Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Datový list stáhnout pdf (Strana 55)

642-531

QUESTION 127

Which of the following represents the best description of a post-block ACL on an IDS blocking device?

A. ACL applied to a managed interface once an attack has been detected.

B. ACL entries applied to the end of the active ACL after blocking entries.

C. ACL used to block traffic on the inbound direction of a managed interface

D. ACL used to block traffic on the internal (trusted) interface of a managed device.

E. ACL used to block traffic on the external (untrusted) interface of a managed device

Answer: B

Explanation:

If you want to change the ACL generated by the Sensor, you can specify either Pre-block or Post-block ACLs.

The Pre-block ACL designates ACL entries that the Sensor should place in the beginning of the new ACL,

before the addition of any Sensor blocking, deny, entries for the addresses and, or connections being blocked.

The Post-block ACL designates ACL entries that the Sensor should place after the Sensor blocking entries.

QUESTION 128

Which type of ACL is allowed when implementing the Cisco IDS IP blocking feature pre-shun ACLs?

A. Named IP extended

B. Named IP standard

C. Numbered IPX standard

D. Numbered IPX extended

E. Named IPX extended

Answer: A

Explanation: A pre-block and post-block ACL must be an extended IP ACL, named or unnumbered. They

should be configured on the device Sensor block is configured for that interface/direction Cisco Secure

Intrusion Detection System 4 chap 15 page 15

QUESTION 129

Which type of ACL is allowed when implementing the Cisco IDS IP blocking feature using post-shun ACLs?

A. Numbered IP extended

B. Named IPX extended

C. Numbered IP standard

D. Numbered IPX standard

Answer: A

Explanation: Extended ACLs enable you to create fine-tuned filtering policies.

Reference:Cisco Secure Intrusion Detection System (Ciscopress) page 464

1 2 ... 50 51 52 53 54 55 56 57 58 59 60 ... 122 123

Žádné komentáře

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Datový list Strana 55