Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Cisco Security Products: PIX 500
Application that provides IPS services on a host.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

2. What is 'Operations Security?'
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Configuration management and control 2. Continuous monitoring

3. What is MARS?
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Integrated - Collaborative - Adaptive
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

4. SDLC Acquisition and Development Phase
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

5. Cisco Security Products: SDM
Application that provides AAA funtionality
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

6. What are the characteristics of the Cisco Self-Defending Network?
Integrated - Collaborative - Adaptive
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

7. What is the ALE and how is it calculated?
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Application that provides IPS services on a host.

8. Cisco Security Products: Cisco Security Agent (CSA)
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Configuration management and control 2. Continuous monitoring
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Application that provides IPS services on a host.

9. What is the difference between a Qualitative analysis and a Quantitative Analysis
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

10. Cisco Security Products: Cisco Secure Access Control Server (ACS)
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Application that provides AAA funtionality

11. What are the 3 types of backup sites?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

12. SDLC: Disposition
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Application that provides IPS services on a host.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

13. SDLC Initiation Phase
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Integrated - Collaborative - Adaptive
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

14. SDLC: Operations and Maintenance Phase
1. Configuration management and control 2. Continuous monitoring
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

15. Cisco Security Products: IOS Router
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

16. What are two types of risk mitigation
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

17. Cisco Security Products: 4200 Series IPS
1. Configuration management and control 2. Continuous monitoring
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

18. What are the components (hierarchy) of the Cisco Self-Defending Network?
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

19. What is the Cisco Self-Defending Network?
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

20. SDLC: Implementation
Application that provides IPS services on a host.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

21. What are the 4 Operations Security Recommendations
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

22. What are the components of a Security Policy?

1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

23. What are the 3 classifications of disruptions?
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Application that provides IPS services on a host.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

24. What are the 3 phases of disaster recovery?
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

25. What is the Cisco Security Manager?
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

26. Cisco Security Products: HIPS
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

27. Cisco Security Products: ASA 5500
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Application that provides IPS services on a host.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

28. Cisco Security Products: Firewall Services Module (FWSM)
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

29. What are two primary goals of business continuity planning?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

30. What are the 5 phases of the System Development Life Cycle (SDLC)?
1. Configuration management and control 2. Continuous monitoring
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring