Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are two primary goals of business continuity planning?
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

2. SDLC: Operations and Maintenance Phase
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Configuration management and control 2. Continuous monitoring
Application that provides AAA funtionality

3. What are the characteristics of the Cisco Self-Defending Network?
Integrated - Collaborative - Adaptive
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Application that provides IPS services on a host.

4. Cisco Security Products: 4200 Series IPS
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

5. SDLC: Disposition
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

6. What are the 3 phases of disaster recovery?
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Integrated - Collaborative - Adaptive

7. What are the 3 classifications of disruptions?
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Configuration management and control 2. Continuous monitoring
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

8. SDLC: Implementation
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

9. What are the components of a Security Policy?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

10. SDLC Initiation Phase
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

11. What is MARS?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

12. Cisco Security Products: Cisco Security Agent (CSA)
1. Configuration management and control 2. Continuous monitoring
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Application that provides IPS services on a host.

13. Cisco Security Products: PIX 500
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

14. SDLC Acquisition and Development Phase
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

15. What is the Cisco Self-Defending Network?
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

16. What is the ALE and how is it calculated?
1. Configuration management and control 2. Continuous monitoring
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

17. What are the 3 types of backup sites?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

18. Cisco Security Products: HIPS
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

19. Cisco Security Products: ASA 5500
Application that provides AAA funtionality
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

20. What is the difference between a Qualitative analysis and a Quantitative Analysis
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Configuration management and control 2. Continuous monitoring

21. What are the 5 phases of the System Development Life Cycle (SDLC)?
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

22. What are the components (hierarchy) of the Cisco Self-Defending Network?

An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Integrated - Collaborative - Adaptive
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

23. What are two types of risk mitigation
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

24. What is 'Operations Security?'
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

25. What are the 4 Operations Security Recommendations
Application that provides IPS services on a host.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

26. Cisco Security Products: IOS Router
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

27. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Application that provides AAA funtionality
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

28. Cisco Security Products: SDM
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

29. What is the Cisco Security Manager?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Integrated - Collaborative - Adaptive
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

30. Cisco Security Products: Firewall Services Module (FWSM)
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.