CCNA Security

Instructions:

• Answer 30 questions in 15 minutes.
• If you are not ready to take this test, you can study here.
• Match each statement with the correct term.
• Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What are the 5 phases of the System Development Life Cycle (SDLC)?
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.


2. What are the 3 types of backup sites?

Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch


3. What are two types of risk mitigation
Application that provides IPS services on a host.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring


4. SDLC: Disposition
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Application that provides IPS services on a host.


5. What are the 4 Operations Security Recommendations
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.


6. SDLC: Operations and Maintenance Phase
1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Configuration management and control 2. Continuous monitoring
1. Information preservation 2. Media sanitation 3. Hardware and software disposal


7. Cisco Security Products: 4200 Series IPS
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.


8. What are the 3 phases of disaster recovery?
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication


9. What are two primary goals of business continuity planning?
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing


10. What is 'Operations Security?'
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Configuration management and control 2. Continuous monitoring

An attempt to secure hardware - software - and various media while investigating anomalous network behavior.


11. Cisco Security Products: Cisco Security Agent (CSA)
1. Configuration management and control 2. Continuous monitoring
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Application that provides IPS services on a host.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition


12. What is the Cisco Self-Defending Network?
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)


13. Cisco Security Products: Firewall Services Module (FWSM)
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.

Integrated - Collaborative - Adaptive
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.


14. Cisco Security Products: SDM

Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
1. Information preservation 2. Media sanitation 3. Hardware and software disposal


15. What are the 3 classifications of disruptions?
Application that provides AAA funtionality
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent


16. What are the characteristics of the Cisco Self-Defending Network?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Integrated - Collaborative - Adaptive
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.


17. What are the components of a Security Policy?
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.



18. SDLC: Implementation
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
Application that provides AAA funtionality
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation


19. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
1. Configuration management and control 2. Continuous monitoring
Application that provides AAA funtionality


20. SDLC Acquisition and Development Phase
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Integrated - Collaborative - Adaptive
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing


21. What is MARS?
1. Configuration management and control 2. Continuous monitoring
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif


22. Cisco Security Products: PIX 500
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment


23. Cisco Security Products: IOS Router
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.


24. What is the ALE and how is it calculated?

ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Application that provides AAA funtionality



25. Cisco Security Products: ASA 5500
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.


26. What is the Cisco Security Manager?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.


27. SDLC Initiation Phase
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Configuration management and control 2. Continuous monitoring
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment


28. What is the difference between a Qualitative analysis and a Quantitative Analysis

Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)


29. Cisco Security Products: HIPS
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Integrated - Collaborative - Adaptive


30. What are the components (hierarchy) of the Cisco Self-Defending Network?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.