Cisco Ccie Ips Security

Front 1

Initializes the system, starts and stops the other applications, configures the OS, and
performs upgrades

Back 1

MainApp—

Front 2

Allows sensors to send control transactions. This
is used to enable the master blocking sensor capability of Attack Response Controller (formerly
known as Network Access Controller).

Back 2

ctlTransSource (Control Transaction server)—

Front 3

An indexed store used to store IPS events (error, status, and alert system
messages) that is accessible through the CLI, IDM, IME, ASDM, or SDEE.

Back 3

Event Store—

Front 4

This IPS app handles bypass and physical settings and defines paired interfaces. Physical
settings are speed, duplex, and administrative state.

Back 4

InterfaceApp—

Front 5

This IPS app writes all the log messages of the application to the log file and the error messages of
the application to the Event Store.

Back 5

Logger—

Front 6

—Manages
remote network devices (firewalls, routers, and switches) to provide blocking capabilities when
an alert event has occurred.

Back 6

Attack Response Controller (formerly known as Network Access Controller)

Front 7

creates and applies ACLs on the controlled network device or
uses the shun command (firewalls).

Back 7

Attack Response Controller (formerly known as Network Access Controller)

Front 8

This app on the IPS sends SNMP traps when triggered by alert, status, and error events.

Back 8

NotificationApp—

Front 9

provide information about
the general health of the sensor.

Back 9

SNMP GETs

Front 10

—Provides a web interface and communication with other IPS
devices through the SDEE protocol using several servlets to provide IPS services.

Back 10

Web Server (HTTP SDEE server)

Front 11

Remote Cisco IPS applications (other sensors, management applications, and third-party software) communicate with
sensors through this protocol.

Back 11

SDEE

Front 12

Verifies that users are authorized to perform CLI, IDM, IME, ASDM, or
SDEE actions.

Back 12

AuthenticationApp—

Front 13

Performs packet capture and analysis.

Back 13

SensorApp (Analysis Engine)—

Front 14

Interfaces with MainApp and SensorApp using various interprocess
communication technologies including IDAPI control transactions, semaphores, shared memory,
and file exchange.

Back 14

CollaborationApp—

Front 15

needs question

Back 15

semaphore

Front 16

All Cisco IPS applications communicate with each other through this common API

Back 16

IDAPI

Front 17

needs question

Back 17

API

Front 18

The Cisco IPS has three partitions

Back 18

application partition
Maintenance partition
Recovery partition

Front 19

A special purpose IPS image used to reimage the application partition of
the IDSM2. When you reimage this partition, all configuration settings are lost.

Back 19

Maintenance partition

Front 20

A special purpose image used for recovery of the sensor. Booting into this partition enables you to completely reimage the application partition. Network settings are
preserved, but all other configuration is lost.

Back 20

recovery partition

Front 21

Since there is no FTP capability on the Cisco sensor, you can use this tool to remotely copy files

Back 21

SCP

Front 22

Installing and uninstalling IPS software upgrade is handled by this component of the Cisco IPs architecture

Back 22

MainApp

Front 23

Gathering stats and reporting the health and security monitoring status of the CIsco IPS is done by this architectural component

Back 23

MainApp

Front 24

Each IPS event is stored here with a time stamp and a unique, monotonic, ascending ID.

Back 24

in Event Store

Front 25

What happens when the Ciscp IPS event store reaches its configured size?

Back 25

When the
circular Event Store has reached its configured size, the oldest event or events are overwritten by the new
event being stored.

Front 26

This IPS application is the only application that writes a;ert event into the Event Store

Back 26

SensorApp is the only application that writes alert events into the Event Store

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 27

The following are examples of ?
Request to update the configuration data of an application instance
• Request for the diagnostic data of an application instance
• Request to reset the diagnostic data of an application instance

Back 27

Control transactions

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 28

IPS data is represented in the format

Back 28

IPS data is represented in XML format as an XML document. The system stores user-configurable
parameters in several XML files.

Front 29

This IPS event —Alert event messages that report when a signature is triggered by network activity.

Back 29

evAlert

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 30

Status event messages that report the status and actions of the IPS applications.

Back 30

evStatus—

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 31

— Error event messages that report errors that occurred while attempting response actions.

Back 31

evError

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 32

Log transaction messages that report the control transactions processed by each
sensor application.

Back 32

evLogTransaction—

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 33

Block request messages that report when ARC issues a block request.

Back 33

evShunRqst—


http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 34

allows the sensor to send alerts and system error messages as SNMP traps.

Back 34

NotificationApp

Front 35

an application that forwards locally initiated remote control transactions to their
remote destinations using HTTP protocol.

Back 35

CtlTransSource is

Front 36

a loop that waits on remote
control transactions that are directed to CtlTransSource.

Back 36

The transactionHandlerLoop method is

Front 37

the IPS application that starts and stops blocking on routers, switches, and firewalls, and rate
limits traffic on routers running Cisco IOS 12.3.

Back 37

ARC is

Front 38

ARC can simultaneously control up to how many interfaces

Back 38

250 interfaces.

Front 39

When the sensor shuts down, ARC writes all blocks and rate limits (with starting timestamps) to this local file

Back 39

a local
file (nac.shun.txt) that is maintained by ARC.

Front 40

What happens to the existing active TCP connections if the block command specifies only the source address?

Back 40

If the block command specifies only the source IP address, existing active TCP connections are not
broken, but all incoming packets from the blocked host are dropped.

Front 41

When you configure a firewall to use NAT or PAT and the sensor is checking packets on the firewall
outside network, if you detect a host attack that originates on the firewall inside network, the sensor tries
to block this address which is provided by the firewall.

Back 41

When you configure a firewall to use NAT or PAT and the sensor is checking packets on the firewall
outside network, if you detect a host attack that originates on the firewall inside network, the sensor tries
to block the translated address provided by the firewall.

Front 42

To view an existing VACL on a catalyst switch:

Back 42

show security acl info acl_name

Front 43

To block an address (address_spec is the same as used by router ACLs):

Back 43

set security acl ip acl_name deny address_spec

Front 44

To map a VACL to a VLAN:

Back 44

set sec acl acl_name vlans

Front 45

To clear a single VACL:

Back 45

clear security acl map acl_name

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_system_architecture.pdf

Front 46

Logger writes the log messages to this circular text file

Back 46

/usr/cids/idsRoot/log/main.log,

Front 47

This IPS component configures and controls IPS AAA and password management.

Back 47

AuthenticationApp

Front 48

needs question

Back 48

Pluggable Authentication Modules (PAM).

Front 49

needs question

Back 49

You can use the show ssh server-key and show tls fingerprint to display the key fingerprints of the
sensor.

Front 50

switches set to this VTPM mode do not participate in VTP.

Back 50

VTP Transparent mode

Front 51

A switch operating in this VTP mode does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements, but these switches do forward VTP advertisements that they receive out their trunk ports in VTP Version 2.

Back 51

VTP Transparent mode

Front 52

In this VTP mode, switches behave the same as in VTP transparent mode with the exception that VTP advertisements are not forwarded.

Back 52

off - vtp mode

Front 53

Switches in this VTP mode, advertise their VLAN configuration to other switches in the same VTP domain and synchronize their VLAN configuration with other switches based on advertisements received over trunk links.

Back 53

VTP server mode

Front 54

This is the default VTP mode

Back 54

VTP server mode