CCIE Security
Domain 1Objective 7
1.7 Detect and Mitigate Common Types of Attacks CCIE-SECURITY Practice Questions (Page 12)
Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)
59questions here
12free pages
10concepts
20%of the exam
Questions 56–59
- 56
A company's web server is under a SYN flood attack, where the attacker sends a high rate of TCP SYN packets with spoofed source IPs. The server's connection table is filling up, causing legitimate connections to be dropped. Which mitigation technique would be MOST effective in preventing the server from being overwhelmed?
Select an answer first - 57
An IDS is missing attacks that use HTTP requests with encoded characters, such as %2e%2e for '..' in a path traversal attempt. The IDS is configured to inspect HTTP payloads but does not decode URL-encoded characters. Which configuration change would improve detection of these evasion attempts?
Select an answer first - 58
A network administrator is concerned about ARP spoofing attacks on the LAN. The switches are manageable and support DHCP snooping. Which combination of features should be enabled to prevent ARP spoofing?
Select an answer first - 59
A security analyst is reviewing firewall logs and notices that a single internal host is sending a large volume of DNS queries to an external server, but the queries are for random, non-existent domains. The analyst suspects the host is part of a botnet using DNS as a covert channel. Which action would be MOST effective in disrupting the botnet's communication?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to CCIE-SECURITY
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.