Acquisitions Editor: Jeff Kellum

Development Editor: Stef Jones

Technical Editors: Chris Carson, Billy Haines

Production Editor: Angela Smith

Copy Editor: Judy Flynn

Editorial Manager: Pete Gaughan

Production Manager: Tim Tate

Vice President and Executive Group Publisher: Richard Swadley

Vice President and Publisher: Neil Edde

Media Project Manager 1: Laura Moss-Hollister

Media Associate Producer: Doug Kuhn

Media Quality Assurance: Josh Frank

Book Designers: Judy Fung and Bill Gibson

Proofreader: Rebecca Rider

Indexer: Jack Lewis

Project Coordinator, Cover: Lynsey Stanford

Cover Designer: Ryan Sneed

Copyright © 2010 by Wiley Publishing, Inc., Indianapolis, Indiana

Published simultaneously in Canada

ISBN: 978-0-470-52767-2

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Library of Congress Cataloging-in-Publication Data is available from publisher.

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CCNA is a registered trademark of Cisco Technology, Inc. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

10 9 8 7 6 5 4 3 2 1

To God and my family. Without the support and love from both, I would not be able to do what I do. Thanks for the many blessings.

Acknowledgments

When you take on a project like this, there are always a number of people involved, and this one is no exception. I could not have done this book without the help and support of several folks. First, I’d like to thank my technical editor, Chris Carson, for keeping me honest and offering candid feedback. Chris also contributed to this book by writing Chapter 10 and Chapter 11. His help was invaluable. I would also like to thank Patrick Conlan, who provided access to most of the equipment used in the writing of this book.

A special thanks goes out to Stef Jones, this book’s developmental editor. Stef was the one to keep me in line and was a tremendous help in shaping up some of the more difficult chapters.

And last but not least, thanks to the team at Sybex for supporting me in this endeavor: Pete Gaughan, editorial manager; Jeff Kellum, acquisitions editor; and Jenni Housh, Connor O’Brien, and Angela Smith, who are all on the editorial team. I’m sure I gave Jeff plenty of cause for concern over the course of the better part of a year, but we all survived—I think. Also, thanks to copyeditor Judy Flynn, proofreader Rebecca Rider, and indexer Jack Lewis.

About The Author

Tim Boyles is an IT manager at a large retailer based in the Dallas–Fort Worth Metroplex. He has been involved in networking and security for over 20 years. He is the holder of many certifications, including CISSP, CISA, CISM, GCIH, GAWN, and of course CCNA and CCNA-Security. Tim has worked on many networking and security books. He was previously the security practice leader for the South Central operation of BT Global Services and has been engaged with consulting for a number of years with numerous large corporate clients. He is also a mentor instructor for the SANS Institute, having conducted sessions on CISSP training, Incident Handling, Wireless Penetration Testing, and Web Application Security.

About the Contributor

Chris L. Carson, CCIE #19511, is a principal at Ethical Networks, a network and security consulting provider in the Dallas–Ft. Worth area. He has been in the network and security industry for more than 17 years and holds over 20 industry certifications, including CCIE, CCSP, CEH, and CCNA-Security. Most of his career has been spent working for large Cisco Gold partners throughout the United States. Chris’s previous position as a security practice manager and principal for one of the largest Cisco partners in North Texas has provided him with expertise in designing, implementing, and troubleshooting solutions for many Fortune 500 customers.

Introduction

Welcome to CCNA Security Study Guide, a comprehensive guide that covers everything you need for Cisco’s exam IINS 640-553. For readers who are new to Cisco certifications, there is a well-defined structure to the different levels that network administrators can achieve. Cisco’s current certification structure has the following five different levels of certification:

Entry level

Associate

Professional

Expert

Architect

This book is written for the associate level of certification. Cisco considers this level to be the “apprentice or foundation level” for network administrators.

Cisco has recently broadened its associate-level certifications to include not only a certification for routing and switching (CCNA) and one for design (CCDA) but also more targeted associate-level certifications for security (CCNA Security), wireless (CCNA Wireless), and voice (CCNA Voice). These new certifications target specific areas of Cisco technology and are to be used as stepping-stones for the professional and expert levels of certification that Cisco offers.

This book is a culmination of a year’s worth of work that focused on the things you need to know to pass the CCNA Security exam, but I also hope to engage your mind on the discussion of security. Obviously everything can’t be covered in one book, so it is incumbent on you, the reader, to enhance your knowledge as you see fit with other training materials. With this book, you will gain hands-on experience by performing the exercises included in each chapter, and I have provided the output of commands that you would see if you were connected to the router. All you really need to practice the techniques shown in the book are a couple of Cisco routers that support SDM. For the most part, you can get by with one, but in some cases you may want to have a second one to help with the real-world aspect of things.

The biggest problem for me was determining what is important for the exam without going into any one topic too deeply. At the end of the day, this is a study guide. There is a certain amount of background material, but I’m confident you will find that it includes the right amount of information to pass the test.

Cisco’s Security Certifications

Cisco offers three distinct levels of Security certifications. This diagram shows that the CCNA Security certification is a building block to the professional- and expert-level security certifications:

This book covers the CCNA Security certification exam, IINS (Implementing Cisco IOS Network Security) 640-553. As this book goes to press, the exam costs $250 USD. The exam tests your knowledge in areas specific to Cisco hardware and software, both theoretical and technical.

Once you achieve your CCNA Security certification, you can choose to continue on the path and achieve higher certifications, such as the Cisco Certified Security Professional (CCSP) or the ultimate, CCIE Security. But even if you stop after achieving your CCNA Security certification, you will have demonstrated to your current or prospective employers that you have a sound knowledge of the interworkings of security and Cisco security technologies. This can only increase your value as an employee, and it might even make it easier to land that dream job you’ve always wanted!

What Skills Do You Need to Become CCNA Security Certified?

To meet the CCNA Security certification skill level, you must possess the following skills:

A thorough knowledge of core security technologies; how to install, troubleshoot, and monitor network devices to maintain integrity, confidentiality, and availability of data and devices; and familiarity of the technologies Cisco uses in its security structure

The ability to develop a security infrastructure, recognize threats and vulnerabilities to networks, and mitigate security threats

How Do You Become CCNA Security Certified?

If you are new to Cisco certifications, to get your CCNA Security certification, you must first obtain your CCNA certification. You can become CCNA certified one of two ways:

Pass the 640-802 CCNA exam.

Pass both the ICND1 (640-822) and ICND2 (640-816) exams.

Once you have your CCNA, you can take the CCNA Security exam. This book covers 100 percent of the exam objectives for Exam #640-553, Implementing Cisco IOS Network Security (IINS). You will need to take and pass this exam to become CCNA Security certified. You can take the exam at any Pearson VUE testing center. The exam is 90 minutes long and includes from 55 to 65 questions.

The one thing I recommend is that you will need some hands-on experience. All you really need to practice the techniques shown in the book are a couple of Cisco routers that support Security Device Manager (SDM). For the most part, you can get by with one, but in some cases you may want to have a second one to help with the real-world aspect of things.

Hands-on experience is very important for this or any CCNA. I’ve provided numerous hands-on exercises throughout this book. That is a good place to start, but don’t hesitate to experiment or look for other ways to gain experience.

Who Should Buy This Book

I am making certain assumptions about the reader:

You either have a CCNA or are in the process of getting one.

You are comfortable working with Cisco routers.

You have at least an idea about security concepts.

This book contains everything you need to know to pass the CCNA Security exam, 640-553. It does not include exhaustive coverage of each and every topic. What it does do is cover what you need to know for the exam.

In the appendices, there is information on some related topics that are not yet part of the exam. It’s anybody’s guess when they might be, but chances are they will when the next release of the exam comes out, so why not get a head start with an introduction to the topics. In Appendix D, you’ll find a more extensive hands-on exercise.

What’s Inside

Here is a glance at what’s in each chapter:

Chapter 1, “Introduction to Network Security,” begins with a discussion to give you a basic understanding of network security, including such topics as threats to network security, the objectives of network security, data classification, security controls, incident response, and law and ethics.

