Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What is the Cisco Security Manager?
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

2. What are the 3 phases of disaster recovery?
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

1. Emergency Response 2. Recovery 3. Return to Normal Operations
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

3. What are the 4 Operations Security Recommendations
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Configuration management and control 2. Continuous monitoring
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

4. What are two types of risk mitigation
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Application that provides AAA funtionality
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

5. What is the Cisco Self-Defending Network?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

6. Cisco Security Products: 4200 Series IPS

Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Integrated - Collaborative - Adaptive

7. Cisco Security Products: PIX 500
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Configuration management and control 2. Continuous monitoring

8. Cisco Security Products: Cisco Security Agent (CSA)
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Application that provides IPS services on a host.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

9. What are the characteristics of the Cisco Self-Defending Network?
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Integrated - Collaborative - Adaptive
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

10. What are the components of a Security Policy?

Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Application that provides AAA funtionality

11. Cisco Security Products: Firewall Services Module (FWSM)
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

12. Cisco Security Products: SDM
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

13. SDLC Initiation Phase
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)

14. What are the 3 classifications of disruptions?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

15. SDLC: Implementation
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

16. What are the 3 types of backup sites?
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

17. Cisco Security Products: HIPS
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

18. SDLC: Disposition
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

19. SDLC: Operations and Maintenance Phase
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Configuration management and control 2. Continuous monitoring

20. What are two primary goals of business continuity planning?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

21. What is 'Operations Security?'
1. Emergency Response 2. Recovery 3. Return to Normal Operations
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Information preservation 2. Media sanitation 3. Hardware and software disposal

22. What are the components (hierarchy) of the Cisco Self-Defending Network?
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

23. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Application that provides AAA funtionality
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

24. What is the ALE and how is it calculated?
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

25. Cisco Security Products: IOS Router
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

26. SDLC Acquisition and Development Phase
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

27. What are the 5 phases of the System Development Life Cycle (SDLC)?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Configuration management and control 2. Continuous monitoring

28. Cisco Security Products: ASA 5500
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

29. What is the difference between a Qualitative analysis and a Quantitative Analysis
1. Configuration management and control 2. Continuous monitoring
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Application that provides AAA funtionality
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

30. What is MARS?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.