CCIE CCIE Security 2

Question 1

Which IKE version is recommended for modern IPsec VPN deployments due to improved security and mobility support?

Accepted Answer

IKEv2

Answer

IKEv2 is recommended over IKEv1 as it is more efficient, supports MOBIKE for mobility, has built-in NAT-T, and is more resistant to DoS attacks.

Question 2

In PKI, what is the role of the Certificate Authority (CA)?

Accepted Answer

Signing and issuing digital certificates that bind identities to public keys

Answer

A CA signs digital certificates that cryptographically bind an entity's identity to their public key, enabling trust in PKI-based authentication.

Question 3

What type of attack does DHCP snooping protect against?

Accepted Answer

Rogue DHCP servers offering malicious IP configurations

Answer

DHCP snooping validates DHCP messages and blocks rogue DHCP servers on untrusted ports, preventing malicious IP address assignment.

Question 4

Which Cisco feature detects and blocks attempts to spoof ARP replies to redirect traffic?

Accepted Answer

Dynamic ARP Inspection (DAI)

Answer

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies.

Question 5

What is the function of Cisco Stealthwatch (Cisco Secure Network Analytics)?

Accepted Answer

Network behavior analytics using NetFlow to detect threats

Answer

Cisco Stealthwatch analyzes NetFlow/IPFIX data to establish behavioral baselines and detect anomalies indicating threats like data exfiltration or C2 communication.

CCIE - Cisco Certified Internetwork Expert Practice Test

CCIE - Cisco Certified Internetwork Expert Practice Test

CCIE CCIE Security 2