Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are two primary goals of business continuity planning?
1. Configuration management and control 2. Continuous monitoring
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

2. What is MARS?
Integrated - Collaborative - Adaptive
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Configuration management and control 2. Continuous monitoring

3. What are two types of risk mitigation
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

4. What is 'Operations Security?'
Application that provides AAA funtionality
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.

5. SDLC: Implementation
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

6. What are the 5 phases of the System Development Life Cycle (SDLC)?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Configuration management and control 2. Continuous monitoring
Application that provides AAA funtionality
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

7. Cisco Security Products: Firewall Services Module (FWSM)
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Integrated - Collaborative - Adaptive
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

8. What is the ALE and how is it calculated?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

9. What are the 3 classifications of disruptions?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring

10. What are the 4 Operations Security Recommendations
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

11. Cisco Security Products: 4200 Series IPS
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

12. SDLC Initiation Phase
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

13. Cisco Security Products: SDM
Integrated - Collaborative - Adaptive
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

14. What is the difference between a Qualitative analysis and a Quantitative Analysis
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

15. Cisco Security Products: Cisco Security Agent (CSA)
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Application that provides IPS services on a host.
Application that provides AAA funtionality

16. SDLC: Disposition
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

17. Cisco Security Products: Cisco Secure Access Control Server (ACS)
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Application that provides AAA funtionality

18. What are the components of a Security Policy?

Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Application that provides AAA funtionality

19. What are the components (hierarchy) of the Cisco Self-Defending Network?
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

20. What are the 3 phases of disaster recovery?
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Emergency Response 2. Recovery 3. Return to Normal Operations

21. SDLC: Operations and Maintenance Phase

1. Configuration management and control 2. Continuous monitoring
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Integrated - Collaborative - Adaptive

22. Cisco Security Products: IOS Router
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

23. What are the 3 types of backup sites?
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

24. Cisco Security Products: PIX 500
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

25. Cisco Security Products: ASA 5500

Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

26. What are the characteristics of the Cisco Self-Defending Network?
Integrated - Collaborative - Adaptive
1. Configuration management and control 2. Continuous monitoring
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

27. What is the Cisco Self-Defending Network?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

28. What is the Cisco Security Manager?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

29. Cisco Security Products: HIPS
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

30. SDLC Acquisition and Development Phase
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Configuration management and control 2. Continuous monitoring
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Emergency Response 2. Recovery 3. Return to Normal Operations