CCIE Security Flashcards

Which IKE version is recommended for modern IPsec VPN deployments due to improved security and mobility support?

Answer: IKEv2

IKEv2 is recommended over IKEv1 as it is more efficient, supports MOBIKE for mobility, has built-in NAT-T, and is more resistant to DoS attacks.

In PKI, what is the role of the Certificate Authority (CA)?

Answer: Signing and issuing digital certificates that bind identities to public keys

A CA signs digital certificates that cryptographically bind an entity's identity to their public key, enabling trust in PKI-based authentication.

What type of attack does DHCP snooping protect against?

Answer: Rogue DHCP servers offering malicious IP configurations

DHCP snooping validates DHCP messages and blocks rogue DHCP servers on untrusted ports, preventing malicious IP address assignment.

Which Cisco feature detects and blocks attempts to spoof ARP replies to redirect traffic?

Answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, dropping spoofed ARP replies.

What is the function of Cisco Stealthwatch (Cisco Secure Network Analytics)?

Answer: Network behavior analytics using NetFlow to detect threats

Cisco Stealthwatch analyzes NetFlow/IPFIX data to establish behavioral baselines and detect anomalies indicating threats like data exfiltration or C2 communication.

In Cisco ASA failover, which unit actively processes traffic while the standby unit monitors health?

Answer: Active unit

In ASA Active/Standby failover, the active unit processes all traffic; the standby unit monitors via failover link and takes over if the active unit fails.