Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Application that provides IPS services on a host.
Application that provides AAA funtionality
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

2. Cisco Security Products: IOS Router

Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

3. Cisco Security Products: Cisco Security Agent (CSA)
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Application that provides IPS services on a host.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

4. What are the 3 classifications of disruptions?
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Integrated - Collaborative - Adaptive
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

5. SDLC: Operations and Maintenance Phase
1. Configuration management and control 2. Continuous monitoring
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Integrated - Collaborative - Adaptive

6. What are the 5 phases of the System Development Life Cycle (SDLC)?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Configuration management and control 2. Continuous monitoring

7. What are the components (hierarchy) of the Cisco Self-Defending Network?
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

8. What is the Cisco Self-Defending Network?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

9. What are two primary goals of business continuity planning?
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Application that provides AAA funtionality
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

10. What is 'Operations Security?'
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Configuration management and control 2. Continuous monitoring
1. Emergency Response 2. Recovery 3. Return to Normal Operations

11. SDLC: Implementation
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Integrated - Collaborative - Adaptive

12. Cisco Security Products: Firewall Services Module (FWSM)

Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

13. SDLC: Disposition
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Application that provides IPS services on a host.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

14. What are two types of risk mitigation
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

15. What is MARS?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

16. Cisco Security Products: SDM
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

17. Cisco Security Products: PIX 500
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

18. Cisco Security Products: 4200 Series IPS
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

19. What are the 3 types of backup sites?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

20. SDLC Initiation Phase
Integrated - Collaborative - Adaptive
Application that provides IPS services on a host.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

21. What are the 3 phases of disaster recovery?
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Integrated - Collaborative - Adaptive
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

22. SDLC Acquisition and Development Phase
1. Configuration management and control 2. Continuous monitoring
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

23. Cisco Security Products: ASA 5500
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

24. What are the 4 Operations Security Recommendations
1. Configuration management and control 2. Continuous monitoring
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Application that provides IPS services on a host.

25. What are the components of a Security Policy?

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Integrated - Collaborative - Adaptive

26. What is the Cisco Security Manager?
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

27. What is the difference between a Qualitative analysis and a Quantitative Analysis
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

28. Cisco Security Products: HIPS
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Integrated - Collaborative - Adaptive

29. What are the characteristics of the Cisco Self-Defending Network?
Integrated - Collaborative - Adaptive
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

30. What is the ALE and how is it calculated?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif