CCIE CCIE Security 1 — Questions and Answers
Question 1: Which Cisco technology provides identity-based network access control using 802.1X, MAB, and Web Auth?
- Cisco ASA
- Cisco ISE (Identity Services Engine) (Correct answer)
- Cisco Firepower
- Cisco DNA Center
Correct answer: Cisco ISE (Identity Services Engine)
Cisco ISE is a policy engine that provides identity-based access control using 802.1X, MAC Authentication Bypass (MAB), and Web Authentication.
Question 2: In Cisco ASA, what is the default security level for the 'inside' interface?
- 0
- 50
- 100 (Correct answer)
- 255
Correct answer: 100
The inside interface on Cisco ASA has a default security level of 100 (highest), while outside is 0 (lowest), controlling traffic flow.
Question 3: What is the primary difference between stateful and stateless firewalls?
- Stateful firewalls are faster
- Stateful firewalls track connection state; stateless only inspect individual packets (Correct answer)
- Stateless firewalls support more protocols
- Stateful firewalls only work at Layer 3
Correct answer: Stateful firewalls track connection state; stateless only inspect individual packets
Stateful firewalls maintain a connection table to track session state, allowing return traffic automatically; stateless firewalls inspect each packet in isolation.
Question 4: Which Cisco Firepower feature provides advanced malware protection by continuously analyzing file behavior after initial inspection?
- URL filtering
- Intrusion Prevention (IPS)
- AMP (Advanced Malware Protection) retrospective analysis (Correct answer)
- SSL decryption
Correct answer: AMP (Advanced Malware Protection) retrospective analysis
AMP retrospective analysis continues monitoring files after they pass initial inspection, allowing Firepower to detect malware even after files enter the network.
Question 5: In Cisco IOS, what command enables Zone-Based Firewall policy between two security zones?
- ip inspect
- zone-pair security (Correct answer)
- access-list extended
- policy-map type inspect
Correct answer: zone-pair security
The 'zone-pair security' command defines the direction of traffic flow between zones and applies the service policy map in Cisco ZBF.
Question 6: What is the purpose of Cisco TrustSec SGT (Security Group Tags)?
- VLAN assignment for QoS
- Policy enforcement based on user/device identity rather than IP (Correct answer)
- Encryption of data center traffic
- Load balancing across ASA clusters
Correct answer: Policy enforcement based on user/device identity rather than IP
SGTs tag traffic with a security group identifier, enabling policy enforcement based on identity (user/device role) rather than IP address or VLAN.
CCIE CCIE Security 1
Which Cisco technology provides identity-based network access control using 802.1X, MAB, and Web Auth?