“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz helps you determine your level of knowledge of this chapter’s topics before you begin. Table 17-1 details the major topics discussed in this chapter and their corresponding quiz questions.

Table 17-1 “Do I Know This Already?” Section-to-Question Mapping

1. Which method should you implement when it is not acceptable for an attack to reach its intended victim?

a. IDS

b. IPS

c. Out of band

d. Hardware appliance

2. A company has hired you to determine whether attacks are happening against the server farm, and it does not want any additional delay added to the network. Which deployment method should be used?

a. Appliance-based inline

b. IOS software-based inline

c. Appliance-based IPS

d. IDS

3. Why does IPS have the ability to prevent an ICMP-based attack from reaching the intended victim?

a. Policy-based routing.

b. TCP resets are used.

c. The IPS is inline with the traffic.

d. The IPS is in promiscuous mode.

4. Which method of IPS uses a baseline of normal network behavior and looks for deviations from that baseline?

a. Reputation-based IPS

b. Policy-based IPS

c. Signature-based IPS

d. Anomaly-based IPS

5. Which type of implementation requires custom signatures to be created by the administrator?

a. Reputation-based IPS

b. Policy-based IPS

c. Engine-based IPS

d. Anomaly-based IPS

6. Which method requires participation in global correlation involving groups outside your own enterprise?

a. Reputation-based IPS

b. Policy-based IPS

c. Signature-based IPS

d. Anomaly-based IPS

7. Which of the micro-engines contains signatures that can only match on a single packet, as opposed to a flow of packets?

a. Atomic

b. String

c. Flood

d. Other

8. Which of the following are properties directly associated with a signature? (Choose all that apply.)

a. ASR

b. SFR

c. TVR

d. RR

9. Which of the following is not a best practice?

a. Assign aggressive IPS responses to specific signatures

b. Assign aggressive IPS responses based on the resulting risk rating generated by the attack

c. Tune the IPS and revisit the tuning process periodically

d. Use correlation within the enterprise and globally for an improved security posture

10. What is the name of Cisco cloud-based services for IPS correlation?

a. SIO

b. EBAY

c. ISO

d. OSI

11. Which of the following is not a Next-Generation IPS (NGIPS) solution?

a. NGIPSv

b. ASA with FirePOWER

c. SIO IPS

d. FirePOWER 8000 series appliances