DECK Flashcards

Question

Which of the following is NOT a configurable action for an ASA IPS sensor in inline mode? A. Deny Packet Inline. B. Deny Network Inline. C. Deny Connection Inline. D. Deny Attacker Inline.

Answer 1

B. Deny Network Inline. Deny network inline is NOT a configurable action for an ASA IPS sensor in inline mode. The IPS can perform blocking of traffic, or it can drop packets when an attack is occurring. Blocking and dropping are not the same function. There are three drop actions that can be configured for a sensor in inline mode. They are: Deny packet inline Deny connection inline Deny attacker inline While there is no drop action called deny network inline, there is a blocking action called network block. However, while this is supported on the sensors, connection blocks and network blocks are not supported on the ASA.

Answer 2

A. SYN Flood SYN flood attacks, like all DoS attacks, attempt to overwhelm the target with huge amounts of traffic. Rate-based preprocessing identifies these types of attacks by recognizing that the traffic is coming in a rate that far exceeds normal traffic patterns. Port scans cannot be mitigated with the rate-based preprocessing engine of the ASA Firepower module. The ASA Firepower module has a port scan detection feature that is more appropriate for this type of reconnaissance. The loss of sensitive data cannot be prevented with the rate-based preprocessing engine of the ASA Firepower module. Sensitive data preprocessor rules are used to prevent configured types of information from leaving the network. Back Orifice attacks cannot be prevented with the rate-based preprocessing engine of the ASA Firepower module. The Back Orifice preprocessor analyzes UDP traffic for the Back Orifice magic cookie, "* !*QWTY? ", which is located in the first eight bytes of the packet and is XOR-encrypted. Reference:http://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/Intrusion-Threat-Detection.html#pgfId-1530827

Answer 3

B. Dynamic Rule States D. Sensitive data preprocessor rule Dynamic Rule States are rule states that become effective under configurable conditions. Sensitive data preprocessor rules are used to prevent configured types of information from leaving the network and also become effective under configurable conditions. The SMTP preprocessor engine cannot become effective under configurable conditions. This component can extract and decode email attachments in client-to-server traffic. You must enable SMTP preprocessor rules, which have a generator ID (GID) of 124, if you want these rules to generate an event. A rate-based preprocessing engine cannot become effective under configurable conditions. This class of preprocessing engine identifies DoS attacks by recognizing that the traffic is coming in a rate that far exceeds normal traffic patterns. Reference:http://www.cisco.com/c/en/us/td/docs/security/firesight/541/firepower-module-user-guide/asa-firepower-module-user-guide-v541/NAP-App-Layer.html#pgfId-1534626

Answer 4

D. Anomaly-based An anomaly-based IPS is one that identifies attacks based on traffic that is outside of the normal traffic pattern. Its purpose is not to collect information about attacks. A honeypot-based IPS is not one that identifies attacks based on traffic that is outside of the normal traffic pattern. It collects information about attacks. It can confuse and delay attackers as well as gather information. A signature-based IPS is not one that identifies attacks based on traffic that is outside of the normal traffic pattern. Ituses a database of attack signatures to identify attacks. A policy-based IPS is not one that identifies attacks based on traffic that is outside of the normal traffic pattern. It uses a configured policy to identify attacks.

Answer 5

B. HTTP Security Device Event Exchange (SDEE) is a standard format for security devices to communicate security events to one another. The devices can communicate these messages using either HTTP or HTTP over SSL/TLS. Secure Shell (SSH) cannot be used to communicate SDEE messages. SSH is a protocol used to secure a remote command line session. While IPsec can used to secure the transport of SDEE messages, it cannot be used to communicate SDEE content. That is done using either HTTP or HTTP over SSL or TLS. Generic Routing Encapsulation (GRE) cannot be used to communicate SDEE content. GRE is a tunneling protocol developed by Cisco Systems that can encapsulate a wide variety of network layer protocols inside virtual point-to-point links over an Internet Protocol network.

