Cisco (300-735-SAUTO) Exam Questions And Answers page 11

Intrusion Detection System (IDS) devices can send alerts and do not sit inline with the flow of network traffic. An IDS is a network monitoring device that passively monitors network traffic and actively sends alerts to a management station when it detects malicious traffic. An IDS typically has one promiscuous network interface attached to each monitored network. Because traffic does not flow through the IDS, the IDS is unable to directly block malicious traffic? however, an IDS can do any of the following:
- Request that another device block a connection
- Request that another device block a particular host
- Reset TCP connections
An IDS can prevent further instances of previously detected malicious traffic from passing onto the network by creating access control lists (ACLs) on routers in the traffic path or by configuring other security devices that reside in the flow of traffic. Although signaturebased pattern matching is the primary method used by an IDS to detect malicious traffic, an IDS can also consider policy definitions and historical traffic behavior when analyzing network packets.
By contrast, an Intrusion Prevention System (IPS) typically sits inline with the flow of traffic and can therefore block malicious traffic before it passes onto the network. An inline IPS can perform the following actions:
- Block traffic from a particular host
- Block a particular connection
- Modify traffic
- Reset TCP connections
However, if an IPS sits inline with traffic, a failed IPS device can cause all traffic to be dropped. Analyzing all of the traffic that passes through the IPS can cause latency and jitter. Alternatively, an IPS can be configured to operate in promiscuous mode, which would make it functionally similar to an IDS. Typically, an IPS is configured to use signaturebased pattern matching to block traffic that has been definitively marked as malicious. Traffic that is suspect but has not been confirmed as malicious is referred to as gray area traffic and is not discarded by an IPS. If an IDS is used in conjunction with an IPS, the IDS can be configured to monitor the gray area traffic in greater detail without affecting the flow of traffic through the IPS.
Cisco: Managed Security Services Partnering for Network Security: Managed Intrusion Detection and Prevention Systems

In Cisco Security Manager (CSM), rulebased policies can contain hundreds of rules containing values for the same set of parameters and settingsbased policies can define only one set of parameters for each settingsbased policy defined on a device. CSM is a graphicsbased management application that can be used to configure a wide variety of Cisco devices, such as routers, switches, firewall appliances, Intrusion Prevention System (IPS) appliances, and Catalyst service modules. One of the advantages of CSM is its ability to centralize the administration of security policies across a large number of Cisco devices. CSM categorizes policies into two general types: rulebased policies and settingsbased policies. Rulesbased policies, such as access control lists (ACLs) and inspection rules, are stored in a tabular fashion and can contain many different values for the same set of parameters. These policies are processed in order and the first matching table entry will be applied, even if there are other matching table entries farther down the table. Because of the nature in which rulesbased policies are processed, they can contain hundreds of rules with values for the same set of parameters. By contrast, settingsbased policies can define only a single set of parameters for each settingsbased policy defined on a device. Settingsbased policies, such as Quality of Service (QoS) policies and IP Security (IPSec) policies, contain a set of parameters that, as a whole, define a particular hardware or security configuration feature.
CSM policies can be either local or shared. A local policy is specific to a particular device, and any changes affect only its associated device. By contrast, a shared policy is applicable to a group of devices and any changes are automatically applied to all of its associated devices. Because local policies are specific to individual devices, it can become cumbersome to manage the policies in a network with a large number of devices? therefore, local policies are better suited to smaller networks and shared policies are better suited to larger networks.
Shared policies use an inheritance hierarchy to determine which policy rules are implemented on a particular device. There are two kinds of shared policy rules: mandatory and default. Mandatory rules cannot be overridden by either child policy rules or local rules. By contrast, default rules can be overridden by both child policy rules and local rules. Inheritance enables you to nest multiple shared rules and ensure that certain policies cannot be overridden while still maintaining the flexibility to override some default settings.
Cisco: Managing Policies: Understanding Policies

