Cisco Implementing Cisco IOS Network Security Set 3

standard ✘ extended ✘ named ✘ IPv4 for 100 to 199 and IPv6 for 2000 to 2699 ✔

Build ACLs based upon your security policy. ✘ Always put the ACL closest to the source of origination. ✘ Place deny statements near the top of the ACL to prevent unwanted traffic from passing through the router. ✘ Always test ACLs in a small, controlled production environment before you roll it out into the larger production network. ✔

Implement in-band management whenever possible. ✘ Implement telnet for encrypted device management access. ✘ Implement SNMP with read/write access for troubleshooting purposes. ✘ Synchronize clocks on hosts and devices. ✔ Implement management plane protection using routing protocol authentication. ✔

Ports in a VLAN will not share broadcasts amongst physically separate switches. ✘ A VLAN can only connect across a LAN within the same building. ✘ A VLAN is a logical broadcast domain that can span multiple physical LAN segments. ✘ A VLAN provides individual port security. ✔

root guard ✘ port fast ✘ HSRP ✘ STP ✔

You must then zeroize the keys to reset secure shell before configuring other parameters. ✘ The SSH protocol is automatically enabled. ✘ You must then specify the general-purpose key size used for authentication with the crypto key generate rsa general-keys modulus command. ✘ All vty ports are automatically enabled for SSH to provide secure management. ✔

Network-based IPS is better suited for inspection of SSL and TLS encrypted data flows. ✘ Network-based IPS provides better protection against OS kernel-level attacks against hosts and servers. ✘ Network-based IPS can provide protection to desktops and servers without the need of installing specialized software on the end hosts and servers. ✘ Host-based IPS can work in promiscuous mode or inline mode. ✔ Host-based IPS is more scalable then network-based IPS. ✔

uses Cisco IPS 5.x signature format ✘ requires the Basic or Advanced Signature Definition File ✘ supports both inline and promiscuous mode ✘ requires IEV for monitoring Cisco IPS alerts ✔ uses the built-in signatures that come with the Cisco IOS image as backup ✔

secure connectivity ✘ threat control and containment ✘ policy management ✘ secure network platform ✔

dynamic ACL ✘ reflexive ACL ✘ netflow ✘ queuing ✔ state ✔