Ccna Chapter 5 Security

Front 1

Why is a network that deploys only IDS particularly vulnerable to an atomic attack?

Back 1

The IDS permits malicious single packets into the network.

Front 2

Which statement is true about an atomic alert that is generated by an IPS?

Back 2

It is an alert that is generated every time a specific signature has been found.

Front 3

Refer to the exhibit. As an administrator is configuring an IPS, the error message that is shown appears. What does this error message indicate?

Back 3

The public crypto key is invalid or entered incorrectly.

Front 4

What is a zero-day attack?

Back 4

an attack that targets software vulnerabilities unknown or unpatched by the software vendor

Front 5

An administrator is using CCP to modify a signature action so that if a match occurs, the packet and all future packets from the TCP flow are dropped. What action should the administrator select?

Back 5

deny-connection-inline

Front 6

What information is provided by the show ip ips configuration command?

Back 6

the default actions for attack signatures

Front 7

efer to the exhibit. What action will be taken if a signature match occurs?

Back 7

The packet will be allowed but an alert will be generated

Front 8

Which protocol is used when an IPS sends signature alarm messages?

Back 8

SDEE, secure device event exchange

Front 9

Refer to the exhibit. Which option tab on the CCP screen is used to view the Top Threats table and deploy signatures associated with those threats?

Back 9

Security Dashboard

Front 10

Refer to the exhibit. When an IPS signature action is to be modified via CCP, which two check boxes should be selected to create an ACL that denies all traffic from the IP address that is considered the source of the attack and drops the packet and all future packets from the TCP flow? (Choose two.)

Back 10

Deny Attacker Inline

Deny Connection Inline

Front 11

Refer to the exhibit. Based on the configuration that is shown, which statement is true about the IPS signature category?

Back 11

Only signatures in the ios_ips basic category will be compiled into memory for scanning.

Front 12

Which two files could be used to implement Cisco IOS IPS with version 5.x format signatures? (Choose two.)

Back 12

IOS-Sxxx-CLI.pkg
realm-cisco.pub.key.txt

Front 13

Which Cisco IPS feature allows for regular threat updates from the Cisco SensorBase Network database?

Back 13

Global correlation

Front 14

What is a disadvantage of network-based IPS as compared to host-based IPS?

Back 14

Network-based IPS cannot examine encrypted traffic.

Front 15

What is a disadvantage of a pattern-based detection mechanism?

Back 15

it cannot detect unknown attacks

however it is easy to deploy and does not depend on baseline configuration.

Front 16

Refer to the exhibit. What is the significance of the number 10 in the signature 6130 10 command?

Back 16

sub signature id.

Front 17

Refer to the exhibit. Based on the configuration, what traffic is inspected by the IPS?

Back 17

all traffic entering the s0/0/1 interface and all traffic entering and leaving the fa0/1 interface

Front 18

A network security administrator would like to check the number of packets that have been audited by the IPS. What command should the administrator use?

Back 18

show ip ips statistics

Front 19

A network administrator tunes a signature to detect abnormal activity that might be malicious and likely to be an immediate threat. What is the perceived severity of the signature?

Back 19

medium

Front 20

Refer to the exhibit. An administrator has configured router R1 as indicated. However, SDEE messages fail to log. Which solution corrects this problem?

Back 20

issue the ip ips notify sdee command in global configuration.

Front 21

Refer to the exhibit. An administrator has configured router R1 as indicated. However, SDEE messages fail to log. Which solution corrects this problem?

Back 21

issue the ip ips notify sdee command in global configuration.

Front 22

Refer to the exhibit. What is the result of issuing the Cisco IOS IPS commands on router R1?

Back 22

All traffic that is permitted by the ACL is subject to inspection by the IPS.

Front 23

Refer to the exhibit. Based on the configuration commands that are shown, how will IPS event notifications be sent?

Back 23

syslog format, because of the key word log, the keyword sdee sends messages in sdee format

Front 24

Which two benefits does the IPS version 5.x signature format provide over the version 4.x signature format? (Choose two.)

Back 24

addition of a signature risk rating
support for encrypted signature parameters