لطفا منتظر باشید ...
Chapter 14
A1: | c |
| A2: | b,d,e |
| A3: | b |
| A4: | a,b,d,f |
| A5: | b |
| A6: | b |
| A7: | b,c,d,e,g |
| A8: | a |
| A9: | c |
| A10: | c |
Q&A
| 1: | What is RFC 2827 filtering? |
| A1: | RFC 2827 filtering ensures that any traffic with a source address that is not part of the organization's public address space is filtered out. |
| 2: | What public services should be available to Internet users? |
| A2: | It is normal practice to allow only those specific ports that are required for a service to function. All other access should be denied. Any attempt to gain access to other public services ports should be logged. |
| 3: | What is the command to implement a Cisco IOS Firewall rule set to an interface? |
| A3: | ip inspect name [in | out] |
| 4: | What technique is used to perform rate limiting within the ISP router? |
| A4: | Rate limiting of traffic in the ISP router can be achieved by the use of committed access rate (CAR) filtering. This technique flags traffic to be rate limited via an ACL. Matched traffic is then rate limited according to the parameters selected in the rate-limit command. |
| 5: | How do you implement RFC 1918 filtering? |
| A5: | To implement RFC 1918 filtering, the following filter rules are defined on an extended IP ACL, which is then applied to the appropriate interface:access-list 140 deny ip 10.0.0.0 0.255.255.255 anyaccess-list 140 deny ip 172.16.0.0 0.15.255.255 anyaccess-list 140 deny ip 192.168.0.0 0.0.255.255 any |
| 6: | How should traffic that is flowing from the internal network to the public services segment be restricted? |
| A6: | Only the traffic that is specifically required to flow to the public services segment should be allowed. All other traffic should be explicitly denied. |
| 7: | How are remote users affected in the small network when the small network is used in a branch configuration? |
| A7: | Under this circumstance, all remote connectivity is normally provided via the corporate headquarters. Consequently, all related configuration for remote user connectivity is removed from the design. |
| 8: | What commands are used to implement IDS services on the PIX Firewall in the small network design? |
| A8: | ip audit name IDSinfo action alarmip audit name IDSattack action alarm drop resetip audit interface outside IDSip audit interface inside IDSip audit interface dmz IDS |
| 9: | What is the importance of the isakmp key command? |
| A9: | The isakmp key command defines the preshared key to be used by the specified peer in the command. |
