CISCO ASA
-
What is the symbol for the prompt in the CLI that lets you know you are in privileged mode?
-
>
-
#
-
(config)
-
(priv)
-
This Cisco ASA quiz assesses knowledge on Adaptive Security Appliance fundamentals, including CLI access, default configurations, and system settings. It is designed for learners aiming to enhance their technical skills in network security, offering insights into essential ASA operations.
Quiz Preview
- 2.
When dealing with security levels, what is the most secure level?
-
10
-
100
-
255
-
1000
Correct Answer
A. 100Explanation
The most secure level when dealing with security levels is 100.Rate this question:
-
- 3.
Which one is NOT a way to access the CLI?
-
Telnet
-
Console
-
RDP
-
SSH
Correct Answer
A. RDPExplanation
RDP (Remote Desktop Protocol) is not a way to access the Command Line Interface (CLI). RDP is a proprietary protocol developed by Microsoft that allows users to remotely connect to and control a computer over a network. It provides a graphical interface rather than a command line interface. Telnet, Console, and SSH are all methods that can be used to access the CLI. Telnet is a network protocol used to establish a remote command line session, Console refers to accessing the CLI directly from the physical device, and SSH (Secure Shell) is a network protocol that provides secure remote access to the CLI.Rate this question:
-
- 4.
What is the default device name on the ASA?
-
ASA
-
Cisco
-
Hostname
-
CiscoASA
Correct Answer
A. CiscoASAExplanation
The default device name on the ASA is "CiscoASA".Rate this question:
-
- 5.
According to the bottom of page one, where are firewalls placed?
-
Only at the entryway to the internet
-
Between trusted and untrusted networks
-
Only internally
-
Right after a switch
Correct Answer
A. Between trusted and untrusted networksExplanation
Firewalls are placed between trusted and untrusted networks. This means that they are positioned at the boundary where the trusted network (such as an internal network) connects with the untrusted network (such as the internet). By being placed in this location, firewalls can monitor and control the incoming and outgoing network traffic, ensuring that only authorized and safe data is allowed to pass through while blocking any potentially harmful or unauthorized access attempts.Rate this question:
-
- 6.
What does ASA stand for?
-
Advanced Security Application
-
Adaptive Security Application
-
Adaptive Security Appliance
-
Advanced Security Application
Correct Answer
A. Adaptive Security ApplianceExplanation
ASA stands for Adaptive Security Appliance. This term refers to a firewall and security device developed by Cisco Systems. The ASA provides network security by combining firewall, VPN (Virtual Private Network), and intrusion prevention system capabilities. It is designed to protect networks from various threats and attacks, ensuring the confidentiality, integrity, and availability of network resources.Rate this question:
-
- 7.
Where do I go in the ASDM software to configure an IP address on an interface?
-
Configuration\Device Setup\Interfaces
-
File\Properties\Interfaces
-
Setup\Interfaces
-
Appreciation\Porn\Inflatable Animal
Correct Answer
A. Configuration\Device Setup\InterfacesExplanation
The correct answer is "Configuration\Device Setup\Interfaces." This is the correct location in the ASDM software to configure an IP address on an interface. The "Device Setup" menu allows users to configure various settings related to the device, including network interfaces. Within the "Interfaces" submenu, users can select the specific interface they want to configure and then set the desired IP address.Rate this question:
-
- 8.
At what baud rate should you set your terminal emulation program in order to connect to the ASA and access the CLI?
-
2400
-
9600
-
12500
-
None, you don’t use a baud rate in telnet programs
Correct Answer
A. 9600Explanation
To connect to the ASA and access the CLI, you should set your terminal emulation program to a baud rate of 9600. Baud rate refers to the number of signal changes per second in a communication channel, and setting it to 9600 ensures a reliable and efficient connection between the terminal emulation program and the ASA.Rate this question:
-
- 9.
Which one of these commands will show me the license information on the ASA?
-
Show Version
-
Show Flash
-
Show License
-
Show Porn
Correct Answer
A. Show VersionExplanation
The "Show Version" command will provide the license information on the ASA. This command displays detailed information about the software and hardware components of the ASA, including the license information. It is commonly used to verify the software version, activation key, and license details of the ASA device.Rate this question:
-
- 10.
Why is it safer to have an IPS rather than an IDS?
-
An IPS will actually prevent the malicious packet from arriving
-
An IDS will alert you to the malicious activity
-
An IDS does not detect distributed denial of service attacks
-
An IDS does not work in promiscuous mode
Correct Answer
A. An IPS will actually prevent the malicious packet from arrivingExplanation
An Intrusion Prevention System (IPS) is safer to have than an Intrusion Detection System (IDS) because an IPS not only detects malicious activity but also takes immediate action to prevent it. By actively blocking and filtering incoming packets, an IPS can stop potential threats from reaching the network, reducing the risk of successful attacks. In contrast, an IDS only alerts the user to malicious activity without actively blocking it, leaving the network vulnerable to potential damage or compromise.Rate this question:
-
- 11.
According to the textbook, what mode are you in if the prompt look like this “(configs)�
-
User
-
Privileged
-
Configuration
-
Sub-Configuration
Correct Answer
A. ConfigurationExplanation
If the prompt looks like "(configs)", according to the textbook, the mode you are in is the Configuration mode.Rate this question:
-
- 12.
Whatis the max speed of the switchports on the 5505?
-
10mbps
-
100mbps
-
1000mbps
-
Frick’n fast man!
Correct Answer
A. 100mbpsExplanation
The correct answer is 100mbps. The 5505 switchports have a maximum speed of 100mbps.Rate this question:
-
- 13.
How many Vlans can be created on the 5505 using the switchports by default?
-
2
-
3
-
4
-
6
Correct Answer
A. 3Explanation
The correct answer is 3 because the Cisco ASA 5505, by default, has three switchports that can be used to create VLANs. These switchports can be configured as access ports or trunk ports to support VLANs and allow for network segmentation and traffic isolation.Rate this question:
-
- 14.
Based on the solution you found for the question above, what does a firewall use to base its decisions on which traffic to permit or deny into the network?
-
Explicit preconfigured policies and rules
-
Only Network address translation
-
TCP/IP Stateful Proxies
-
Application Translation
Correct Answer
A. Explicit preconfigured policies and rulesExplanation
A firewall uses explicit preconfigured policies and rules to determine which traffic to allow or block from entering the network. These policies and rules are set by the network administrator and dictate the criteria that the firewall uses to make decisions. By following these predefined policies and rules, the firewall can effectively filter and control the incoming and outgoing traffic, ensuring the security and integrity of the network.Rate this question:
-
- 15.
If a user selects "NO" at the setup menu when the ASA starts up, what will the hostname of the device be?
-
ASA
-
CiscoASA
-
Cisco
-
Router
Correct Answer
A. CiscoASAExplanation
If a user selects "NO" at the setup menu when the ASA starts up, the hostname of the device will be CiscoASA.Rate this question:
-
- 16.
Where is the ASDM software stored at on the ASA?
-
Flash
-
Rom
-
NVRAM
-
Hard Drive
Correct Answer
A. FlashExplanation
The ASDM software is stored in the Flash memory of the ASA. Flash memory is a type of non-volatile storage that retains data even when power is lost. It is commonly used in networking devices like the ASA to store firmware, operating systems, and other software. Storing the ASDM software in Flash memory allows for easy access and quick retrieval when needed.Rate this question:
-
- 17.
Which layer 4 protocol will pattern matching work against?
-
ESP
-
AH
-
TCP
-
GRE
Correct Answer
A. TCPExplanation
Pattern matching typically works against the TCP protocol at the layer 4 of the OSI model. TCP (Transmission Control Protocol) is a reliable, connection-oriented protocol that ensures the delivery of data packets in the correct order and without errors. Pattern matching involves analyzing the content of the TCP packets to identify specific patterns or signatures, which can be useful for various purposes such as intrusion detection, network monitoring, and content filtering.Rate this question:
-
- 18.
What is the purpose of a packet filter?
