1.
What are the entries called that make up an ACL?
Correct Answer
C. ACE
Explanation
The entries that make up an ACL (Access Control List) are called ACE (Access Control Entries). ACEs define the permissions or restrictions for a particular user or group of users on a network device or system. They specify whether the user or group is allowed or denied access to specific resources or actions.
2.
True of False, an ACL can inspect a packet header for layer 5 information?
Correct Answer
B. False
Explanation
An ACL (Access Control List) cannot inspect a packet header for layer 5 information. ACLs are typically used for filtering network traffic based on layer 3 (network layer) and layer 4 (transport layer) information such as source and destination IP addresses, ports, and protocols. Layer 5 (session layer) information, which includes data related to establishing, managing, and terminating connections between network devices, is not typically inspected by ACLs. Therefore, the statement that an ACL can inspect a packet header for layer 5 information is false.
3.
True or false, only the first packet of a flow is inspected by the ACL , after that all subsequent packets matching that connection are not checked.
Correct Answer
A. True
Explanation
The statement is true. ACLs (Access Control Lists) are used to control network traffic by filtering packets based on specific criteria. Once a packet matches a flow, the ACL will inspect it and make a decision (allow or deny). However, for subsequent packets that belong to the same flow, the ACL does not need to inspect them again as the decision has already been made. This helps improve network performance by reducing the processing overhead on the ACL for every packet in the same flow.
4.
True or false, if a packet flow comes in and the first line of the ACL matches the packet, no further ACE’s are checked.
Correct Answer
A. True
Explanation
If the first line of the Access Control List (ACL) matches the packet flow, it means that the conditions specified in that line are satisfied by the packet. In this case, there is no need to check any further Access Control Entries (ACEs) in the ACL because the packet has already been matched and the corresponding action can be taken. Therefore, the statement "if a packet flow comes in and the first line of the ACL matches the packet, no further ACE's are checked" is true.
5.
Where are new ACE’s added to the ACL?
Correct Answer
B. Bottom of the list
Explanation
New ACEs (Access Control Entries) are added to the bottom of the ACL (Access Control List). This is because the ACL is processed in a sequential manner from top to bottom, and the first matching ACE determines the access control decision. By adding new ACEs at the bottom, they have a lower priority and will only be evaluated if no previous ACEs match the criteria.
6.
What is the message ID of an entry that shows a packet dropped due to the implicit deny at the end of an ACL?
Correct Answer
D. 106023
Explanation
The message ID 106023 is the correct answer because it represents a packet being dropped due to the implicit deny at the end of an Access Control List (ACL). When a packet matches none of the permit conditions in an ACL, it is denied by default. This message ID is specifically associated with this type of event, indicating that the packet was dropped due to the implicit deny.
7.
How many total ACL’s can I have applied to an interface if I only use standard and extended ACL’s?
Correct Answer
A. 4
Explanation
You can have a total of 4 ACL's applied to an interface if you only use standard and extended ACL's.
8.
True of False, an extended ACL only filters by IP address?
Correct Answer
B. False
Explanation
An extended ACL does not only filter by IP address. It can also filter based on other criteria such as protocol type, source and destination port numbers, and specific TCP flags. This allows for more granular control and flexibility in determining what traffic is allowed or denied.
9.
True or False, Standard ACL’s only work in transparent mode.
Correct Answer
B. False
Explanation
Standard ACL's can work in both transparent mode and routed mode. Transparent mode is used in a firewall to filter traffic between two networks without changing the IP addresses. In this mode, the firewall acts as a bridge between the two networks. However, standard ACL's can also be applied to interfaces in routed mode, where the firewall is actively routing traffic between networks. Therefore, the statement that standard ACL's only work in transparent mode is false.
10.
If I have an ACL that says permit 192.168.10.0 0.0.0.255, which address will it block?
Correct Answer
B. 192.169.10.100
11.
What kind of filtering do we apply to traffic that terminates on the security applicance?
