Do I Know This Already Klo
1. DMZ stands for what?
Answer: a. Demilitarized zone
2. When defining an extended access list, what TCP port numbers can you use? Answer: c. 0 to 65,535
TCP port numbers from 0 to 65,535 can be used when defining an extended access list; devices such as PCs go from 1023 to 65535.
3. When defining an extended access list, what UDP port numbers can you use? Answer: c. 0 to 65,535
UDP port numbers from 0 to 65,535 can be used when defining an extended access list.
4. Which of the following is not a TCP service? Answer: a. who who is a UDP service.
5. Which of the following is not a UDP service? Answer: a. BGP
BGP runs over TCP port 179.
6. About how many translations does PAT (for a PIX Firewall) allow you to use for one IP address?
Answer: b. 64,000
Port Address Translation (PAT) occurs when the local port number is modified, allowing more than one host the ability to share one public address, for example. The port number in a TCP frame can be numbered from 0 to 65,535, so 64,000 is closest to the actual number of allowed translations.
7. PAT translates all private addresses based on what? Answer: c. Both source and destination ports
PAT is based on source port; the destination port is not altered but is taken into consideration when making decisions. For example, a Telnet connection is based on the local port number (a random number generated by the device between 0 and 65,535) and the destination port number 23.
8. NAT is which of the following? Answer: d. Network Address Translation
9. NAT is defined in which RFC? Answer: d. 1631
NAT is defined by Request for Comment (RFC) number 1631.
10. The following defines which NAT terminology: "A legitimate registered IP address as assigned by the InterNIC?"
Answer: c. Inside global address
11. NAT might often be broken in what common scenario?
Answer: c. By traffic that carries the source/destination IP address in the application data fields
NAT does not work well if the application carries the details on local and remote ports in the data section, because the checksum will change and may cause CRC errors.
12. When will the command overload, applied to NAT configurations, possibly break a network application?
Answer: e. With some multimedia applications
NAT does not work well with some multimedia applications that send local and remote port details in the data stream.
13. Firewalls can operate at what three layers of the OSI model? Answer: d. 7, 4, 3
Firewalls can operate at the application (7), transport (4), and network (3) layers.
14. What is the main advantage of using NAT on a firewall or Cisco IOS router?
Answer: b. Enables RFC 1918-based privately defined IP addresses to be configured and enables access to the Internet
The primary reason to use NAT is for Internet access and to hide internal IP addresses. RFC 1918 is based on privately defined IP addresses and enables access to the Internet by using NAT/PAT. It can also be used when one organization is merged with another in case the IP subnet address space is the same.
15. When using the IOS NAT overload command, how many inside sessions can be translated? Answer: c. 64,000
16. What IOS command defines a pool of IP addresses for Network Address Translation (NAT)? Answer: c. ip nat pool
To define a pool of IP addresses for NAT, use the ip nat pool command in global configuration mode. The ip nat pool command defines the actual registered IP addresses.
17. PIX stands for what?
Answer: c. Private Internet Exchange
18. To define how a PIX will route IP data, what is the correct syntax for a PIX? Answer: b. route
A PIX can run RIP or be configured for static routing; a default route is typically required so that end-user data can be sent to the Internet, for example.
19. If you configure NAT on an Cisco IOS router, what command is used to enable PAT? Answer: d. overload
The overload command enables the router to use one global address for many local addresses. When overloading is configured, the TCP or UDP port number of each inside host distinguishes between the multiple conversations using the same local IP address.
20. Cisco IOS-based NAT provides all of the following functions except one; which one? Answer: b. It can be traced or viewed by an outside address
Cisco IOS-based NAT does not permit an inside host to be traced from an Internet or outside address.
21. Which of the following is not considered a security device? Answer: d. Microsoft Windows XP Professional
PIX, switches, IDS, and VPN Concentrators are all considered devices that provide security.
22. What extended IP access list will prevent the internal subnet 10.0.0.0/8 from being spoofed on a Cisco IOS-enabled router? (Assume permit statements are applied to allow legitimate traffic.)
