconnected from the network?

A

Host IPS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What are two well-known security terms?

A

Phishing ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What hash type does Cisco use to validate the integrity of downloaded images?

A

MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What are the three layers of a hierarchical network design?

A

access core distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

Which type of attack is directed against the network directly?

A

Denial of Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Your security team has discovered a malicious program that has been harvesting the CEO’s email messages and the company’s user database for the last 6 months. What type of attack did your team discover?

A

advanced persistent threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What type of security support is provided by the Open Web Application Security Project?

A

Education about common Web site vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

How to verify that tacacs connectivity to a device?

A

You connect to the device using SSH and receive the login prompt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Which three statements describe DHCP spoofing attacks?

A

They can modify traffic in transit They are used to perform man-in-the-middle attacks They use ARP poisoning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What is a potential drawback to leaving VLAN 1 as the native VLAN?

A

It may be susceptible to a VLAN hopping attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Which two actions can a zone-based firewall take when looking at traffic?

A

Drop

Inspect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

What technology can you use to provide data confidentiality, data integrity, and data origin authentication

A

IPSec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

What is the effect of the given command?

A

It merges authentication and encryption methods to traffic that matches an ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Which countermeasures can mitigate ARP spoofing attacks?

A

DHCP snooping Dynamic ARP inspection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Within an 802.1x enabled network with the Auth Fail feature configured, when does a switch port get placed into a restricted VLAN?

A

When a connected client fails to authenticate after a certain number of attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Which statement about the given configuration is true?

A

The single-connection command causes the device to establish one connection for all tacacs transactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

The first layer of defense which provides real-time preventive solutions against malicious traffic is provided by?

A

Outbreak Filters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

In which type of attack does an attacker send email messages that ask the recipient to click a link such as https://www.cisco.net.cc/securelogon?

A

phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Which two functions can SIEM provide?

A

Correlation between logs and events from multiple systems Proactive malware analysis to block malicious traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

On which Cisco Configuration Professional screen do you enable AAA?

A

AAA Summary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Which line in the following OSPF configuration will not be required for MD5 authentication to work? interface g0/1 ip address 1.1.1.1 255.255.255.0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 ccna router ospf 65000 router-id 1.1.1.1 area 20 authentication message-digest

A

area 20 authentication message-digest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

How can you detect a false negative on an IPS?

A

Use a third-party system to perform penetration testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

After reloading a router, you issue the dir command to verify the installation and observe that the image file appears to be missing. For what reason could the image file fail to appear in the dir output?

A

The secure boot-image command is configured

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

When is the best time to perform an anti-virus signature update?

A

Every time a new update is available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

In which two situations should you use out-of-band management?

A

when a network device fails to forward packets when you require ROMMON access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Syn flood attack is a form of?

A

Denial of Service attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Which two features of Cisco Web Reputation tracking can mitigate web-based threats?

A

outbreak filter web reputation filter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What is a valid implicit permit rule for traffic that is traversing the ASA firewall?

A

ARPs in both directions are permitted in transparent mode only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

When is the default deny all policy an exception in zone-based firewalls?

A

When traffic traverses two interfaces in the same zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Which of the following pairs of statements is true in terms of configuring MD authentication?

A

Router process (only for OSPF) must be configured; key chain in EIGRP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Which statements about smart tunnels on a Cisco firewall are true?

A

Smart tunnels can be used by clients that do not have administrator privileges Smart tunnels offer better performance than port forwarding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

In which configuration mode do you configure the ip ospf authentication-key 1 command?

A

Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Which statement about IOS privilege levels is true?

A

Each privilege level supports the commands at its own level and all levels below it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

SSL certificates are issued by Certificate Authority (CA) are?

A

Trusted root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

What commands can you use to verify the binding table status?

A

show ip dhcp snooping database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Which two authentication types does OSPF support

A

plaintext MD5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

How does a zone-based firewall implementation handle traffic between interfaces in the same zone?

A

Traffic between interface in the zone is allowed by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Which statement about zone-based firewall configuration is true?