Remote Authentication DialIn User Service (RADIUS) combines authentication and authorization into a single function and encrypts only the password in AccessRequest packets. RADIUS is an Internet Engineering Task Force (IETF) standard protocol for Authentication, Authorization, and Accounting (AAA) operations. RADIUS uses User Datagram Protocol (UDP) for packet delivery. Because RADIUS encrypts only the password of a packet, the rest of the packet would be viewable if the packet were intercepted by a malicious user. RADIUS has fewer flexible security options than Terminal Access Controller Access Control System Plus (TACACS+), because RADIUS combines the authentication and authorization functions of AAA into a single function and does not provide router command authorization capabilities.
By contrast, TACACS+ is a Ciscoproprietary protocol that uses Transmission Control Protocol (TCP) for transport during AAA operations. TACACS+ provides more security and flexibility than RADIUS because TACACS+ encrypts the entire body of a packet and separates the authentication, authorization, and accounting functions of AAA. This separation enables granular control of access to resources. For example, TACACS+ gives administrators control over access to configuration commands? users can be permitted or denied access to specific configuration commands. Because of this flexibility, TACACS+ is used with Cisco Secure Access Control Server (ACS), which is a software tool that is used to manage user authorization for router access.
Cisco: TACACS+ and RADIUS Comparison: Compare TACACS+ and RADIUS

Terminal Access Controller Access Control System Plus (TACACS+) encrypts the entire body of a packet and provides router command authorization capabilities. TACACS+ is a Ciscoproprietary protocol that uses Transmission Control Protocol (TCP) for transport during Authentication, Authorization, and Accounting (AAA) operations. TACACS+ provides more security and flexibility than other authentication protocols, such as Remote Authentication DialIn User Service (RADIUS), which is an open standard protocol commonly used as an alternative to TACACS+. Because TACACS+ can be used to encrypt the entire body of a packet, users who intercept the encrypted packet cannot view the user name or contents of the packet. In addition, TACACS+ provides flexibility by separating the authentication, authorization, and accounting functions of AAA. This enables granular control of access to resources. For example, TACACS+ gives administrators control over access to configuration commands? users can be permitted or denied access to specific configuration commands. Because of this flexibility, TACACS+ is used with Cisco Secure Access Control Server (ACS), which is a software tool that is used to manage user authorization for router access.
RADIUS, not TACACS+, was developed as an Internet Engineering Task Force (IETF) standard protocol.
Like TACACS+, RADIUS is a protocol used with AAA operations. However, RADIUS uses User Datagram Protocol (UDP) for packet delivery and is less secure and less flexible than TACACS+. RADIUS encrypts only the password of a packet? the rest of the packet would be viewable if the packet were intercepted by a malicious user. With RADIUS, the authentication and authorization functions of AAA are combined into a single function, which limits the flexibility that administrators have when configuring these functions.
Furthermore, RADIUS does not provide router command authorization capabilities.
Cisco: TACACS+ and RADIUS Comparison: Compare TACACS+ and RADIUS

The DfltGrpPolicy group policy can be applied to user profiles and is the default policy used with both the DefaultRAGroup and the DefaultWEBVPNGroup connection profiles. Group policies are used with Cisco Adaptive Security Appliances (ASAs) to specify security policies and network settings that are used when remote virtual private network (VPN) users log in to the ASA. Cisco ASAs include the DfltGrpPolicy group policy, which is the default policy used for the default connection profiles that are included on an ASA: DefaultRAGroup and DefaultWEBVPNGroup. You can customize the DfltGrpPolicy group policy and tailor it to match your company s requirements, and you can inherit policies from it from within custom group policies. In addition to applying this group policy to connection profiles, you can also apply it to user profiles, which you can use to create a specific set of policies for individual users.
The DfltGrpPolicy group policy cannot be deleted. You can create custom group policies, but you cannot delete the default group policy.
Cisco: Configuring Tunnel Groups, Group Policies, and Users: Default Group Policy

