Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are the 3 types of backup sites?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Integrated - Collaborative - Adaptive
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

2. What is the Cisco Security Manager?
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Application that provides IPS services on a host.

3. What are the 5 phases of the System Development Life Cycle (SDLC)?
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

4. What are the 3 classifications of disruptions?
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

5. What are two types of risk mitigation
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

6. What are the 3 phases of disaster recovery?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Application that provides AAA funtionality

7. Cisco Security Products: HIPS
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

8. Cisco Security Products: PIX 500

1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

9. What are two primary goals of business continuity planning?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Integrated - Collaborative - Adaptive

10. SDLC Initiation Phase
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Application that provides IPS services on a host.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

11. Cisco Security Products: SDM
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

12. Cisco Security Products: IOS Router

Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

13. What are the components (hierarchy) of the Cisco Self-Defending Network?

1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

14. What is the Cisco Self-Defending Network?
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Application that provides IPS services on a host.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

15. Cisco Security Products: ASA 5500
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Integrated - Collaborative - Adaptive
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

16. What is the ALE and how is it calculated?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

17. What are the components of a Security Policy?
1. Configuration management and control 2. Continuous monitoring

Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

18. Cisco Security Products: Firewall Services Module (FWSM)
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

19. SDLC Acquisition and Development Phase
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

20. What is 'Operations Security?'
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

21. What are the characteristics of the Cisco Self-Defending Network?
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

Integrated - Collaborative - Adaptive
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

22. Cisco Security Products: Cisco Security Agent (CSA)
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Application that provides AAA funtionality
Application that provides IPS services on a host.

23. What are the 4 Operations Security Recommendations
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

24. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Application that provides AAA funtionality
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

25. What is the difference between a Qualitative analysis and a Quantitative Analysis
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

26. What is MARS?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

27. SDLC: Disposition
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Application that provides AAA funtionality
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

28. Cisco Security Products: 4200 Series IPS
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Configuration management and control 2. Continuous monitoring
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

29. SDLC: Operations and Maintenance Phase
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Configuration management and control 2. Continuous monitoring
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

30. SDLC: Implementation

1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Integrated - Collaborative - Adaptive
Application that provides IPS services on a host.