Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are the characteristics of the Cisco Self-Defending Network?
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Integrated - Collaborative - Adaptive
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

2. Cisco Security Products: 4200 Series IPS
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

3. What is MARS?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Application that provides IPS services on a host.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

4. What are the 3 types of backup sites?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Integrated - Collaborative - Adaptive
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

5. What are two primary goals of business continuity planning?
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

6. What are the 5 phases of the System Development Life Cycle (SDLC)?
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

7. What is 'Operations Security?'
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Integrated - Collaborative - Adaptive
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

8. SDLC: Implementation
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

9. Cisco Security Products: ASA 5500
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

10. Cisco Security Products: SDM
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

11. Cisco Security Products: PIX 500
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Application that provides AAA funtionality
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

12. What is the difference between a Qualitative analysis and a Quantitative Analysis
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

13. What are the components (hierarchy) of the Cisco Self-Defending Network?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

14. Cisco Security Products: HIPS
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

15. What is the Cisco Security Manager?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Application that provides IPS services on a host.

16. SDLC Initiation Phase
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

17. What is the Cisco Self-Defending Network?
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

18. What are the components of a Security Policy?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Application that provides IPS services on a host.

19. SDLC: Disposition
Application that provides AAA funtionality

1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

20. What is the ALE and how is it calculated?
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

21. SDLC: Operations and Maintenance Phase
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Configuration management and control 2. Continuous monitoring
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

22. What are the 3 classifications of disruptions?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

23. SDLC Acquisition and Development Phase
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

Integrated - Collaborative - Adaptive

24. Cisco Security Products: Cisco Secure Access Control Server (ACS)
1. Configuration management and control 2. Continuous monitoring
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Application that provides AAA funtionality
Integrated - Collaborative - Adaptive

25. What are the 4 Operations Security Recommendations
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Emergency Response 2. Recovery 3. Return to Normal Operations

26. What are two types of risk mitigation
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Integrated - Collaborative - Adaptive

27. What are the 3 phases of disaster recovery?
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Application that provides IPS services on a host.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

28. Cisco Security Products: Cisco Security Agent (CSA)
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Application that provides IPS services on a host.

29. Cisco Security Products: IOS Router
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

30. Cisco Security Products: Firewall Services Module (FWSM)
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Application that provides IPS services on a host.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.