Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

From Flashcardlet > Chapter 6 - Securing the Mgmt Plane on a Cisco IOS Device > Flashcards

Chapter 6 - Securing the Mgmt Plane on a Cisco IOS Device Flashcards

1
Q

What are 7 Management Plane Best Practices?

A

1) Strong Passwords
2) User authentication and AAA
3) Role-based access control (RBAC)
4) Encrypted management protocols
5) Logging
6) Network Time Protocol (NTP)
7) Secure system files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Describe AAA.

A

Authentication, authorization, and accounting - You can control which admins are allowed to connect to which devices and what they can do while they are there, and you can create an audit trail of what they did.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can you control an adminitrator’s access to a device?

A

Through AAA and custom privilege levels/parser views. You could create a group that has limited permissions and then assign that administrator to that group. This is an example of using RBAC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does out-of-band management mean?

A

It implies that there is a completely separate network just for management protocols and a different network for end users and their traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are some examples of encrypted communication to use with management?

A

Secure Shell (SSH) or Hypertext Transfer Protocol Secure (HTTPS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

If a plaintext management protocol must be used, what can be used to encrypt the traffic?

A

VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the purpose of logging?

A

It’s a way to create an audit trail. It not only includes what admins have changed or done, but also system events that are generated by the router or switch because of some problem or some threshold that has been reached.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If SNMP is used for logging, what version should be used and why?

A

Version 3 should be used because of its authentication and encryption abilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an SNMP trap?

A

A message generated by the router or switch to alert the manager or management station of some event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why is it important to use NTP to synchronize clocks on network devices?

A

It’s important to correlate clocks among network devices in case there is ever a breach you need to reconstruct (or prove in a court of law) what occurred.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the 3 functional components of AAA?

A

1) Authentication
2) Authorization
3) Accounting and auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the function of authentication in AAA?

A

It’s the process by which individuals prove that they are who they claim to be.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are 2 common methods or choices for authenticating a user?

A

1) Referring to the local running configuration

2) Going to an external server that holds the username and password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In AAA, what happens after the user has been authenticated?

A

The user or admin is then authorized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does authorization in AAA do?

A

It determines which resources the user or admin is allowed access, and which operations may be performed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the role of accounting and auditing?

A

To record what the user or admin actually does with this access, what he accesses, and how long he accesses it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Monitoring all the activity of a user or admin through accounting and auditing is also referred to what?

A

Creating an audit trail.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are 4 AAA centralized server types?

A

1) Cisco Secure ACS Solution Engine
2) Cisco Secure ACS for Windows Server
3) Current flavors of ACS functionality
4) Self-contained AAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the Cisco Secure ACS Solution Engine?

A

This is a dedicated server that contains the usernames, their passwords, and other information about what users are allowed to access and when.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the protocol used between the router and the ACS server if you are authenticating an admin who is seeking command-line access?

A

TACACS+

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the protocol used between the router and ACS server if you are authenticating an end user for network access?

A

RADIUS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is Cisco Secure ACS for Windows Server?

A

AAA services on a router or network access server contact an external Cisco Secure ACS (running on a Microsoft Windows system).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are current flavors of ACS functionality?

A

The most common way that ACS services are implemented today is through a virtual machine running on some flavor of VMWare.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is Cisco Identity Services Engine?

A

It’s another up-and-coming service to support similar services to ACS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is ACS?

A

Access Control Server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is self-contained AAA?

A

AAA services are self-contained on the router itself.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is self-contained AAA also known as?

A

Local authentication and authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

In self-contained AAA, what is the local database also referred to?

A

The running configuration of the router or IOS device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Before we can authorize a user or admin, what must be done first?

A

We must choose authentication first. We cannot choose authorization for a user without knowing who that user is through authentication first.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

For remote administrative access, what type of protocol would be used?

A

Usually TACACS+ between the router and the ACS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

For remote network access end users, what type of protocol would be used?

A

Usually RADIUS between the router and the ACS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

For remote admin access, what mode does this normally provide access to?

A

Character (line or EXEC mode).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

For remote network access and users, what mode does this normally provide access to?

A

Packet (interface mode) such as an interface with PPP requiring authentication.

34
Q

For remote admin access, where (lines or interfaces) are these likely to be used?

A

vty, AUX console, and tty

35
Q

For remote network access and users, where (lines or interfaces) are these likely to be used?

A

Interfaces: async, group-async, BRI, PRI, Other functionality: VPN user authentication

36
Q

For remote admin access, what are the AAA command elements?

A

login, enable, exec

37
Q

For remote network access and users, what are the AAA command elements?

A

ppp, network, vpn groups

38
Q

What is a AAA method list?

A

Lis of available methods for AAA to use in order (local, RADIUS, TACACS, and so on).

39
Q

What method list command element identifies the type of list being created - with relevant options being authentication, authorization, or accounting?

