Distributed Denial of Service (DDoS) attacks are broadly classified into three main categories based on the network layer they target. Volume-based (or volumetric) attacks aim to consume all available bandwidth between the target and the internet. Protocol attacks focus on consuming the processing capacity of network infrastructure components like firewalls or load balancers by exploiting vulnerabilities in Layer 3 and Layer 4 protocols. The third category, not listed as an option, is application-layer attacks, which target specific application vulnerabilities.

A. sequential: This term describes a pattern or order of events, not a recognized category of DDoS attacks.

C. database: A database is a potential target of an application-layer DDoS attack, but it is not a fundamental attack category itself.

E. screen-based: This is not a standard term used in the classification of network security attacks like DDoS.

1. Cisco. (n.d.). What Is a Distributed Denial-of-Service (DDoS) Attack? Cisco. Retrieved from Cisco's public documentation. In the section "Common types of DDoS attacks

" the document explicitly lists the three main categories: "The most common types of DDoS attacks are: Volumetric attacks... Protocol attacks... Application layer attacks." This directly supports the selection of 'volume-based' and 'protocol' as correct categories.

2. Radware. (2013). DDoS Attack Types. In The Ultimate Guide to DDoS Attack Types

Motivations

and Mitigation Methods (p. 4). Radware Security. This document

often referenced in security curricula

outlines the three primary attack vectors: "Volume Based Attacks

" "Protocol Attacks

" and "Application Layer Attacks."

3. MIT OpenCourseWare. (2014). Lecture 15: Network Security & Denial of Service. In 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology. The lecture notes discuss various DoS attacks that fall into the protocol (e.g.

SYN flooding) and volumetric (e.g.

amplification attacks) categories

establishing these as fundamental classifications in an academic context.

:

Multifactor authentication (MFA) is an authentication method that requires the user to provide two

or more verification factors to gain access to a resource such as an application, online account, or a

VPN1. MFA is a core component of a strong identity and access management (IAM) policy. MFA can

help prevent an attacker from stealing usernames and passwords of users within an organization by

adding an extra layer of security beyond the traditional username and password. For example, a user

may need to enter a one-time code sent to their phone or email, scan their fingerprint, or use a

hardware token to prove their identity. This way, even if an attacker obtains the user’s credentials,

they cannot access the resource without the second factor2.

The other options are not technologies that can help prevent an attacker from stealing usernames

and passwords of users within an organization. RADIUS-based REAP is a protocol that allows wireless

clients to authenticate with a RADIUS server, but it does not provide MFA3. Fingerprinting is a

technique that identifies the operating system or application of a device based on its network

characteristics, but it does not provide MFA4. Dynamic ARP Inspection is a security feature that

prevents ARP spoofing attacks by validating ARP packets, but it does not provide MFA5.

Reference := 1: What is Multi-Factor Authentication (MFA)? |

OneLogin(https://www.onelogin.com/learn/what-is-mfa) 2: What is: Multifactor Authentication -

Microsoft Support(https://support.microsoft.com/en-us/topic/what-is-multifactor-authenticatione5e39437-121c-be60-d123-eda06bddf661) 3: Implementing and Operating Cisco Security Core

Technologies (SCOR) v1.0, Module 3: Securing the Network, Lesson 3.3: Secure Wireless Connectivity,

Topic 3.3.1: Wireless Security Protocols, page 3-40. 4: Implementing and Operating Cisco Security

Core Technologies (SCOR) v1.0, Module 2: Securing the Cloud, Lesson 2.2: Cloud Security

Assessment, Topic 2.2.1: Cloud Security Concepts, page 2-13. 5: Implementing and Operating Cisco

Security Core Technologies (SCOR) v1.0, Module 3: Securing the Network, Lesson 3.2: Secure

Network Access, Topic 3.2.2: Layer 2 Security Features, page 3-19.

According to the NIST 800-145 guide1, a community cloud is a cloud infrastructure that is provisioned

for exclusive use by a specific community of consumers from organizations that have shared concerns

(e.g., mission, security requirements, policy, and compliance considerations). It may be owned,

managed, and operated by one or more of the organizations in the community, a third party, or some

combination of them, and it may exist on or off premises. A community cloud differs from a private

cloud, which is provisioned for exclusive use by a single organization, and a public cloud, which is

provisioned for open use by the general public. A hybrid cloud is a composition of two or more

distinct cloud infrastructures (private, community, or public) that remain unique entities, but are

bound together by standardized or proprietary technology that enables data and application

portability (e.g., cloud bursting for load balancing between clouds). Reference := 1: NIST SP 800-145,

The NIST Definition of Cloud Computing, page 3.

