Implementing Network Security (Version 2.0) - CCNA Security (IINS) Certification Practice Exam Online

1. Question

2 points

Which two characteristics describe a virus? (Choose two.)

A self-replicating attack that is independently launched.
Malicious code that can remain dormant before executing an unwanted action.
Program code specifically designed to corrupt memory in network devices.
Malware that relies on the action of a user or a program to activate.
Malware that executes arbitrary code and installs copies of itself in memory.

2. Question

2 points

Which two options can limit the information discovered from port scanning? (Choose two.)

authentication
encryption
firewall
intrusion prevention system
passwords

3. Question

2 points

Which two options provide secure remote access to a router? (Choose two.)

CHAP
HTTP
HTTPS
SSH
Telnet

4. Question

1 points

Refer to the exhibit. An administrator issues these IOS login enhancement commands to increase the security for login connections. What can be concluded about them?

Implementing Network Security (Version 2.0) – CCNA Security (IINS) Certification Practice Exam Answers 2019 02

Because the login delay command was not used, a one-minute delay between login attempts is assumed.
These enhancements apply to all types of login connections.
The hosts that are identified in the ACL will have access to the device.
The login block-for command permits the attacker to try 150 attempts before being stopped to try again.

5. Question

1 points

A network administrator notices that unsuccessful login attempts have caused a router to enter quiet mode. How can the administrator maintain remote access to the networks even during quiet mode?

Quiet mode behavior will only prevent specific user accounts from attempting to authenticate.
Quiet mode behavior can be disabled by an administrator by using SSH to connect.
Quiet mode behavior can be overridden for specific networks by using an ACL.
Quiet mode behavior can be enabled via an ip access-group command on a physical interface.

6. Question

3 points

When configuring SSH on a router to implement secure network management, a network engineer has issued the login local and transport input ssh line vty commands. What three additional configuration actions have to be performed to complete the SSH configuration? (Choose three.)

Set the user privilege levels.
Generate the asymmetric RSA keys.
Configure the correct IP domain name.
Configure role-based CLI access.
Create a valid local username and password database.
Manually enable SSH after the RSA keys are generated.

7. Question

2 points

An administrator assigned a level of router access to the user ADMIN using the commands below.

Router(config)# privilege exec level 14 show ip route
Router(config)# enable algorithm-type scrypt secret level 14 cisco-level-10
Router(config)# username ADMIN privilege 14 algorithm-type scrypt secret cisco-level-10

Which two actions are permitted to the user ADMIN? (Choose two.)

The user can execute all subcommands under the show ip interfaces command.
The user can issue the ip route command.
The user can issue all commands because this privilege level can execute all Cisco IOS commands.
The user can issue the show version command.
The user can only execute the subcommands under the show ip route command.

8. Question

1 points

What is a characteristic of a role-based CLI view of router configuration?

A CLI view has a command hierarchy, with higher and lower views.
When a superview is deleted, the associated CLI views are deleted.
Only a superview user can configure a new view and add or remove commands from the existing views.
A single CLI view can be shared within multiple superviews.

9. Question

1 points

What function is provided by the Cisco IOS Resilient Configuration feature?

It maintains a secure copy of the IOS image and running configuration that can be used for fast recovery if flash or NVRAM is erased.
It allows administrators to create different views of router configurations for different users.
It identifies attacks and security policy violations that are occurring on the network.
It locks down the management plane and the forwarding plane services and functions of a router.

10. Question

1 points

What service or protocol does the Secure Copy Protocol rely on to ensure that secure copy transfers are from authorized users?

AAA
IPsec
SNMP
RADIUS

11. Question

1 points

What level of syslog is associated with Log_Alert?

0
1
2
3
4

12. Question

1 points

syslog server has received the message shown.

*Mar 1 00:07:18.783: %SYS-5-CONFIG_I: Configured from console by vty0 (172.16.45.1)

What can be determined from the syslog message?

The message is a normal notification and should not be reviewed.
The message is a Log_Alert notification message.
The message description displays that the console line was accessed locally.
The message informs the administrator that a user with an IP address of 172.16.45.1 configured this device remotely.

13. Question

2 points

In the implementation of secure network management, what are two services or functions of the management plane of a Cisco router that should be configured? (Choose two.)

Cisco Express Forwarding
secure SSH access
traffic filtering with ACLs
secure logins and passwords
Cisco IOS firewall inspection

14. Question

1 points

Which AAA component can be established using token cards?

accounting
authorization
auditing
authentication

15. Question

1 points

During the AAA process, when will authorization be implemented?

immediately after successful authentication against an AAA data source
immediately after AAA accounting and auditing receives detailed reports
immediately after an AAA client sends authentication information to a centralized server
immediately after the determination of which resources a user can access

16. Question

1 points

What function is provided by the RADIUS protocol?

RADIUS provides separate AAA services.
RADIUS provides secure communication using TCP port 49.
RADIUS provides separate ports for authorization and accounting.
RADIUS provides encryption of the complete packet during transfer.

17. Question

1 points

What does the TACACS+ protocol provide in a AAA deployment?

authorization on a per-user or per-group basis
AAA connectivity via UDP
compatibility with previous TACACS protocols
password encryption without encrypting the packet

18. Question

2 points

A network administrator is configuring an AAA server to manage RADIUS authentication. Which two features are included in RADIUS authentication? (Choose two.)

encryption for all communication
hidden passwords during transmission
single process for authentication and authorization
separate processes for authentication and authorization
encryption for only the data

19. Question

1 points

An administrator is comparing multiple implementations of AAA. Which AAA method is server-based and considered the most secure?

local-case
enable
RADIUS
TACACS+

20. Question

2 points

A network administrator is configuring an AAA server to manage TACACS+ authentication. What are two attributes of TACACS+ authentication? (Choose two.)

encryption for only the password of a user
encryption for all communication
separate processes for authentication and authorization
UDP port 1645
single process for authentication and authorization
TCP port 40

21. Question

2 points

Which two UDP port numbers may be used for server-based AAA RADIUS authentication? (Choose two.)

1645
1812
1646
1813
49

22. Question

1 points

Which functionality does the TACACS single-connection keyword provide to AAA services?

maintains a single UDP connection for the life of the session
enhances the performance of the TCP connection
encrypts the data transfer between the TACACS+ server and the AAA client
allows the use of differing keys between the TACACS+ server and the AAA client

23. Question

1 points

What is an effective deployment of IPS and IDS appliances in a corporate network?

Place both an IPS and an IDS inside the DMZ network.
Place an IPS between the border router and the internal network and an IDS in the same LAN.
Place an IDS between the border router and the internal network and an IPS inside the DMZ network.
Place an IPS between the border router and the internal network and an IDS between the border router and the ISP.

24. Question

1 points

Which statement describes the function of the SPAN tool used in a Cisco switch?

It supports the SNMP trap operation on a switch.
It provides interconnection between VLANs over multiple switches.
It is a secure channel for a switch to send logging to a syslog server.
It copies the traffic from one switch port and sends it to another switch port that is connected to a monitoring device.

25. Question

3 points

What are three attributes of IPS signatures? (Choose three.)

type
depth
length
trigger
action
function

26. Question

1 points

A system analyst is configuring and tuning a recently deployed IPS appliance. By examining the IPS alarm log, the analyst notices that the IPS does not generate alarms for a few known attack packets. Which term describes the lack of alarms by the IPS?

true positive
true negative
false positive
false negative

27. Question

1 points

Which IPS signature trigger type is based on a defined profile of normal network activity?

honeypot-based detection
policy-based detection
pattern-based detection
anomaly-based detection

28. Question

1 points

Which type of IPS signature alarm occurs from normal traffic that should not have triggered an alarm?

false positive
false negative
true positive
true negative

29. Question

1 points

Which condition describes a true positive IPS signature alarm?

when an alarm is generated in response to a known attack
when an alarm is not generated by normal traffic
when an alarm is not generated in response to a known attack
when an alarm is generated by normal traffic

30. Question

1 points

A security specialist configures an IPS so that it will generate an alert when an attack is first detected. Alerts for the subsequent detection of the same attack are suppressed for a pre-defined period of time. Another alert will be generated at the end of the period indicating the number of the attack detected. Which IPS alert monitoring mechanism is configured?

atomic alert
summary alert
composite alert
correlation alert

31. Question

1 points

In configuring a Cisco router to prepare for IPS and VPN features, a network administrator opens the file realm-cisco.pub.key.txt, and copies and pastes the contents to the router at the global configuration prompt. What is the result after this configuration step?

A pair of public/secret keys is created for IPsec VPN operation.
A crypto key is created for IOS IPS to verify the master signature file.
The router is authenticated with the Cisco secure IPS resource web server.
A pair of public/secret keys is created for the router to serve as an SSH server.

32. Question

1 points

What type of data does the DLP feature of Cisco Email Security Appliance scan in order to prevent customer data from being leaked outside of the company?

inbound messages
outbound messages
messages stored on a client device
messages stored on the email server

33. Question

1 points

What is the role of the Cisco NAC Agent in implementing a secure networking infrastructure?

to assess and enforce security policy compliance in the NAC environment
to provide post-connection monitoring of all endpoint devices
to define role-based user access and endpoint security policies
to provide the ability for company employees to create guest accounts
to perform deep inspection of device security profiles

34. Question

3 points

Which three functions are provided under Cisco NAC framework solution? (Choose three.)

AAA services
VPN connection
intrusion prevention
secure connection to servers
scanning for policy compliance
remediation for noncompliant devices

35. Question

1 points

What mitigation plan is best for thwarting a DoS attack that is creating a switch buffer overflow?

Disable DTP.
Disable STP.
Enable port security.
Place unused ports in an unused VLAN.

36. Question

1 points

What mitigation method is effective against CAM table overflow attacks?

port security
DHCP snooping
Dynamic ARP Inspection
Source Guard

37. Question

1 points

Which antispoofing technology is used to mitigate DoS attacks?

encryption
strong authentication
port scanning
switched infrastructure
switch port-security

38. Question

1 points

What action can a network administrator take to help mitigate the threat of VLAN hopping attacks?

Disable VTP.
Configure all switch ports to be members of VLAN 1.
Disable automatic trunking negotiation.
Enable PortFast on all switch ports.

39. Question

1 points

In what situation would a network administrator most likely implement root guard?

on all switch ports (used or unused)
on all switch ports that connect to host devices
on all switch ports that connect to another switch
on all switch ports that connect to a Layer 3 device
on all switch ports that connect to another switch that is not the root bridge

40. Question

1 points

What can be implemented to help mitigate the threat of a rogue switch becoming the root bridge in an STP domain?

root guard
loop guard
BPDU guard
Source Guard

41. Question

1 points

Which network attack is mitigated by enabling BPDU guard?

rogue switches on a network
CAM table overflow attacks
rogue DHCP servers on a network
MAC address spoofing

42. Question

1 points

What type of algorithms require sender and receiver to exchange a secret key that is used to ensure the confidentiality of messages?

hashing algorithms
public key algorithms
symmetric algorithms
asymmetric algorithms

43. Question

1 points

What is the primary function of the Diffie-Hellman algorithm?

to generate and share public keys
to exchange shared secret keys over untrusted networks
to provide data integrity
to prevent man-in-the middle attacks

44. Question

1 points

How is asymmetric encryption used to provide confidentiality for VPN traffic?

A sender encrypts traffic with the public key of the receiver and the receiver decrypts the data using the private key of the receiver.
A sender encrypts traffic with the private key of the receiver and the receiver decrypts the data using the public key of the sender.
A sender encrypts traffic with the public key of the receiver and the receiver decrypts the data using the public key of the sender.
A sender encrypts traffic with the private key of the receiver and the receiver decrypts the data using the private key of the sender.

45. Question

1 points

A security technician uses an asymmetric algorithm to encrypt messages with a private key and then forwards that data to another technician. What key must be used to decrypt this data?

The private key of the sender.
The public key of the sender.
The public key of the receiver.
The private key of the receiver.

46. Question

1 points

Which transform set provides the best protection?

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA esp-aes esp-des esp-sha-hmac

47. Question

1 points

When is a security association (SA) created if an IPsec VPN tunnel is used to connect between two sites?

only during Phase 1
only during Phase 2
during both Phase 1 and 2
after the tunnel is created, but before traffic is sent

48. Question

1 points

What is negotiated in the establishment of an IPsec tunnel between two IPsec hosts during IKE Phase 1?

ISAKMP SA policy
transform sets
interesting traffic
DH groups

49. Question

1 points

What is the next step in the establishment of an IPsec VPN after IKE Phase 1 is complete?

negotiation of the IPsec SA policy
negotiation of the ISAKMP policy
detection of interesting traffic
authentication of peers

50. Question

1 points

Consider the following configuration on a Cisco ASA:

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

What is the purpose of this command?

to define only the allowed encryption algorithms
to define the ISAKMP parameters that are used to establish the tunnel
to define what traffic is allowed through and protected by the tunnel
to define the encryption and integrity algorithms that are used to build the IPsec tunnel

51. Question

1 points

Refer to the exhibit. Based on the security levels of the interfaces on ASA1, what traffic will be allowed on the interfaces?

Implementing Network Security (Version 2.0) – CCNA Security (IINS) Certification Practice Exam Answers 2019 01

Traffic from the Internet and DMZ can access the LAN.
Traffic from the LAN and DMZ can access the Internet.
Traffic from the Internet and LAN can access the DMZ.
Traffic from the Internet can access both the DMZ and the LAN.

52. Question

1 points

In the implementation of security on multiple devices, how do ASA ACLs differ from Cisco IOS ACLs?

Cisco IOS ACLs are configured with a wildcard mask and Cisco ASA ACLs are configured with a subnet mask.
Cisco IOS ACLs utilize an implicit deny all and Cisco ASA ACLs end with an implicit permit all.
Cisco IOS ACLs are processed sequentially from the top down and Cisco ASA ACLs are not processed sequentially.
Cisco IOS routers utilize both named and numbered ACLs and Cisco ASA devices utilize only numbered ACLs.

53. Question

1 points

In the implementation of network security, how does the deployment of a Cisco ASA firewall differ from a Cisco IOS router?

ASA devices use ACLs that are always numbered.
ASA devices do not support an implicit deny within ACLs.
ASA devices support interface security levels.
ASA devices use ACLs configured with a wildcard mask.

54. Question

2 points

When dynamic NAT on an ASA is being configured, what two parameters must be specified by network objects? (Choose two.)

the inside NAT interface
the interface security level
a range of private addresses that will be translated
the outside NAT interface
the pool of public global addresses

55. Question

1 points

What function is performed by the class maps configuration object in the Cisco modular policy framework?

restricting traffic through an interface
applying a policy to an interface
applying a policy to interesting traffic
identifying interesting traffic

Average score
Your score