A

The zone must be configured before a can be assigned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Which two statements about Telnet access to the ASA are true?

A

You may VPN to the lowest security interface to telnet to an inside interface Best practice is to disable Telnet and use SSH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

Which type of PVLAN port allows hosts in the same VLAN to communicate directly with each other?

A

community for hosts in the PVLAN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Which statement about the communication between interfaces on the same security level is true?

A

Interfaces on the same security level require additional configuration to permit inter-interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Which statement about personal firewalls is true?

A

They can protect a system by denying probing requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

nat (inside,outside) dynamic interface Which translation technique does this configuration result in?

A

Dynamic PAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

Which EAP method uses Protected Access Credentials?

A

EAP-FAST

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

Which NAT option is executed first during in case of multiple nat translations?

A

static nat with longest prefix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Which statement about extended access lists is true?

A

Extended access lists perform filtering that is based on source and destination and are most effective when applied to the source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Which term best describes the concept of preventing the modification of data in transit and in storage?

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

You have configured R1 and R2 as shown, but the routers are unable to establish a site-to-site VPN tunnel. What action can you take to correct the problem?

A

Edit the crypto keys on R1 and R2 to match

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Which Cisco product can help mitigate web-based attacks within a network?

A

Web Security Appliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Which command verifies phase 1 of an IPSec VPN on a Cisco router?

A

show crypto isakmp sa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Which feature filters CoPP packets?

A

ACLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

How many crypto map sets can you apply to a router interface?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Which option is the most effective placement of an IPS device within the infrastructure?

A

Inline, behind the internet router and firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

According to Cisco best practice, which three protocols should the default ACL allow on an access port to enable wired BYOD devices to supply valid credentials and connect to the network?

A

BOOTP TFTP DNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Which option is a characteristic of the RADIUS protocol?

A

combines authentication and authorization in one process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

What do you use when you have a network object or group and want to use an IP address?

A

Dynamic NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

What are two challenges faced when deploying host-level IPS?

A

The deployment must support multiple operating systems It does not provide protection for offsite computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

What is the only permitted operation for processing multicast traffic on zone-based firewalls?

A

Only control plane policing can protect the control plane against multicast traffic

121
Q

What is the primary purpose of a defined rule in an IPS?

A

to configure an event action that takes place when a signature is triggered

122
Q

Which firepower preprocessor blocks traffic based on IP?

A

Reputation-Based

123
Q

When AAA login authentication is configured on Cisco routers, which two authentication methods should be used as the final method to ensure that the administrator can still log into the router in case the external AAA server fails?

A

local enable

124
Q

Which two characteristics of an application layer firewall are true?

A

provides protection for multiple applications provides reverse proxy services

125
Q

Which of the following commands results in a secure bootset?

A

secure boot-config secure boot-image

126
Q

Which sensor mode can deny attackers inline?

A

IPS

127
Q

Which Cisco feature can help mitigate spoofing attacks by verifying symmetry of the traffic path?

A

Unicast Reverse Path Forwarding

128
Q

With Cisco IOS zone-based firewall, by default, which three types of traffic are permitted by the router when some of the router interfaces are assigned to a zone

A

traffic flowing to and from the router interfaces (the self zone) traffic flowing among the interfaces that are members of the same zone traffic flowing among the interfaces that are not assigned to any zone

129
Q

Which IPS detection method can you use to detect attacks that based on the attackers IP addresses?

A

Reputation-Based

130
Q

Which statement is a benefit of using Cisco IOS IPS?

A

It uses the underlying routing infrastructure to provide an additional layer of security

131
Q

If a switch port goes into a blocked state only when a superior BPDU is received, what mechanism must be in uses?

A

STP root guard

132
Q

Which command do you enter to enable authentication for OSPF on an interface?

A

router(config-if)#ip ospf authentication message-digest

133
Q

You have implemented a Sourcefire IPS and configured it to block certain addresses utilizing Security Intelligence IP Address Reputation. A user calls and is not able to access a certain IP. What action can you take to allow the user access to the IP address?

A

Create a whitelist and add the appropriate IP address to allow the traffic

134
Q

Which type of secure connectivity does an extranet provide?

A

other company networks to your company network

135
Q

A specific URL has been identified as containing malware. What action can you take to block users from accidentally visiting the URL and becoming infected with the malware?

A

Enable URL filtering on the perimeter router and add the URLs you want to block to the router’s local URL list

136
Q

You have been tasked with blocking user access to websites that violate company policy, but the sites use dynamic IP addresses. What is the best practice for URL filtering to solve the problem?

A

Enable URL filtering and use URL categorization to block the websites that violate company policy

137
Q

What are two uses of SIEM software?

A

collecting and archiving syslog data alerting administrators to security events in real time

138
Q

Which address block is reserved for locally assigned unique local addresses?

A

FD00::/8

139
Q

What is an advantage of placing an IPS on the inside of a network?

A

It receives traffic that has already been filtered

140
Q

Which accounting notices are used to send a failed authentication attempt record to a AAA server?

A

start-stop stop-only

141
Q

Which source port does IKE use when NAT has been detected between two VPN gateways?

A

UDP 4500

142
Q

Which command is needed to enable SSH support on a Cisco router?

A

crypto key generate rsa

143
Q

Which two option are advantages of an application layer firewall?

A

makes DoS attacks difficult authenticates individuals

144
Q

Which feature of the Cisco Email Security Appliance can mitigate the impact of snowshoe spam and sophisticated phishing attacks?

A

contextual analysis

145
Q

What security feature allows a private IP address to access the Internet by translating it to a public address?

A

NAT

146
Q

While troubleshooting site-to-site VPN, you issued the show crypto isakmp sa command. What does the given output show?

A

IPSec Phase 1 is established between 10.10.10.2 and 10.1.1.5

147
Q

A clientless SSL VPN user who is connecting on a Windows Vista computer is missing the menu option for RDP on the portal web page. Which action should you take to begin troubleshooting?

A

Ensure that the RDP plug-in is installed on the VPN gateway

148
Q

Which components does HMAC use to determine the authenticity and integrity of a message?

A

the hash the key

149
Q

What is the FirePOWER impact flag used for?

A

A value that indicates the potential severity of an attack

150
Q

What configuration allows AnyConnect to automatically establish a VPN session when a user logs in to the computer?

A

always-on

151
Q

What is the actual IOS privilege level of User Exec mode?

A

1

152
Q

What type of IPS can identify worms that are propagating in a network?

A

Anomaly-based IPS

153
Q

In what type of attack does an attacker virtually change a device’s burned-in address in an attempt to circumvent access lists and mask the device’s true identity?

A

MAC spoofing

154
Q

What three actions are limitations when running IPS in promiscuous mode?

A

deny attacker deny packet modify packet

155
Q

Which prevents the company data from modification even when data is in transit?

A

Integrity

156
Q

Which two services define cloud networks?

A

Infrastructure as a Service Platform as a Service

157
Q

Which two features fo CoPP and CoPPr use to protect the control plane?

A

QoS traffic classification

158
Q

In which three ways does the TACACS protocol differ from RADIUS?

A

TACACS uses TCP to communicate TACACS can encrypt the entire packet that is sent TACACS supports per-command authorization

159
Q

What is the best way to confirm that AAA authentication is working properly?

A

Use the test aaa command

160
Q

How does PAEP protect the EAP exchange?

A

It encrypts the exchange using the server certificate

161
Q

Which technology can be used to rate data fidelity and to provide an authenticated hash for data?

A

file reputation

162
Q

How does the Cisco ASA use Active Directory to authorize VPN users?

A

It queries the Active Directory server for a specific attribute for the specific user

163
Q

You want to allow all your company’s users to access the Internet without allowing other Web servers to collect the IP addresses of individual users. What two solutions can you use?

A

Configure a proxy server to hide users’ local IP addresses Configure a firewall to use PAT

164
Q

Using a stateful packet firewall and given an inside ACL entry of permit ip 192.16.1.0 0.0.0.255 any, what would be the resulting dynamically configured ACL for the return traffic on the outside ACL?

A

permit tcp host 172.16.16.10 eq 80 host 192.16.1.11 eq 2300

165
Q

How many times was a read-only string used to attampt a write operation?

A

9

166
Q

Which Sourcefire event action should you choose if you want to block only malicious traffic from a particular end user?

A

Allow with inspection

167
Q

The stealing of confidential information of a company comes under the scope of?

A

Social Engineering

168
Q

Which command is used to verify that a VPN connection is established between two endpoints and that the connection is passing?

A

Firewall#sh crypto ipsec sa

169
Q

If the native VLAN on a truck is different on each of the links, what is a potential consequence?

A

STP loops may occur

170
Q

Which TACACS server-authentication protocols are supported on Cisco ASA firewalls?

A

ASCII

PAP

MS-CHAPv1

171
Q

What can the SMTP preprocessor in FirePOWER normalize?

A

It can extract and decode email attachments in client to server traffic

172
Q

What is an example of social engineering?

A

gaining access to server room by posing as IT

173
Q

How does a device on a network using ISE receive its digital certificate during the new-device registration process?

A

ISE acts as a SCEP proxy to enable the device to receive a certificate from a central CA server

174
Q

Which two protocols enable Cisco Configuration Professional to pull IPS alerts from a Cisco ISR router?

A

SDEE

HTTPS

175
Q

Which statement about a college campus is true?

A

College campus has geographical position

176
Q

Which statement about application blocking is true?

A

It blocks access to specific programs

177
Q

In a security context, which action can you take to address compliance?

A

Implement rules to prevent a vulnerability

178
Q

How can FirePOWER block malicious email attachments?

A

It sends the traffic through a file policy

179
Q

Which two devices are components of the BYOD architectural framework?

A

Prime Infrastructure

Identity Services Engine

180
Q

In which three cases does the ASA firewall permit inbound HTTP GET requests during normal operations?

A

when matching NAT entries are configured

when matching ACL entries are configured

when the firewall receives a SYN packet

181
Q

Which command causes a Layer 2 switch interface to operate as a Layer 3 interface?

A

no switchport

182
Q

What is the default timeout interval during which a router waits for responses from a TACACS server before declaring a timeout failure?

A

5 seconds

183
Q

Which command will configure a Cisco ASA firewall to authenticate users when they enter the enable syntax using the local database with no fallback method?

A

aaa authentication enable console LOCAL

184
Q

Which type of firewall can act on the behalf of the end device?

A

Proxy

185
Q

While troubleshooting site-to-site VPN, you issue the show crypto isakmp sa command. What does the given output show?

A

IPSec Phase 1 is established between 10.10.10.2 and 10.1.1.5

186
Q

Which line in the configuration prevents the Helpdesk user from modifying the interface configuration?

A

Privilege exec level 9 configure terminal

187
Q

Which two NAT types allows only objects or groups to reference an IP address?

A

dynamic NAT

static NAT

188
Q

Which tool can an attacker use to attempt a DDoS attack?

A

botnet

189
Q

Which alert protocol is used with Cisco IPS Manager Express to support up to 10 sensors?

A

SDEE

190
Q

Which security zone is automatically defined by the system?

A

the self zone

191
Q

What are two effects of the given command?

A

It configures authentication to use MD5 HMAC

It configures encryption to use AES 256

192
Q

What is the most common Cisco Discovery Protocol version 1 attack?

A

Denial of Service

193
Q

Which statement about this debug is true?

A

The TACACS authentication request came from a valid user

194
Q

A proxy firewall protects against which type of attack?

A

cross-site scripting attack

195
Q

Which type of PVLAN port allows a host in the same VLAN to communicate only with promiscuous hosts?

A

Isolated host in the PVLAN

196
Q

What is the purpose of a honeypot IPS?

A

to collect information about attacks

197
Q

What are two ways to prevent eavesdropping when you perform device-management tasks?

A

use an SSH connection

use SNMPv3

198
Q

What is the purpose of the Integrity component of the CIA triad?

A

to ensure that only authorized parties can modify data

199
Q

Which IOS command is used to define the authentication key for NTP?

A

Switch(config)#ntp authenticatioin-key 1 md5 C1sc0

200
Q

What are purposes of the Internet Key Exchange in an IPSec VPN?

A

The Internet Key Exchange protocol establishes security associations

The Internet Key Exchange protocol is responsible for mutual authentication

201
Q

Which IPS mode provides the maximum number of actions?

A

inline

202
Q

Which options are filtering options used to display SDEE message types?

A

error

all

203
Q

Which two next-generation encryption algorithms does Cisco recommend?

A

AES

SHA-384

204
Q

What type of packet creates and performs network operations on a network device?

A

control plane packets

205
Q

What port option in a PVLAN that can communicate with every other port?

A

promiscuous

206
Q

When a company puts a security policy in place, what is the effect on the company’s business?

A

Minimizing risk

207
Q

The command debug crypto isakmp results in?

A

Troubleshooting ISAKMP (Phase 1) negotiation problems

208
Q

If a packet matches more than one class map in an individual feature type’s policy map, how does the ASA handle the packet?

A

The ASA will apply the actions form the first matching class map it finds for the feature type

209
Q

What type of attacks was the Stuxnet virus?

A

cyber warfare

210
Q

What is a possible reason for the error message?

Router(config)#aaa server?% Unrecognized command

A

The router is a new device on which the aaa new-model command must be applied before continuing

211
Q

With which preprocessor do you detect incomplete TCP handshakes?

A

rate based prevention

212
Q

In which three ways does the RADIUS protocol differ from TACACS?

A

RADIUS uses UDP to communicate with the NAS

RADIUS encrypts only the password field in an authentication packet

RADIUS authenticates and authorizes simultaneously, causing fewer packets to be transmitted

213
Q

Which statement about the device time is true?

A

The time is authoritative, but the NTP process has lost contact with its server

214
Q

Which Sourcefire logging action should you choose to record the most detail about a connection?

A

Enable logging at the end of the session

215
Q

Which syslog severity level is number 7?

A

Debugging

216
Q

What are two Cisco IOS privilege levels?

A

1

15

217
Q

What improvement does EAP-FASTv2 provide over EAP-FAST?

A

It allows multiple credentials to be passed in a single EAP exchange

218
Q

Which three statements about Cisco host-based IPS solutions are true?

A

It can view encrypted files

It can have more restrictive policies than network-based IPS

It can generate alerts based on behavior at the desktop level

219
Q

Which actions can a promiscuous IPS take to mitigate an attack?

A

Requesting connection blocking

Resetting the TCP connection

Requesting host blocking

220
Q

While troubleshooting site-to-site VPN, you issued the show crypto ipsec sa command. What does the given output show?

A

IPSec Phase 2 is established between 10.1.1.1 and 10.1.1.5

221
Q

By which kind of threat is the victim tricked into entering username and password information on a disguised website?

A

Phishing

222
Q

What VPN feature allows traffic to exit the security appliance through the same interface it entered?

A

hairpinning

223
Q

Which protocols use encryption to protect the confidentiality of data transmitted between two parties?

A

SSH

HTTPS

224
Q

Which aaa accounting command is used to enable logging of the start and stop records for user terminal sessions on the router?

A

aaa accounting exec start-stop tacacs+

225
Q

Which option is a weakness in an information system that an attacker might leverage to gain unauthorized access to the system or its data?

A

vulnerability

226
Q

What command could you implement in the firewall to conceal internal IP addresses?

A

no proxy-arp

227
Q

A data breach has occurred and your company database has been copied. Which security principle has been violated?

A

Confidentiality

228
Q

In which stage of an attack does the attacker discover devices on a target network?

A

Reconnaissance

229
Q

Which port should (or would) be open in VPN NAT-T was enabled?

A

port 4500 ipsec

230
Q

Which produced can be used to provide application layer protection for TCP port 25 traffic?

