Company XYZ wants to secure the data plane of their network. Which two technologies can be included in the security design? (Choose two.)
Answer(s): C,D
Data Plane Intrusion Detection (DAI) is a security technology that can be used to detect malicious traffic in the data plane of a network. DAI works by monitoring the traffic that is flowing through a network and looking for patterns that are indicative of malicious activity. If DAI detects malicious traffic, it can take action to block the traffic or to alert the network administrator.IP Source Guard is a security technology that can be used to prevent unauthorized devices from injecting traffic into a network. IP Source Guard works by checking the source IP address of a packet against a list of allowed addresses. If the source IP address is not found in the list of allowed addresses, then the packet is dropped.The other options are not as suitable for securing the data plane of a network. BEEP (Borderless Ethernet Edge Protocol) is a protocol that is used to manage the edge of a network. MPP (Multiprotocol Label Switching) is a technology that is used to encapsulate traffic and forward it across a network. CPPr (Cisco Packet Policing) is a technology that is used to limit the amount of traffic that a router can receive or transmit.
https://www.ciscopress.com/articles/article.asp?p=2928193&seqNum=4
A healthcare provider discovers that protected health information of patients was altered without patient consent. The healthcare provider is subject to HIPAA compliance and is required to protect PHI data. Which type of security safeguard should be implemented to resolve this issue?
Answer(s): D
According to the following link, answer 'C' is for implement procedures to regularly review records of information system activity, access logs and security incident tracking - not prevent it. Answer 'D' is for Implement policies and procedures to protect ePHI from improper alteration or destruction.
https://www.cisco.com/en/US/docs/solutions/Enterprise/Compliance/HIPAA/HIP_AppC.html#wp1085353
Which three items do you recommend for control plane hardening of an infrastructure device? (Choose three.)
Answer(s): A,C,F
A: SNMPv3: SNMPv3 is the latest version of the Simple Network Management Protocol (SNMP) and provides secure authentication and encryption for monitoring and managing network devices. It is recommended to use SNMPv3 for control plane security.C: Routing protocol authentication: Implementing authentication mechanisms, such as MD5 or SHA, for routing protocols helps ensure that only trusted devices can participate in the routing process. This helps prevent unauthorized devices from injecting false or malicious routing information.F: Control Plane Policing (CoPP): CoPP is a mechanism that allows you to control and prioritize traffic destined for the control plane of a network device. By applying policies to limit the rate and types of traffic allowed to reach the control plane, CoPP helps protect the control plane from resource exhaustion and denial-of-service (DoS) attacks.
https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html#anc54
What is a characteristic of a secure cloud architecture model?
Software-defined network segmentation (SDNS) is a technique that can be used to segment a cloud environment into smaller, more isolated networks. This can help to improve security by reducing the attack surface and by making it more difficult for attackers to move laterally within the cloud environment.The other options are also important for securing a cloud architecture, but they are not as specific to SDNS. Multi-factor authentication (MFA) is a security measure that requires users to provide two or more pieces of identification to gain access to a system. Limited access to job function is a security measure that restricts users' access to only the resources that they need to do their jobs. Dedicated and restricted workstations are workstations that are physically isolated from other workstations and that have limited access to the network.
https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/scloud-aws-design-guide.pdf page 9
DRAG DROP (Drag and Drop is not supported)Drag and drop the design characteristics from the left onto the correct network filter techniques on the right. Not all options are used.
Answer(s): A
Post your Comments and Discuss Cisco 400-007 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 400-007 content, but please register or login to continue.