Endpoint Security for LANs

In a modern network security approach, what is the role of Network Admission Control (NAC)?

What is a key difference between traditional endpoint security and modern endpoint security solutions?

Which of the following is a primary function of Cisco's Email Security Appliance (ESA)?

What type of security threat is mitigated by implementing DHCP snooping?

What is the primary purpose of using port security on a network switch?

How does a CAM table overflow attack compromise network security?

What does Cisco's Advanced Malware Protection (AMP) provide in addition to traditional anti-virus software?

Which Layer 2 attack involves manipulating the Spanning Tree Protocol (STP) to become the root bridge and intercept network traffic?

What is the function of IP Source Guard in network security?

What is VLAN hopping and what type of vulnerability does it exploit?

How does a modern Web Security Appliance (WSA) protect a network from web-based threats?

Which of the following is a typical characteristic of a DHCP starvation attack?

What is the purpose of configuring 'switchport port-security mac-address sticky' on a switchport?

When configuring port security, what is the 'violation mode' and what options are typically available?

How does implementing Dynamic ARP Inspection (DAI) contribute to network security?

What is the role of the Talos team in the context of Cisco's security solutions?

In the context of network security, what does the term 'blacklisting' refer to?

What is the purpose of configuring a DHCP snooping limit rate on a switch interface?

When implementing port security, which aging type is most appropriate for environments where devices frequently move or change?

Which of the following best describes the combined function of a Cisco Web Security Appliance (WSA) and Email Security Appliance (ESA) in a comprehensive security strategy?

What is a common method an attacker might use to initiate a CAM table overflow attack?

How does implementing 802.1X authentication improve network security?

What is the purpose of configuring VLAN trunk security, and what type of attack does it primarily mitigate?

What is one key benefit of using hardware-based encryption over software-based encryption for local data?

What is the significance of the 'show mac address-table' command on a Cisco switch?

Traditional endpoint security relies solely on network-based protections, neglecting host-based firewalls and intrusion prevention systems.

In a borderless network, limiting security measures to antivirus software is sufficient to protect against the wide array of potential threats.

Advanced Malware Protection (AMP) operates only after a malware attack by focusing solely on remediation.

Cisco AMP utilizes threat intelligence gathered from a broad range of sources, analyzing approximately 100 MB of security data daily.

A key feature of the Cisco Email Security Appliance is its ability to block spam, provide advanced malware protection, and control outbound messages.

When a client initiates a web request, the Cisco Web Security Appliance (WSA) intercepts the request, analyzes it for potential threats, and then forwards it to the internet.

Cisco NAC functions do not include policy enforcement; it only focuses on identifying users and devices on the network.

Layer 2 vulnerabilities involve exploitation of the Physical and Application layers of the OSI model.

In a CAM table overflow attack, the switch floods the network with traffic because it cannot determine the correct destination MAC address.

The macof tool is used to mitigate CAM table attacks by preventing attackers from flooding the network with bogus MAC addresses.

Port security guarantees network performance by ensuring that only authorized devices can connect to a switch port.

Enabling sticky learning on a switch port allows the switch to dynamically learn and permanently store MAC addresses until manually deleted.

In port security, the 'restrict' violation mode drops traffic from unauthorized MAC addresses, sends a syslog message, and increments the violation counter.

A DHCP starvation attack renders a DHCP server unable to issue IP addresses by overwhelming it with requests, while a DHCP spoofing attack sets up a bogus DHCP server.

Configuring DHCP snooping on a switch involves defining ports as either 'trusted' or 'untrusted', with 'trusted' ports being allowed to send DHCP responses.

In the context of endpoint security, 'blacklisting' refers to a technique that only permits known good URLs to be accessed, blocking all others.

ESA and WSA are legacy systems and offer similar functionaility to Antivirus software.

Modern security solutions replaced the need for hardware and software encryption of local data.

In DHCP Snooping configurations, DHCP 'trust' is configured on the interfaces connecting to clients, not the DHCP server.

Advanced Malware Protection (AMP) can block URLs.

Modern security solutions combine NAC, AMP, ESA and WSA functionality.

1 TB of security intelligence data is analyzed daily using Cisco's threat defense.

The purpose of blacklisting is to ensure only trusted sources can access your server.

Once sticky MAC Addreses are learned, they cannot be deleted.

Sticky learning requires a manual reboot to take effect.