2.5 Describe CIS Benchmarks for Hardening Devices Such as Cisco Secure Firewall (FTD) and Cisco IOS XE 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security manager is evaluating whether to adopt CIS Benchmarks for the organization's network devices. The manager is concerned that the benchmarks may be too rigid and not applicable to the organization's specific needs. What is the best response to this concern?

   • ACIS Benchmarks must be implemented exactly as written to be effective
   • BCIS Benchmarks are only applicable to specific industries
   • CCIS Benchmarks are flexible guidelines that can be tailored to the organization's requirements
   • DCIS Benchmarks are too complex for most organizations to implement
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   According to CIS Benchmark guidance for Cisco IOS XE, which action is recommended to reduce the attack surface of a device?

   • ADisabling unused services and interfaces
   • BEnabling all available services to ensure full functionality
   • CEnabling services only when needed and leaving them on permanently
   • DKeeping all services enabled but restricting them with ACLs
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security engineer is hardening a Cisco FTD device according to the CIS Benchmark. The engineer needs to ensure that the data plane is protected against common attacks. Which configuration aligns with the CIS Benchmark recommendation for the data plane?

   • ADisable the data plane entirely and route all traffic through the management interface
   • BEnable IP source routing to allow flexible traffic engineering
   • CDisable TCP sequence number randomization to improve performance
   • DEnable TCP sequence number randomization and disable IP source routing
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security consultant is advising a company that wants to standardize the configuration of its network devices. The company operates a mixed environment of Cisco FTD firewalls and IOS XE routers. The consultant recommends using CIS Benchmarks as the basis for the hardening standard. What is the primary reason CIS Benchmarks are suitable for this purpose?

   • AThey are specific to Cisco devices and cannot be applied to other vendors
   • BThey are mandatory regulatory requirements that must be implemented exactly as written
   • CThey guarantee complete security against all known attacks when fully implemented
   • DThey provide vendor-neutral, consensus-based configuration guidelines that can be adapted to the organization's needs
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a key CIS Benchmark recommendation for hardening the management plane of a Cisco Secure Firewall (FTD) device?

   • AAllowing management access from any source to simplify administration
   • BDisabling all logging to reduce the attack surface
   • CRestricting management access to specific source IP addresses and enforcing strong authentication
   • DEnabling all management protocols to ensure maximum flexibility
   Reveal Solution Discussion Select an answer first