Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are the components (hierarchy) of the Cisco Self-Defending Network?
Application that provides AAA funtionality
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

2. What are the 3 classifications of disruptions?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

3. Cisco Security Products: Cisco Secure Access Control Server (ACS)
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Application that provides AAA funtionality
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

4. Cisco Security Products: Cisco Security Agent (CSA)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Application that provides IPS services on a host.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

5. What are the 3 types of backup sites?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

6. SDLC: Disposition

Integrated - Collaborative - Adaptive
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

7. SDLC Acquisition and Development Phase
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

8. Cisco Security Products: PIX 500
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

9. Cisco Security Products: ASA 5500
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Application that provides IPS services on a host.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

10. What are the 3 phases of disaster recovery?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Integrated - Collaborative - Adaptive
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

11. What are the characteristics of the Cisco Self-Defending Network?
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Integrated - Collaborative - Adaptive

12. Cisco Security Products: IOS Router
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

13. Cisco Security Products: 4200 Series IPS
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

14. Cisco Security Products: SDM
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Emergency Response 2. Recovery 3. Return to Normal Operations

15. SDLC: Operations and Maintenance Phase
1. Configuration management and control 2. Continuous monitoring
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

16. What is the ALE and how is it calculated?
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Integrated - Collaborative - Adaptive

17. What are two types of risk mitigation
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

1. Emergency Response 2. Recovery 3. Return to Normal Operations
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

18. Cisco Security Products: Firewall Services Module (FWSM)
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

19. What are two primary goals of business continuity planning?
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

20. What is the difference between a Qualitative analysis and a Quantitative Analysis
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

21. SDLC: Implementation
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Application that provides IPS services on a host.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

22. What is 'Operations Security?'
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

23. Cisco Security Products: HIPS
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

24. SDLC Initiation Phase
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

25. What are the components of a Security Policy?

Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Configuration management and control 2. Continuous monitoring
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

26. What are the 4 Operations Security Recommendations
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

27. What is MARS?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

28. What is the Cisco Self-Defending Network?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Integrated - Collaborative - Adaptive
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

29. What are the 5 phases of the System Development Life Cycle (SDLC)?
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

30. What is the Cisco Security Manager?
Application that provides AAA funtionality
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch