Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are the 5 phases of the System Development Life Cycle (SDLC)?
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

2. Cisco Security Products: HIPS
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

3. What are two types of risk mitigation
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Application that provides IPS services on a host.

4. What are the 3 types of backup sites?
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Application that provides IPS services on a host.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

5. Cisco Security Products: PIX 500
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

6. What is the ALE and how is it calculated?
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

7. What is MARS?
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

8. Cisco Security Products: 4200 Series IPS
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

9. SDLC: Implementation
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

1. Configuration management and control 2. Continuous monitoring
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

10. What are the components (hierarchy) of the Cisco Self-Defending Network?
Application that provides IPS services on a host.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

11. SDLC: Disposition
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

12. Cisco Security Products: Firewall Services Module (FWSM)
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Application that provides IPS services on a host.
1. Configuration management and control 2. Continuous monitoring

13. What are two primary goals of business continuity planning?
Application that provides IPS services on a host.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

14. SDLC: Operations and Maintenance Phase
Application that provides AAA funtionality
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Configuration management and control 2. Continuous monitoring

15. SDLC Initiation Phase

Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

16. Cisco Security Products: ASA 5500
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

17. What are the components of a Security Policy?
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

18. What is 'Operations Security?'
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

19. What are the 3 classifications of disruptions?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

20. What are the characteristics of the Cisco Self-Defending Network?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Integrated - Collaborative - Adaptive
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

21. Cisco Security Products: Cisco Security Agent (CSA)
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Application that provides IPS services on a host.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

22. What are the 3 phases of disaster recovery?
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

23. What is the Cisco Self-Defending Network?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

24. Cisco Security Products: SDM
Application that provides IPS services on a host.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Integrated - Collaborative - Adaptive

25. SDLC Acquisition and Development Phase
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

26. What is the difference between a Qualitative analysis and a Quantitative Analysis
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

27. What is the Cisco Security Manager?
Integrated - Collaborative - Adaptive
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

28. Cisco Security Products: IOS Router
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

29. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Application that provides AAA funtionality
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

30. What are the 4 Operations Security Recommendations
1. Configuration management and control 2. Continuous monitoring
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues