Ccna Security

Front 1

CoPP (Control Plane Policing)

Back 1

Rate-limit traffic destined to an IP address on the device itself (such as SSH/HTTPS/SSL)

Prevents attacks involving excessive traffic of this nature

Effectively applying QoS to the valid management traffic & policing the malicious

Front 2

CPPr (Control Plane Protection)

Back 2

Allows more detailed classification of traffic than CoPP (host sub-if, transit sub-if, CEF)

Applied to logical control plane interface, as with CoPP

Front 3

IPS limitations in Promiscuous mode

Back 3

Deny attacker

Deny packet

Modify packet

Front 4

SIEM

Back 4

Security Information & Event Management

Combines SIM & SEM to provide real-time alerts for security events for administrators

Collects & archives syslog data

SIEM systems also allow compliance checking

Front 5

SDEE

Back 5

Security Device Event Exchange

Protocol that communicates events generated by security devices

SDEE client authenticates with SDEE server before communicating (using a session ID in all future requests) - using SSL

Front 6

How does FirePOWER block malicious email attachments?

Back 6

Sends traffic through a file policy

Front 7

Clientless SSL VPN - Browser Plugins

Back 7

VISTA requires RDP2

Front 8

Default TACACS+ timeout

Back 8

5 seconds

Front 9

How does FirePOWER prevent SYN attacks?

Back 9

Rate-based prevention

Front 10

Honeypot IPS

Back 10

Purpose: Collect info about attacks

Front 11

In a security context, which action can you take to address compliance?

Back 11

Implement rules to prevent a vulnerability

Front 12

Which technology can rate fidelity and provide authenticated hash for data?

Back 12

File reputation

Front 13

How to mitigate CAM table overflows?

Back 13

DYNAMIC port security

Front 14

Which feature filters CoPP packets?

Back 14

ACL

Front 15

What is the most common CDPv1 attack?

Back 15

Denial of Service