Global Knowledge Training Blog » CCNP Security http://globalknowledgeblog.com Your Source for Technical, Professional, & Leadership Training Tue, 18 Jun 2013 17:03:59 +0000 en-US hourly 1 http://wordpress.org/?v=3.5.1 CCNP Security Exam Prep Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week-3/ http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week-3/#comments Thu, 03 May 2012 17:25:02 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=5737 Which of the following provide high availability and performance enhancements for VPN sessions?

  1. Stateful active/standby failover
  2. Global Access Control Lists
  3. Cluster load balancing
  4. Server load balancing

 

The correct answers are 1, 3, and 4.

With Stateful Active/Standby failover, VPN users do not have to reconnect or reauthenticate should the Active ASA fail. With Cluster Load balancing a group of ASAs will work cooperatively to share the VPN load. With Server Based Load Balancing a Cisco Application Control Engine (ACE) is installed in a Cisco 7600/6500 series device and is used as an SSL VPN front end to multiple ASA servers running in parallel.

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week-3/feed/ 1 CCNP Security Exam Prep Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week-2/ http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week-2/#comments Thu, 19 Apr 2012 17:25:01 +0000 Guest Authors http://globalknowledgeblog.com/?p=5625 Which of the following is true regarding Cisco Secure Desktop prelogin policies?

  1. They are evaluated after the user successfully authenticates.
  2. They are evaluated before the user successfully authenticates.
  3. They contain the same checks as Host Scan provides to the DAPs.
  4. You can only have a single prelogin policy.

 

The correct answer is 2.

As the name implies, prelogin policies are used prior to user authentication to determine which Cisco Secure Desktop (CSD) policy to apply to the session. Prelogin policies can check for the presence of specific files, digital certificates, operating systems, IP addresses, and/or registry keys.

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week-2/feed/ 0 Cisco Career Certifications: Design & Security http://globalknowledgeblog.com/certification/cisco-career-certifications-design/ http://globalknowledgeblog.com/certification/cisco-career-certifications-design/#comments Tue, 10 Apr 2012 12:38:34 +0000 Guest Authors http://globalknowledgeblog.com/?p=5504 Last week we started to look at the Foundation Certs of the Cisco Career Certifications. Now we’ll continue with Design and Security Certifications.

Design Certifications

CCDA — Cisco Certified Design Associate

CCDA certification indicates a foundation or apprentice knowledge of network design for the Cisco converged network. CCDA certification designates professionals who can design routed and switched network infrastructures and services involving LAN, WAN, and broadband access for businesses and organizations. The exam topics were recently updated to include design methodology, network structure, campus design, enterprise edge, and more.

Prerequisite: CCNA-level knowledge and SWITCH knowledge are needed to prepare for the CCDA certification exam.

Required Cisco Exam: 640–864 DESGN

CCDP — Cisco Certified Design Professional

The CCDP certification indicates advanced journeyman knowledge of intelligent network design concepts and principles. A network professional with CCDP certification can discuss, design, and create advanced addressing and routing, security, network management, data center, and IP multicast complex multilayered enterprise architectures that include virtual private networking and wireless domains.

Prerequisite: Valid CCNA certification and CCDA certification, or any CCIE certification.

Required Cisco Exams:
642–902 ROUTE
642–813 SWITCH
642–874 ARCH

CCDE — Cisco Certified Design Expert

Cisco Certified Design Expert (CCDE) validates advanced network infrastructure design principles and fundamentals for large networks. With a CCDE certification, a network professional demonstrate an ability to develop solutions which address planning, design, integration, optimization, operations, security and ongoing support focused at the infrastructure level for customer networks.

Prerequisite: There are no formal prerequisites for CCDE certification, but it is expected that the candidate will have an in-depth understanding of the topics in the exam blueprints, a minimum of seven years job experience, and a thorough understanding of networking infrastructure principles.

Required Cisco Exams:
Step One: CCDE Written Exam
You must pass the two-hour, written qualification exam which covers advanced networking infrastructure design principles and concepts. Once you pass the written exam, you are then eligible to schedule the practical exam.

Step Two: CCDE Practical Exam
The CCDE Practical exam is a design-scenario exam that tests your ability to perform design analysis, justify design requirements, and develop a design implementation based on best practices. The exam will assess your ability to apply your specific body of knowledge into current business problems of technical network design. The topics covered in the Practical exam are located within the exam blueprint. The exam scenarios will change each instance the exam is delivered, however, the topics will remain the same.

Security Certifications

CCNA Security

More than any other area, security and risk management skills are some of the highly sought across the network, and demand is continuing to grow. The CCNA Security confirms your competency for job roles such as network security specialists or support engineers and security administrators. It also validates installation and troubleshooting skills, as well as monitoring network devices for integrity, confidentiality, and availability. Through your exam preparation, you will get an introduction to core security technologies and also learn how to develop security policies and mitigate risks. These skills will enable you to develop a security infrastructure, recognize vulnerabilities in networks, and detect potential security threats.
Prerequisite: Valid CCNA certification or any CCIE certification.
Required Cisco Exam: 640–553 IINS

CCNP Security – Cisco Certified Network Professional Security

Last year Cisco completed a significant upgrade to their CCSP program, including a new name: Cisco Certified Network Professional Security (CCNP Security). Key changes to the program include:

  • Focus on daily job tasks of experienced network security professionals and engineers
  • More emphasis on defining service, service levels, and quality of service
  • Streamlined process eliminates elective requirements

Prerequisite: Valid CCNA Security certification, valid CCSP certification, or valid CCNA certification plus SND exam pass.
Required Cisco Exams:
642–637 SECURE v1.0
642–627 IPS v7.0
642–647 VPN v1.0
642–617 FIREWALL v1.0

CCIE Security

CCIE Security certification is the industry standard for recognizing network security engineers who have demonstrated expert-level performance implementing, configuring, and troubleshooting Cisco network security solutions.

To earn the CCIE Security certification, you must not only prove your theoretical knowledge of security best practices in the CCIE Security written exam, but you must also demonstrate your skill in the CCIE Security lab exam using real equipment in real-world scenarios. Because of this rigorous process and the expert-level knowledge and skill it requires, CCIE Security certification is one of the most advanced network security certifications available and qualifies you to manage, lead, and design the most complex network security teams and projects.
Prerequisite: While there are no formal prerequisites for CCIE Security certification, you are expected to have an in-depth understanding of the topics in the exam blueprints and are strongly encouraged to have three to five years of job experience before attempting certification.

Required Cisco Exams:
Step One: CCIE Security Written Exam
You must pass the two-hour written exam covering areas such as security protocols, operating systems, application protocols, security technologies, and Cisco security applications before you are eligible to schedule the lab exam.

Step Two: CCIE Security Lab Exam
The CCIE Security lab exam is an eight-hour, hands-on exam which requires you to configure a series of secure networks to given specifications. Knowledge of troubleshooting is an important skill, and you are expected to diagnose and solve issues as part of the CCIE Security lab exam. Your first lab attempt must be made within 18 months.

Related Courses
Cisco Certifications

Cisco Career Certifications Series

]]> http://globalknowledgeblog.com/certification/cisco-career-certifications-design/feed/ 2 CCNP Security Exam Prep Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week/ http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week/#comments Thu, 05 Apr 2012 17:15:04 +0000 Guest Authors http://globalknowledgeblog.com/?p=5577 True or False — The AnyConnect client XML file contains all attributes necessary to configure the client for features such as Start Before Login, Trusted Network Detection, and the name of connection entries that appear to the user.

The answer is True

To make modifications to the XML file, use the template that appears after installing AnyConnect on a workstation: \Documents and Settings\All Users\Application Data\Cisco\Cisco AnyConnect VPN Client\Profile\AnyConnectProfile.tmpl

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-exam-prep-question-of-the-week/feed/ 0 CCNP Security Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-13/ http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-13/#comments Thu, 22 Mar 2012 17:05:13 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=5386 Which of the following are supported methods of customizing the portal for clientless VPN access?

