Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Cisco Security Products: IOS Router
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

2. What are the components (hierarchy) of the Cisco Self-Defending Network?
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

3. Cisco Security Products: Firewall Services Module (FWSM)
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

4. SDLC Acquisition and Development Phase
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

5. What is MARS?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

6. Cisco Security Products: HIPS
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Application that provides AAA funtionality

1. Emergency Response 2. Recovery 3. Return to Normal Operations

7. What are the 3 phases of disaster recovery?
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

8. SDLC Initiation Phase
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

9. SDLC: Disposition
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

10. SDLC: Implementation
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

11. What is the difference between a Qualitative analysis and a Quantitative Analysis
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

12. What is 'Operations Security?'

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Integrated - Collaborative - Adaptive
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

13. Cisco Security Products: PIX 500
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

14. Cisco Security Products: Cisco Secure Access Control Server (ACS)
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Application that provides AAA funtionality

15. What are the 3 types of backup sites?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

16. What is the ALE and how is it calculated?
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Configuration management and control 2. Continuous monitoring

ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

17. Cisco Security Products: Cisco Security Agent (CSA)

Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Application that provides IPS services on a host.
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

18. Cisco Security Products: 4200 Series IPS
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Integrated - Collaborative - Adaptive
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

19. What are the 3 classifications of disruptions?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Configuration management and control 2. Continuous monitoring

20. Cisco Security Products: ASA 5500
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Application that provides AAA funtionality

21. SDLC: Operations and Maintenance Phase
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Configuration management and control 2. Continuous monitoring
Application that provides IPS services on a host.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

22. What is the Cisco Self-Defending Network?
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

23. What are the 4 Operations Security Recommendations

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

24. What are the components of a Security Policy?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

25. What are the characteristics of the Cisco Self-Defending Network?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Integrated - Collaborative - Adaptive
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

26. What is the Cisco Security Manager?
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Emergency Response 2. Recovery 3. Return to Normal Operations

27. What are two types of risk mitigation
Application that provides AAA funtionality
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Emergency Response 2. Recovery 3. Return to Normal Operations

28. What are the 5 phases of the System Development Life Cycle (SDLC)?
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

29. What are two primary goals of business continuity planning?
1. Configuration management and control 2. Continuous monitoring
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

30. Cisco Security Products: SDM
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.