The FirePOWER inline normalization preprocessor engine cannot detect Transmission Control Protocol (TCP) SYN flood attacks or session hijacking attacks. The inline normalization preprocessor can be used by a FirePOWER Intrusion Prevention System (IPS) that is deployed in an inline configuration. Packet normalization can reduce the chances of malicious traffic evading detection. The inline normalization process takes place immediately after the IPS packet decoder decodes the packet, which ensures that packets being analyzed by the IPS are identical to the packets that will be assembled by the target host. The inline normalization preprocessor can perform normalizations on various components of Internet Control Message Protocol version 4 (ICMPv4), IP version 4 (IPv4), IPv6, and TCP packets. For example, it can reset the timetolive (TTL) value on a packet if it detects a TTL value outside of a userdefined range.
The FirePOWER ratebased prevention preprocessor engine, not the inline normalization detection preprocessor engine, can detect SYN flood traffic. The ratebased prevention preprocessor engine detects traffic abnormalities based on the frequency of certain types of traffic. The following traffic patterns can trigger ratebased attack prevention:
- Traffic containing excessive incomplete TCP connections
- Traffic containing excessive complete TCP connections
- Excessive rule matches for a particular IP address or range of IP addresses
- Excessive rule matches for one particular rule regardless of IP address
The FirePOWER TCP stream preprocessor engine, not the inline normalization detection preprocessor, can detect session hijacking attacks. The stream preprocessor assembles the packets of a TCP data stream into a single comprehensive unit for scanning. Because the TCP stream preprocessor has access to multiple packets in a data stream, it can analyze state information, analyze payload anomalies, and identify streambased attacks that are not possible to identify based on singlepacket analysis.
Cisco: Configuring Transport & Network Layer Preprocessing: Normalizing Inline Traffic

A class map can match traffic by Transmission Control Protocol (TCP) port number, by User Datagram Protocol (UDP) port number, and by IP precedence on a Cisco Adaptive Security Appliance (ASA). A class map is one of the three basic components of Modular Policy Framework (MPF)? policy maps and service policies are the other two components. MPF is a Cisco ASA feature that provides a flexible method of enabling security policies on an interface. A class map identifies a specific flow of traffic, a policy map determines the action that will be performed on the traffic, and a service policy ties this action to a specific interface. Generally, each class map can contain only a single match statement, and a packet can match only a single class map within the policy map of a particular feature type. For example, if a packet matched a class map for File Transfer Protocol (FTP) inspection and a class map for traffic policing, the ASA would apply both policy map actions to the packet. However, if a packet matched a class map for FTP inspection and a second, different class map that included FTP inspection, the ASA would apply only the actions of the first matching policy map.
You can use the match command from class map configuration mode to identify traffic based on specified characteristics. The keywords you can use to identify traffic in a class map are closely tied to their respective characteristics. The match command supports the following key words: accesslist, port, defaultinspectiontraffic, dscp, precedence, rtp, tunnelgroup, and any.
For example, you could issue the following commands to create a class map named CLASSMAP that identifies traffic using TCP port 25:
asa(config)#classmap CLASSMAP
asa(configcmap)#match port tcp eq 25
Once traffic has been identified by a class map, the associated policy map can take action on that traffic. A policy map typically contains references to one or more class maps and defines actions that should be performed on traffic matched by the specified class maps. If traffic matches multiple class maps for different actions within a policy map-for instance, if traffic matches a class map for application inspection as well as a class map for priority queuing-the actions of both class maps will be applied to the traffic. To continue the example from above, you could issue the following commands to configure a policy map named POLICYMAP that matches traffic specified by the class map named CLASSMAP and then processes the traffic with the Hypertext Transfer Protocol (HTTP) inspection engine:
asa(config)#policymap POLICYMAP
asa(configpmap)#class CLASSMAP
asa(configpmapc)#inspect http
A policy map does not act on traffic until the map has been applied to an interface by a service policy. A service policy can be applied globally to all interfaces, which will apply application inspection to only traffic entering the appliance? alternatively, a service policy can be applied to a single interface, which will apply application inspection to traffic entering and exiting the interface. An interface service policy overrides a global service policy: if traffic matches both an interface policy and a global policy, only the interface policy will be applied to that particular traffic flow. To complete the example, you could issue the following commands to apply the POLICYMAP policy map to the inside interface:
asa(config)#servicepolicy POLICYMAP interface inside
Cisco: Service Policy Using the Modular Policy Framework: Feature Matching Within a Service Policy

An Intrusion Prevention System (IPS) does not require that at least one interface be in promiscuous mode. An IPS sits inline with the flow of traffic, thus actively monitoring network traffic and blocking malicious traffic, such as an atomic or singlepacket attack, before it spreads onto the network. An IPS requires at least two interfaces for each monitored network: one interface listens to traffic entering the IPS, and the other listens to traffic leaving the IPS. In addition, an IPS acts similarly to a Layer 2 bridge in that it can pass traffic through to destinations on the same subnet? an IPS cannot route to destinations on a different subnet. Because all monitored traffic must pass through the IPS, it can add latency to traffic flows on the network.
By contrast, an Intrusion Detection System (IDS) typically has one promiscuous network interface attached to each monitored network, with no IP address assigned to the monitoring interface. An IDS is a network monitoring device that does not sit inline with the flow of network traffic? an IDS passively monitors a copy of network traffic, not the actual packet. Since an IDS analyzes a copy of network traffic, an IDS can support asymmetric traffic flows in which the original traffic may use a different return path than it used to arrive at its original destination. Because monitored traffic does not pass through an IDS, it does not add latency to the traffic flow.
CCNA Security 210260 Official Cert Guide, Chapter 17, Difference Between IPS and IDS, pp. 460-462 Cisco: Cisco IPS Mitigation Capabilities

In the Infrastructure as a Service (IaaS) service model, the consumer does not have control over the physical infrastructure in the cloud. The National Institute of Standards and Technology (NIST) defines three service models in its definition of cloud computing: Software as a Service (SaaS), IaaS, and Platform as a Service (PaaS).
The SaaS service model enables its consumer to access applications running in the cloud infrastructure but does not enable the consumer to manage the cloud infrastructure or the configuration of the provided applications. A company that licenses a service provider s office suite and email service that is delivered to end users through a web browser is using SaaS. SaaS providers use an Internetenabled licensing function, a streaming service, or a web application to provide end users with software that they might otherwise install and activate locally. Webbased email clients, such as Gmail and Outlook.com, are examples of SaaS.
The PaaS service model provides its consumer with a bit more freedom than the SaaS model by enabling the consumer to install and possibly configure providersupported applications in the cloud infrastructure. A company that uses a service provider s infrastructure, programming tools, and programming languages to develop and serve cloudbased applications is using PaaS. PaaS enables a consumer to use the service provider s development tools or Application Programmer Interface (API) to develop and deploy specific cloudbased applications or services. Another example of PaaS might be using a third party s MySQL database and Apache services to build a cloudbased customer relationship management (CRM) platform.
The IaaS service model provides the greatest degree of freedom by enabling its consumer to provision processing, memory, storage, and network resources within the cloud infrastructure. The IaaS service model also enables its consumer to install applications, including operating systems (OSs) and custom applications. However, with IaaS, the cloud infrastructure remains in control of the service provider. A company that hires a service provider to deliver cloudbased processing and storage that will house multiple physical or virtual hosts configured in a variety of ways is using IaaS. For example, a company that wanted to establish a web server farm by configuring multiple Linux Apache MySQL PHP (LAMP) servers could save hardware costs by virtualizing the farm and using a provider s cloud service to deliver the physical infrastructure and bandwidth for the virtual farm. Control over the OS, software, and server configuration would remain the responsibility of the organization, whereas the physical infrastructure and bandwidth would be the responsibility of the service provider.
NIST: Special Publication 800145: The NIST Definition of Cloud Computing (PDF)

In Cisco FireSIGHT Management Center, beginningofconnection events contain less information than endofconnection events. Cisco FireSIGHT Management Center, which was formerly called Sourcefire Defense Center, can log beginningofconnection and endofconnection events for various types of network traffic.
Although most network traffic will generate both kinds of events, blocked or blacklisted traffic is typically denied without further processing and therefore only generates beginningofconnection events. Beginningofconnection events contain a limited amount of information because they are generated based on the information contained in the first few packets of a connection.
By contrast, endofconnection events are generated when a connection closes, times out, or can no longer be tracked because of memory constraints. Endofconnection events contain significantly more information than beginningofconnection events because they can draw upon data collected throughout the course of a connection. This additional information can be used to create traffic profiles, generate connection summaries, or graphically represent connection data. In addition, the data can be used for detailed analysis or to trigger correlation rules based on session data. Endofconnection events are also required to log encrypted connections that are handled by a Secure Sockets Layer (SSL) policy because there is not enough information in the first few packets to indicate that a connection is encrypted.
Cisco: Logging Connections in Network Traffic: Logging the Beginning or End of Connections