Answer: d. access-list 100 ip deny 10.0.0.0 0.0.0.255 0.0.0.0 any
The correct command to deny the 10.0.0.0/8 is access-list 100 ip deny 10.0.0.0 0.0.0.255 0.0.0.0 any. Of course, you must also apply the ACL to the interface.
23. What is the alias command's function on a PIX Firewall?
Answer: c. The alias command is used in NAT environments where one IP address is translated into another
The PIX alias command is used for NAT configurations. (The alias command is replaced in newer versions with a dns keyword in static and nat commands.) The alias command translates one IP address into another address. For example, one private network might be using unregistered IP address space, and to allow users access to outside address space, the alias command is used. This command is applied differently on a Cisco IOS router.
PIX Firewall software version 6.2 allows NAT of external source IP addresses for packets traveling from the outside interface to the inside interface. All functionality available with traditional NAT, such as fixups, stateful failover, dynamic NAT, static NAT, and PAT, are available bidirectionally in this release.
24. CBAC stands for what?
Answer: c. Context-Based Access Control
25. What is IKE used to accomplish?
Answer: c. To ensure that data is not viewable by unauthorized sources
Internet Key Exchange (IKE) ensures that network confidentiality is protected against unauthorized sources.
26. To create a simple VPN tunnel (unencrypted) between two sites, what must you do on a Cisco router?
Answer: a. Create a GRE tunnel
A simple VPN tunnel requires a generic routing encapsulation (GRE) tunnel between two Cisco routers.
27. PIX Firewall software version 6.3 can support which of the following routing protocols? (Choose the best three answers.)
Answers: b. OSPF
d. RIP version 2
PIX Firewall software version 6.3 is now capable of supporting RIP versions 1 and 2 along with OSPF.
28. To support OSPF on a PIX Firewall version 6.3-capable firewall, what additional OSPF authentication mechanisms are possible? (Choose the best two answers.)
Answers: a. MD5
c. Password
OSPF can be tightened with secure options by enabling MD5 password authentications. OSPF will not become an adjacent neighbor with a device configured in the wrong area, but this cannot be regarded as an authentication mechanism. However, this can be viewed as a light security option as well. This is a very tricky question. RADIUS and the two other security application protocols cannot be used to secure OSPF.
29. What PIX command can be used for a dual NAT environment? Answer: c. alias
The alias command can be used for two scenarios, dual NAT or DNS doctoring. PIX Firewall 6.3 now has bidirectional NAT, however the alias command is still being tested.
30. What PIX command is used on a PIX Firewall to view address mappings when NAT is enabled?
Answer: d. show xlate
31. If a PIX Firewall is configured without a conduit or an access list, data from the inside interface is dropped. In effect, the PIX Firewall is acting like which of the following? (Select the best two answers.)
Answers: d. Bit bucket e. Black hole router
If there are no conduits/access lists, then any data from the outside interface will be dropped or thrown away, resulting in the PIX Firewall acting as a bit bucket or black hole router. A bit bucket is commonly referred to as a router throwing out bits or bytes. A black hole router is the same thing!
32. After viewing the PIX syslog with the command show logging, the following output is discovered:
14:25:02 10.1.1.1 : %PIX-7-7100006: TCP request discarded from 6.3.62.119/57000 to inside:10.1.1.1/www
Assuming the inside interface on the PIX is configured for the IP address 10.1.1.1/24, which of the following answers best describes what might be going on in the network?
Answer: c. A host on the inside has launched a denial of service (DoS) attack generating random source addresses aimed at the PIX inside interface.
Severity level 7 is a debug message, and this particular message indicates an inside host is launching a random DoS attack aimed at the inside interface 10.1.1.1 using HTTP or the World Wide Web.
33. Which of the following statements best describes Cisco Threat Response (CTR)?
Answer: a. CTR reads IDS alarms and performs automated forensics on hosts or servers that may have been compromised.
Cisco Threat Response technology provides an automated, just-in-time, around-the-clock, real-time analysis of each targeted host to determine whether a compromise has occurred and to determine how to address it quickly. Additionally, CTR reads IDS alarms and performs automated tasks.
34. Which of the following best describes Cisco Security Agent (CSA)?
Answer: b. CSA uses a set of predefined rules to protect host-based systems such as PCs or servers.
35. Which of the following describes the default rules a host version of the Cisco Security Agent accomplishes? (Choose the best three answers.)
Answers: a. Prevents writing to the system directory.
b. Stops unauthorized systems from initiating network connections to the CSA-protected host.
e. Prevents updates to the system registry.
36. IEEE 802.1X is primarily used for what purpose?
Answer: d. Allow Layer 3 communication and authenticate clients
The primary function of IEEE 802.1X is to authenticate clients and permit Layer 3 communications.
What device initiates the first communication in IEEE 802.1X? Answer: c. The end workstation connected to the switch
IEEE 802.1X is initiated by the end workstation connected to the active Layer 2/3 switch.
CSA is supported on what two platforms? Answers: a. Windows b. UNIX
CSA is supported on Windows and UNIX platforms only.
How does anomaly-based intrusion detection recognize that a network attack is in progress?
Answer: b. The IDS normalizes network traffic and sends alarms when sampled traffic falls out of that norm.
Anomaly-based IDS checks network traffic for patterns falling outside normal packet structures.
What does the term DMZ refer to?
Answer: The DMZ, or demilitarized zone, is defined as an isolated part of the network that is easily accessible to hosts on the outside (Internet, for example).
What is the perimeter router's function in a DMZ?
Answer: The perimeter router sits between the DMZ and the public domain. It is typically a high-performance router (or routers) that performs a number of duties, including the following:
■ Uses access lists to ensure access to IP is restricted
■ Sets restrictions to TCP services
■ Sets restrictions on what applications can be run
■ Sets routing protocols (typically, BGP)
Typically the DMZ is a third interface on a firewall containing the inside and outside interface also.
Extended access lists filter the services of what two main transport layer protocols? Answer: Extended access lists filter both TCP and UDP transport layer services.
4. Which of the following is not a TCP service?
a. Ident b. FTP
c. pop3
d. pop2
e. echo
Answer: Echo is part of the UDP protocol suite. Ident, FTP, and pop2/pop3 are TCP services.
5. Name five UDP services that can be filtered with an extended access list. Answer: Cisco IOS can filter a number of UDP services, including the following:
■ biff—Biff (mail notification, comsat, 512)
■ bootpc—Bootstrap Protocol (BOOTP) client (68)
■ bootps—Bootstrap Protocol (BOOTP) server (67)
■ dnsix—DNSIX security protocol auditing (195)
■ isakmp—Internet Security Association and Key Management Protocol (500)
■ mobile-ip—Mobile IP registration (434)
■ nameserver—IEN116 name service (obsolete, 42)
■ netbios-dgm—NetBIOS datagram service (138)
■ netbios-ns—NetBIOS name service (137)
■ netbios-ss—NetBIOS session service (139)
■ rip—Routing Information Protocol (router, in.routed, 520)
■ snmp—Simple Network Management Protocol (161)
■ sunrpc—Sun Remote Procedure Call (111)
■ tacacs—TAC Access Control System (49)
■ tftp—Trivial File Transfer Protocol (69)
■ xdmcp—X Display Manager Control Protocol (177)
6. What RFC defines NAT?
Answer: Network Address Translation (NAT) is defined in RFC 1631.
7. In NAT, what is the inside local address used for?
Answer: The inside local address refers to the IP address that is assigned to a host on the internal network—that is, the logical address that is not being advertised to the Internet. A local administrator generally assigns this address. This address is not a legitimate Internet address.
8. What does the IOS command ip nat inside source list accomplish?
Answer: It defines the addresses that will be allowed to access the Internet. This command enables NAT of the inside source addresses. The list keyword helps define the access list to be used for determining the source addresses.