A

ESA

231
Q

Which RADIUS server authentication protocols are supported on Cisco ASA firewalls?

A

PAP

MS-CHAMPv1

MS-CHAMPv2

232
Q

Which will auto-nat process first?

A

static nat longest prefix

233
Q

Which of the following are features of IPSec transport mode?

A

IPSec transport mode is used between end stations

IPSec transport mode supports unicast

IPSec transport mode encrypts only the payload

234
Q

Which firewall configuration must you perform to allow traffic to flow in both directions between two zones?

A

You must configure two zone pairs, one for each direction

235
Q

Which two statements about stateless firewalls are true?

A

They compare the 5-tuple of each incoming packet against configurable rules

They cannot track connections

236
Q

What can cause the state table of a stateful firewall to update?

A

when a connection is created

when a connection’s timer has expired within the state table

237
Q

With which NTP server has the router synchronized?

A

192.168.10.7

238
Q

Which Cisco Security Manager application collects information about device status and uses it to generate notifications and alerts?

A

Health and Performance Monitor

239
Q

What is the transition order of STP states on a Layer 2 switch interface?

A

blocking, listening, learning, forwarding, disabled

240
Q

On Cisco ISR routers, for what purpose is the realm-cisco.pub public encryption key used?

A

used to verify the digital signature of the IPS signature file

241
Q

Which type of PVLAN port allows communication from all port types?

A

Promiscuous

242
Q

What is the reason for an organization to deploy a personal firewall?

A

To protect endpoints such as desktops from malicious activity

243
Q

Which three options are common examples of AAA implementation on Cisco routers?

A

authenticating remote users who are accessing the corporate LAN through VPN

authenticating administrator access to the router console port, auxiliary port, and vty ports

performing router commands authorization using TACACS

244
Q

Which type of encryption technology has the broadcast platform support to protect operating systems?

A

Software

245
Q

Which option describes information that must be considered when you apply an access list to a physical interface?

A

Direction of the access group

246
Q

Which statement about this output is true?

A

The login failed because the password entered was incorrect

247
Q

Which protocol provides security to Secure Copy?

A

SSH

248
Q

Security well-known terms?

A

Phishing

Ransomware

249
Q

You are the security administrator for a large enterprise network with many remote locations. You have been given the assignment to deploy a Cisco IPS. Where in the network would be the best place to deploy Cisco IOS IPS?

A

At remote branch offices

250
Q

Which two characteristics of the TACACS protocol are true

A

separates AAA functions

encrypts the body of every packet

251
Q

What is a benefit of a web application firewall?

A

It blocks known vulnerabilities without patching applications

252
Q

Which security term refers to a person, property, or data of value to a company?

A

Asset

253
Q

Which filter uses in Web reputation to prevent from Web-Based Attacks?

A

outbreak filter

web reputation

254
Q

How can the administrator enable permanent client installation in a Cisco AnyConnect VPN firewall configuration?

A

issue the command anyconnect keep-installer installed under the group policy or username webvpn mode

255
Q

Which option is the default value for the Diffie-Hellman group when configuring a site-to-site VPN on an ASA device?

A

Group 2

256
Q

Which task is the session management path responsible for?

A

Performing route lookup

Allocating NAT translations

Checking packets against the access list

257
Q

Which wildcard mask is associated with a subnet mask of /27?

A

0.0.0.31

258
Q

Which type of mirroring does SPAN technology perform?

A

Local mirroring over Layer 2

259
Q

When an administrator initiates a device wipe command from the ISE, what is the immediate effect?

A

It requests the administrator to choose between erasing all device data or only managed corporate data

260
Q

While troubleshooting site-to-site VPN, you issued the show crypto isakmp sa command. What does the given output show?

A

IKE Phase 1 main mode was created on 10.1.1.5, but it failed to negotiate with 10.10.10.2

261
Q

Which option is the resulting action in a zone-based policy firewall configuration with these conditions?

A

Drop

262
Q

The Oakley cryptography protocol is compatible with following for managing security?

