Number of incomplete TCP sessions on a p

CCNA Security Practice Exam: 10 Questions On The IOS Firewall Set Computers Articles | September 5 Alex Smith , 2008

The CCNA Security certification is the most valuable Cisco certification to come along in years, and mastering the IOS Firewall set is a big part of passing this demanding exam.?? To help you prepare for success on exam day, here are 10 complimentary practice exam questions on this topic!



Earning your CCNA Security certification is a tremendous boost to your career and your career prospects!? To help you prepare for total success on exam day, here are 10 complimentary questions on the IOS Firewall set.? Answers are at the end of the article.? Enjoy!


1. Define the term "DMZ" as it pertains to network security Sean Taylor , and name three different common network devices that are typically found there.


2. Identify the true statements.


A. Stateless packet filtering considers the TCP connection state.


B. Stateful packet filtering considers the TCP connection state.


C. Neither stateless nor stateful packet filtering monitor the TCP connection state.


D. Both stateless and stateful packet filtering monitor the TCP connection state, and keep a state table containing that information.


3. Does the Cisco IOS Firewall feature set act as a stateful or stateless packet filter?


4. Which of the following are considered parts of the IOS Firewall feature set?


A. IOS Firewall


B. Intrusion Prevention System


C. RADIUS


D. Authentication Proxy


E. Password Encryption


5. Identify the true statements regarding the Authentication Proxy.


A. It's part of the IOS Firewall Feature Set.


B. It allows creation of per-user security profiles, rather than more general profiles.


C. It allows creation of general security profiles, but not per-user profiles.


D. Profiles can be stored locally Washington Redskins Jersey , but not remotely.


E. Profiles can be stored on a RADIUS server.


F. Profiles can be stored on a TACACS+ server.


6. Configuring ACLs is an important part of working with the IOS Firewall. What wildcard masks are replaced in ACLs by the words host and any?


7. What does the dollar sign in the following ACL line indicate?


R1(config)#$ 150 deny ip 172.50.50.0 0.0.0.255 172.50.100.0 0.0.0.255


8. Basically, how does an IOS Firewall prevent a TCP SYN attack?


9. What does the term "punch a hole in the firewall" refer to? (Logically, that is, not physically.)


10. What exactly does the router-traffic option in the following configuration do?


R4(config)#ip inspect name PASSCCNASECURITY tcp router-traffic


R4(config)#ip inspect name PASSCCNASECURITY udp router-traffic


R4(config)#ip inspect name PASSCCNASECURITY icmp router-traffic


Here are the answers!


1. It's easy to think of your network as the "inside" Jurrell Casey , and everything else as "outside".? However, we've got a third area when it comes to firewalls - the DMZ.


From an IT standpoint, the DMZ is the part of our network that is exposed to outside networks.?? ?It's common to find the following devices in a DMZ:


FTP server


Email server


E-commerce server


DNS servers


Web servers


2. (B.) Stateful packet filtering does monitor the connection state, and that's particularly important when it comes to preventing TCP attacks.? A stateful firewall will not only monitor the state of the TCP connection Kevin Byard , but also the sequence numbers.? Stateful firewalls accomplish this by keeping a session table, or state table.


3. The Cisco IOS Firewall is a stateful filter.


4. (A, B, D.) There are three major components to the IOS Firewall feature set - the IOS Firewall Derrick Henry , the Intrusion Prevention System (IPS), and the Authentication Proxy.


5. (A, B, E Corey Davis , F. T he Authentication Proxy allows us to create security profiles that will be applied on a per-user basis, rather than a per-subnet or per-address basis.? These profiles can be kept on either of the following:


RADIUS server


TACACS+ server


Upon successful authentication, that particular user's? security policy is downloaded from the RADIUS or TACACS+ server and applied by the IOS Firewall router.


6. We have the option of using the word host to represent a wildcard mask of 0.0.0.0.? Consider a configuration where only packets from IP source 10.1.1.1 should be allowed and all other packets denied.? The following ACLs both do that.


R3#conf t


R3(config)#access-list 6 permit 10.1.1.1 0.0.0.0


R3(config)#conf t


R3(config)#access-list 7 permit host 10.1.1.1


The keyword any can be used to represent a wildcard mask of 255.255.255.255.? Both of the following lines permit all traffic.


R3(config)#access-list 15 permit any


R3(config)#access-list 15 permit 0.0.0.0 255.255.255.255


There's no "right" or "wrong" decision to make when you're configuring ACLs in the real world.? For your exam, though Marcus Mariota , I'd be very familiar with the proper use of host and any.


7. The dollar sign simply indicates that part of the command you're entering or viewing can't be shown because the entry is so long. It does not mean the command is illegal.


8. The IOS Firewall can use any or all of the following values to detect when a TCP SYN attack is underway:


Overall total of incomplete TCP sessions


Number of incomplete TCP sessions on a per-host basis


When any of these thresholds are reached, either of the following actions can be t . Cheap Jerseys Wholesale Soccer Jerseys Free Shipping Cheap Jerseys Cheap Jerseys From China Cheap Jerseys From China Cheap NFL Jerseys Cheap NFL Jerseys Wholesale NFL Jerseys Cheap Jerseys Wholesale Baseball Jerseys