-
Filter traffic based on rules from the Proxy
-
Control access to specific network segments by defining which traffic can pass through them
-
Operate as an intermediary agent on behalf of clients that are on a private network
-
Hide the internal private addresses from the unprotected network
Correct Answer
A. Control access to specific network segments by defining which traffic can pass through themExplanation
A packet filter is used to control access to specific network segments by defining which traffic can pass through them. It allows the network administrator to set rules and filters that determine which packets are allowed to enter or leave a particular network segment. This helps in enhancing network security by preventing unauthorized access and controlling the flow of traffic within the network. By selectively allowing or blocking packets based on defined criteria, a packet filter helps in managing and securing network resources effectively.Rate this question:
-
- 19.
What does the firewall do with NAT?
-
Filter traffic based on rules from network address translation
-
Control access to specific network segments by defining which traffic can pass through them
-
Operate as an intermediary agent on behalf of clients that are on a private or protected network
-
Hides the internal private addresses from the unprotected network, and exposes only its own address
Correct Answer
A. Hides the internal private addresses from the unprotected network, and exposes only its own addressExplanation
The firewall with NAT hides the internal private addresses from the unprotected network and exposes only its own address. This means that when traffic passes through the firewall, the internal IP addresses of the devices on the private network are replaced with the firewall's public IP address. This provides an additional layer of security by preventing direct access to the private network and only allowing communication through the firewall's address.Rate this question:
-
- 20.
By default, without any configuration form you, the ASA has a default inside IP address of?
-
It does not have an IP by default
-
10.1.1.1
-
192.168.1.100
-
192.168.1.1
Correct Answer
A. It does not have an IP by defaultExplanation
By default, the ASA does not have an IP address assigned to its inside interface. It needs to be manually configured with an IP address for communication on the inside network.Rate this question:
-
- 21.
According to page two, what is the primary task of the firewall?
-
To deny bad traffic from entering the network
-
To permit good traffic to leave the network
-
To deny or permit traffic that attempts to enter the network
-
To control access to specific network segments
Correct Answer
A. To deny or permit traffic that attempts to enter the networkExplanation
The primary task of a firewall, as mentioned on page two, is to deny or permit traffic that attempts to enter the network. Firewalls act as a barrier between the internal network and external networks, filtering incoming traffic based on predetermined rules. They can deny or permit traffic based on factors such as IP addresses, port numbers, and protocols. By doing so, firewalls help protect the network from unauthorized access and potential security threats.Rate this question:
-
- 22.
Which one is NOT a class B private ip address?
-
172.16.0.200
-
172.24.255.5
-
172.32.12.15
-
172.30.255.254
Correct Answer
A. 172.32.12.15Explanation
The IP address 172.32.12.15 is not a class B private IP address because class B private IP addresses range from 172.16.0.0 to 172.31.255.255. The given IP address falls outside of this range, making it not a valid class B private IP address.Rate this question:
-
- 23.
What is it called when a program attempts to store more data in a temporary storage area within memory than it was designed to hold?
-
Heuristic analysis
-
Zero-day exploit
-
Distributed denial of service
-
Buffer overflow
Correct Answer
A. Buffer overflowExplanation
A buffer overflow occurs when a program tries to store more data in a temporary storage area within memory than it was originally designed to hold. This can lead to the corruption of nearby data or even the execution of malicious code. It is a common vulnerability that can be exploited by attackers to gain unauthorized access or control over a system.Rate this question:
-
- 24.
What is an attack for which there is no signature called?
-
Heuristic analysis
-
Zero-day exploit
-
Distributed denial of service
-
Buffer overflow
Correct Answer
A. Zero-day exploitExplanation
A zero-day exploit is an attack for which there is no signature available. This means that it is an attack that takes advantage of a software vulnerability that is unknown to the software vendor and for which no patch or fix has been developed. Since there is no knowledge or signature of this exploit, it becomes difficult to detect and defend against, making it a significant threat to computer systems and networks.Rate this question:
-
- 25.
If you accidently type NO in for the setup option, is there another way to get into setup (according to the text) without rebooting or power cycling the ASA?
-
No
-
Type setup in configs mode
-
Type reload in priv mode
-
I picked the wrong week to quit sniffing glue
Correct Answer
A. Type setup in configs modeExplanation
The correct answer is "Type setup in configs mode." This means that if you accidentally type "NO" for the setup option, you can still access the setup mode by typing "setup" in the configuration mode. This allows you to make changes to the ASA without having to reboot or power cycle it.Rate this question:
-
- 26.
What kind of address translation would I use if I had a web server that resided on the internal network that people needed to access from the public side?
-
Port address translation
-
Static translation
-
Dynamic translation
-
Deep packet translation
Correct Answer
A. Static translationExplanation
Static translation would be the appropriate kind of address translation to use in this scenario. Static translation involves mapping a specific internal IP address to a specific external IP address, allowing external users to access the web server on the internal network. This type of translation does not change over time and remains constant, providing a reliable and consistent connection for accessing the server from the public side.Rate this question:
-
- 27.
What is meant by Stateful Inspection?
-
Firewalls can look at specific layer 7 payloads to protect against security threats
-
The device searches for a fixed sequence of bytes within the packets traversing the network
-
The tracking of every packet passing through an interface by assuring that they are valid, established connections
-
When the state highway patrol pulls you over after you had a bad day and got snookered with some tequila to the point you cant even see straight
Correct Answer
A. The tracking of every packet passing through an interface by assuring that they are valid, established connectionsExplanation
Stateful Inspection refers to the tracking of every packet passing through an interface by ensuring that they are valid, established connections. This means that the firewall or network device monitors the state of each connection and keeps track of the state information for future packets. It checks if the packets are part of an existing connection or if they are trying to establish a new connection. This allows the firewall to make more informed decisions about which packets to allow or block based on the context of the connection.Rate this question:
-
- 28.
What is the flash card used for on the ASA 5510 besides storing the IOS?
-
Saving Configs
-
Additional RAM space
-
CPU Overflow
-
Flashing the BIOS
Correct Answer
A. Saving ConfigsExplanation
The flash card on the ASA 5510 is used for saving configurations. Configurations include settings and parameters that define how the device operates, such as network settings, security policies, and access control rules. By storing configurations on the flash card, they can be easily backed up, restored, or transferred to other devices. This helps in maintaining consistent and reliable network configurations across multiple devices and simplifies the management of the ASA 5510.Rate this question:
-
- 29.
In the "HOME" screen of the ASDM software, where would I look to find information about the number of active TCP connections going through the ASA?
-
System Resources Status
-
VPN Status
-
Interface Status
-
Traffic Status
Correct Answer
A. Traffic StatusExplanation
In the "Traffic Status" section of the ASDM software's "HOME" screen, information about the number of active TCP connections going through the ASA can be found. This section provides details and statistics related to the traffic passing through the ASA, including the number of active TCP connections.Rate this question:
-
- 30.
At which layer do the majority of proxy firewalls operate at?
-
Application
-
Presentation
-
Session
-
Transport
Correct Answer
A. ApplicationExplanation
Proxy firewalls operate at the application layer. This layer is responsible for providing services directly to the user applications. By operating at this layer, proxy firewalls can intercept and filter application-layer protocols such as HTTP, FTP, and SMTP. They can inspect the content of the traffic and make decisions based on application-specific rules. This allows them to provide more advanced security features, such as content filtering, application-level access control, and protocol validation.Rate this question:
-
- 31.
What does the book call a "popular software application that you can install on end-user machines or servers to protect them from external security threats and intrusions"?
-
Cisco ASA
-
Cisco PIX
-
Personal Firewall
-
Network Address Translation
Correct Answer
A. Personal FirewallExplanation
A personal firewall is a popular software application that can be installed on end-user machines or servers to protect them from external security threats and intrusions. It acts as a barrier between the user's device and the internet, monitoring incoming and outgoing network traffic and blocking any unauthorized access attempts. It helps in preventing malicious attacks, such as hacking and unauthorized access to sensitive data, by filtering network traffic and allowing only legitimate connections.Rate this question:
-
- 32.
What command do I type in to enter a new license key?
-
Activation-key
-
Enter activation-key
-
License-key
-
Activate License-Key
Correct Answer
A. Activation-keyExplanation
To enter a new license key, the correct command to type in is "activation-key". This command is used to activate or update the license key on a system. It is a standard command used in many software applications to input license information and unlock additional features or functionalities.Rate this question:
-
- 33.
Which model of ASA does NOT support adding the AIP-SSM according to the book?
-
5505
-
5510
-
5520
-
5555
Correct Answer
A. 5505Explanation
The ASA 5505 model does not support adding the AIP-SSM according to the book.Rate this question:
-
- 34.
True or false, packet filters do not commonly inspect layer 4 fields like the sequence number and ACK fields?
-
True
-
False
Correct Answer
A. TrueExplanation
Packet filters commonly inspect layer 3 fields such as source and destination IP addresses, as well as layer 4 fields such as source and destination port numbers. However, they do not commonly inspect layer 4 fields like the sequence number and ACK fields. Therefore, the statement "True" is correct.Rate this question:
-
- 35.
What are the two different modes when using IPSEC?
-
ESP and AH
-
Transport and Tunnel
-
Site and Transport
-
SSL or HTTPS
Correct Answer
A. Transport and TunnelExplanation
Transport mode and Tunnel mode are the two different modes when using IPSEC. Transport mode encrypts only the data portion of the IP packet, leaving the header untouched. It is typically used for end-to-end communication between two hosts. Tunnel mode, on the other hand, encrypts both the data and the original IP header, creating a new IP packet. It is commonly used for securing communication between two networks, where the original IP header needs to be protected.Rate this question:
-
- 36.
How many PoE ports are there on the 5505 by default?
-
1
-
2
-
3
-
5
Correct Answer
A. 2Explanation
The default number of PoE ports on the 5505 is 2.Rate this question:
-
- 37.
Which module provides support for antivirus features?
-
CSC-SSM
-
AIP-SSM
-
SSC-SSM
-
OU812
Correct Answer
A. CSC-SSMExplanation
The CSC-SSM module provides support for antivirus features.Rate this question:
-
- 38.
How big is the license key used to enable features on the ASA?
-
20 Digit Decimal
-
30 Digit Hex
-
40 Digit Hex
-
40 Digit Decimal
Correct Answer
A. 40 Digit HexExplanation
The license key used to enable features on the ASA is a 40 digit hexadecimal number. Hexadecimal numbers are commonly used in computing systems, as they provide a convenient way to represent large binary numbers. The 40 digit length suggests that the license key is quite long, which may provide a high level of security and complexity.Rate this question:
-
- 39.
How much does an AIP-SSM cost for the 5505 from CDW according to my powerpoint slide?
-
Under $1,000
-
$1,000 to $2,500
-
$2,500 to $3,500
-
Over $5,000
Correct Answer
A. $1,000 to $2,500Explanation
The given answer suggests that the cost of an AIP-SSM for the 5505 from CDW according to the powerpoint slide is between $1,000 to $2,500.Rate this question:
-
- 40.
Which of the following is NOT an element that could be inspected by a packet-filtering technique?
-
Source address
-
Destination translation
-
Source port
-
Protocol
Correct Answer
A. Destination translationExplanation
Packet-filtering techniques are used to inspect and filter network traffic based on certain criteria. The source address, source port, and protocol are all elements that can be inspected by a packet-filtering technique. However, destination translation is not an element that can be inspected by this technique. Destination translation refers to the process of translating the destination address of a packet, which is typically done by network address translation (NAT) devices. Packet-filtering techniques do not have the capability to inspect or modify destination translation information.Rate this question:
-
- 41.
The process of allowing many devices on the internal protected network to share one ip address by inspecting the layer 4 information of the packet is called?
-
Static translation
-
Stateful inspection
-
Deep packet inspection
-
Port address translation
Correct Answer
A. Port address translationExplanation
Port address translation (PAT) is the process of allowing multiple devices on the internal protected network to share a single IP address by inspecting the layer 4 information of the packet. This technique is commonly used in network address translation (NAT) to conserve IP addresses. By assigning unique port numbers to each device, the router can keep track of the different connections and route the packets accordingly. This allows for more efficient use of IP addresses and helps in securing the internal network.Rate this question:
-
- 42.
What is the first octet of a class A private ip address when expressed in binary?
