Test your basic knowledge |

CCNA Security

Instructions:

Answer 30 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. What is MARS?
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Integrated - Collaborative - Adaptive
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

2. SDLC: Operations and Maintenance Phase
Integrated - Collaborative - Adaptive

1. Configuration management and control 2. Continuous monitoring
1. Emergency Response 2. Recovery 3. Return to Normal Operations

3. SDLC: Disposition
Application that provides IPS services on a host.
1. Configuration management and control 2. Continuous monitoring
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition

4. What are the 3 phases of disaster recovery?
1. Emergency Response 2. Recovery 3. Return to Normal Operations
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
1. Configuration management and control 2. Continuous monitoring
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch

5. What are the components (hierarchy) of the Cisco Self-Defending Network?

Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues

6. What are two types of risk mitigation
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

7. Cisco Security Products: IOS Router
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

8. What are the 5 phases of the System Development Life Cycle (SDLC)?
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

9. What are the characteristics of the Cisco Self-Defending Network?
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
Many Cisco IOS routers can be configured with Intrusion Prevention System (IPS) - virtual private network (VPN) and firewall features.
Integrated - Collaborative - Adaptive
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.

10. Cisco Security Products: Cisco Secure Access Control Server (ACS)
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.
Application that provides AAA funtionality
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs

11. Cisco Security Products: HIPS
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

12. Cisco Security Products: PIX 500
1. Configuration management and control 2. Continuous monitoring
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Cisco PIX 500 series of security appliances offer firewall and VPN-termination features.

13. What are the 4 Operations Security Recommendations
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Integrated - Collaborative - Adaptive

14. What are the 3 types of backup sites?
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.

15. Cisco Security Products: ASA 5500
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

16. Cisco Security Products: Firewall Services Module (FWSM)
1. Configuration management and control 2. Continuous monitoring
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Application that provides IPS services on a host.

17. Cisco Security Products: 4200 Series IPS
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent

18. What is the difference between a Qualitative analysis and a Quantitative Analysis
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.

19. What are two primary goals of business continuity planning?
1. Hot site: completely redundant site 2. Warm site: similar - but outdated equipment 3. Cold site: network needs to be built from scratch
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.

20. Cisco Security Products: SDM
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)

21. What are the components of a Security Policy?

1. Emergency Response 2. Recovery 3. Return to Normal Operations
1. Configuration management and control 2. Continuous monitoring
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

22. SDLC: Implementation
Security Device Manager provides GUI for configuring security features (e.g. IPS - IPSec site-site VPN - firewall features)
Integrated - Collaborative - Adaptive
1. Configuration management and control 2. Continuous monitoring
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation

23. What are the 3 classifications of disruptions?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.
1. Information preservation 2. Media sanitation 3. Hardware and software disposal
1. Configuration management and control 2. Continuous monitoring

24. What is the Cisco Self-Defending Network?
Application that provides IPS services on a host.
Consists of a collection of security solutions to identify - prevent and adapt to emerging threats.
1. Separate duties (dual operator - two-man control) 2. Rotate duties (allows peer review) 3. System failure preparation (Trusted recovery) 4. Multiple personnel oversee configuration changes to anticipate issues
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment

25. What is the ALE and how is it calculated?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
Analyze inline traffic for malicious activity. IPS can drop offending traffic - instruct appliances to block specific host - send alerts etc.
Cisco 5500 Adaptive Security Appliances (ASA) offers a wide variety of security solutions such as firewall - IPS - VPN - anti-spyware - antivirus - and anti-phishing.

26. Cisco Security Products: Cisco Security Agent (CSA)
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent
Application that provides IPS services on a host.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
Monitors security devices and applications: Uses event correlation to collect events from multiple devices - reducing the number of false positives - Identified appropriate mitigation strategies - Uses Cisco NetFlow technology to more readily identif

27. What is 'Operations Security?'
Module that goes in a Catalyst 6500 or similar to provide firewall services between VLANs.
1. Initiation 2. Acquisition and development 3. Implementation 4. Operations and maintenance 5. Disposition
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
An attempt to secure hardware - software - and various media while investigating anomalous network behavior.

28. What is the Cisco Security Manager?
1. Non-disaster: Brief interruption 2. Disaster: Interruption 1-7 days 3. Catastrophe: Move to alternative site - all resources destroyed.
Qualitative mathematically models the probability and severity of a risk while Quantitative uses a scenario model (better for big deployments)
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
1. Relocating operations to another facility while the original facility is under repair 2. Using alternative forms of internal and external communication

29. SDLC Acquisition and Development Phase
ALE = Monetary value to justify expense of security solutions AV = total cost of an asset EF = % representing percentage of loss that an asset experiences ARO = How many times per year a threat occurs
An application used to configure security features on a variety of IOS-based routers - ASA 5500 - PIX 500 - IPS 4200 - Catalyst 6500 through a graphical interface. Also provides a centralized policy and inter-operates with Cisco ACS.
Risk Management: keeping damange to a minimum - Risk Avoidance: preventing risk from occuring
1. Formalized risk assessment 2. Security functional requirements 3. Security assurance/legal requirements 4. Cost considerations 5. Security planning (security controls in use) 6. Design and development of security controls 7. Basic testing

30. SDLC Initiation Phase
1. Categorize severity of a security breach 2. Preliminary (high-level) risk assessment
1. Inspection of security system 2. System integration 3. Security certification 4. Security accreditation
Application that provides AAA funtionality
Host-based Intrusion Prevention System (HIPS) - Example Cisco Security Agent