Asymmetric encryption, also known as public-key cryptography, is a type of encryption that uses a

pair of keys to encrypt and decrypt data. The pair of keys includes a public key, which can be shared

with anyone, and a private key, which is kept secret by the owner. In asymmetric encryption, the

sender uses the recipient’s public key to encrypt the data. The recipient then uses their private key to

decrypt the data. This approach allows for secure communication between two parties without the

need for both parties to have the same secret key. RSA is one of the most commonly used

asymmetric encryption algorithms. It is based on the mathematical problem of factoring large

numbers, which is believed to be hard to solve. RSA stands for Rivest-Shamir-Adleman, the names of

the three inventors of the algorithm. RSA can be used for both encryption and digital signatures. To

generate an RSA key pair, the following steps are performed:

Choose two large prime numbers, p and q, and compute their product, n = pq. This is called the

modulus.

Choose a small number, e, that is relatively prime to (p-1)(q-1). This is called the public exponent.

Compute a number, d, that satisfies the equation ed ≡ 1 (mod (p-1)(q-1)). This is called the private

exponent.

The public key is (n, e) and the private key is (n, d).

To encrypt a message, m, with the public key (n, e), the following formula is used:

c = m^e mod n

To decrypt a ciphertext, c, with the private key (n, d), the following formula is used:

m = c^d mod n

Reference :=

[Implementing and Operating Cisco Security Core Technologies (SCOR) v1.0], Module 3: VPN

Technologies, Lesson 3.1: Site-to-Site VPNs, Topic 3.1.2: IPsec VPNs

What is Asymmetric Encryption? - GeeksforGeeks

What is asymmetric encryption? | Asymmetric vs. symmetric … - Cloudflare

Cisco Container Platform (CCP) is a security product that enables administrators to deploy

Kubernetes clusters in air-gapped sites without needing Internet access. CCP tenant images contain

all the necessary binaries and don’t need internet access to function. CCP also supports offline

installation and updates of the platform components. CCP is designed to simplify the deployment

and management of containerized applications across hybrid cloud environments, while ensuring

security and compliance. CCP integrates with Cisco security solutions such as Cisco Tetration and

Cisco Stealthwatch Cloud to provide visibility and protection for Kubernetes clusters and workloads.

CCP also leverages Cisco Intersight, a cloud-based management platform, to provide centralized

monitoring and automation for CCP clusters. Reference:

Cisco Container Platform

350-701 SCOR Cisco CCNP Security Updated Questions in April

SHA-1 (Secure Hash Algorithm 1) is a hashing algorithm used to generate a unique digest of a message. In VPNs (specifically IPsec), it is used within HMAC to verify that data has not been altered during transit, ensuring data integrity.

ISAKMP (Internet Security Association and Key Management Protocol) provides the framework for authentication and key exchange. It defines the procedures and packet formats to establish, negotiate, modify, and delete Security Associations (SAs), effectively defining IKE SAs.

AES (Advanced Encryption Standard) is a symmetric key encryption algorithm. It encrypts the data payload, rendering it unreadable to unauthorized users, which ensures data confidentiality.

RSA (Rivest-Shamir-Adleman) is an asymmetric algorithm often used for digital signatures. In the IKE phase, peers use RSA signatures to prove their identities to one another, providing authentication.

IETF RFC 2408, Internet Security Association and Key Management Protocol (ISAKMP), Section 1: "ISAKMP defines the procedures for authenticating a communicating peer, creation and management of Security Associations, key generation techniques, and threat mitigation."

NIST Special Publication 800-77 Rev. 1, Guide to IPsec VPNs, Section 2.2.1: Discusses how encryption algorithms like AES provide confidentiality. Section 2.2.2: Describes how hash functions (e.g., SHA) are used to provide data integrity.

Cisco Systems, IPsec Configuration Guide, "IKEv1 and IKEv2 Packet Exchange": Details the use of RSA signatures for the authentication method during IKE phase 1 negotiations.

Stallings, W., Cryptography and Network Security: Principles and Practice, 7th Edition, Pearson. Chapter 19 (IP Security): Explains the role of ISAKMP in defining the SA management and the use of HMAC-SHA for integrity.

Cisco Identity Services Engine (ISE) is a comprehensive identity and access control policy platform. It is specifically designed to provide centralized Authentication, Authorization, and Accounting (AAA) services. ISE meets all the requirements by functioning as a TACACS+ server for device administration (controlling access to network devices like routers and switches) and as a RADIUS server to enforce network access policies for users and endpoints using protocols such as 802.1X, MAC Authentication Bypass (MAB), and Web Authentication (WebAuth) for both wired and wireless networks.