Correct Answer
C. To-the-box
Explanation
The correct answer is "To-the-box". This refers to the kind of filtering that is applied to traffic that terminates on the security appliance. "To-the-box" filtering means that the traffic is filtered based on its destination IP address, and is only allowed to reach the security appliance itself. This type of filtering is commonly used to protect the security appliance from any potentially malicious or unwanted traffic.
12.
What command will apply an ACL to an interface?
Correct Answer
A. Access-group
Explanation
The correct answer is "Access-group." This command is used to apply an Access Control List (ACL) to an interface. An ACL is a set of rules that determines what network traffic is allowed or denied on a network device. By using the access-group command, the specified ACL can be applied to a specific interface, allowing the network administrator to control the traffic flow.
13.
True or False, named ACL’s have to include the “standard” or “extended” parameter?
Correct Answer
A. True
Explanation
Named ACL's have to include the "standard" or "extended" parameter. This means that when creating a named ACL, it is necessary to specify whether it is a standard or extended ACL.
14.
What does this ACL do - access-list 102 permit tcp any 192.168.100.200 0.0.0.0 eq 25
Correct Answer
D. Allows traffic to the Mail server
Explanation
The given ACL (access-list 102 permit tcp any 192.168.100.200 0.0.0.0 eq 25) allows traffic to the Mail server. This is because it permits TCP traffic from any source IP address to the specific IP address 192.168.100.200 on port 25, which is the standard port for SMTP (Simple Mail Transfer Protocol) used for sending emails. Therefore, this ACL allows incoming traffic to the Mail server on port 25.
15.
True or False, anytime I use the “IN” parameter when applying an ACL to an interface, it means to check the traffic coming inside my network?
Correct Answer
B. False
Explanation
Using the "IN" parameter when applying an ACL to an interface does not necessarily mean checking the traffic coming inside the network. The "IN" parameter refers to the direction of traffic flow relative to the interface where the ACL is applied. It could mean checking traffic coming into the interface from an external network or checking traffic going out of the interface towards an external network. Therefore, the statement is false.
16.
True or False, IP6 ACL’s are only supported in version 6.2 of the ASDM or higher?
Correct Answer
A. True
Explanation
IP6 ACL's are only supported in version 6.2 of the ASDM or higher.
17.
True or False, I can use the “access-group” command to create groups of similar items like protocols or internal servers?
Correct Answer
B. False
Explanation
The "access-group" command is used in Cisco IOS to apply an access control list (ACL) to a specific interface. It is not used to create groups of similar items like protocols or internal servers. Therefore, the given answer "False" is correct.
18.
Which one is NOT a type of object group?
Correct Answer
D. Internal
Explanation
The given answer "Internal" is the correct answer because the other options - "Network," "Protocol," and "Service" - are all types of object groups. However, "Internal" does not fall under the category of an object group.
19.
Which command will allow me to create a time-based ACL that will be enforced every Saturday?
Correct Answer
A. Periodic
Explanation
The command "Periodic" allows the creation of a time-based ACL that will be enforced every Saturday. This means that the ACL rules will only be applied and enforced on Saturdays, providing a specific time-based restriction.
20.
Which command will allow me to create a specfic time-based ACL start and stop time?
Correct Answer
B. Absolute
Explanation
The command "Absolute" allows the creation of a specific time-based ACL start and stop time. This means that the ACL will only be active during the specified time period and will not be applied outside of that timeframe.
21.
If I have BOTH an Absolute and a Periodic parameter configured in the same timerange, which one would be evaluated first?
Correct Answer
C. Absolute
Explanation
If both an Absolute and a Periodic parameter are configured in the same timerange, the Absolute parameter would be evaluated first. This means that the timerange specified by the Absolute parameter would take precedence over the timerange specified by the Periodic parameter.
22.
What is the term for how many times a packet is matched against an ACE?
