Cisco Ccna Security Chapter 9

Front 1

next-generation firewall (NGFW)

Back 1

devices that deliver integrated threat defense across the entire attack continuum.

combine proven ASA firewalls with Sourcefire threat and advanced malware protection in a single device.

Front 2

choice of ASA model depends on an organization’s requirements

Back 2

throughput,

maximum connections per second

budget.

Front 3

ASA 5505 / Security Plus

Back 3

up to 150 Mbps

Front 4

ASA 5506-X / Security Plus

Back 4

750 Mbps

Front 5

ASA 5512-X / Security Plus

Back 5

1 Gbps

Front 6

ASA 5515-X

Back 6

1.2 Gbps

Front 7

ASA 5525-X

Back 7

2 Gbps

Front 8

ASA 5545-X

Back 8

3 Gbps

Front 9

ASA 5555-X

Back 9

4 Gbps

Front 10

ASA 5585-X SSP10

Back 10

4 Gbps

Front 11

ASA 5585-X SSP20

Back 11

10 Gbps

Front 12

ASA 5585-X SSP40

Back 12

20 Gbps

Front 13

ASA 5585-X SSP60

Back 13

40 Gbps

Front 14

ASA Service Module

Back 14

20 Gbps

Front 15

Cisco Adaptive Security Virtual Appliance (ASAv)

Back 15

brings the power of ASA appliances to the virtual domain.

operates as a VM using the server’s interfaces to process traffic

does not support clustering and multiple contexts.

Front 16

Cisco ASAv5

Back 16

This appliance requires up to 2 GB of memory and delivers up to 100 Mbps of throughput.

Front 17

Cisco ASAv10

Back 17

This appliance requires up to 2 GB of memory and delivers up to 1 Gbps of throughput.

Front 18

Cisco ASAv30

Back 18

This appliance requires up to 8 GB of memory and delivers up to 2 Gbps of throughput.

Front 19

ASA software combines

Back 19

firewall, VPN concentrator, and intrusion prevention functionality into one software image.

Front 20

ASA virtualization

Back 20

Each virtual device is called a security context.

Each context is an independent device,

has its own security policy, interfaces, and administrators.

Front 21

features that are supported in multiple context modes,

Back 21

routing tables,

firewall features,

IPS

management.

Front 22

features that aren't supported in multiple context modes,

Back 22

VPN

dynamic routing protocols.

Front 23

High availability with failover

Back 23

Both platforms must be identical in software, licensing, memory, and interfaces, including the Security Services Module (SSM)

Front 24

Identity firewall

Back 24

Identity-based security policies can be interleaved without restriction between traditional IP address-based rules.

hese services enhance the existing access control and security policy mechanisms by allowing users, or groups, to be specified in place of source IP addresses.

Front 25

Threat control and containment services

Back 25

IPS capability is available using the Advanced Inspection and Prevention (AIP) modules.

Antimalware capabilities can be deployed by Content Security and Control (CSC) module.

Front 26

Cisco Advanced Inspection and Prevention Security Services Module (AIP-SSM)

Cisco Advanced Inspection and Prevention Security Services Card (AIP-SSC)

Back 26

deliver protection against tens of thousands of known exploits.

They also protect against millions of other unknown exploit variants using specialized IPS detection engines and thousands of signatures

Front 27

Outside network

Back 27

etwork/zone that is outside the protection of the firewall

Front 28

Inside network

Back 28

Network/zone that is protected and behind the firewall

Front 29

DMZ

Back 29

Demilitarized zone that allows both inside and outside users access to protected network resources

Front 30

Cisco ISRs can provide firewall features by using either

Back 30

Zone-Based Policy Firewall (ZPF)

context-based access control (CBAC) feature.

Front 31

security levels enable the ASA to implement security policies.

Back 31

inside users can access outside networks based on certain addresses, by requiring authentication or authorization, or by coordinating with an external URL filtering server.

Front 32

two firewall modes of operation available on ASA devices

Back 32

Routed Mode

Transparent Mode

Front 33

Routed Mode

Back 33

Two or more interfaces separate Layer 3 networks,

the ASA is considered to be a router hop in the network and can perform NAT between connected networks.

supports multiple interfaces

Each interface is on a different subnet and requires an IP address on that subnet.

ASA applies policy to flows as they transit the firewall

Front 34

Transparent Mode

Back 34

Often referred to as a “bump in the wire,” or a “stealth firewall” because the ASA functions like a Layer 2 device and is not considered a router hop

useful to simplify a network configuration, or when the existing IP addressing cannot be altered.

no support for dynamic routing protocols, VPNs, QoS, or DHCP Relay.

Front 35

Most ASA appliances come pre-installed with either a

Back 35

Base license

Security Plus license.

Front 36

How many permanent license keys can be installed?

Back 36

1 after it is installed it is referred to as a running license

Front 37

ASA 5505

Back 37

default DRAM memory is 256 MB (upgradable to 512 MB)

default internal flash memory is 128 MB

Front 38

ASA 5505 failover configuration

Back 38

must be identical models with the same hardware configuration, the same number and types of interfaces, and the same amount of RAM.

Front 39

ASA 5505 status led

Back 39

flashing green = booting and power-up tests are running

solid green = system tests passed and system operational.

solid amber = system tests have failed

Front 40

ASA 5505 active led

Back 40

Green = Cisco ASA is active.

Front 41

ASA 5505 VPN led

Back 41

Solid green = one or more VPN tunnels are active.

Front 42

ASA 5505 SSC led

Back 42

solid green = SSC card is present in the ssc slot.

Front 43

ASA 5505 Speed and link activity leds

Back 43

solid green speed indicator LED = 100 Mb/s

speed indicator LED is off = 10 Mb/s

link activity indicator LED is on = network link is established

ink activity indicator LED is blinking = network activity

Front 44

security level numbers range

Back 44

(untrustworthy) to 100 (very trustworthy).

Front 45

Each operational interface must have

Back 45

name

security level

Front 46

When traffic moves from an interface with a higher security level to an interface with a lower security level, it is considered

Back 46

outband traffic

Front 47

traffic moving from an interface with a lower security level to an interface with a higher security level is considered

Back 47

inbound traffic

Front 48

Network access

Back 48

If communication is enabled for interfaces with the same security level, there is an implicit permit for traffic between the interfaces.

Front 49

Inspection Engine

Back 49

When interfaces have the same security level, the ASA inspects traffic in either direction.

Front 50

Application Filtering

Back 50

HTTP(S) and FTP filtering applies only for outbound connections, from a higher level to a lower level.

Same security level can be filtered both ways.

Front 51

Outgoing traffic is ___________ by default

Back 51

allowed

Front 52

Incoming traffic is ____________ by default

Back 52

denied

Front 53

Return traffic, originating on the inside network and returning via the outside interface, would be

Back 53

allowed

Front 54

ASA 5505 is commonly used as an edge security device.

Back 54

can be deployed to interconnect and protect several workstations, network printers, and IP phones.

Front 55

ASA can be configured using these three methods

Back 55

manually using CLI

Interactively using the CLI setup initialization wizard

using the ASDM startup wizard

Front 56

To change the master passphrase,

Back 56

config-key password-encryption

Front 57

Logical VLAN interfaces

Back 57

hese interfaces are configured with the Layer 3 information including a name, security level, and IP address.

Front 58

Physical switch ports

Back 58

These are Layer 2 switch ports which are assigned to the logical VLAN interfaces.

Front 59

An SVI requires

Back 59

a name, an interface security level, and an IP address.

Front 60

An ASA 5505 with a Base license does not allow ________ fully functioning VLAN interfaces to be created.

Back 60

three

Front 61

a third “limited” VLAN interface can be created if it is first configured with the _____________ command.

Back 61

no forward interface vlan

Front 62

the no forward interface vlan number command must be entered before the nameif command is entered on the third interface

Back 62

The number argument specifies the VLAN ID to which this VLAN interface cannot initiate traffic.

Front 63

The IP address of an interface can be configured using one of the following options:

Back 63

Manually

DHCP

PPPoE

Front 64

An SVI requires a

Back 64

name

interface security level

IP address.

Front 65

show dhcpd state

Back 65

Displays the current DHCP state for inside and outside interfaces.

Front 66

show dhcpd binding

Back 66

Displays the current DHCP bindings of inside users.

Front 67

show dhcpd statistics

Back 67

Displays the current DHCP statistics.

Front 68

Network object

Back 68

Contains a single IP address and subnet mask.

Front 69

Network objects can be of three types:

Back 69

host

subnet

range

Front 70

Service object

Back 70

Contains a protocol and optional source and/or destination port.

Front 71

To erase all network objects, use

Back 71

clear config object network

Front 72

To erase all service objects, use

Back 72

clear config object service

Front 73

The following guidelines and limitations apply to object groups:

Back 73

Objects and object groups share the same name space.

Object groups must have unique names.

An object group cannot be removed or emptied if it is used in a command.

The ASA does not support IPv6 nested object groups.

Front 74

Object Group

Network

Back 74

A network-based object group specifies a list of IP host, subnet, or network addresses.

Front 75

Object group

Service

Back 75

A service-based object group is used to group TCP, UDP, or TCP and UDP ports into an object.

Front 76

Object Group

security

Back 76

used in features that support Cisco TrustSec by including the group in an extended ACL, which in turn can be used in an access rule.

Front 77

Object Group

ICMP-Type

Back 77

groups the necessary types required to meet an organization’s security needs, such as to create an object group called ECHO to group echo and echo-reply.

Front 78

A ____________ cannot be used to implement NAT. A __________ is required to implement NAT.

Back 78

network object group

network object

Front 79

ASA ACLs differ from IOS ACLs in that they

Back 79

use a network mask

named instead of numbered.

Front 80

Through-traffic filtering

Back 80

Traffic that is passing through the security appliance from one interface to another interface.

Front 81

To-the-box-traffic filtering

Back 81

Also known as a management access rule, to-the-box-traffic filtering applies to traffic that terminates on the ASA. Introduced in version 8.0 to filter traffic destined for the control plane of the ASA.

Front 82

To allow connectivity between interfaces with the same security levels,

Back 82

cmd

same-security-traffic permit inter-interface

Front 83

To enable traffic to enter and exit the same interface, such as when encrypted traffic enters an interface and is then routed out the same interface unencrypted

Back 83

cmd

same-security-traffic permit intra-interface

Front 84

Standard access list

Back 84

ASA standard ACLs are used to identify the destination IP addresses. They are typically only used for OSPF routes and can be used in a route map for OSPF redistribution.

Front 85

EtherType access list

Back 85

An EtherType ACL can be configured only if the security appliance is running in transparent mode.

Front 86

Webtype access list

Back 86

Used in a configuration that supports filtering for clientless SSL VPN.

Front 87

IPv6 access list

Back 87

Used to determine which IPv6 traffic to block and which traffic to forward at router interfaces.

Front 88

Use the _________________ privileged EXEC command to display the syntax for all of the ACLs supported on an ASA platform.

Back 88

help access-list

Front 89

Dynamic NAT

Back 89

This is a many-to-many translation.

Front 90

Dynamic PAT

Back 90

This is a many-to-one translation. This is also known as NAT overloads.

cmd

nat (inside,outside) dynamic interface

Front 91

Static NAT

Back 91

This is a one-to-one translation. Usually an outside address mapping to an internal server.

Front 92

Policy NAT

Back 92

Policy-based NAT is based on a set of rules.

Front 93

Outside NAT

Back 93

This method is used when traffic from a lower-security interface that is destined for a host on the higher-security interface must be translated.

Front 94

Inside NAT

Back 94

The typical NAT deployment method is when a host from a higher-security interface has traffic destined for a lower-security interface and the ASA translates the internal host address into a global address.

ASA restores the original Inside IP address for return traffic

Front 95

Bidirectional NAT

Back 95

Indicates that both inside NAT and outside NAT are used together.

Front 96

Twice-NAT

Back 96

identifies both the source and destination address in a single rule (natcommand). Twice-NAT is used when configuring remote-access IPsec and SSL VPNs.

Front 97

To configure network object dynamic NAT, two network objects are required:

Back 97

A network object identifying the pool of public IP addresses into which internal addresses are translated.

The second network object identifies the internal addresses to be translated and then binds the two objects together

Front 98

Modular Policy Framework (MPF) configuration

Back 98

defines a set of rules for applying firewall features, such as traffic inspection and QoS, to the traffic that traverses the ASA.

Front 99

Class maps

Back 99

configured to identify Layer 3/4 traffic.

Front 100

The maximum number of policy maps is

Back 100

64

Front 101

The configuration includes a default Layer 3/4 policy map that the ASA uses in the default global policy. It is called

Back 101

global_policy and performs an inspection on the default inspection traffic.

Front 102

There can only be ______ global policy.

Back 102

one

Front 103

three most common commands available in policy map configuration mode:

Back 103

set connection - Sets connection values.

inspect - Provides protocol inspection servers.

police - Sets rate limits for traffic in this class.

Front 104

To activate a policy map globally on all interfaces or on a targeted interface, use the ____________ command.

Back 104

service-policy policy-map-name [ global | interface intf ]

Front 105

To alter the global policy, an administrator needs to

Back 105

either edit the default policy or disable the default policy and apply a new policy.

Front 106

Use the _______________ command in global configuration mode to remove all service policies.

Back 106

clear configure service-policy

Front 107

The ________________ command clears the service policy statistics.

Back 107

clear service-policy