Chapter 2, “Creating the Secure Network,” provides a discussion of operations security, including the SDLC process. Also discussed are security policy, risk management, the Cisco Self-Defending Network, and security awareness.

Chapter 3, “Securing Administrative Access,” shows you how to configure secure access to your router. It includes an introduction to Cisco Security Device Manager (SDM). And you’ll find information on privilege levels, security features of Cisco ISR routers, and securing configuration files.

Chapter 4, “Configuring AAA Services,” covers the functions and importance of AAA services, including TACACS+ and RADIUS. A more detailed discussion of authentication, authorization, and accounting follow.

Chapter 5, “Securing Your Router,” introduces you to locking down the router by using One-Step Lockdown with Cisco SDM and then via the command line with AutoSecure. Also covered in this chapter is configuring SSH access and Syslog via the command line and SDM.

Chapter 6, “Layer 2 Security,” shows you how to use IOS features on the Catalyst switch to secure your layer 2 communications.

Chapter 7, “Implementing Cisco IOS Firewall,” covers the evolution of firewalls, using access-control lists, a discussion of stateful firewall features, and a Cisco Firewall feature set implemented with Cisco SDM.

Chapter 8, “Implementing Cisco IOS Intrusion Prevention,” provides a discussion of network and host based intrusion detection and prevention. You will use Cisco SDM to implement IOS Intrusion Prevention.

Chapter 9, “Understanding Cryptographic Solutions,” explains the history of cryptograph and goes over the different methods used. Also covered is a discussion of symmetric encryption.

Chapter 10, “Using Digital Signatures,” gives us a discussion of hashing values and a covers an overview of digital signatures.

Chapter 11, “Using Asymmetric Encryption and PKI,” covers public key cryptography and a discussion of asymmetric encryption.

Chapter 12, “Implementing Site-to-Site IPsec VPN Solutions,” gives us a discussion of the components of IPsec plus runs through the configuration of a site-to-site VPN using Cisco SDM.

How to Use This Book

The CCNA Security Study Guide is designed to prepare the reader to pass the 640-553 exam to achieve the associate-level certification in Cisco security technologies. To get the most out of this book, I recommend you use the following study methods:

1. Take the assessment test provided to you prior to Chapter 1 of this book. Try to answer each question without looking at the provided answers and explanations found at the end of the test.

The assessment test is also included on the companion CD and can be taken electronically.

The assessment test should give you an indication of your skill level prior to reading the book. Once you have completed the assessment test and graded yourself, take time to carefully read over the explanations for any question you get wrong and note the chapters in which the material is covered. This information should help you identify sections of the book that you need to spend additional time on. Keep in mind, however, that the book was designed such that the chapters should be read in order. Much of the material found in the chapters build on knowledge learned from previous chapters.

2. Prior to reading each chapter, make sure you review the test objectives listed at the beginning. They list what the exam taker must ultimately know in order to pass the CCNA Security exam.

3. Complete each written lab at the end of each chapter. These labs are created to make sure the reader fully understands key topics that are contained within the chapter. Using a written format as opposed to a multiple-choice format forces the reader to know the answers off the top of their head instead of just eliminating options, as we often do with multiple-choice questions.

4. Work through and fully understand the commands found in the hands-on labs. Not all chapters have hands-on labs, but the book focuses on the important tasks necessary for aspiring CCNA Security network administrators.

5. Answer all of the review questions related to each chapter. Once you have finished answering the questions, review the answers and explanations to not only understand the correct answers but also to understand why the incorrect answers are actually incorrect! Keep in mind that these review questions will not be the exact questions you’ll find on the exam, but they help you to understand the material from which Cisco creates the actual exam questions.

6. Take time to review the bonus exams that are included on the companion CD. Questions in these exams appear only on the CD.

7. Test yourself using all the flashcards on the included CD. They can be viewed on both PCs and mobile PC, so now you can take your study material with you wherever you go!

Home Lab Setup

Having access to a lab at home is always great, if you can swing it. As a suggestion, the minimum setup would be an ISR router that supports SDM and a Catalyst switch that you can use for practice exercises. For the router, you can use any of the following that support SDM:

Cisco 800 Series

Cisco 1800 Series

Cisco 1900 Series

Cisco 2800 Series

Cisco 2900 Series

For the switch, you can choose almost any Catalyst model from the last few years. As noted in the text, some switches have slightly different syntax on some of the commands, but that’s to be expected.

Of course, you can add servers and PCs as you wish to make it more realistic, but that’s entirely your option. What I’ve listed is the minimum you would need.

What’s on the CD?

The CD included with this book includes many supplemental tools that you can use to further your studies and achieve your goal of becoming a CCNA Security certified administrator. You can use the content described in the following sections to further your studying.

The Sybex Test Engine

The Sybex test engine software lets readers take all of the review and assessment questions found in the book as well as two additional bonus exams that are found only on the CD. Potential test takers can practice in an electronic test-taking environment that is similar to the environment of the actual Cisco exam.

Electronic Flashcards for PCs and Mobile PC Devices

In addition to the Sybex test engine software, Sybex has included over 100 electronic flashcards for you to test yourself with on PCs and compatible handheld devices. These flashcards are designed to get the reader to quickly recognize and recall important CCNA security information that will be useful for them when taking the 640-553 exam.

CCNA Security Study Guide in PDF

Finally, the CD contains the entire CCNA Security Study Guide in PDF format so you can read the book on your PC or laptop or any handheld devices that reads PDF files.

Tips for Taking Your CCNA Security Exam

The CCNA Security exam contains anywhere from 55 to 65 questions and must be completed in 90 minutes or less. The exam is in English, Japanese, Chinese, Russian, Portuguese, Korean, French, and Spanish. This information can change per exam. A passing score varies according to the types of questions found in the exam, but it is probably best to assume you need to get approximately 85 percent of the questions correct to pass the exam.

When taking the exam, thoroughly read each question to make sure you know what answer it is looking for. Cisco exam questions tend to have answers that look identical. You will find, however, that there are small differences in the answers that can determine which is correct.

Also, keep in mind that you should choose the answer that Cisco believes is correct as opposed to what you or other vendors believe. This is a Cisco exam, after all, so the right answer is the one that Cisco recommends!

The 640-553 exam questions might be in any of the following formats:

Multiple-choice, single answer

Multiple-choice, multiple answer (Cisco will always tell you to choose two or three depending on the proper number of multiple correct responses.)

Drag and drop

Fill in the blank

Simulations

Test-Day Tips for Certification Success

Here are some things to keep in mind as you prepare for the exam:

Arrive at the exam center at least 30 minutes early. That way you can check in and mentally prepare for the exam without having to rush.

Take the Cisco exam tutorial. This tutorial is offered prior to the official start of each exam before the test timer starts. It is an interactive tutorial that shows you the format of the exam and how to navigate through the different question types, including multiple choice, drag-and-drop, fill-in-the-blank, and simulation questions. Even if you have taken many Cisco exams, I highly recommend going through the tutorial in case something new has been added to the exam format since the last time you took an exam.

Read both the questions and answers very carefully. Cisco often will intentionally lead the hasty test taker who simply glosses over a question to quickly choose the incorrect answer. Patience and careful thinking pay off greatly when taking Cisco exams!

Be aware that you cannot go back to change an answer once you have moved on to the next question. Make sure the answer you choose is the one you want to stick with.

How to Contact the Author

I welcome feedback from you about this book or any topic for a future book. You may reach me by writing to me at ccnasecurity1@gmail.com.

Sybex strives to keep you supplied with the latest tools and information you need for your work. Please check the website at www.sybex.com, where we’ll post additional content and updates that supplement this book should the need arise. Enter CCNA Security in the Search box or type the book’s ISBN—9780470527672—and click Go to get to the book’s update page.

Assessment Test

1. Which of the following is a group of computers that have been compromised and are controlled by a third party?

A. Hotnet

B. Botnet

C. LANnet

D. DOSnet

2. A smurf attack is an attack on which tenet of the network security objectives?

A. Confidentiality

B. Reliability

C. Availability

D. Integrity

E. Repeatability

3. A piece of marketing data for an upcoming but not yet released marketing campaign for the private sector is accidentally released. What would be the classification for this data?

A. Top Secret

B. Confidential

C. Secret

D. Private

E. Sensitive

4. If you were going to design a network and adhere to operation security best practices, what in the following list would not be a factor?

A. Keep it simple.

B. Look for single points of failure.

C. Look for attack vectors.

D. Find the lowest cost.

E. Plan for the future.

5. A degree in information assurance from a four-year university would be an example of what in a security awareness program?

A. Training

B. Awareness

C. Certification

D. Education

E. Motivation

6. If you configured an enable secret password, what would precede the password in the saved configuration?

A. 1

B. 7

C. 4

D. 6

E. 5

7. What command would you use from the command line to verify that the proper SDM files exist so that you can run SDM to configure your router?

A. show directory

B. show files

C. show flash

D. show sdm

8. What command would you use to deter a brute-force attack on your router by setting a minimum time (beyond the default) to wait before login commands would be accepted again after an unsuccessful attempt?

A. login block-for

B. login delay

C. login wait

D. login wait attempt

9. What can be described as who logged in, what they did, and for how long?

A. Authentication

B. Authorization

C. Logging

D. Accounting

E. Debugging

10. A network access server (NAS—which also stands for network attached storage) is another name for what? (Choose all that apply.)

A. Switch

B. Router

C. VPN concentrator

D. Firewall

11. Cisco Secure ACS for Windows runs which AAA services? (Choose all that apply.)

A. RADIUS

B. CDP

C. TACACS+

D. SDEE

12. When you run auto secure from the command line, a number of global services are disabled. Which of these is not one of the global services that is disabled?

A. Finger

B. PAD

C. Small servers

D. Service password-encryption

E. NTP

13. A Syslog server can be configured in Cisco SDM by utilizing what interface element? (Choose all that apply.)

A. Router Properties

B. Additional Tasks

C. Security Tasks

D. Logging

14. Network Time Protocol (NTP) uses what protocol and port to communicate?

A. UDP 321

B. UDP 123

C. UDP 514

D. TCP 514

E. TCP 123

15. Which of the following is a method of basic layer 2 security?

A. CDP

B. DHCP snooping

C. 802.1Q

D. PPP

16. What is used to elect a root bridge within a layer 2 switched environment?

A. Hello packets

B. STP update packets

C. BPDU

D. CDP

E. STP cost

17. ARP spoofing attacks depend on the use of what type of messages?

A. CDP updates

B. NTP

C. GARP

D. MAC

E. DAI

18. When discussing access list placement, which of the following is correct? (Choose two.)

A. A standard access list should be placed as close to the destination as possible.

B. An extended access list should be placed as close to the source as possible.

C. A standard access list should be placed as close to the source as possible.

D. An extended access list should be placed as close to the destination as possible.

19. True or false? RFC 1918 IP addresses should be blocked by ACL at an Internet-facing router heading inbound to the local LAN.

A. True

B. False

20. At what level of the OSI model does a circuit-level firewall operate? (Choose all that apply.)

A. 2

B. 3

C. 4

D. 5

E. 7

21. The IDS and IPS sensor uses four different approaches to scan for and identify malicious traffic. Which of the following is not one of the four approaches?

A. Policy approach

B. Signature approach

C. Honeypot approach

D. Brute-force capture approach

E. Anomaly-based approach

22. When IDS/IPS technology is discussed, which of the following types can be described as “using a predefined definition of known good network behavior, usually provided by the vendor”?

A. Statistical

B. Nonstatistical

C. Honeypot

D. Active

23. Cisco Security Agent can be described as what kind of system?

A. NIDS

B. HIDS

C. HIPS

D. NIPS

24. DES has two operating modes, block cipher and stream cipher. Which two of the following selections are part of the block cipher mode? (Choose two.)