Answer 6

A. Local URL List The Local URL List option is used to add to what is called the local URL list. From a higher level, the steps to implement URL filtering are: 1. Enable URL filtering on the perimeter router 2. Add the URLs you want to block to the router' local URL list. The option to access and add to the Local URL List is shown below: (see screen shot 210-260_4-URLlista.jpg) You would not choose URL Filter Servers. This option is used to specify the URL filtering server, which is the other of the two steps in this process. The filtering server will use a dynamically generated list of problem URLs, which may not include the one you would like to block. You would not choose Zone Pairs. This selection is used to implement a zone based policy. It is used to specify a unidirectional firewall policy between two security zones. Despite the attractiveness of the option, there is no Blacklist option in the SDM.

Answer 7

B. OWASP The Open Web Application Security Project (OWASP) offers several ways to help organizations to secure web infrastructures, including by providing education about common web site vulnerabilities. They also have created a number of tools, guides, and testing methodologies that are free for anyone to use. They publish a list of top 10 web vulnerabilities. The National Institute of Standards and Technology (NIST) is a unit of the U.S. Commerce Department. Formerly known as the National Bureau of Standards, NIST promotes and maintains measurement standards. The NIST 800-115 is a Technical Guide to Information Security Testing that provides guidance and a methodology for reviewing security that is required for the U.S. government's various departments to follow. It is NOT focused solely on common Web site vulnerabilities. The Open Source Security Testing Methodology Manual (OSSTMM) is a free methodology to conduct security testing in a thorough and repeatable manner developed under the Creative Commons License. It is NOT focused solely on common Web site vulnerabilities. The Information Systems Security Assessment Framework (ISSAF) is one of the largest free-assessment methodologies available. It is focused on the business aspect of security, and on a penetration test framework. It is NOT focused solely on common Web site vulnerabilities.

Answer 8

A. It initializes a lawful intercept view. This command initializes a lawful intercept view. These views are created in case they are requested by law enforcement as a part of an investigation. The command initializes a view and associates it with the account and password in the same line. Multiple accounts can be set here as well. Moreover, this command will not work in global configuration mode unless you run this command first at the user mode prompt. R3 > enable view This command enables root view, and when you run the command, you will be prompted for the privilege Level 15 (admin) password. Once you have created the view, you create a user account that matches the username and password specified in the command. Accessing the view will require this username and password. The command does not configure a lawful intercept user account. While it specifies the account to be used to access the view, creating the account is a separate step. The username is not cisco. That is the lawful intercept password. The username is intercept. The syntax is: li-view li-password user username password password It does not configure an intercept of the user cisco. The word cisco is the LI password and the word intercept is the username.

Answer 9

D. MD5 When MD5 authentication is used to secure routing updates between OSPF routers, it is called Type 2 authentication. There are three possible methods of OSPF authentication available: ``` Null authentication (none) referred to as Type 0 Plaintext passwords referred to as Type 1 Message Digest 5 (MD5) referred to as Type 2 ``` While plaintext sends the credentials in clear text, MD5 does not and is the most secure. MD5 is a one-way hashing algorithm that produces 128-bit checksums. Secure Hash Algorithm (SHA-1) is not a supported authentication method for OSPF.

Answer 10

B. send-lifetime local 14:32:00 31 Dec 2016 infinite The correct command is send-lifetime local 14:32:00 31 Dec 2016 infinite. The syntax of the send-lifetime command is as follows: send-lifetime start-time {infinite | end-time | duration seconds} The start-time parameter has some specific syntactic requirements. The syntax can be either of the following: hh: mm:ss Month date year hh: mm:ss date Month year The parameters are defined as follows: ``` hh - hours mm - minutes ss - seconds Month - first three letters of the month date - date (1 - 31) year - year (four digits) ``` The default start time and earliest acceptable date is January 1, 1993. The commands send-lifetime local 14:32:00 31 December 2016 infinite and send-lifetime local 23:59:00 December 31 2016 infinite are incorrect because the month must be a three-letter abbreviation. The command send-lifetime local 14:32:00 31 December 2016 indefinite is incorrect because the month is not a three-letter abbreviation and the parameter indefinite does not exist. The correct parameter is infinite.