  1. ASDM
  2. Frontpage
  3. Full customization
  4. There is no full customization; you are limited on what you can customize on the web interface

 

The correct answers are 1 and 3.

The clientless SSL VPN portal can be modified from within ASDM using the options in the GUI. In addition, a complete customization specification can be created and invoked to replace the portal altogether (Full Customization).

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-13/feed/ 0 CCNP Security Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-12/ http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-12/#comments Thu, 08 Mar 2012 18:52:53 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=5385 Which of the following uses a polling method for revocation checking in a PKI environment?

  1. AAA
  2. CRL
  3. OCSP
  4. Not available

 

The correct answer is 2.

A Certificate Authority (CA) will publish its Certificate Revocation List (CRL) to identify the serial numbers of certificates that are no longer valid. The Fully Qualified Domain Name (FQDN) with the location of the CRL is placed into the CA root certificate. A host that chooses to trust the CA can use that information to periodically poll the CRL to determine which certificates have been revoked and should no longer be used.

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

 

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-12/feed/ 0 CCNP Security Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-11/ http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-11/#comments Thu, 23 Feb 2012 18:08:40 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=5168 A user has called the helpdesk for a VPN-related issue. While at a coffee shop, the user attempted to connect to the VPN using the IPsec client and failed. In other locations, the user can successfully connect. Which of the following settings would more than likely allow the user to access the VPN while at this coffee shop?

  1. Enable IPsec over TCP
  2. Disable group authentication
  3. Enable DTLS
  4. Change the port number that the IPsec tunnel listens on at the head end ASA

The correct answer is 1.

In many environments, Port Address Translation (PAT) is used to connect users to the internet. IPSec and PAT are not compatible without using either NAT-T (NAT Traversal) on UDP port 4500, or the Cisco proprietary solution of IPSec over TCP (usually to port 10,000).

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-11/feed/ 0 CCNP Security Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-10/ http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-10/#comments Thu, 09 Feb 2012 18:03:36 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=5167 When configuring a site-to-site IPsec tunnel, which of the following is a valid command?

  1. tunnel-group 1.1.1.1 type ipsec-l2l
  2. tunnel-group 2.2.2.2 type s2s
  3. tunnel-group SiteB type ipsec l2l
  4. tunnel-group SiteB type s2s

The correct answer is 1.

LAN to LAN VPNs will use a connection profile with the IP address of the peer being connected to. Hence options C and D are not valid because they use a name instead of an ip address as the identifier for the connection profile. Option B is also incorrect because although it uses an ip address to identify the connection profile, the syntax of s2s is not valid.

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-10/feed/ 0 CCNP Security Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-9/ http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-9/#comments Thu, 26 Jan 2012 18:08:57 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=5010 In which of the following methods can a VPN user be automatically associated with a connection profile?

  1. Certificate mapping
  2. Group alias
  3. Group URL
  4. Cannot be done

 

The correct answers are 1 and 2.

Every VPN user needs to be associated with a connection profile in order for the ASA to determine which set of policies to apply to the connection. If certificate based authentication is in use, the a certificate to connection profile mapping can be used. Otherwise and alias can be displayed to the user at logon to allow for selection of the appropriate profile.

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

 

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-9/feed/ 0 CCNP Security Question of the Week http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-8/ http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-8/#comments Thu, 12 Jan 2012 18:19:24 +0000 Dawn Hopper http://globalknowledgeblog.com/?p=4628 When setting the name of an interface from the command line, what is the default security level on any interface with a name other than inside?

  1. 0
  2. 50
  3. 100
  4. none

 

The correct answer is 1.

When working from the command line (CLI) all interfaces other than the inside interface get a default security level of 0 (Most untrusted).

Related Courses:
ASAE — ASA Essentials
FIREWALL — Deploying Cisco ASA Firewall Solutions
VPN — Deploying Cisco ASA VPN Solutions
CCNP Security — Cisco Certified Network Professional Security

CCNP Security Question of the Week Series

]]> http://globalknowledgeblog.com/certification/ccnp-security-question-of-the-week-8/feed/ 0