A

ISAKMP

263
Q

Which statement about communication over failover interfaces is true?

A

All information that is sent over the failover interfaces is sent as clear text by default

264
Q

In the router ospf200 command, what does the value 200 stand for?

A

the process id

265
Q

For what reason would you configure multiple security contexts on the ASA firewall?

A

To separate different departments and business units

266
Q

Which option is the default value for the Diffie-Hillman group when configuring a site-to-site VPN on an ASA device?

A

Group 2

267
Q

Which ports need to be active for AAA server to integrate with Microsoft AD?

A

Ports 445, 389

268
Q

Protocols supported in contest aware VRF over VRF lite?

A

EIGRP

Multicast

269
Q

What causes a client to be placed in a great or restricted VLAN on an 802.1x enabled network?

A

Client entered wrong credentials multiple times

270
Q

What data is transferred during DH for making a public and private key?

A

Random prime integer

271
Q

Which IPS mode is less secure than other options but allows optimal network throughput?

A

Promiscuous mode

272
Q

How can you protect CDP from reconnaissance attacks?

A

Disable CP on ports connected to endpoints

273
Q

What feature defines a campus area network?

A

It has a single geographic location

274
Q

Which FirePOWER Management Center feature detects and blocks exploits and hack attempts?

A

File control

275
Q

What is the highest security level that can be configured for an interface on an ASA?

A

100

276
Q

Which type of social-engineering attacks uses normal telephone service as the attack vector?

A

Phishing

277
Q

What are two options for running Cisco SDM?

A

Running SDM from a PC

Running SDM from the Cisco web portal

278
Q

By default, how does zone-based firewall handle traffic to and from the self-zone?

A

It drops all traffic

279
Q

For which reason is the tunnel unable to pass traffic?

A

The local peer is unable to encrypt the traffic

280
Q

Which two statements about the self-zone on a Cisco zone-based policy firewall are true?

A

It can be either the secure zone or the destination zone

It supports stateful inspection for multicast traffic

281
Q

What does the command crytpo isakmp nat-traversal do?

A

Enables UDP port 4500 on all IPSec enabled interfaces

282
Q

Which quantifiable item should you consider when your organization adopts new technologies?

A

Risk

283
Q

Which IPS mode is less secure than other options but allows optional network throughput?

A

Promiscuous mode

284
Q

Which option is a key security component of an MDM deployment?

A

Using self-signed certificates to validate the server

285
Q

Which command should be used to enable AAA authentication to determine if a user can access the privileged command level?

A

aaa authentication enable default local

286
Q

Which type of firewall can serve as the intermediary between a client and a server?

A

Proxy firewall

287
Q

Which two characteristics of a PVLAN are true?

A

Promiscuous portscan communicate with PVLAN ports

Community ports have to be a part of the trunk

288
Q

Which two features are supported in a VRF-aware software infrastructure before VRF-lite?

A

EIGRP

Multicast

289
Q

Which two primary security concerns can you mitigate with a BYOD solution?

A

Compliance with applicable policies

Securing access to a trusted corporate network

290
Q

Which IDS\IPS solution can monitor system processes and resources?

A

HIPS

291
Q

Which type of attack can exploit design flaws in the implementation of an application without going noticed?

A

Low-rate DoS attacks

292
Q

Which type of address translation supports the initiation of communications bidirectionally?

A

dynamic NAT

293
Q

Which IDS\IPS is used for monitoring systems?

A

HIPS

294
Q

Referencing the CIA model, in which scenario is a hash-only function most appropriate?

A

Securing data at rest

295
Q

Which description of the nonsecret numbers that are used to start a DH exchange is true?

A

They are preconfigured prime integers

296
Q

Which two options are the primary deployment models for device management?

A

on-premises

cloud-based

297
Q

Which two characteristics of symmetric encryption are true?

A

It uses a public key and a private key to encrypt and decrypt traffic

It uses the same key to encrypt and decrypt the traffic

298
Q

Drag the hash or algorithm from the left column to its appropriate category on the right?

A

210-260 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions