Cisco CCNP ENCOR > Security Theory > Flashcards

Security Theory Flashcards

Access Control, CoPP, AAA (59 cards)

Study These Flashcards
1
Q

What is the name of the Cisco Security Architectural Framework?

A

Cisco SAFE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the PINs (Places In Network) where you would see Cisco SAFE deployed?

A
  • Branch
  • Campus
  • Data Center
  • Edge
  • Cloud
  • WAN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the operational domains that Cisco SAFE defines?

A
  • Management
  • Security Intelligence
  • Compliance
  • Segmentation
  • Threat Defense
  • Secure Services
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What three intelligence teams make up Cisco Talos?

A
  • Ironport Security Applications
  • Sourcefire Vulnerability Research Team (VRT)
  • Cisco Threat Research, Analysis, and Communications Team (TRAC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is Cisco Threat Grid?

A

A complex virtual sandbox that that observes and analyzes static files for the behavior of malware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is Cisco AMP?

A

Advanced Malware Protection - comprehensive malware protection across the full attack continuum: Before, During, and After a breach occurs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the key components of the Cisco AMP architecture?

A
  • AMP Cloud
  • Threat intelligence from Talos and Threat Grid
  • AMP Connectors (Endpoints, Networks, Email, Web, Meraki)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Cisco Umbrella?

A

A Cloud-based secure DNS solution that blocks malicious Internet destinations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Cisco WSA?

A

Web Security Appliance - URL filtering, malware-block, Data Loss Prevention, Anti-Virus scanning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Cisco ESA?

A

Email Security Appliance - includes global threat intelligence, spam protection, reputation filtering, forged email protection, domain protection, DLP, Phishing protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is NGIPS?

A

Next Generation Intrusion Protection System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the name of Cisco’s NGIPS?

A

Firepower

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the key characteristics of any NGIPS?

A
  • Real time contextual awareness
  • Advanced threat protection
  • Intelligent security automation
  • Performance and scalability
  • Application Visibility and Control (AVC)
  • URL filtering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the key characteristics of a Next Generation Firewall (NGFW)?

A
  • Stateful packet inspection
  • Integrated IPS
  • Application level packet inspection
  • leverages external security intelligence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Cisco Stealthwatch?

A

Collector of network telemetry data that can perform security analysis on the network data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Cisco ISE?

A

Identity Services Engine - a security policy management platform that performs Network Access Control (NAC) and 802.1x functions and more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some of the key benefits to Cisco ISE?

A
  • Network Access Control
  • DNA Center integration
  • Device Access Control, onboarding, and profiling
  • Cisco TrustSec
  • Guest Lifecycle Management
  • Internal Certificate Authority
  • Endpoint posture service
  • Cisco Platform Exchange Grid (pxGrid)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is pxGrid and what role does ISE play in pxGrid?

A

Platform Exchange Grid - an IETF framework that uses a single API to exchange security information to mitigate and remediate security threats across the network. Cisco ISE acts as the pxGrid Controller (aka server).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

List the five most prolific types of Network Access Control (NAC)

A
  • 802.1X
  • Mac Address Bypass (MAB)
  • WebAuth
  • TrustSec
  • MacSec
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the four main components of 802.1x?

A
  • Extensible Authentication Protocol (EAP)
  • EAP Method aka EAP Type
  • EAP over LAN (Layer 2)
  • RADIUS protocol
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is 802.1X?

A

An IEEE Standard for authenticating devices that are trying to connect to a network. AAA, Radius, WLCs, and/or Cisco ISE are core components in an 802.1X deployment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the device roles in an 802.1x deployment?

A
  • Supplicant
  • Authenticator
  • Authentication Server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the role of a Supplicant in an 802.1x deployment?

A

The software on the endpoint that is attempting to authenticate to the network. This could be the Operating system or a Cisco AnyConnect client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the role of a Authenticator in an 802.1x deployment?

Study These Flashcards
A

The network access device (NAD) such as a switch or WLC. The authenticator accepts EAP encapsulated Layer 2 frames from the supplicant and encapsulates them into RADIUS packets before sending them to the Authentication Server.

25
What are the most common methods of EAP?
- EAP-MD5 - EAP-TLS - EAP-FAST - EAP-TTLS - PEAP - EAP-GTC - EAP-MSCHAPv2
26
Describe the EAPOL 4-way handshake.
- **Step 1** When the authenticator notices a port coming up, it starts the authentication process by sending periodic EAP-request/identify frames. The supplicant can also initiate the authentication process by sending an EAPoL-start message to the authenticator. - **Step 2** The authenticator relays EAP messages between the supplicant and the authentication server, copying the EAP message in the EAPoL frame to an AV-pair inside a RADIUS packet and vice versa until an EAP method is selected. Authentication then takes place using the selected EAP method. - **Step 3** If authentication is successful, the authentication server returns a RADIUS access-accept message with an encapsulated EAP-success message as well as an authorization option such as a downloadable ACL. When this is done, the authenticator opens up the port.
27
What is MAB?
MAC Address Bypass - typically used when 802.1X authentication is unavailable. A port can be enabled or disabled based on the MAC address of the endpoint trying to connect.
28
What is WebAuth?
Endpoints are directed to a web page where they can use the web server to authenticate to the network.
29
What are the two types of WebAuth?
Local Web Auth (LWA) - switch or WLC redirects endpoint to a local web server running IN the switch Central Web Auth (CWA) using ISE
30
What are dACLs, dVLAN, and SGT
- downloadable Access Control List - dynamic VLANs - Security Group Tags
31
What is Cisco TrustSec?
Next generation Access Control solution developed by Cisco based on the use of Security Group Tags (SGT).
32
What are the three phases of TrustSec?
1.) Ingress Classification - assigning the SGT 2.) Propagation - communicates the SGT mappings through the network 3.) Egress Enforcement - enforcing the policy based on the SGT
33
What are the two methods of TrustSec Propagation?
1.) Inline tagging - SGT tags inserted into frames 2.) SXP Propagation - TCP-based peer-to-peer protocol
34
What are the two major methods of TrustSec Enforcement?
- Security Group ACLs (SGACL) - Security Group Firewall (SGFW)
35
What is MACSec?
An IEEE standards-based Layer 2 encryption method.
36
What is the IEEE Standard designation for MACSec?
802.1AE
37
What are the two keying methods available for MACSec?
- Security Association Protocol (SAP) - MACSec Key Agreement (MKA) protocol
38
What is the difference between Downlink MACSec and Uplink MACSec?
- Downlink is between and endpoint and switch. - Uplink is between two switches
39
What does AAA mean?
Authentication, Authorization and Accounting: Authentication - login Authorization - privilege Accounting - logging the activity
40
What is TACACS+?
Terminal Access Controller Access Control System: A security protocol developed by Cisco for Authentication and Authorization to a device. TACACS can give a very granular level of authorization specific to what commands a user can enter on a device.
41
What is Radius?
An industry standard security protocol for centralized network access control (NAC) authentication.
42
When referring to RADIUS, what ports does Cisco use for default compared to industry standards?
- Cisco: UDP-1645 for authorization and authentication; UDP-1646 for accounting - Industry Standard: UDP-1812 for authentication and authorization; UDP-1813 for accounting
43
Why is RADIUS typically chose over TACACS+ for AAA deployments?
TACACS does not support EAP
44
When configuring TACACS+ in a Cisco environment, what is typically the best choice for a TACACS server?
Cisco ISE (2.0)
45
What is ZBFW?
Zone Based Firewall - an integrated stateful firewall now included on IOS.
46
What are the two "automatic" zones used in ZBFW?
- Self-Zone - Default Zone
47
What is the command to verify ZBFW zone configurations on a Cisco router?
show policy-map type inspect zone-pair PAIR_NAME
48
What is the Windows Server role that allows a domain controller to be used as a RADIUS server?
Network Policy and Access Services
49
When configuring privilege levels for a user account, what do the built-in privilege levels 0, 1, and 15 mean?
0 - only allows five commands: logout, enable, disable, help and exit. 1 - read only and "ping" 15 - full access to all commands
50
When configuring privilege levels for a user account, what do levels 2 through 14 do?
Privilege 2 through 14 are custom configurable levels. In theory the higher levels would have more access but this depends on what was configured.
51
What is CoPP?
Control Plane Policing - the concept of controlling what and how much traffic is handled by a routing device's CPU so it does not get overloaded. (and DDoS prevention)
52
What is MQC?
Modular Quality of Service Command Line Interface - the basic structure of QoS configuration from the command line. This model fits well for CoPP.
53
What is Cisco EPC?
Embedded Packet Capture
54
What are the general steps to create a CoPP policy on a Cisco device?
1.) Create ACLs to match traffic for treatment. **Note:** some traffic like ICMP may want to be allowed but rate limited 2.) Create class-maps to match on all the ACLs 3.) Create policy maps to police/treat the traffic 4.) Apply the policy map to the control-plane
55
In wireless security, what is PSK?
Pre-Shared Key - essentially it is like a password that an endpoint device will use to gain access to an SSID over a wireless AP
56
In wireless security, what is EAP?
Extensible Authentication Protocol - a set of protocols and functions that leverage backend databases, user accounts, and device IDs to authenticate an endpoint to a wireless network. This is a common 802.1X framework (supplicant, authenticator, authentication server)
57
In a Wireless LAN Controller GUI, how would you go to configure a Pre-Shared Key?
WLANs (Node) > Create New (Go) > Set Name; SSID; ID > Apply (Button) WLAN > NAME > Security (Tab) > Layer 2 (Tab) > Layer 2 Security > WPA + WPA2 Select Policy; Enable PSK; Set Key > Apply (Button)
58
In a Wireless LAN Controller GUI, how would you go to configure EAP?
Security (Node) > Radius > New (Button) > Set Radius Server Details WLAN (Node) > New (or existing) > Security (Tab) > Layer 2 (Tab) > Set WAP+WPA2; **Enable 802.1X**; Set AES; Set WPA2 Policy WLAN > Security (Tab) > AAA Servers (Tab) > Set Server Defined in Step 1
59
In a Wireless LAN Controller GUI, how would you go to configure Web Auth?
Security (Node) > (Left Navigation) Web Auth > Web Login Page: choose Internal, Custom, or External Page WLANs > WLAN_ID > Security (Tab) > Layer 2 (Tab) > Set to None WLANs > WLAN_ID > Security (Tab) > Layer 3 (Tab) > Layer 3 Security Set to "Web Policy"; Set options as needed {Passthrough, Authentication, etc) NOTE: If using "Authentication" then AAA Server needs to be configured from AAA Servers (Tab)
Cisco CCNP ENCOR
flashcards
Decks in class (27)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions