2.5 Describe CIS Benchmarks for Hardening Devices Such as Cisco Secure Firewall (FTD) and Cisco IOS XE 350-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In a CIS Benchmark document, what is the purpose of the 'Level 1' and 'Level 2' profile designations?

   • ALevel 1 is for small businesses, while Level 2 is for large enterprises
   • BLevel 1 defines baseline security settings that are easy to implement, while Level 2 defines more stringent settings for high-security environments
   • CLevel 1 applies to hardware devices, while Level 2 applies to software-based devices
   • DLevel 1 requires all recommendations to be implemented, while Level 2 allows for exceptions
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is applying CIS Benchmark recommendations to a Cisco FTD device. The team wants to ensure that only authorized administrators can access the device. Which configuration should be implemented?

   • AConfigure only local user accounts with no fallback to AAA
   • BConfigure AAA with TACACS+ or RADIUS for centralized authentication and authorization
   • CDisable authentication and rely on network segmentation for protection
   • DUse a shared local password for all administrators to simplify management
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reading the CIS Benchmark for Cisco IOS XE. The analyst notices that some recommendations are marked as 'Level 2' while others are 'Level 1'. The analyst is working in a standard enterprise environment without strict regulatory requirements. Which recommendations should the analyst prioritize for implementation?

   • AAll recommendations, regardless of level, to ensure maximum security
   • BOnly the recommendations in the 'Introduction' section
   • CLevel 1 recommendations, which provide a baseline security posture with minimal operational impact
   • DLevel 2 recommendations, which provide the highest level of security
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which command on a Cisco IOS XE device would be used to verify that Telnet is disabled on the VTY lines?

   • Ashow ip interface brief
   • Bshow version
   • Cshow running-config | include transport input
   • Dshow ip route
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   According to CIS Benchmark guidance for Cisco FTD, which practice is recommended for securing the data plane?

   • AImplementing access control policies that follow the principle of least privilege
   • BUsing the same access policy for all interfaces to simplify configuration
   • CAllowing all traffic by default and relying on external devices for filtering
   • DDisabling the firewall's inspection engines to improve performance
   Reveal Solution Discussion Select an answer first