||Article by Chris Bryant
Earning your CCNA Security certification is a tremendous boost to your career and your career prospects! To help you prepare for total success on exam day, here are 10 complimentary questions on the IOS Firewall set. Answers are at the end of the article. Enjoy!
1. Define the term "DMZ" as it pertains to network security, and name three different common network devices that are typically found there.
2. Identify the true statements.
A. Stateless packet filtering considers the TCP connection state.
B. Stateful packet filtering considers the TCP connection state.
C. Neither stateless nor stateful packet filtering monitor the TCP connection state.
D. Both stateless and stateful packet filtering monitor the TCP connection state, and keep a state table containing that information.
3. Does the Cisco IOS Firewall feature set act as a stateful or stateless packet filter?
4. Which of the following are considered parts of the IOS Firewall feature set?
A. IOS Firewall
B. Intrusion Prevention System
D. Authentication Proxy
E. Password Encryption
5. Identify the true statements regarding the Authentication Proxy.
A. It's part of the IOS Firewall Feature Set.
B. It allows creation of per-user security profiles, rather than more general profiles.
C. It allows creation of general security profiles, but not per-user profiles.
D. Profiles can be stored locally, but not remotely.
E. Profiles can be stored on a RADIUS server.
F. Profiles can be stored on a TACACS+ server.
6. Configuring ACLs is an important part of working with the IOS Firewall. What wildcard masks are replaced in ACLs by the words host and any?
7. What does the dollar sign in the following ACL line indicate?
R1(config)#$ 150 deny ip 188.8.131.52 0.0.0.255 184.108.40.206 0.0.0.255
8. Basically, how does an IOS Firewall prevent a TCP SYN attack?
9. What does the term "punch a hole in the firewall" refer to? (Logically, that is, not physically.)
10. What exactly does the router-traffic option in the following configuration do?
R4(config)#ip inspect name PASSCCNASECURITY tcp router-traffic
R4(config)#ip inspect name PASSCCNASECURITY udp router-traffic
R4(config)#ip inspect name PASSCCNASECURITY icmp router-traffic
Here are the answers!
1. It's easy to think of your network as the "inside", and everything else as "outside". However, we've got a third area when it comes to firewalls - the DMZ.
From an IT standpoint, the DMZ is the part of our network that is exposed to outside networks. It's common to find the following devices in a DMZ:
2. (B.) Stateful packet filtering does monitor the connection state, and that's particularly important when it comes to preventing TCP attacks. A stateful firewall will not only monitor the state of the TCP connection, but also the sequence numbers. Stateful firewalls accomplish this by keeping a session table, or state table.
3. The Cisco IOS Firewall is a stateful filter.
4. (A, B, D.) There are three major components to the IOS Firewall feature set - the IOS Firewall, the Intrusion Prevention System (IPS), and the Authentication Proxy.
5. (A, B, E, F. T he Authentication Proxy allows us to create security profiles that will be applied on a per-user basis, rather than a per-subnet or per-address basis. These profiles can be kept on either of the following:
Upon successful authentication, that particular user's security policy is downloaded from the RADIUS or TACACS+ server and applied by the IOS Firewall router.
6. We have the option of using the word host to represent a wildcard mask of 0.0.0.0. Consider a configuration where only packets from IP source 10.1.1.1 should be allowed and all other packets denied. The following ACLs both do that.
R3(config)#access-list 6 permit 10.1.1.1 0.0.0.0
R3(config)#access-list 7 permit host 10.1.1.1
The keyword any can be used to represent a wildcard mask of 255.255.255.255. Both of the following lines permit all traffic.
R3(config)#access-list 15 permit any
R3(config)#access-list 15 permit 0.0.0.0 255.255.255.255
There's no "right" or "wrong" decision to make when you're configuring ACLs in the real world. For your exam, though, I'd be very familiar with the proper use of host and any.
7. The dollar sign simply indicates that part of the command you're entering or viewing can't be shown because the entry is so long. It does not mean the command is illegal.
8. The IOS Firewall can use any or all of the following values to detect when a TCP SYN attack is underway:
Overall total of incomplete TCP sessions
Number of incomplete TCP sessions in a certain amount of time
Number of incomplete TCP sessions on a per-host basis
When any of these thresholds are reached, either of the following actions can be taken:
Block all incoming SYN packets for a certain period of time
Transmit a RST to both parties in the oldest incomplete session
We'll look at specific instances in future tutorials.
9. That term simply refers to configuring the firewall to open a port that was previously closed. Don't forget to close it when you no longer need it to be open!