-
00000010
-
00001010
-
00101010
-
10101010
Correct Answer
A. 00001010Explanation
The first octet of a class A private IP address when expressed in binary is 00001010. In class A, the first octet ranges from 0 to 127, and private IP addresses fall within the range of 10.0.0.0 to 10.255.255.255. Therefore, the binary representation of the first octet is 00001010.Rate this question:
-
- 43.
How long of a time period does the ASDM display on the HOME screen? If the ASA says there have been 50 active TCP connections, what is the timeframe it is measuring that in?
-
1 minute
-
2 minutes
-
5 minutes
-
10 minutes
Correct Answer
A. 5 minutesExplanation
The ASDM displays a time period of 5 minutes on the HOME screen. Therefore, if the ASA says there have been 50 active TCP connections, it is measuring that within the 5-minute timeframe.Rate this question:
-
- 44.
What is the default enable password on the ASA?
-
Porn
-
Cisco
-
Cisco ASA
-
There is none by default
Correct Answer
A. There is none by defaultExplanation
The correct answer is "There is none by default" because the ASA (Adaptive Security Appliance) does not have a default enable password. When initially setting up the ASA, the user is prompted to create an enable password. If the user does not set a password during the initial setup, the enable password remains blank by default. It is important for the user to set a strong enable password to ensure the security of the ASA.Rate this question:
-
- 45.
Which module is required for IPS?
-
CSC-SSM
-
AIP-SSM
-
SSC-SSM
-
OU812
Correct Answer
A. AIP-SSMExplanation
The AIP-SSM module is required for IPS. The AIP-SSM (Advanced Inspection and Prevention Security Services Module) is specifically designed for intrusion prevention and detection. It provides real-time threat protection, network visibility, and advanced security features. The CSC-SSM (Content Security and Control Security Services Module) is focused on content filtering and anti-malware, while the SSC-SSM (Security Services Card) is used for firewall and VPN services. OU812 is not a valid module for IPS.Rate this question:
-
- 46.
What does a solid amber light on the status LED mean?
-
System is booting
-
System tests passed
-
System tests failed
-
No soup for you!
Correct Answer
A. System tests failedExplanation
A solid amber light on the status LED indicates that the system tests have failed. This means that there is an issue or malfunction in the system that needs to be addressed. It could be a hardware or software problem that needs to be diagnosed and fixed before the system can function properly.Rate this question:
-
- 47.
What scanning software does the CSC-SSM module use?
-
AVG
-
Trend Micro
-
Avast
-
PCcillin
Correct Answer
A. Trend MicroExplanation
The CSC-SSM module uses Trend Micro scanning software.Rate this question:
-
- 48.
What does Deep Packet Inspection do?
-
Firewalls can look at specific layer 7 payloads to protect against security threats
-
The device searches for a fixed sequence of bytes within the packets traversing the network
-
The tracking of every packet passing through an interface by assuring that they are valid, established connections
-
When the state highway patrol pulls you over after you had a bad day and got snookered with some tequila to the point you cant even see straight.
Correct Answer
A. Firewalls can look at specific layer 7 payloads to protect against security threatsExplanation
Deep Packet Inspection is a process used by firewalls to analyze the content of network packets at layer 7 of the OSI model. By examining the specific layer 7 payloads, firewalls can identify and protect against security threats. This technique involves searching for a fixed sequence of bytes within the packets traversing the network, allowing the firewall to detect and block malicious or unauthorized traffic.Rate this question:
-
- 49.
During IKE negotiation, what protocol and port number are used?
-
TCP port 500
-
UDP port 500
-
TCP port 443
-
UDP port 443
Correct Answer
A. UDP port 500Explanation
During IKE (Internet Key Exchange) negotiation, UDP (User Datagram Protocol) is used as the protocol and port number 500 is used. UDP is a lightweight protocol that does not guarantee delivery or order of packets, making it suitable for the high-speed and low-latency requirements of IKE negotiation. Port number 500 is specifically assigned for IKE negotiation, allowing devices to communicate and exchange security parameters for establishing a secure VPN (Virtual Private Network) connection.Rate this question:
-
Quiz Review Timeline (Updated): Mar 22, 2023 +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Mar 22, 2023Quiz Edited by
ProProfs Editorial Team -
Feb 14, 2012Quiz Created by
Jjscarpino4
Back to top