Which Cisco IOS configuration option instructs the IPS to compile a signature category

named ios_ips into memory and use it to scan traffic?

R1(config)# ip ips signature-category

R1(config-ips-category)# category ios_ips basic
R1(config-ips-category-action)# retired false

Refer to the exhibit. An administrator has configured router R1 as indicated. However, SDEE
messages fail to log. Which solution corrects this problem?

Issue the ip ips notify sdee command in global configuration

Which three principles are enabled by a Cisco Self-Defending Network? (Choose three.)

-Adaptability
-Collaboration
-Integration

What are two disadvantages of using network IPS? (Choose two.)

-Network IPS has a difficult time reconstructing fragmented traffic to determine if an attack was
successful
-Network IPS is incapable of examining encrypted traffic

Which access list statement permits HTTP traffic that is sourced from host 10.1.129.100 port
4300 and destined to host 192.168.30.10?

Access-list 101 permit tcp 10.1.128.0 0.0.1.255 eq 4300 192.168.30.0 0.0.0.15 eq www

Which type of SDM rule is created to govern the traffic that can enter and leave the network
based on protocol and port number?

Access rule

Refer to the exhibit. When configuring SSH on a router using SDM from the Configure menu,
which two steps are required? (Choose two.)

-Choose additional tasks >Router access> SSH to generate the RSA key
-Choose additional tasks >Router access> VTY to specify SSH as the input and output protocol

Refer to the exhibit. Which two statements are correct regarding the configuration on switch
S1? (Choose two.)

-Port Fa0/5 storm control for broadcasts will be activated if traffic exceeds 80.1 percent of the total
bandwidth
-Port Fa0/6 storm control for multicasts will be activated if traffic exceeds 2,000,000 packets per
second

Refer to the exhibit. Which three things occur if a user attempts to log in four times within 10
seconds using an incorrect password? (Choose three.)

-Subsequent virtual login attempts from the user are blocked for 60 seconds
-A message is generated indicating the username and source IP address of the user
-During the quiet mode, an administrator can log in from host 172.16.1.2
Which type of Layer 2 attack makes a host appear as the root bridge for a LAN?

STP manipulation

What occurs after RSA keys are generated on a Cisco router to prepare for secure device
management?

The generated keys can used by SSH

An organization has mobile workers who use corporate-owned laptops at customer sites to
view inventory and place orders. Which type of VPN allows these workers to securely access
all of the client/server applications of the organization?

Remote-access IPsec VPN

Which two guidelines relate to in-band network management? (Choose two.)

Apply in-band management only to devices that must be managed on the production network
-Use IPsec, SSH or SSL

Which three commands are required to configure SSH on a Cisco router? (Choose three.)

-Ip domain-namename in global configuration mode

-Transport input ssh on a vty line
-Crypto key generate rsa in global configuration mode

An administrator needs to create a user account with custom access to most privileged
EXEC commands. Which privilege command is used to create this custom account?

Privilege exec level 2

Refer to the exhibit. An administrator has configured a standard ACL on R1 and applied it to
interface serial 0/0/0 in the outbound direction. What happens to traffic leaving interface
serial 0/0/0 that does not match the configured ACL statements?

The traffic is dropped

Which statement describes configuring ACLs to control Telnet traffic destined to the router
itself?

The ACL should be applied to all vty lines in the in direction to prevent an unwanted user from
connecting to an unsecured port

Which three statements describe SSL-based VPNs? (Choose three.)

-Asymmetric algorithms are used for authentication and key exchange.

-Symmetric algorithms are used for bulk encryption
-The authentication process uses hashing technologies

Refer to the exhibit. What information can be obtained from the AAA configuration
statements?

The authentication method list used for Telnet is named ACCESS

Which two Cisco IPS management and monitoring tools are examples of GUI-based, centrally managed
IPS solutions? (Choose two.)

Cisco Security Manager

Cisco Security Monitoring, Analysis, and Response System

Refer to the exhibit. Which AAA function and protocol is in use in the network

The client is authenticating using the TACACS+ protocol

Which three OSI layers can be filtered by a stateful firewall? (Choose three.)

-Layer 3
-Layer 4
-Layer 5

Refer to the exhibit. Based on the SDM screen shown, which two actions will the signature
take if an attack is detected? (Choose two.)

-Generate an alarm message that can be sent to a syslog server

-Create an ACL that denies traffic from the attacker IP address

Which three switch security commands are required to enable port security on a port so that
it will dynamically learn a single MAC address and disable the port if a host with any other
MAC address is connected? (Choose three.)

-Switchport mode access

-Switchport port-security
-Switchport por-security mac-address sticky

Which statement describes the SDM Security Audit wizard?

The wizard is based on the Cisco IOS AutoSecure feature

Which component of AAA is used to determine which resources a user can access and
which operations the user is allowed to perform?

Authorization

Which two protocols allow SDM to gather IPS alerts from a Cisco ISR router? (Choose two.)

-SDEE
-Syslog

Refer to the exhibit. Which AAA command logs the activity of a PPP session?

.aaa accounting network start-stop group radious

What is a feature of the TACACS+ protocol?

It encrypts the entire body of the packet for more secure communications

Refer to the exhibit. Which interface configuration completes the CBAC configuration on
router R1?

R1(config)# interface fa0/1

R1(config-if)# ip inspect OUTBOUND in
R1(config-if)# ip access-group INSIDE in
Refer to the exhibit. Which Cisco IOS security feature is implemented on router R2?
CBAC firewall
Which Cisco IOS privileged EXEC command can be used to verify that the Cisco IOS image
and configuration files have been properly backed up and secured?

Router# show secure bootset

Which device supports the use of SPAN to enable monitoring of malicious activity?

Cisco Catalyst switch

Which three statements describe zone-based policy firewall rules that govern interface
behavior and the traffic moving between zone member interfaces? (Choose three.)

- Pass, inspect, and drop options can only be applied between two zones
- If traffic is to flow between all interfaces in a router, each interface must be a member of a zone
- To permit traffic to and from a zone member interface, a policy allowing or inspecting traffic must
be configured between that zone and any other zone

Refer to the exhibit. Based on the SDM screen shown, which two conclusions can be drawn
about the IKE policy being configured? (Choose two.)

-It will use a predefined key for authentication

-It will use a very strong encryption algorithm

The use of 3DES within the IPsec framework is an example of which of the five IPsec
building blocks?

Confidentiality

Which statement describes the operation of the IKE protocol?

It calculates shared keys based on the exchange of a series of data packets

Which three types of views are available when configuring the Role-Based CLI Access
feature? (Choose three.)

-Root view
-Superview
-CLI view

Which statement describes a MAC address table overflow attack?

A software tool floods a switch with frames containing randomly generated source and destination
MAC and IP addresses

When configuring a class map for zone-based policy firewall, how are the match criteria
applied when using the match-all parameter?

Traffic must match all of the match criteria specified in the statement.

Which three statements describe limitations in using privilege levels for assigning command
authorization? (Choose three.)

- There is no access control to specific interfaces on a router

-Commands set on a higher privilege level are not available for lower privileged users
- Creating a user account that needs access to most but not all commands can be a tedious
process
What is an important difference between network-based and host-based intrusion
prevention?

Network-based IPS can provide protection to hosts without the need of installing specialized
software on each one

Refer to the exhibit. Based on the output from the show secure bootset command on router
R1, which three conclusions can be drawn regarding Cisco IOS Resilience? (Choose three.)

-A copy of the router configuration file has been made

-The Cisco IOS image file is hidden and cannot be copied, modified, or deleted
-The secure boot-config command was issued on R1

Which element of the Cisco Threat Control and Containment solution defends against
attempts to attack servers by exploiting application and operating system vulnerabilities?

threat control for infrastructure

Refer to the exhibit. Based on the SDM NTP Server Details screen, which two conclusions
can be drawn from the information entered and check boxes checked? (Choose two.)

-The IP address of the NTP server is 10.1.1.2

-NTP messages will be sent and received on interface Serial0/0/0 for this router

Which two statements match a type of attack with an appropriate example? (Choose two.)

-To conduct an access attack, an attacker uses L0phtCrack to obtain a Windows server password.
-To conduct a DoS attack, an attacker initiates a smurf attack by sending a large number of ICMP
requests to directed broadcast addresses

The use of which two options are required for IPsec operation? (Choose two.)

-Diffie-Hellman to establish a shared-secret key

-IKE to negotiate the SA

Which three security services are provided by digital signatures? (Choose three.)

-authenticates the source

-guarantees data has not changed in transit
-provides non repudiation of transactions

Which three statements should be considered when applying ACLs to a Cisco router?
(Choose three.)

-Place more specific ACL entries at the top of the ACL

-Router-generated packets pass through ACLs on the router without filtering
-An access list applied to any interface without a configured ACL allows all traffic to pass

Which consideration is important when implementing syslog in a network?

Synchronize clocks on all network devices with a protocol such as Network Time Protocol