Ccna security question and answers

CCNA Security Q&A

-------by Nar(Naresnet@gmail.com)

www.CertBible.org Help you pass any it exams www.ccnp.cc www.ccvp.cc www.ccsp.name www.ccna.cc www.640-802.net www.ciscoexams.org

The IOS Firewall Set Questions & Answers:
1-Question:Define the term "DMZ" as it pertains to network security, and name three different common network devices that are typically found there. Answer: It'seasy to think of your network as the "inside", and everything else as "outside". However, we've got a third area when it comes to firewalls - the DMZ. From an IT standpoint, the DMZ is the part of our network that is exposed to outside networks. common to find the following devices in a DMZ:
• • • • •

It's

FTP server Email server E-commerce server DNS servers Web servers

2-Question:Identify the true statements. A. Stateless packet filtering considers the TCP connection state. B. Stateful packet filtering considers the TCP connection state. C. Neither stateless nor stateful packet filtering monitor the TCP connection state. D. Both stateless and stateful packet filtering monitor the TCP connection state, and keep a state table containing that information. Answer: (B.) Statefulpacket filtering does monitor the connection state, and that's particularly important when it comes to preventing TCP attacks. A stateful firewall will not only monitor the state of the TCP connection, but also the sequence numbers. Stateful firewalls accomplish this by keeping a session table, or state table. 3-Question:Does the Cisco IOS Firewall feature set act as a stateful or stateless packetfilter? Answer:The Cisco IOS Firewall is a stateful filter. 4-Question: Which of the following are considered parts of the IOS Firewall feature set? A.

www.640-553.com Help you pass CCNA SECURITY EXAMS

IOS Firewall B. Intrusion Prevention System C. RADIUS D. Authentication Proxy E. Password Encryption

www.640-553.com Help you pass CCNA SECURITY EXAMS

CCNA Security Q&A

-------byNar(Naresnet@gmail.com)

Answer:(A, B, D.) There are three major components to the IOS Firewall feature set - the IOS Firewall, the Intrusion Prevention System (IPS), and the Authentication Proxy. 5-Question:Identify the true statements regarding the Authentication Proxy. A. It's part of the IOS Firewall Feature Set. B. It allows creation of per-user security profiles, rather than more generalprofiles. C. It allows creation of general security profiles, but not per-user profiles. D. Profiles can be stored locally, but not remotely. E. Profiles can be stored on a RADIUS server. F. Profiles can be stored on a TACACS+ server. Answer: (A, B, E, F. T he Authentication Proxy allows us to create security profiles that will be applied on a per-user basis, rather than a per-subnet or per-addressbasis. These profiles can be kept on either of the following:
• •

RADIUS server TACACS+ server

Upon successful authentication, that particular user's security policy is downloaded from the RADIUS or TACACS+ server and applied by the IOS Firewall router. 6-Question:Configuring ACLs is an important part of working with the IOS Firewall. What wildcard masks are replaced in ACLs by the words hostand any? Answer: We have the option of using the word host to represent a wildcard mask of 0.0.0.0. Consider a configuration where only packets from IP source 10.1.1.1 should be allowed and all other packets denied. The following ACLs both do that. R3#conf t R3(config)#access-list 6 permit 10.1.1.1 0.0.0.0 R3(config)#conf t R3(config)#access-list 7 permit host 10.1.1.1 The keyword any can be used torepresent a wildcard mask of 255.255.255.255. following lines permit all traffic. R3(config)#access-list 15 permit any R3(config)#access-list 15 permit 0.0.0.0 255.255.255.255 There's no "right" or "wrong" decision to make when you're configuring ACLs in the real world. your exam, though, I'd be very familiar with the proper use of host and any. For Both of the

www.640-553.com Help you pass...