C. TCP 80.
D. TCP and UDP 1353. Answer: B Explanation: Secure Sockets Layer (SSL) is an application-level protocol that enables secure transactions of data through privacy, authentication, and data integrity. It relies upon certificates, public keys, and private keys. Use 443 (generally used for SSL transactions) as the SSL TCP service port and 443 as the clear text port. Configure the server to not use SSL and to monitor port 443. TCP service port 80 requests are serviced normally. Use 443 as the SSL TCP service port and 81 (or another unused port) for the clear text port. Configure the server to monitor port 81. TCP service port 80 requests are serviced normally.
QUESTION 65 What is the sequence number in the TACACS+ protocol? (Choose all that apply.)
A. It is an identical number contained in every packet.
B. The sequence number is a number that must start with 1 (for the fist packet in the session) and increment each time a request or response is sent.
C. The sequence number is always an odd number when sent by the client.
D. The sequence number is always an even number when sent by the client and odd when sent by the daemon. Answer: B, C Explanation: Seq_no - The sequence number of the current packet for the current session. The first TACACS+ packet is a session must have the sequence number 1, and each subsequent packet increments the sequence number by 1. Thus, clients (such as the NAS) send only packets containing odd sequence numbers, and TACACS+ daemons send only packets containing even sequence numbers. The sequence number must never wrap. In other words, if the sequence number 2^8-1 is ever reached, that session must terminate and be restarted with a sequence number of 1. CCIE Professional Development Network Security Principles and Practices by Saadat Malik pg 496
QUESTION 66 The Cisco Highway network administrator is troubleshooting a problem with FTP services. What will the administrator encounter if a device blocks the data connection?
A. The administrator will experience very slow connect times.
B. Incomplete execution, when issuing commands like "pwd" or "cd".
C. User login problems will occur.
D. Failure when listing a directory.
E. No problems at all. Answer: D Explanation: Below is a caption from a cert advisory about FTP. FTP can have problems when the data channel is blocked. In FTP PASV mode, the client makes a control connection to the FTP server (typically port 21/tcp) and requests a PASV data connection. The server responds by listening for client connections on a specified port number, which is supplied to the client via the control connection An active open is done by the server, from its port 20 to the same port on the client machine as was used for the control connection. The client does a passive open. For better or worse, most current FTP clients do not behave that way.
QUESTION 67 Which of the following is a description of the principle on which a Denial of Service (DoS) attack works?
A. MS-DOS and PC-DOS operating systems using a weak security protocol.
B. Overloaded buffer systems can easily address error conditions and respond appropriately.
C. Host systems are incapable of responding to real traffic, if they have an overwhelming number of incomplete connections (SYN/RCVD State).
D. All CLIENT systems have TCP/IP stack compromisable implementation weaknesses and permit them to launch an attack easily.
E. A server ceases accepting connections from certain networks as soon as they become flooded. Answer: D Explanation: Some of these answers are true examples of types of dos but in itself does not define a dos Denial-of-service (DOS) attacks might attempt o starve a host of resources needed to function correctly. Network Intrusion Detection third edition by Stephen Northcutt and Judy Novak pg 93
QUESTION 68 The newly appointed Cisco Highway trainee technician wants to know Global deployment of RFC 2827 (ingress and egress filtering) would help mitigate what classification of attack. What will your reply be?
A. Sniffing attack
B. Denial of service attack
C. Spoofing attack
D. Reconnaissance attack
E. Port Scan attack
F. All of the above. Answer: C Explanation: Network Ingress Filtering- Defeating Denial of Service Attacks which employ IP Source Address Spoofing
QUESTION 69 The CEO of Cisco Highway want to know which security programs can effectively protect your network against password sniffer programs? (Choose all that apply.)
A. IPSec, due to it encrypting data.
B. RLOGIN, because of it incapacity to send passwords.
C. Kerberos, due to encrypt password abilities.
D. One time passwords, because the passwords always change.
E. Use of POP e-mail, because it is better than using SMTP. Answer: A, D
QUESTION 70 Exhibit: Host 1 and Host 2 are on Ethernet LANs in different building. A serial line is installed between two Cisco routers using Cisco HDLC serial line encapsulation. Routers A and B are configured to route IP traffic. Host 1 sends a packet to Host 2. A line hit on the serial line causes an error in the packet. How is a retransmission sent when this specific error is detected?
A. Host 1
B. Host 2
C. Router A
D. Router B
E. Protocol analyzer Answer: C