Answer 11

B. Control Plane Control Plane Protection (CPPr) is used to restrict and/or police control plane traffic destined to the route processor. This traffic is typically referred to as the control plane. There are two available options to protect the contrail plane. They are CCPr and Control Plane Policing (CoPP). CPPr is not designed to protect the session management path. This path is related to the stateful inspection function, not the control plane. Initial packets of conversations undergoing stateful inspection are subjected to the session management path. CPPr is not designed to protect Cisco Express Forwarding (CEF). CEF is mainly used to increase packet switching speed by reducing the overhead and delays that are introduced by other routing techniques. Although it required for CPPr, it is not protected by it. CPPr is not designed to protect the data plane. It is used to restrict and/or police control plane traffic destined to the route processor. The data plane is where forwarding takes place while the control plane is where the forwarding decision is made.

Answer 12

D. A root bridge is chosen Even when the STP topology is a simple as two switches with two links between them, the operation of STP is the same. The steps are: 1. One of the two switches will be elected root bridge base on their priorities. 2. Both ports on the root bridge will be set to designated and will forward. 3. One of the ports on the non-root bridge will be set to root and will forward. 4. The remaining port on the non-root bridge will be set to blocking and will block.

Answer 13

A. Create a NAT object under NAT Rules. There are two steps that must be completed. First, you must create a NAT object under NAT Rules that maps the public address to the private address, as shown in the graphic below: (see screen shot 210-260_5-NAT_obj.jpg) Next, you must create a firewall rule to allow the HTTP traffic under Access Rules as shown in the following exhibit. The rule shown below allows traffic to 172.16.1.2 using HTTP: (see screen shot 210-260_6-accs_rule.jpg) NAT objects are not created under Service Policy Rules. They are created under NAT Rules. Firewall rules to allow HTTP access are neither created under Service Policy Rules or under AAA Rules. They are created under Access Rules.

Answer 14

B. Security Contexts Security contexts operate as separate virtual firewalls in the same physical ASA. These contexts can each have their own interfaces and configurations. In any scenario where compliance with industry or government security requirements is an issue, each security context can use rules to prevent any vulnerabilities those requirements or measures are designed to address. Configuration partitions is not a term used when discussing the ability of an ASA to function as separate virtual firewalls in the same physical ASA. Execution spaces are not the equivalent of separate physical firewalls in the ASA. The system execution space is an area created when the ASA is placed in multiple mode, thereby enabling multiple security contexts. It is from the system execution space that contexts are created. Multiple mode is not the equivalent of separate physical firewall in the ASA. Multiple mode is a mode that the ASA can be set to in which multiple security contexts become possible.

Answer 15

A. Initiator bytes Initiator bytes are used by Firepower services in the ASA to indicate the total number of bytes transmitted by the session initiator. Impact flags of various colors are used to indicate the potential severity of an attack. Flags result from the correlation between intrusion data, network discovery data, and vulnerability information. Application tags characterize each application to help you understand the application's function. URL reputation describes the reputation associated with the URL requested by the monitored host during the session, if available.

Answer 16

A. SDEE messages The messages are Security Device Event Exchange (SDEE) messages. SDEE is a standard format for security devices to communicate security events to one another. This particular dialog box is the SDEE messages dialog box from an instance of Security Device (SD) manager. Notice the drop down box that allows you to filter the messages. While this drop down box is currently set for ALL messages, it can also be set to filter using the following choices in the drop down box: -All - SDEE error, status, and alert messages are shown. -Error - Only SDEE error messages are shown. -Status - Only SDEE status messages are shown. -Alerts - Only SDEE alert messages are shown. messages.