ccna 5.1 exam

ccna 5.1 exam.134 Chapter 5 Implementing Intrusion PreventionWhen dealing with network traffic, IPS devices tend to generate a large slack of alerts and other events. Large organizations need the right security personnel to analyze these behaviors and determine how IPS can better protect the network. In addition, examining these alerts also allows security operators to adjust the IPS and optimize its operation to meet the unique needs of the network.Incident Response PlanningIf a system on the network is subject to a security threat, then the appropriate response plan must be implemented. The threatened system must be able to be restored to the state it was in before the attack. It must first be determined if the threatened system has caused a loss of intellectual property or caused other systems on the network to be threatened.5.2.5.3 Using Cisco Configuration Expert to Monitor IPSAlthough the CLI can be used to configure an IPS deployment, it is simpler to use a graphical user interface (GUI)-based device manager. Many Cisco device management software solutions can be used to help administrators manage IPS solutions. Some of them provide locally managed IPS solutions, while others provide centrally managed solutions.GUI-based IPS device managers include the following.Cisco Configuration Expert: Cisco Configuration Expert is an ISR router GUI that can be used to manage IPS implementations. Cisco Configuration Expert allows administrators to control the CisocIOSIPS application on the interface, import and edit feature definition files (SDFs) from cisco.com, and configure a behavior so that when a threat is detected, CiscoIOSIPS can take that behavior.CiscoIPSManagerExpress(IME): CiscoIPS Manger Express is a 4" all-in-one IPS management application that provides deployment, monitoring, troubleshooting, and report generation for up to 10 IPS sensors. It also supports RSS fbed for most of the latest security intelligence. the device manager works specifically with Cisco IPS 4300 Series sensors. The Cisco IPS 4300 series sensors come with their own CiscoIPS Device Manager, which provides a GUIo for individual sensors.Cisco Security Manager: Cisco Security Manager can be used to manage multiple IPS sensors as well as other infrastructure devices. Cisco Security Manager supports automatic policy-based IPS sensor software and feature updates and includes another feature update wizard to allow simple viewing and editing prior to deployment.