Home > Articles > Cisco

  • Print
  • + Share This
This chapter is from the book

This chapter is from the book

Apply Your Knowledge

Exercise

4.1 Mitigation Methods

Based on the Cisco-provided exam objectives, you may need to "explain general methods to mitigate common security threats to network devices, hosts, and applications" on the CCNA exam. In this exercise, list the eleven mitigation methods that were covered in this chapter, and write a brief description of each one. You may refer to Table 4.4 to check your answers.

Estimated Time: 20 minutes

  1. ___________ _______________________________________________
  2. ___________ _______________________________________________
  3. ___________ _______________________________________________
  4. ___________ _______________________________________________
  5. ___________ _______________________________________________
  6. ___________ _______________________________________________
  7. ___________ _______________________________________________
  8. ___________ _______________________________________________
  9. ___________ _______________________________________________
  10. ___________ _______________________________________________
  11. ___________ _______________________________________________

Review Questions

  1. Define trust exploitation.

  2. Describe a TCP SYN attack.

  3. What are the three services that make up AAA?

  4. What can a Cisco ACL help mitigate?

  5. List the similarities and differences between an IPS and IDS.

Exam Questions

  1. What are the three common classes of attack?

    circle.gif

    A. Access attack

    circle.gif

    B. DoS attack

    circle.gif

    C. Smurf attack

    circle.gif

    D. Reconnaissance attack

  2. Which of the following are types of access attacks? (Choose three)

    circle.gif

    A. Trust exploitation

    circle.gif

    B. TCP SYN attack

    circle.gif

    C. Port redirection

    circle.gif

    D. Man-in-the-middle

  3. Which of the following are tools that can be used for a reconnaissance attack? (Choose three)

    circle.gif

    A. Port redirection

    circle.gif

    B. Ping sweep

    circle.gif

    C. Port scan

    circle.gif

    D. Packet sniffer

  4. Which of the following are types of DoS attacks? (Choose three)

    circle.gif

    A. Smurf attack

    circle.gif

    B. Packet sniffer

    circle.gif

    C. DDoS

    circle.gif

    D. TCP SYN attack

  5. What command can be configured on a Cisco device to mitigate smurf attacks?

    circle.gif

    A. ip tcp intercept

    circle.gif

    B. ip directed-broadcast

    circle.gif

    C. no ip directed-broadcast

    circle.gif

    D. no ip tcp intercept

  6. When a valid host IP address is assumed by an attacking system, it is called ________________.

    circle.gif

    A. Filtering

    circle.gif

    B. Ping of death

    circle.gif

    C. IP spoofing

    circle.gif

    D. Teardrop attack

  7. What do the three A's in AAA stand for?

    circle.gif

    A. Authentication, authorization, advertising

    circle.gif

    B. Authorization, accounting, activating

    circle.gif

    C. Authentication, accounting, activating

    circle.gif

    D. Authentication, authorization, accounting

  8. Which protocol uses TCP port 22?

    circle.gif

    A. SSL

    circle.gif

    B. SSH

    circle.gif

    C. SNMP

    circle.gif

    D. NTP

  9. Which of the following are Cisco IOS secure management features? (Choose three)

    circle.gif

    A. Syslog

    circle.gif

    B. SSH

    circle.gif

    C. AAA

    circle.gif

    D. SNMP

  10. Which protocol provides a secure channel between two devices at the Application layer (Layer 7) of the OSI model?

    circle.gif

    A. SSL

    circle.gif

    B. IPsec

    circle.gif

    C. SNMP

    circle.gif

    D. NTP

Answers to Review Questions

  1. Trust exploitation occurs when a device or group of devices on a shared segment erroneously trusts information that has been provided by an untrustworthy source.

  2. In a TCP SYN attack, a SYN request is sent to a device with a spoofed IP address. The attacking system does not acknowledge the resulting SYN-ACK, which causes the session connection queues to fill up and stop taking new connection requests.

  3. Authentication identifies a user by login and password. Authorization determines what a user is allowed to do by putting together a list of attributes. Accounting assembles and sends usage information.

  4. IP spoofing

    TCP SYN attacks

    Smurf attacks

    ICMP and traceroute

  5. Both IPS and IDS listen promiscuously to all incoming traffic. IPS is an active device that is inline with the traffic path. It can identify attacks and block them in the system. IDS is a passive device that may not be inline with the path of traffic. IDS can also generate alerts and send TCP resets when necessary.

Answers to Exam Questions

  1. A, B, D. The three common classes of attack are access attack, reconnaissance attack, and DoS attack. Answer C is not a class of attack, but rather a type of DoS attack.

  2. A, C, D. Trust exploitation, port redirection, and man-in-the-middle are all types of access attacks. Answer B is incorrect because a TCP SYN attack is a form of DoS attack.

  3. B, C, D. Ping sweeps, port scans, and packet sniffers are all tools that can be utilized for a reconnaissance attack. Answer A is incorrect because port redirection is a type of access attack.

  4. A, C, D. Smurf attacks, DDoS attacks, and TCP SYN attacks are all types of DoS attacks. Answer B is incorrect because a packet sniffer is a tool used for a reconnaissance attack.

  5. C. The no ip directed-broadcast command can be configured on a Cisco device to block smurf attacks. Answers A and D are incorrect because they are related to the TCP SYN attack. Answer B is incorrect because it does not contain the keyword no.

  6. C. When a valid host IP address is assumed by an attacking system, it is called IP spoofing. Answer A is incorrect because filtering is used to filter traffic. Answer B is incorrect because the ping of death is when an ICMP echo request packet that is larger than 65,535 bytes is sent to a target destination, causing it to overflow, crash, and/or reboot. Answer D is incorrect because a teardrop attack happens when the Offset field of the TCP header is changed.

  7. D. AAA stands for authentication, authorization, and accounting. Answer A is incorrect because advertising is not a service of AAA. Answers B and C are incorrect because activating is not a service of AAA.

  8. B. SSH uses TCP port 22. Answer A is incorrect because SSL uses TCP port 443. Answer C is incorrect because SNMP uses UDP port 161. Answer D is incorrect because NTP uses UDP port 123.

  9. A, B, D. Syslog, SSH, and SNMP are all Cisco IOS secure management features. Answer C is incorrect because AAA consists of a group of three services that are used in conjunction with an authentication server and a software service such as TACACS or RADIUS to provide a secure network connection with a record of user activities.

  10. A. SSL is a protocol that provides a secure channel between two devices at the Application layer (Layer 7) of the OSI model. Answer B is incorrect because IPsec functions at Layer 3 of the OSI model. Answer C is incorrect because SNMP is a management protocol that monitors the network and manages configurations. Answer D is incorrect because NTP is a protocol that synchronizes clocks on the local network to provide accurate local time on the user system.

Suggested Readings and Resources

  1. "A Beginner's Guide to Network Security," http://www.cisco.com/warp/public/cc/so/neso/sqso/beggu_pl.pdf.
  2. List of Cisco Security products, http://www.cisco.com/en/US/products/hw/vpndevc/index.html.
  • + Share This
  • 🔖 Save To Your Account