Module 10

Question 1

Step 1 of designing a ZPF

Answer 1

Determine the zones

Question 2

Step 2 of designing a ZPF

Answer 2

Establish policies between zones

Question 3

Step 3 of designing a ZPF

Answer 3

Design the physical infrastructure

Question 4

Step 4 of designing a ZPF

Answer 4

Identify subsets within zones and merge traffic requirements

Question 5

Are ZPFs dependent on ACLs? (benefit)

Answer 5

No

Question 6

What is Cisco Common Classification Policy Language (C3PL)? (benefit)

Answer 6

A structured method to create traffic policies based on events, conditions, and actions

Question 7

What does C3PL provide? (benefit)

Answer 7

Scalability

Question 8

How does C3PL provide scalability? (benefit)

Answer 8

One policy affects any given traffic, instead of needing multiple ACLs and inspection actions for different types of traffic

Question 9

What can be grouped into zones? (benefit)

Answer 9

Virtual and physical interfaces

Question 10

What are policies applied to? (benefit)

Answer 10

Unidirectional traffic between zones

Question 11

What does the action ‘inspect’ do?

Answer 11

Performs Cisco IOS stateful packet inspection

Question 12

What does the action ‘drop’ do?

Answer 12

Similar to deny statement in an ACL. Log option is available to log the rejected packets

Question 13

What does the action ‘pass’ do?

Answer 13

Similar to permit statement in an ACL. Pass action does not track the state of connections or sessions within the traffic

Question 14

Neither interface is a zone member. (inspect, drop, pass)

Answer 14

Traffic passes

Question 15

Both interfaces are members of the same zone. (inspect, drop, pass)

Answer 15

Passes because they are both members

Question 16

One interface is a zone member, but the other is not. (inspect, drop, pass)

Answer 16

Drop regardless of whether a zone-pair exists

Question 17

Both interfaces belong to the same zone-pair and a policy exists. (inspect, drop, pass)

Answer 17

Inspect, allow, or drop as defined by the policy

Question 18

What is the self zone?

Answer 18

The router itself and includes all of the IP addresses assigned to the router interfaces