CCIE Security Exam Practice

01. In most buffer overflow attacks, which behavior would be expected?

(A) A vulnerability used to overflow the buffer and an exploit used to run malicious software off of the stack.

(B) Shell code to exploit the buffer.

(D) A single crafted packet to overflow the buffer and run malicious software.

02. When implementing best practices for IP Source Address Spoofing and Defeating Denial of Service Attacks with IP Source Address Spoofing, what RFC is commonly used to protect your network?

(A) RFC 1149

(B) RFC 1918

(D) RFC 2827

03. What is the net effect of using ICMP Type 4 messages to attact RFC 1122 compliant hosts?

(A) Hosts will perform a "soft" TCP reset and restart the connection

(B) Hosts will redirect packets to the IP address indicated in the ICMP type 4 message.

(D) Hosts will reduce the rate at which they inject traffic into the network.

04. What does qos pre-classify provides in regard to implementing QoS over GRE/IPSec VPN tunnels?

(A) enables IOS to classify packets based on the ToS field in the inner (original) IP header.

(B) enables IOS to copy the ToS field from the inner (original) IP header to the outer tunel IP header.

(C) enables IOS to make a copy of the inner (original) IP header and to run a QoS classification before encryption, based on fields in the inner IP header.

(D) enables the IOS classification engine to only see a single encrypted and tunneled flow to reduce classification complexity.

05. CSA protects your host by ?

(A) Preventing browsers from opening network sockets in listening state.

(B) Preventing buffer overflows.

(D) Preventing users from entering unencrypted passwords.

06. Which of the following is the most effective technique to prevent source IP Address spoofing?

(A) lock and key ACL

(B) unicast reverse path forwarding (uRPF)

(D) IP source routing

07. VPDN is short for Virtual Private Dialup Network. In an L2TP voluntary tunneling scenario, the VPDN tunnel is terminated between ?

(A) The NAS and the LAC

(B) The client and the NAS

(D) The client and the LNS

08. ISDN BRI channels are made up of what?

(A) 2 X 64 kbps channels and one D channel at 16 kbps

(B) 32 X 64 kbps channels and one D channel at 16 kbps

(D) 1 × 64 kbps channel and one D channel at 64 kbps

09. The AS5300 series router can support which of the following incoming connections?

(A) Dialup users via PSTN

(B) Voice

(D) All the above

10. For the following IOS Qos mechanisms, which one is used stickly to rate limit traffic destned to the router itself?

(A) Dual-Rate Policier

(B) Control Plane Policing

(D) Class-Based Policing

11. SNMP is restricted on Cisco routers by what IOS command?

(A) snmp-server ip-address

(B) snmp-server enable

(D) snmp-server no access permitted

12. Which can control the per-user authorization of commands on a pass4sure router?

(A) RADIUS

(B) TACACS+

(D) AAAA

13. If the configuration register is set to 0x2101, where is the IOS image booted from?

(A) TFTP server

(B) ROM

(D) slot1

14. To change the configuration register to 0x2141, what is the correct IOS command?

(A) config-register 0x2141

(B) configuration 0x2141

(D) copy running-config register

15. What algorithm initiates and encrypts a session between two routers’ exchange keys between two encryption devices?

(A) The switching engine

(B) Diffie-Hellman algorithm

(D) The stac compression algorithm

16. How do you enable a RADIUS server to debug messages for Cisco Secure on a UNIX server?

(A) Edit the configuration file on the router

(B) Terminal monitor

(D) Edit the syslog.conf and csu.cfg files

17. What primary security method can be designed and deployed to secure and protect any IP network after an attack has been documented?

(A) IP policy

(B) Countermeasures

(D) Security policy

18. A TCP SYN attack is what type of attack?

(A) Telnet/Kerberos attack

(B) ICMP

(D) Ping attack only

19. What versions of TACACS does Cisco IOS support?

(A) Extended TACACS+

(B) TACACS

(D) None of the above

20. FTP runs over what Layer 4 protocol?

(A) TFTP

(B) TCP

(D) DNS

21. A network technician is using a LAN analyzer to troubleshoot OSPF router exchange messages sent to ALL OSPF ROUTERS. Which MAC address are these messages sent to ?

(A) 01-00-5E-EF-00-00

(B) 01-00-5E-00-00-05

(D) 00-00-1C-EF-00-00

22. You work as a network technician , can you tell me what is chain of Evidence in the context of security forensics ?

(A) The concept that the general whereabouts of evidence is known

(B) The concept that evidence is controlled and accounted for as to not disrupt its authenticity and integrity.

(C) The concept that if a person has possession of evidence someone knows where the evidence is and can say who had it if it is not logged.

(D) The concept that evidence is controlled in locked down, but not necessarily authenticated.

23. In Unix, where are failed super-user level access attempts stored?

(A) /var/adm/sulog

(B) /var/adm/wtmp

(D) /etc/wtmp

24. What devices can the Cisco Secure Policy Manager remotely manage?

(A) PIX Firewalls

(B) NMS workstations

(D) None of the above

25. Which of the following is not a UNIX file flag parameter?

(A) Read

(B) 10BaseT

(D) Authenticate

CCIE Security Practice Exam Questions

CCIE R & S Exam ( 350-001 ) Practice Test CCIE Security Exam ( 350-018 ) Practice Test