10. If you're going to inspect traffic that is actually generated on the router, you need to include the router-traffic option at the end of that particular ip inspect statement.
Look for more Cisco certification practice exams and fully-illustrated tutorials on my website!
Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of free CCNA Security exam tutorials.
Getting A Job and Starting A Career With Computers (Popularity: ): In today's fast-paced and technically-driven world almost any type of job involves using computers. To be unfamiliar with current and evolving technological trends is to be in the doldrums and lagging behind others who are surging rapidly ahead in their careers. So, it only makes sense to become familiar, and even extremely knowledgeable about computers, whether ranging from basic to advanced knowhow. And it's not like knowing about or working ...
Business Analyst Certification (Popularity: ): Establishments nowadays are speedily getting bigger because of a international fiscal growth. Businesses are making an effort in order to enjoy worldwide conditions in order to swiftly boost their income. Rivalry amid companies is powerful in this ecosystem. Winning relies on several factors. A chief prerequisite is a thorough knowledge of an individual company's basic arrangement. This includes a total study of the company's strong suits, faults as well as ...
An Overview Of The New Generation Of Microsoft Certifications (Popularity: ): Do you know why there exists Microsoft Certifications for new generation and what these certifications are? Let us discuss each of these certifications in detail in the coming paragraphs.These new generation Microsoft Certification programs are designed in such a way that they not only improve the primary technical skill but also emphasizes on the individual's job role. These new certification programs offer shorter certification path, which helps the professionals to ...
How Does a MCSE Boot Camp Work? (Popularity: ): One of the best methods of securing IT training, and preparing for your MCSE Certification examination is the boot camp. MCSE stands for Microsoft Certified System Engineer. The MSCE boot camp gives you the intensive training that you need to not only pass the examination, but also to handle the work afterwards. The boot camp concept takes its name from military basic training and although it does not resemble that ...
Getting Ahead with Computer Software Training (Popularity: ): It’s quite evident that computers have changed virtually every aspect of modern living. Anything worth doing these days involves computers. Everyone uses them these days. Computer jargon like cyberspace, email, software, and hardware are now ordinary pieces of our everyday language. To take advantage of this technological revolution it’s sensible to learn more about computer related issues and undergo computer software training.Having computer software training can really give you an ...
Provides practice tests for the most major vendor certifications. (Popularity: ): Examgoal provides CCNA, CCNP, CCIE, A+, Network+, Security+, VCP, MCSA, MCSE, MCITPIT exam questions with .PDF and .VCE format help you to pass exams successfully.
The Firewall Toolkit (FWTK) (Popularity: ): A set of proxies to build a firewall. Provides information and software on building free firewall and security solutions.
Real Exam Questions (Popularity: ): Offers test questions for CCNA.
Dumps Point (Popularity: ): Dumps Point offers the latest real questions and answer, the real exam topics, to ensure you pass exam successfully, Brain Dumps professional provides Q&As as the same as real exam. The cheap and pocket friendly rates on these certificate programs can be accessed at, It is suitable to use the, for superb performance in your grades. Once you go through the Cert Key training materials thoroughly, it’s guaranteed that you ...
Audio Whiz (Popularity: ): Questions and answers format for MCSE, CCNA, A+, Novell, and ASE exam study on audio cassettes and CDs.
Solidshare Firewall and Analyzer (Popularity: ): Provides firewall security and Internet sharing on your LAN. The firewall can prevent resource exposure and defend from an attack.The analyzer is an effective tool for analyzing your Internet connection usage and possible security
Information Resource Center (Popularity: ): Get the latest official DSA driving theory test 2010/11 questions with case study style questions and practice all official DSA car and motorcycle questions from which actual exam questions are chosen.
MRCPsych Exam Practice (Popularity: ): Questions are categorised by subject. Each page of ten questions is marked on completion.
Questions 4 Exam (Popularity: ): Questions 4 Exam is the Premium Provider of IT Certifications and Training Tools. Questions4Exam is committed to product quality, accuracy and cheapest prices as compared to other companies. Questions 4Exam thank you for your sincere and longtime support.
Best Cisco Certification Training Institute (Popularity: ): Best Cisco Certification Training Institute for CCIE Security, CCIE Voice, CCNA Training Courses. With 100% job Guaranteed. Networkers Home Bangalore, Delhi. Networkers Home is the largest institute in India for Cisco Certification Training programs. CCIE Security, CCIE Voice, CCNA, CCNP, CCNA Security, CCNP Security, CCNA Voice, CEH are some of the mainstream courses provided by us. Networkers Home firmly believes in the saying “Action Speaks Louder Than Words” Our achievements ...