9. What are the four possible NAT translations on a Cisco IOS router? Answer: The four NAT translation versions are as follows:
■ Static NAT—Maps an unregistered IP address to a registered IP address on a one-to-one basis.
■ Dynamic NAT—Maps an unregistered IP address to a registered IP address from a group of registered IP addresses.
■ Overloading—A form of dynamic NAT that maps multiple unregistered IP addresses to a single registered IP address using different ports. Known also as Port Address Translation (PAT), single address NAT, or port-level multiplexed NAT.
■ Overlapping—When the IP addresses used on your internal network are registered IP addresses in use on another network, the router must maintain a lookup table of these addresses so that it can intercept them and replace them with registered unique IP addresses.
10. How many connections can be translated with a PIX Firewall for the following RAM configurations: 16 MB, 32 MB, and 256 MB?
Answer: You can support up to 7500 connections with 16 MB, 25,000 connections with 32 MB, and 280,000 connections with 256 MB.
11. When the alias command is applied to a PIX Firewall, what does it accomplish?
Answer: The alias command translates one address into another, and is used for translating unregistered IP addresses in a NAT environment. The PIX Firewall software version 6.2 and above allows NAT of external source IP addresses for packets traveling from the outside interface to the inside interface. All functionality available with traditional NAT, such as fixups, stateful failover, dynamic NAT, static NAT, and PAT, are available bidirectionally in this release.
12. What security features does the Cisco IOS Firewall feature set allow a network administrator to accomplish?
Answer: The Cisco IOS Firewall feature set consists of the following:
■ Context-based Access Control (CBAC)—Provides to internal users secure, per-application-based access control for all traffic across perimeters, such as between private enterprise networks and the Internet.
■ Java blocking—Protects against unidentified, malicious Java applets.
■ DoS detection and prevention—Defends and protects router resources against common attacks, by checking packet headers and dropping suspicious packets.
■ Audit trail—Details transactions, recording time stamp, source host, destination host, ports, duration, and total number of bytes transmitted.
■ Real-time alerts—Logs alerts in case of DoS attacks or other preconfigured conditions.
13. What does CBAC stand for? Answer: Context-Based Access Control
14. Name the eight possible steps to take when configuring CBAC.
Answer: To configure CBAC, the following tasks are required, except for the last task, which is optional:
1. Pick an internal or external interface.
2. Configure IP access lists at the interface.
3. Configure global timeouts and thresholds.
4. Define an inspection rule.
5. Apply the inspection rule to an interface.
6. Configure logging and audit trail.
7. Follow other guidelines for configuring a firewall.
8. Verify CBAC. (Optional)
15. What is a virtual private network?
Answer: A virtual private network (VPN) enables IP traffic to travel securely over a public
TCP/IP network by encrypting all traffic from one network to another. A VPN uses tunneling to encrypt all information at the IP level.
16. What type of attacks can be mitigated by CSA?
Answer: The types of attacks that can be stopped by CSA are numerous. The following is a list of these attacks and the corresponding countermeasures taken by CSA:
■ Probes—CSA prevents scanning of ports and ping packets.
■ Penetration—CSA prevents unauthorized mail attachments from running, buffer overflows, ActiveX controls, network installs, backdoors, guessing passwords, and guessing of mail users.
■ Persist—CSA prevents new file creation, modification of existing files, and registration of trap doors.
■ Propagate—CSA prevents mail clients from sending out e-mails to propagate the attack, web connections, FTP, and infecting file shares.
■ Paralyze—CSA does not permit deletion or modification of files and prevents drilling of security holes (opening new doors to provide an opening into your network or device).
17. What are the three possible states with an 802.1X connection?
Answer: The switch port can be in one of three states:
■ Authorized—Successful authentication and normal packet flow.
■ Unauthorized 802.1X—If a client device does not support 802.1X authentication, the port is left unauthorized.
■ 802.1X enabled—If a client is enabled for 802.1X but the switch port is not configured for 802.1X support, the client initiates but will not receive a reply. The client then sends packets, assuming that the authorization was granted.
Continue reading here: Do I Know This Already Nxo
Was this article helpful?