Lesson 12

Question 1

Cisco ASA acts as an _______ and authenticates users based on the RADIUS server’s response .

Answer 1

NAS (client)

Question 2

By default , RADIUS only supports __________

Answer 2

Authentication & Accounting

Question 3

There are two ways to configure RADIUS authorization:

Answer 3

• The RADIUS server returns the name of an ACL that is defined locally on the firewall.
• The RADIUS server returns the contents of a downloadable ACL defined on the RADIUS server itself .

Question 4

RADIUS encrypts only _______

Answer 4

User password

Question 5

You can use ___________ to secure RADIUS traffic unless you are on a secure network

Answer 5

IPSEC or VPN tunnels

Question 6

RSA SecurID (SDI) allows for the use of ____________

Answer 6

one - time passwords (OTP).

Question 7

Cisco ASA communicates with Active Directory and/or a Kerberos server via __________

Answer 7

UDP port 88.

Question 8

AAA Server Group

Answer 8

fw1(config )# aaa - server pumpkin protocol tacacs +

fw1(config )# aaa - server pumpkin ( dmz ) host 10.100.2.3 lemmein timeout 15

Question 9

The security appliance will intercept ____________requests when you use the aaa authentication command.

A user must first authenticate with one of these services before the ASA allows other traffic requiring authentication

Answer 9

FTP , Telnet HTTP , and HTTPS

Question 10

Specifies that all outbound http connections going anywhere must be authenticated by the server group called SERVERS1.

Answer 10

aaa authentication include http outbound 0 0 SERVERS1

Question 11

Example of a configuration to authenticate users from 10.10.0.1 through 10.10.0.254 using the RADIUS1 group with the host 10.10.0.88 not needing authentication :

Answer 11

fw1(config )# aaa authentication include any outbound 0 0 RADIUS1
fw1(config )# aaa authentication exclude outbound 10.10.0.88 255.255.255.255 0 0 RADIUS1

Question 12

ACL statements with _______ parameters specify that the matching traffic must be authenticated ; statements with _______ parameters specify that the matching traffic is exempt from authentication .

Answer 12

permit

deny

Question 13

The firewall uses the _______ service as an authentication method for any service other than HTTP, FTP, or Telnet

Answer 13

virtual telnet

Question 14

To see a list of all users currently authenticated by your security appliance, issue the command:

To clear out a cached entry, use the command:

Answer 14

show uauth

clear uauth user - id

Question 15

Configure Virtual HTTP

Answer 15

fw1( config )# virtual http [ warning ]

Question 16

enables accounting on all TCP connections through the firewall

Answer 16

fw1(config)# aaa accounting include any inside 0 0 0 0 TAC1