Cisco CCIE Security Written v4.0 (Beta) Set 6

The firewall attack is used to discover hosts behind firewall device. ✘ The firewall attack uses ICMP sweep to find expected hosts behind the firewall. ✘ The firewall attack uses traceroute with a predetermined TTL value to discover hosts behind the firewall. ✘ The firewall attack is used to find the vulnerability in the Cisco IOS firewall code. ✔ The firewall attack uses an ICMP echo message to discover firewall misconfiguration. ✔

Echo-Echo Request ✘ Route Solicitation- Time Exceeded ✘ Echo-Time Exceeded ✘ Echo Reply-Host Unreachable ✔ Echo-Host Unreachable ✔

SensorApp ✘ InterfaceApp ✘ MainApp ✘ NotificationApp ✔ AuthenticationApp ✔

AV pairs are only required to be enabled on Cisco Secure ACS for successful implementation. ✘ The Cisco Secure ACS Solution Engine does not support accounting AV pairs. ✘ AV pairs are only string values. ✘ AV pairs are of two types: string and integer. ✔

when the authentication server does not have credentials to authenticate. ✘ when the authenticator is missing the dot1x guest VLAN under the port with which the supplicant isconnected. ✘ when the supplicant fails EAP-MD5 challenge with the authentication server. ✘ when the supplicant fails to respond to EAPOL messages from the authenticator. ✔ when the authenticator is missing the reauthentication timeout configuration under the port with which thesupplicant is connected. ✔

produce-alert ✘ deny-attacker-inline ✘ deny-connection-inline ✘ reset-tcp-action ✔ deny-session-inline ✔

Atomic IP ✘ Meta ✘ Atomic IP Advanced ✘ Fixed ✔ Service ✔

If the default route is not present, then the routing table is checked. ✘ If the routing table has two matching entries, the packet is dropped. ✘ If routing table has two matching entries with same prefix length, the first entry is used. ✘ If routing table has two matching entries with different prefix lengths, the entry with the longer prefix length isused. ✔

It is a logical interface that combines two physical interfaces, both of which are active. ✘ It can only be used for failover links. ✘ By default, the first physical interface that is configured in the pair is the active interface. ✘ The redundant interface uses the MAC address of the second physical interface in the pair. ✔

When the packet is checked by the access-list. ✘ When the packet reaches the ingress interface internal buffer. ✘ When the packet is a SYN packet or UDP packet. ✘ When a translation rule exists for the packet. ✔ When the packet is subjected to inspection. ✔