A. Cisco Prime Infrastructure: This is a network management platform for monitoring and configuration, not a policy enforcement engine for AAA services like TACACS+ or 802.1X.

C. Cisco Stealthwatch: Now called Cisco Secure Network Analytics, this tool provides network visibility and threat detection using telemetry like NetFlow. It does not perform AAA functions.

D. Cisco AMP for Endpoints: Now called Cisco Secure Endpoint, this is an endpoint protection (EPP) and detection/response (EDR) solution focused on malware. It does not provide network access control.

---

1. Cisco Identity Services Engine (ISE) Data Sheet. Cisco. "Cisco ISE is a centralized solution that automates and simplifies secure access control... It provides: [...] Device administration (via TACACS+)

[...] IEEE 802.1X

MAC Authentication Bypass (MAB)

web authentication". This document explicitly lists both core functionalities required by the question.

Source: Cisco Identity Services Engine (ISE) Data Sheet

"Features and benefits" table.

2. Cisco Identity Services Engine Administrator Guide

Release 3.2. Cisco. "Device administration access service provides a policy framework for controlling access to the network devices... Cisco ISE uses the TACACS+ protocol for device administration." This confirms the TACACS+ capability. The guide also extensively covers configuring authentication and authorization policies for 802.1X

MAB

and WebAuth.

Source: Chapter: "Device Administration"

Section: "Device Administration Access Service" and Chapter: "Authentication"

Section: "Authentication Policies".

3. SCOR 350-701 Official Cert Guide. Cisco Press. "ISE is the Cisco solution for network access control (NAC) and is the main product that implements AAA for users and devices connecting to a network... ISE also supports TACACS+ for device administration."

Source: Chapter 21

"Cisco Identity Services Engine (ISE)"

Section: "ISE Fundamentals".

Advanced Malware Protection (AMP) is specifically designed to detect, block, and remediate malware, including zero-day attacks, through continuous analysis. Full Context Awareness aggregates data on users, devices, applications, and operating systems, providing the visibility necessary to create and enforce granular security policies. Collective Security Intelligence (powered by Cisco Talos) provides the system with real-time updates on global threat intelligence (IP, URL, and domain reputation) to block attacks proactively. Finally, the Next-Generation Intrusion Prevention System (NGIPS) utilizes this context and intelligence to provide comprehensive threat prevention and mitigation against both known exploits and unknown vulnerabilities.

Cisco Systems. (2015). Cisco ASA with Firepower Services Data Sheet. Retrieved from Cisco.com. (Section: "Features and Benefits", specifically Table 1 which maps features like "Full Context Awareness" to visibility/policy enforcement and "AMP" to malware remediation).

Cisco Systems. Cisco Firepower Management Center Configuration Guide, Version 6.0. "Chapter: Security Intelligence and Content Blocking". (Discusses the role of Collective Security Intelligence in real-time threat blocking).

Cisco Systems. Cisco ASA with Firepower Services - At-a-Glance. (Explicitly links NGIPS to comprehensive threat prevention and AMP to malware remediation).

Next Generation Intrusion Prevention System (NGIPS): Cisco defines its NGIPS capabilities as providing "superior threat prevention and mitigation" by leveraging contextual awareness to detect both known exploits and unknown (zero-day) threats.

Advanced Malware Protection (AMP): AMP is distinguished by its "retrospective security" capabilities. The keywords "tracking," "analysis," and "remediation" (specifically the ability to fix issues after a file enters the network) are unique to AMP's "before, during, and after" attack continuum.

Application Control and URL Filtering: This technology (often part of AVC) operates at the "application-layer," allowing administrators to enforce policies on specific "custom applications and URLs" rather than just ports or IP addresses.

Cisco Web Security Appliance (WSA): The WSA is a dedicated "web protection" gateway. The description "combined integrated solution... of web protection" directly describes the WSA's role in securing web traffic with visibility and control.

Cisco Systems. (2015). Cisco ASA with Firepower Services Data Sheet. Cisco.com. (Section: "Product Overview", Table 1 features the exact phrase "Superior threat prevention and mitigation for known and unknown threats" and "Detection, blocking, tracking, analysis, and remediation" for AMP).

Cisco Systems. (2020). Cisco Web Security Appliance Data Sheet. Cisco.com. (Describes the WSA as an "all-in-one web security gateway" providing defense, visibility, and control).

Cisco Systems. Firepower Management Center Configuration Guide, Version 6.0. (Chapter: "Access Control Policies", specifically discussing "Application Visibility and Control (AVC)" and "URL Filtering" for application-layer enforcement).