A. CFB mode

B. CBC mode

C. ECB mode

D. OFB mode

25. Which of the Rivest Ciphers (RCs) is commonly used within Secure Sockets Layer (SSL)?

A. RC2

B. RC3

C. RC6

D. RC4

26. Which of the following encryption algorithms is not supported in Cisco IOS for IPsec implementations?

A. 3DES

B. AES

C. DES

D. IDEA

27. What function is a code that further secures a hash?

A. MAC

B. MD5

C. HMAC

D. HMC

28. Which of the following is not a feature of digital signatures?

A. Integrity

B. Confidentiality

C. Nonrepudiation

D. Authentication

29. What is the biggest drawback to using asymmetric encryption algorithms?

A. Less security

B. Slow computing time

C. Greater key length

D. Difficulty in administration

30. What is the main standard for digital certificates?

A. X.11

B. 802.af

C. X.509

D. H.323

31. When you’re configuring Cisco Easy VPN, what is the difference between Network Extension Mode and Network Extension Mode Plus?

A. A loopback address is configured.

B. An access list is required.

C. NATs are in use.

D. Routable addresses are used.

32. What commands might you use to troubleshoot a site-to-site VPN tunnel? (Choose two.)

A. debug crypto isakmp

B. show crypto isakmp sa

C. show ip route

D. debug isakmp

33. When you’re using the Cisco SDM tool to configure a VPN tunnel, which one of the following items is not shown on the VPN Connection Information screen?

A. Interface Selection

B. Peer Identity

C. Authentication

D. Preshared Key

E. Traffic to Encryption

Answers to Assessment Test

B. A botnet is a group of computers that have been compromised by various means and are controlled by a third party through a command and control server. For more information, see Chapter 1.

C. During a smurf attack, a large number of small packets are directed to a single host, causing a denial of service, which would be an attack on availability. For more information, see Chapter 1.

E. This is somewhat subjective, but since there were no specific security aspects, marketing data that is not really confidential or private but not public either would have to be classified as sensitive. Options A and B are from the military classification system. For more information, see Chapter 1.

D. All of the options except D (find the lowest cost) would be an aspect of operation security. See Chapter 2 for more information.

D. There are three components of a security awareness program: training, awareness, and education. A formal degree program would be an example of the education component. For more information, see Chapter 2.

E. The answer is 5 because the enable secret password is an MD5 hash of the entered password. For more information, see Chapter 3.

C. The answer is show flash, which displays the files on the flash memory. For more information, see Chapter 3.

B. When you use the login block-for command by itself, it sets a default of 1 second to wait after an unsuccessful attempt to login. If you want to configure a different interval, you must use the login delay command. For more information, see Chapter 3.

D. AAA services include authentication, authorization, and accounting. Accounting involves keeping a record of who logged in, what they did, and for how long. Authorization involves who can perform what tasks, and authentication is concerned with who is allowed to log in. For more information, see Chapter 4.

A, B, C, D. A network access server can be any device that can run TACACS+. A router is commonly used as an NAS, but if you have a Cisco network with many devices, chances are they are all using TACACS+ for AAA. For more information, see Chapter 4.

A, C. Cisco Secure ACS for Windows can be both a TACACS+ server and a RADIUS server and both at the same time. See Chapter 4 for more information.

D. Service password-encryption is enabled during the auto secure process. The rest of the global services listed are part of those that are disabled. For more information, see Chapter 5.

A, B, D. This is a bit of a trick question, but after you click the Configure button, Additional Tasks is the correct task on the taskbar. Router Properties is selected on the selection tree and then expands to display the Logging selection. More information can be found in Chapter 5.

B. NTP uses UDP 123 to communicate. UDP is a connectionless protocol, best suited for things like updates on time and log messages. More information can be found in Chapter 5.

B. DHCP snooping is a layer 2 security feature that creates ports where DHCP responses are allowed; this is called a trusted port. See Chapter 6 for more information.

C. Bridge Protocol Data Units (BPDUs) are used to elect a root bridge, based on bridge priority. For more information, see Chapter 6.

C. ARP spoofing attacks depend on the use of Gratuitous ARP (GARP) messages, which offer up bogus ARP packets to replace correct ones in an ARP table on a host or router. For more information, see Chapter 6.

A, B. A standard access list should be placed as close to the destination as possible and an extended access list should be placed as close to the source as possible. See Chapter 7 for more information.

A. You should block RFC 1918 addresses as well as multicast addresses, localhost addresses, and the local LAN range of addresses. For more information, see Chapter 7 and also RFC 2827, “Network Ingress Filtering.”

C, D. A circuit-level firewall operates at the Transport and Session layers of the OSI model, monitoring TCP and UDP port communications. For more information, see Chapter 7.

D. The four approaches to IDS and IPS usage are policy, signature, honeypot, and anomaly based. Brute-force refers to an attack methodology to crack encryption. For more information see Chapter 8.

B. There are two types of anomaly-based IDS and IPS sensors, statistical and nonstatistical. Statistical sensors “learn” the good network behavior over time. Nonstatistical sensors are preprogrammed and may be correct, or they might need lots of tuning. For more information, see Chapter 8.

C. Cisco Security Agent (CSA) can best be described as a Host Intrusion Prevention System (HIPS). Certainly it can alert like an IDS, but the difference is that it can take action to block malicious actions. For more information, see Chapter 8.

B, C. The block cipher mode uses the Cipher Block Chaining (CBC) type and the Electronic Code Book (ECB) type. For more information, see Chapter 9.

D. RC4 is the most commonly used Rivest cipher and is a variable key length stream cipher. For more information, see Chapter 9.

D. IDEA is not supported for Cisco IPsec implementations. For more information, see Chapter 9.

C. The Hash Message Authentication Code (HMAC) is another layer of security on top of a hash such as MD5 or SHA-1. Cisco uses the HMAC within its security protocols. See Chapter 10 for more information.

B. Digital signatures feature integrity, authentication, and nonrepudiation but do not address confidentiality. See Chapter 10 for more information.

B. The biggest drawback to using asymmetric encryption is the speed factor. Using it is significantly slower than using symmetric encryption. For more information, see Chapter 11.

C. The main standard for digital certificates is the X.509 standard and is specified in RFC 5280.

A. The only difference in the Network Extension Mode and the Network Extension Mode Plus is that the Network Extension Mode Plus has an additional IP address configured in the form of a loopback address. For more information, see Chapter 12.

A, B. Two of the most commonly used commands to troubleshoot an IPsec VPN tunnel are related to the ISAKMP exchange. You want to debug the crypto ISAKMP messages with the debug crypto isakmp command and then show the state of the security association with the show crypto isakmp sa command. For more information, see Chapter 12.

D. The preshared key is not part of the information needed on the VPN Connection Information screen; however, whether to use a preshared key or digital certificate is one of the choices. For more information, see Chapter 12.

Chapter 1

Introduction to Network Security

This chapter lays the foundation for future chapters covering the CCNA Security Exam objectives. In this chapter, I’ll discuss the following topics:

Threats to network security

Network security objectives

Classification of data

Security controls

Incident response

Law and ethics

In Chapter 1, I’m going to explore some fundamental tenets of network security. It’s important to have a foundation for the topics we will continue to explore in depth later on. I’ll start with the threats to network security. Then I’ll cover the objectives of network security and you’ll learn some of the ways data is classified. Next, we will look at the types of controls that can be applied to help achieve network security.

In the two final sections, I will discuss the steps of incident response. Then we will briefly cover the law as it applies to computers and networks and the part ethics plays in network security.

Threats to Network Security

In today’s world, the threat to computer networks is great. Because of the nature of the global communications network, threats can come from an increasing number of places and are constantly taking on new forms. An old joke in security circles goes, “What’s the most secure computer in the world?” “The one that isn’t turned on.” It’s even more true today than it was when it was first told.

The computer that isn’t turned on isn’t of much value to us, so we have to strike some balance between the usability of the computer network and the security controls that we apply.

Threats to network security are generally categorized into two basic types, external and internal. Along the lines of the joke I made earlier, the best way to secure the network from external threats is to disconnect it from external networks. Unfortunately, that isn’t an option in today’s business climate. Virtually every business these days is connected to the Internet. Even some military computer networks are connected to the Internet. The days of maintaining complete physical separation of internal and external networks are over.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!