CCNA Security Chapter 5

1.

1 point

Refer to the exhibit. What is the significance of the number 10 in the signature 6130 10 command?

It is the subsignature ID.

It is the signature fidelity rating.

It is the alert severity.

It is the signature version.

It is the signature number.

2.

1 point

What is a disadvantage of network-based IPS as compared to host-based IPS?

Network-based IPS is less cost-effective.

Network-based IPS should not be used with multiple operating systems.

Network-based IPS does not detect lower level network events.

Network-based IPS cannot examine encrypted traffic.

3.

1 point

An IPS sensor has detected the string confidential across multiple packets in a TCP session. Which type of signature trigger and signature type does this describe?

Trigger: Pattern-based detection Type: Atomic signature

Trigger: Policy-based detection Type: Composite signature

Trigger: Anomaly-based detection Type: Composite signature

Trigger: Policy-based detection Type: Atomic signature

Trigger: Anomaly-based detection Type: Atomic signature

Trigger: Pattern-based detection Type: Composite signature

4.

1 point

A network administrator tunes a signature to detect abnormal activity that might be malicious and likely to be an immediate threat. What is the perceived severity of the signature?

low

medium

informational

high

5.

1 point

Refer to the exhibit. Based on the SDM screen shown, which two actions will the signature take if an attack is detected? (Choose two.)

Drop the packet and all future packets from this TCP flow.

Reset the TCP connection to terminate the TCP flow.

Create an ACL that denies traffic from the attacker IP address.

Drop the packet and permit remaining packets from this TCP flow.

Generate an alarm message that can be sent to a syslog server.

6.

1 point

Why is a network that deploys only IDS particularly vulnerable to an atomic attack?

The IDS requires significant router resources to maintain the event horizon.

The stateful properties of atomic attacks usually require the IDS to have several pieces of data to match an attack signature.

The IDS must track the three-way handshake of established UDP connections.

The IDS permits malicious single packets into the network.

The IDS must track the three-way handshake of established TCP connections.

7.

1 point

Which two statements characterize a network-based IPS implementation? (Choose two.)

It makes hosts visible to attackers.

It monitors to see if an attack was successful.

It is unable to examine encrypted traffic.

It is independent of the operating system on hosts.

It provides application-level encryption protection.

8.

1 point

Which two benefits does the IPS version 5.x signature format provide over the version 4.x signature format? (Choose two.)

addition of a signature risk rating

support for comma-delimited data import

support for IPX and AppleTalk protocols

support for encrypted signature parameters

addition of signature micro engines

9.

1 point

Refer to the exhibit. Which option tab on the SDM IPS screen is used to view the Top Threats table and deploy signatures associated with those threats?

Create IPS

IPS Migration

Security Dashboard

Edit IPS

10.

1 point

What information is provided by the show ip ips configuration configuration command?

the default actions for attack signatures

detailed IPS signatures

alarms that were sent since the last reset

the number of packets that are audited

11.

1 point

Which two Cisco IOS commands are required to enable IPS SDEE message logging? (Choose two.)

logging on

ip ips notify sdee

ip sdee events 500

ip http server

ip ips notify log

12.

1 point

When editing IPS signatures with SDM, which action drops all future packets from a TCP flow?

Deny Attacker Inline

Deny Connection Inline

Deny TCP Connection

Deny Packet Inline

13.

1 point

What are two major drawbacks to using HIPS? (Choose two.)

HIPS installations are vulnerable to fragmentation attacks or variable TTL attacks.

With HIPS, the network administor must verify support for all the different operating systems used in the network.

HIPS has difficulty constructing an accurate network picture or coordinating the events happening across the entire network.

With HIPS, the success or failure of an attack cannot be readily determined.

If the network traffic stream is encrypted, HIPS is unable to access unencrypted forms of the traffic.

14.

1 point

Refer to the exhibit. What is the result of issuing the Cisco IOS IPS commands on router R1?

All traffic that is permitted by the ACL is subject to inspection by the IPS.

A numbered ACL is applied to S0/0/0 in the outbound direction.

All traffic that is denied by the ACL is subject to inspection by the IPS.

A named ACL determines the traffic to be inspected.

15.

1 point

Refer to the exhibit. When modifying an IPS signature action, which two check boxes should be selected to create an ACL that denies all traffic from the IP address that is considered the source of the attack and drops the packet and all future packets from the TCP flow? (Choose two.)

Deny Connection Inline

Deny Packet Inline

Deny Attacker Inline

Reset TCP Connection

Produce Alert

16.

1 point

What are two IPS configuration best practices that can help improve IPS efficiency in a network? (Choose two.)

Place signature packs on a dedicated FTP server within the management network.

Configure all sensors to check the server for new signature packs at the same time to ensure that they are all synchronized.

Configure the sensors to simultaneously check the FTP server for new signature packs.

Ensure that signature levels that are supported on the management console are synchronized with the signature packs on the sensors.

Update signature packs manually rather than automatically to maintain close control when setting up a large deployment of sensors.

17.

1 point

Which type of intrusion detection triggers an action if excessive activity occurs beyond a specified threshold of normal activity?

pattern-based detection

policy-based detection

honey pot-based detection

anomaly-based detection

18.

1 point

Which two files could be used to implement Cisco IOS IPS with version 5.x format signatures? (Choose two.)

realm-cisco.pub.key.txt

realm-cisco.priv.key.txt

IOS-Sxxx-CLI.sdf

IOS-Sxxx-CLI.bin

IOS-Sxxx-CLI.pkg

19.

1 point

Which Cisco IOS configuration option instructs the IPS to compile a signature category named ios_ips into memory and use it to scan traffic?

R1(config)# ip ips signature-category R1(config-ips-category)# category ios_ips basic R1(config-ips-category-action)# enabled true

R1(config)# ip ips signature-category R1(config-ips-category)# category all R1(config-ips-category-action)# enabled true

R1(config)# ip ips signature-category R1(config-ips-category)# category all R1(config-ips-category-action)# retired false

R1(config)# ip ips signature-category R1(config-ips-category)# category ios_ips basic R1(config-ips-category-action)# retired false

20.

1 point

Refer to the exhibit. What is the significance of the small red flag waving in the Windows system tray?

Cisco Security Agent is installed but inactive.

Cisco Security Agent is active and has detected a potential security problem.

A network-based IPS sensor has pushed an alert to a host running Cisco Security Agent.

Network-based IPS is active and has detected a potential security problem.

21.

1 point

Refer to the exhibit. A user was installing a Flash Player upgrade when the CSA displayed the dialog box shown. Which default action is taken by CSA if the user does not respond within 4 minutes and 20 seconds?

The action is allowed, and a log entry is recorded.

The action is allowed, and CSA does not prompt the user again.

The action is denied, and the FlashPlayerUpdate.exe application is terminated.

The action is denied, and a log entry is recorded.