Which statement about IDS／IPS design is correct?()A. An IPS should be deployed if the security policy does not support the denial of traffic.B. An IPS analyzes a copy of the monitored traffic and not the actual forwarded packet.C. An IDS analyzes a copy o

第1题：

第2题：

IPS与IDS的区别是（）

• A、IDS是1种检测技术，IPS是一种阻断技术
• B、IDS并联在网络上的设备，IPS是串接在网络上的设备
• C、IPS属于审计类产品；IDS属于访问控制类产品
• D、IPS会检测并主动防御。而IDS却只会检测然后交由防火墙处理

正确答案:A,B,D

第3题：

Which statement about IDS/IPS design is correct?（）

• A、An IPS should be deployed if the security policy does not support the denial of traffic.
• B、An IPS analyzes a copy of the monitored traffic and not the actual forwarded packet.
• C、An IDS analyzes a copy of the monitored traffic and not the actual forwarded packet.
• D、Bandwidth considerations must be taken into account since IDS is deployed inline to traffic flow.

正确答案:C

第4题：

关于IDS和IPS，说法正确的是（）

• A、IDS部署在网络边界，IPS部署在网络内部
• B、IDS适用于加密和交换环境，IPS不适用
• C、用户需要IDS日志定期查看，IPS不需要
• D、IDS部署在网络内部，IPS部署在网络边界

正确答案:D

第5题：

Which statement about an IPS is true？（）

• A、The IPS is in the traffic path.
• B、Only one active interface is required.
• C、Full benefit of an IPS will not be realized unless deployed in conjunction with an IDS.
• D、When malicious traffic is detected，the IPS will only send an alert to a management station.

正确答案:A

第6题：

Which statement is correct about the use of the virtual interface on a WLC ？（）

• A、 Used to relay DHCP messages
• B、 Used to communicate with LAPs
• C、 Used to bring up LWAPP tunnels
• D、 Used to extend into the wireless client VLAN

正确答案:A

第7题：

Which key method is used to detect and prevent attacks by use of IDS and/or IPS technologies？（）

• A、Signature-based detection
• B、Anomaly-based detection
• C、Honey pot detection
• D、Policy-based detection

正确答案:A

第8题：

IPS与IDS的职责都是保证网络安全，IPS注重接入控制，而IDS则进行网络监测。

正确答案:错误

第9题：

第10题：

第11题：

第12题：

第13题：

第14题：

As a critical part of the design for the Enterprise Campus network， which of the following two aretrue concerning intrusion detection and prevention solution？ （）

• A、 IDS is capable of both inline and promiscuous monitoring， while IPS is only capable ofpromiscuous monitoring
• B、 IDS will stop malicious traffic from reaching its intended target for certain types of attacks.
• C、 IPS processes information on Layer 3 and 4 as well as analyzing the contents and payload ofthe packets for more sophisticated embedded attacks （Layers 3 to 7）
• D、 IPS inspects traffic statefully and needs to see both sides of the connection to function properly
• E、 IDS placement at the perimeter of Data Center outside the firewall generates many warningsthat have relatively low value because no action is likely to be taken on this information

正确答案:C,E

第15题：

Which two statements about an IDS are true？（）

• A、The IDS is in the traffic path.
• B、The IDS can send TCP resets to the source device.
• C、The IDS can send TCP resets to the destination device.
• D、The IDS listens promiscuously to all traffic on the network.
• E、Default operation is for the IDS to discard malicious traffic.

正确答案:B,D

第16题：

Which statement about data center access layer design modes is correct?（）

• A、The access layer is the first oversubscription point in a data center design.
• B、When using a Layer 2 loop-free design, VLANs are extended into the aggregation layer.
• C、When using a Layer 2 looped design, VLANs are not extended into the aggregation layer.
• D、When using a Layer 3 design,stateful services requiring Layer 2 connectivity are provisioned from the aggregation layer.
• E、The data center access layer provides the physical-level connections to the server resources and only operates at Layer 3.

正确答案:A

第17题：

Which two statements describe the functions and operations of IDS and IPS systems？（）

• A、A network administrator entering a wrong password would generate a true-negative alarm.
• B、A false positive alarm is generated when an IDS/IPS signature is correctly identified.
• C、An IDS is significantly more advanced over IPS because of its ability to prevent network attacks.
• D、Cisco IDS works inline and stops attacks before they enter the network.
• E、Cisco IPS taps the network traffic and responds after an attack.
• F、Profile-based intrusion detection is also known as "anomaly detection".

正确答案:B,F

第18题：

In a base e-Commerce module design, which routing statement is correct?（）

• A、Routing is mostly static.
• B、Hardcoded IP addresses are used to support failover.
• C、Inbound servers use the CSM or ACE as the default gateway.
• D、VLANs between the access layer switches are used for FHRP protocols.

正确答案:A

第19题：

Which statement about PPPoA configuration is correct？（）

• A、The dsl operating-mode auto command is required if the default mode has been changed
• B、The ip mtu 1496 command must be applied on the dialer interface
• C、The encapsulation ppp command is required
• D、The ip mtu 1492 command must be applied on the dialer interface

正确答案:A

第20题：

Which statement is correct about a Routing Policy term?（）

• A、A term must contain a "from" statement.
• B、A term acts like "if" and "then" statements.
• C、The most specific term has precedence.
• D、Terms can be written in any order to achieve the same behavior.

正确答案:B

第21题：

第22题：

第23题：

第24题：