Correct Answer
A. Hit count
Explanation
The term for how many times a packet is matched against an ACE is "hit count". This refers to the number of times a packet matches the conditions specified in an Access Control Entry (ACE) within a network device. By keeping track of the hit count, network administrators can monitor the traffic patterns and determine the effectiveness of their access control policies.
23.
The ASA allows you to specify two difrent time restrictions. When setting the Absolute values it uses it uses the same start and date format as what other comand?
Correct Answer
B. Clock set
Explanation
Notes: top of page 169
24.
Which command will show me how many total packets are being dropped and what is causing the drop?
Correct Answer
C. Show asp drop
Explanation
The command "Show asp drop" will display the number of total packets being dropped and provide information about the reason for the drop. This command is specifically used to monitor the Adaptive Security Appliance (ASA) and identify any dropped packets, helping to troubleshoot network connectivity issues.
25.
What do I use when I want to statically map multiple inside servers to one global IP address?
Correct Answer
C. Port Redirection
Explanation
Port Redirection is the correct answer because it allows for multiple inside servers to be mapped to a single global IP address. This technique involves redirecting incoming traffic on specific ports to different internal servers based on the port number. By using port redirection, multiple servers can share a single IP address while still being accessible from the outside network. This is commonly used in scenarios where there are limited available public IP addresses or when there is a need to consolidate multiple servers behind a single IP address.
26.
True or False, ICMP is considered a unidirectional protocol and requires a rule for each direction you wish it to flow.
Correct Answer
A. True
Explanation
ICMP (Internet Control Message Protocol) is considered a unidirectional protocol because it is primarily used for error reporting and diagnostic purposes in IP networks. It does not establish a connection or maintain a session between two hosts, unlike bidirectional protocols such as TCP or UDP. In order to allow ICMP traffic to flow in both directions, separate rules need to be configured for each direction. Therefore, the statement that ICMP is considered a unidirectional protocol and requires a rule for each direction is true.
27.
What kind of ACL is this - access-list 102 permit tcp any 192.168.100.200 0.0.0.0 eq 25
Correct Answer
B. Extended
Explanation
The given access control list (ACL) is an extended ACL. This can be determined by looking at the syntax of the command. In an extended ACL, we can specify more specific criteria such as source and destination IP addresses, protocols, and port numbers. In this case, the ACL permits TCP traffic from any source IP address to the destination IP address 192.168.100.200 on port 25, which is commonly used for SMTP (Simple Mail Transfer Protocol) for email communication.
28.
What does RIP stand for?
Correct Answer
B. Routing Information Protocol
Explanation
RIP stands for Routing Information Protocol. This protocol is used for routing and exchanging network information between routers in a network. It helps routers to determine the best path for data packets to travel from one network to another. RIP uses hop count as a metric to calculate the distance between routers and chooses the route with the fewest hops as the best route.
29.
Which routing protocol uses only hop-count as its metric?
Correct Answer
A. RIP
Explanation
RIP (Routing Information Protocol) uses only hop-count as its metric. Hop-count refers to the number of routers a packet must pass through to reach its destination. RIP determines the best path to a destination based on the lowest hop-count. It is a distance-vector routing protocol that periodically shares routing information with neighboring routers, allowing them to update their routing tables. RIP is a simple and easy-to-configure protocol, but it may not be suitable for large networks due to its limited scalability.
30.
If I manually put in a route it is called a________?
Correct Answer
B. Static route
Explanation
A manually inputted route is called a static route. This means that the route is manually configured and does not change unless manually updated. It is commonly used in small networks or for specific network configurations where the route needs to remain constant.
31.
What does the ip address of 209.165.201.2 signify in the following command – route outside 0.0.0.0 0.0.0.0 209.165.201.2 1
Correct Answer
B. Gateway
Explanation
The IP address 209.165.201.2 in the given command signifies the gateway. In networking, a gateway is a device or a computer that connects different networks together. It acts as an entry point to a network and allows devices from one network to communicate with devices from another network. In this command, the IP address 209.165.201.2 is specified as the gateway for the "outside" interface of the ASA (Adaptive Security Appliance). This means that any traffic destined for networks outside of the ASA will be sent to this IP address for further routing.
32.
In this command - route outside 0.0.0.0 0.0.0.0 209.165.201.2 1 what does the number one mean at the end of the command?
Correct Answer
D. Hop count
Explanation
The number one at the end of the command "route outside 0.0.0.0 0.0.0.0 209.165.201.2 1" represents the hop count. In networking, a hop refers to the movement of data from one network node to another. The hop count indicates the number of routers or network devices that the data must pass through to reach its destination. In this case, the hop count of 1 means that the destination is directly connected to the next hop, which is the IP address 209.165.201.2.
33.
What command will display the routing table of the ASA?
Correct Answer
B. Show route
Explanation
The correct answer is "Show route." This command is used to display the routing table of the ASA.
34.
What version of RIP supports CIDR?
Correct Answer
B. Version 2
Explanation
RIP (Routing Information Protocol) is a distance-vector routing protocol that is used to exchange routing information between routers. Version 1 of RIP does not support Classless Inter-Domain Routing (CIDR), which is a technique used to allocate IP addresses more efficiently. However, Version 2 of RIP does support CIDR. Therefore, the correct answer is Version 2.
35.
Now that you know what version of RIP supports CIDR, what the heck is CIDR?
Correct Answer
D. Classless InterDomain Routing
Explanation
CIDR stands for Classless InterDomain Routing. It is a method used to allocate and manage IP addresses more efficiently. In traditional IP addressing, addresses were divided into classes, which led to wastage of IP addresses. CIDR allows for more flexible allocation of IP addresses by allowing the use of variable-length subnet masks. This means that IP addresses can be allocated in smaller blocks, reducing the overall wastage of IP addresses and improving the efficiency of routing on the internet.
36.
RIP has a limit of how many hops?
Correct Answer
C. 15
Explanation
RIP (Routing Information Protocol) has a limit of 15 hops. This means that RIP can only route packets to a maximum of 15 network hops away. If a destination network is more than 15 hops away, RIP will not be able to route the packets to that network.
37.
In the show route command, what letter signifies a route learned through EIGRP?
Correct Answer
C. D
Explanation
In the show route command, the letter "D" signifies a route learned through EIGRP. EIGRP (Enhanced Interior Gateway Routing Protocol) is a Cisco proprietary routing protocol that is used to exchange routing information between routers in a network. The "D" in the show route command indicates that the route was learned dynamically through EIGRP.
38.
In the show route command, what letter signifies a route learned through RIP?
Correct Answer
D. R
Explanation
The letter "R" signifies a route learned through RIP in the show route command. RIP (Routing Information Protocol) is a dynamic routing protocol that uses hop count as a metric to determine the best path for routing data packets. When the show route command is used, the "R" indicates that the route was learned through RIP.
39.
If I want to stop the router from advertising RIP updates through an interface, what command do I use?
Correct Answer
A. Passive-interface
Explanation
The command "Passive-interface" is used to stop the router from advertising RIP updates through an interface. By configuring an interface as passive, the router will still receive RIP updates from that interface but will not send any updates out through it. This is useful when you want to prevent certain interfaces from participating in RIP routing updates while still allowing them to receive routing information from other interfaces.
40.
If I want to send default route information with my RIP advertisements, what command do I use?
Correct Answer
B. Default-information originate
Explanation
The correct answer is "Default-information originate." This command is used in RIP (Routing Information Protocol) to advertise the default route to other routers in the network. By using this command, the router sends the default route information in its RIP advertisements, allowing other routers to learn about the default route and use it for forwarding packets to destinations outside of their own network.
41.
Can an ASA be connected to two different networks using two different routing protocols? In other words, can I have a RIP network connected and an EIGRP network connected and be able to route between both of them?
Correct Answer
A. Yes
Explanation
Yes, an ASA can be connected to two different networks using two different routing protocols. This allows the ASA to route between both networks and enables communication between devices on each network.
42.
OK, since you know the answer to the question above is yes, what is the command to make RIP work with another routing protocol?
Correct Answer
C. Redistribute
Explanation
The command "redistribute" is used to make RIP work with another routing protocol. This command allows the redistribution of routes learned from one routing protocol into another routing protocol. By using this command, RIP can exchange routing information with other protocols, enabling communication and coordination between different routing protocols.
43.
What does OSPF stand for?
Correct Answer
D. Open shortest path first
Explanation
OSPF stands for Open Shortest Path First. This is a routing protocol used in computer networks to determine the best path for data packets to travel from one network to another. It calculates the shortest path based on the cost of each link and updates the routing table accordingly. By using OSPF, networks can efficiently exchange routing information and dynamically adapt to changes in network topology.
44.
What was the name of the routing protocol that was a “link-state” protocol?
Correct Answer
B. OSPF
Explanation
OSPF, which stands for Open Shortest Path First, is a routing protocol that is classified as a "link-state" protocol. This means that it uses information about the state of links in a network to determine the shortest path to a destination. OSPF calculates the cost of each link based on factors such as bandwidth and congestion, and then uses this information to build a database of the network's topology. By considering the state of each link, OSPF is able to make more informed routing decisions and efficiently route data packets through the network.
45.
Does OSPF use an area number?
Correct Answer
A. Yes
Explanation
OSPF (Open Shortest Path First) does use an area number. OSPF divides a network into areas to improve scalability and reduce routing overhead. Each area is identified by a unique area number, and routers within the same area share routing information. This allows for efficient routing within the area and reduces the amount of routing information that needs to be exchanged between areas.
46.
Does OSPF support the default-information originate command?
Correct Answer
B. No
Explanation
OSPF does not support the default-information originate command. This command is used in other routing protocols, such as EIGRP, to advertise a default route into the OSPF domain. However, in OSPF, the use of a default route is achieved through other means, such as redistributing a default route from another routing protocol or configuring a static default route.
47.
What command can I run to only show the routes learned on the inside interface of the ASA?
Correct Answer
C. Show route inside
Explanation
The correct answer is "Show route inside" because this command specifically instructs the ASA to display only the routes learned on the inside interface. By using the "inside" keyword, the command filters the output to show only the relevant information, making it easier for the user to identify and analyze the routes learned on the inside interface.
48.
Which of the two open-source routing protocols are designed for large-scale networks?
Correct Answer
B. OSPF
Explanation
OSPF (Open Shortest Path First) is an open-source routing protocol that is specifically designed for large-scale networks. It is widely used in enterprise networks and internet service provider networks. OSPF uses a link-state routing algorithm, which allows it to efficiently calculate the shortest path to a destination and adapt to changes in the network topology. It supports large networks with thousands of routers and can scale well. Therefore, OSPF is the correct answer for this question.
49.
Which routing protocol is Cisco proprietary?
Correct Answer
C. EIGRP
Explanation
EIGRP is Cisco proprietary because it was developed by Cisco Systems and is only available on Cisco devices. Unlike RIP and OSPF, which are open standard protocols that can be used on various vendors' equipment, EIGRP is exclusive to Cisco. SpongeBob is not a routing protocol and is not relevant to this question.
50.
Which routing protocol uses DUAL for calculating the metric (route options)?
Correct Answer
C. EIGRP
Explanation
EIGRP (Enhanced Interior Gateway Routing Protocol) is the routing protocol that uses DUAL (Diffusing Update Algorithm) for calculating the metric or route options. DUAL allows EIGRP to quickly adapt to network changes and find the best path to a destination by considering multiple factors such as bandwidth, delay, reliability, and load. This makes EIGRP a highly efficient and scalable routing protocol for large networks.