A

type

40
Q

What method list command element specifies the default list of methods to be used based on the methods that follow this argument?

A

default

41
Q

What method list command element is used to create a custom method list?

A

list-name

42
Q

In the case of an authentication method list, what are some example methods?

A

enable, krb5, krb5-telnet, line, local, local-case, none, group radius, group tacacs+

43
Q

To use the local user database for authentication, what keyword must be used?

A

local

44
Q

What is a solution to protecting the router against a user connecting with Telnet or SSH since CCP cannot restrict visibility at the CLI?

A

parser views or simply a view

45
Q

What is a parser view?

A

Creating a “view” and associating it with a subset of commands. When the user logs in using this view, that same user is restricted to only those commands. You can also associate multiple users with a single view.

46
Q

What is the main problem with telnet?

A

It uses plain text and anyone who gets a copy of those packets can identify our usernames and passwords used for access and any other information being passed.

47
Q

If Telnet must be used, how should it be used?

A

It should only be used out of band, or placed within a VPN tunnel for privacy, or both.

48
Q

How is SSH better than Telnet?

A

SSH encrypts all packets used in the session.

49
Q

Accurate time can be implemented with what protocol?

A

Network Time Protocol (NTP)

50
Q

Cisco IOS devices can send log output to what different destinations?

A

1) Console
2) vty lines
3) Buffer
4) SNMP server
5) Syslog server

51
Q

What is the area called where messages are stored in router memory?

A

Buffer

52
Q

A syslog logging solution consists of what two primary components?

A

Syslog server and Syslog client

53
Q

What command encrypts most plaintext passwords in the configuration?

A

service password-encryption

54
Q

What command enables AAA features?

A

aaa new-model

55
Q

What command creates a default method list for character mode login that will use the local database (running config) on the router or switch?

A

aaa authentication login default local

56
Q

What command enters the root parser view, from where you can create additional views?

A

enable view

57
Q

To use the enable view command, what must already be in place?

A

aaa new-model

58
Q

What command assigns a show startup-config command to a customer privilege level 8?

A

privilege exec level 8 show startup-config

59
Q

What command creates the public/private key pair required for SSH?

A

crypto key generate rya

60
Q

What command secures the IOS image on flash?

A

secure boot-image

61
Q

What command would create an authentication method list called bubba that will use the local database first, and if the username does not exist, will require the enable secret to allow login?

A

aaa authentication bubba local enable

62
Q

What commands apply the method list named bubba to the console port?

A

line console 0

login authentication bubba

63
Q

What command displays debugging messages for the authentication functions of AAA?

A

debug aaa authentication

64
Q

What command displays debugging messages for the authorization functions of AAA?

A

debug aaa authorization

65
Q

What command displays debugging messages for the accounting functions of AAA?

A

debug aaa accounting

66
Q

What is SNMP?

A

Simple Network Management Protocol - The intent is to manage network nodes, such as network servers, routers, switches, and so on.

67
Q

What are 3 components of SNMP?

A

SNMP manager, SNMP agent, and Management Information Base

68
Q

What is the SNMP Manager?

A

Runs a network management application. This SNMP manager is sometimes called a Network Management Server (NMS).

69
Q

What is an SNMP Agent?

A

A piece of software that runs on a managed devices (such as server, router, or switch).

70
Q

What is the Management Information Base?

A

Information about a managed device’s resources and activity is defined by a series of objects. The structure of these management objects is defined by a a managed device’s Management Information Base (MIB). It’s like a collection of unique numbers associated with each of the individual components of a router.

71
Q

What are the 3 broad categories of SNMP message types?

A

1) GET
2) SET
3) Trap

72
Q

This type of SNMP message is used to retrieve information from a managed device.

A

GET

73
Q

This type of SNMP message is used to set a variable in a managed device or to trigger an action on a managed device.

A

SET

74
Q

This SNMP message is an unsolicited message sent from a managed device to an SNMP manager.

A

Trap

75
Q

In regards to SNMP, what is a security model?

A

Defines an approach for user and group authentication.

76
Q

In regards to SNMP, what is a security level?

A

Defines the type of security algorithm performed on SNMP packets.

77
Q

What are 3 SNMP security levels?

A

1) noAuthnoPriv
2) authNoPriv
3) authPriv

78
Q

Why is using SNMPv3 better than SNMPv1 or SNMPv2c?

A

SNMPv3 supports all 3 SNMP security levels, whereas the others only support noAuthNoPriv security levels.

79
Q

What is a custom privilege level?

A

Level 0 (user) and level 15 (enable) are predefined; anything in between (1-14) would be custom privilege level.

80
Q

What is secure bootset?

A

Part of the Cisco IOS Resilient Configuration feature, preventing the erasure of IOS files from a storage device, such as flash or NVRAM.

From Flashcardlet (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions