CCIE Security Flashcards

Which Cisco technology provides identity-based network access control using 802.1X, MAB, and Web Auth?

Answer: Cisco ISE (Identity Services Engine)

Cisco ISE is a policy engine that provides identity-based access control using 802.1X, MAC Authentication Bypass (MAB), and Web Authentication.

In Cisco ASA, what is the default security level for the 'inside' interface?

Answer: 100

The inside interface on Cisco ASA has a default security level of 100 (highest), while outside is 0 (lowest), controlling traffic flow.

What is the primary difference between stateful and stateless firewalls?

Answer: Stateful firewalls track connection state; stateless only inspect individual packets

Stateful firewalls maintain a connection table to track session state, allowing return traffic automatically; stateless firewalls inspect each packet in isolation.

Which Cisco Firepower feature provides advanced malware protection by continuously analyzing file behavior after initial inspection?

Answer: AMP (Advanced Malware Protection) retrospective analysis

AMP retrospective analysis continues monitoring files after they pass initial inspection, allowing Firepower to detect malware even after files enter the network.

In Cisco IOS, what command enables Zone-Based Firewall policy between two security zones?

Answer: zone-pair security

The 'zone-pair security' command defines the direction of traffic flow between zones and applies the service policy map in Cisco ZBF.

What is the purpose of Cisco TrustSec SGT (Security Group Tags)?

Answer: Policy enforcement based on user/device identity rather than IP

SGTs tag traffic with a security group identifier, enabling policy enforcement based on identity (user/device role) rather than IP address or VLAN.