CCIE CCIE Security 2 — Questions and Answers
Question 1: Which IKE version is recommended for modern IPsec VPN deployments due to improved security and mobility support?
- IKEv1 aggressive mode
- IKEv1 main mode
- IKEv2 (Correct answer)
- SSL VPN only
Correct answer: IKEv2
IKEv2 is recommended over IKEv1 as it is more efficient, supports MOBIKE for mobility, has built-in NAT-T, and is more resistant to DoS attacks.
Question 2: In PKI, what is the role of the Certificate Authority (CA)?
- Encrypting data in transit
- Signing and issuing digital certificates that bind identities to public keys (Correct answer)
- Storing private keys for all devices
- Managing firewall access control lists
Correct answer: Signing and issuing digital certificates that bind identities to public keys
A CA signs digital certificates that cryptographically bind an entity's identity to their public key, enabling trust in PKI-based authentication.
Question 3: What type of attack does DHCP snooping protect against?
- ARP spoofing
- Rogue DHCP servers offering malicious IP configurations (Correct answer)
- MAC flooding
- STP manipulation
Correct answer: Rogue DHCP servers offering malicious IP configurations
DHCP snooping validates DHCP messages and blocks rogue DHCP servers on untrusted ports, preventing malicious IP address assignment.
Question 4: Which Cisco feature detects and blocks attempts to spoof ARP replies to redirect traffic?
- DHCP snooping
- Dynamic ARP Inspection (DAI) (Correct answer)
- IP Source Guard
- Port Security
Correct answer: Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies.
Question 5: What is the function of Cisco Stealthwatch (Cisco Secure Network Analytics)?
- Firewall policy management
- Network behavior analytics using NetFlow to detect threats (Correct answer)
- SSL certificate management
- Endpoint patch management
Correct answer: Network behavior analytics using NetFlow to detect threats
Cisco Stealthwatch analyzes NetFlow/IPFIX data to establish behavioral baselines and detect anomalies indicating threats like data exfiltration or C2 communication.
Question 6: In Cisco ASA failover, which unit actively processes traffic while the standby unit monitors health?
- Primary unit
- Secondary unit
- Active unit (Correct answer)
- Master unit
Correct answer: Active unit
In ASA Active/Standby failover, the active unit processes all traffic; the standby unit monitors via failover link and takes over if the active unit fails.
CCIE CCIE Security 2
Which IKE version is recommended for modern IPsec VPN deployments due to improved security and mobility support?