Cisco Implementing Cisco IOS Network Security Set 1

Disable double tagging by enabling DTP on the trunk port. ✘ Enable encryption on the trunk port. ✘ Enable authentication and encryption on the trunk port. ✘ Limit the allowed VLAN(s) on the trunk to the native VLAN only. ✔ Configure an unused VLAN as the native VLAN. ✔

MAC spoofing attack ✘ CAM overflow attack ✘ VLAN hopping attack ✘ STP attack ✔

Encapsulate trunk ports with IEEE 802.1Q. ✘ Physically secure data closets. ✘ Disable DTP negotiations. ✘ Enable BDPU guard. ✔

PVLAN Edge can be configured to restrict the number of MAC addresses that appear on a single port. ✘ The switch does not forward any traffic from one protected port to any other protected port. ✘ By default, when a port policy error occurs, the switchport shuts down. ✘ The switch only forwards traffic to ports within the same VLAN Edge. ✔

no switchport mode access ✘ no switchport trunk native VLAN 1 ✘ switchport mode DTP ✘ switchport nonnegotiate ✔

The Cisco IOS interface ACL has an implicit permit-all rule at the end of each interface ACL. ✘ Cisco IOS supports interface ACL and also global ACL. Global ACL is applied to all interfaces. ✘ The Cisco ASA appliance interface ACL configurations use netmasks instead of wildcard masks. ✘ The Cisco ASA appliance interface ACL also applies to traffic directed to the IP addresses of the Cisco ASA appliance interfaces. ✔ The Cisco ASA appliance does not support standard ACL. The Cisco ASA appliance only support extended ACL. ✔

used for SSH server/client authentication and encryption ✘ used to verify the digital signature of the IPS signature file ✘ used to generate a persistent self-signed identity certificate for the ISR so administrators can authenticate the ISR when accessing it using Cisco ConfigurationProfessional ✘ used to enable asymmetric encryption on IPsec and SSL VPNs ✔ used during the DH exchanges on IPsec VPNs ✔

Select the interface(s) to apply the IPS rule. Select the traffic flow direction that should be applied by the IPS rule. Specify the configuration location and select the category of signatures to be applied to the selected interface(s). Specify the signature file and the Cisco public key. Select the IPS bypass mode (fail-open or fail-close).

It uses the underlying routing infrastructure to provide an additional layer of security. ✘ It works in passive mode so as not to impact traffic flow. ✘ It supports the complete signature database as a Cisco IPS sensor appliance. ✘ The signature database is tied closely with the Cisco IOS image. ✔

It uses symmetrical encryption to provide data confidentiality over an unsecured communications channel. ✘ It uses asymmetrical encryption to provide authentication over an unsecured communications channel. ✘ It is used within the IKE Phase 1 exchange to provide peer authentication. ✘ It provides a way for two peers to establish a shared-secret key, which only they will know, even though they are communicating over an unsecured channel. ✔ It is a data integrity algorithm that is used within the IKE exchanges to guarantee the integrity of the message of the IKE exchanges. ✔