All practice questions

Question 181Question →

Match each OSPFv2 network configuration or interface state on the left with its correct DR/BDR election behavior and timer trait on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Broadcast Network Type pairs with electing a DR/BDR using 10s/40s timers; Point-to-Point Network Type pairs with forming direct adjacencies without DR/BDR election using 10s/40s timers; Interface OSPF Priority set to 0 pairs with rendering the router interface completely ineligible for DR/BDR election.

Each OSPF network type has specific rules regarding DR/BDR elections and default timers. Broadcast networks elect DR/BDRs and use 10s/40s timers. Point-to-Point networks bypass DR/BDR elections entirely while sharing the 10s/40s timer defaults. Setting interface priority to 0 explicitly revokes DR/BDR eligibility.

Step-by-Step Solution

1

Analyze OSPF Broadcast media characteristics.

Broadcast networks (like Ethernet) require DR and BDR election to reduce adjacencies on multiaccess segments, operating with 10s Hello and 40s Dead timers.

Broadcast multiaccess segments require a central Designated Router to handle LSA flooding.

2

Evaluate Point-to-Point OSPF network behavior.

Point-to-point links only connect two devices, so no DR/BDR election is needed, though 10s Hello and 40s Dead timers are still used.

DR/BDR election is unnecessary when only two routers share the link.

3

Determine the impact of setting OSPF interface priority to 0.

Setting the priority to 0 disqualifies the router interface from becoming DR or BDR.

Cisco IOS uses priority 0 specifically to keep lower-capacity routers in DROTHER state.

Key Concept

OSPFv2 Network Types and DR/BDR Selection Criteria

Question 182Question →

Match each OSPFv2 network type or interface state on the left with its correct DR/BDR election requirement and default timer characteristics on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Broadcast Multiaccess maps to electing DR/BDR with 10s/40s timers; Point-to-Point maps to no DR/BDR with 10s/40s timers; Interface priority 0 maps to election ineligibility (DROTHER); Point-to-Multipoint maps to no DR/BDR with 30s/120s timers.

Each OSPF interface network type specifies whether DR/BDR elections are held and sets default Hello/Dead timers. Broadcast Ethernet networks elect DR/BDR with 10s/40s timers. Point-to-Point links bypass DR/BDR elections with 10s/40s timers. Setting priority to 0 on a broadcast interface retains standard timers but prevents DR/BDR election. Point-to-Multipoint skips DR/BDR elections and uses 30s/120s default timers.

Step-by-Step Solution

1

Analyze OSPF election requirements per network type

Broadcast networks elect DR/BDR; Point-to-Point and Point-to-Multipoint networks do not elect DR/BDR.

DR/BDR election is only required on multiaccess media (Broadcast and Non-Broadcast) to reduce link-state packet duplication.

2

Determine interface priority impact

Setting priority to 0 makes a router ineligible to become DR or BDR regardless of router ID.

OSPF interface priority ranges from 0 to 255, where 0 explicitly prevents candidacy.

3

Evaluate default Hello and Dead timers for each network type

Broadcast and Point-to-Point default to 10s/40s, while Point-to-Multipoint defaults to 30s/120s.

Non-broadcast and point-to-multipoint OSPF network types assume slower WAN links and use 30-second Hello / 120-second Dead timer defaults.

Key Concept

OSPFv2 DR/BDR election rules and default timer intervals vary according to the interface network type and priority setting.

Question 183Question →

Match each OSPFv2 network type configuration on the left with its corresponding DR/BDR election requirement and default Hello/Dead timer characteristics on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Broadcast pairs with DR/BDR elected automatically with 10s/40s timers. Point-to-Point pairs with no DR/BDR election and 10s/40s timers. Point-to-Multipoint pairs with no DR/BDR election and 30s/120s timers. Non-Broadcast pairs with DR/BDR elected using manual neighbor statements and 30s/120s timers.

Each OSPF network type has distinct rules regarding whether DR/BDR elections occur, whether multicast is used for neighbor discovery, and which default timers apply. LAN-oriented types (Broadcast and Point-to-Point) use 10-second Hello and 40-second Dead timers, while WAN-oriented types (Point-to-Multipoint and Non-Broadcast) use 30-second Hello and 120-second Dead timers. Multiaccess types (Broadcast and Non-Broadcast) perform DR/BDR elections, whereas point-to-point styles (Point-to-Point and Point-to-Multipoint) bypass DR/BDR elections entirely.

Step-by-Step Solution

1

Analyze election requirements for multiaccess vs. point-to-point network types.

Broadcast and Non-Broadcast networks require DR/BDR elections because multiple routers share the medium. Point-to-Point and Point-to-Multipoint networks do not elect DR/BDRs.

DR/BDR selection reduces adjacency formation overhead from

n(n-1)/2

to

2n-3

on multiaccess segments.

2

Analyze neighbor discovery mechanisms (multicast vs. unicast).

Broadcast, Point-to-Point, and Point-to-Multipoint use multicast (

224.0.0.5

). Non-Broadcast multiaccess requires manual unicast neighbor definition via the `neighbor` command.

NBMA media do not natively support broadcast or multicast traffic.

3

Evaluate default OSPFv2 Hello and Dead timers for each network type.

LAN types (Broadcast, Point-to-Point) default to 10s Hello / 40s Dead. WAN types (Point-to-Multipoint, Non-Broadcast) default to 30s Hello / 120s Dead.

Slower WAN links require higher timer tolerances to avoid unnecessary neighbor flap state transitions.

Key Concept

OSPFv2 Network Types, DR/BDR Election Requirements, and Default Timers

Estimated Time:2m 0s

Question 184Question →

Match each IPv4 routing table entry from a Cisco IOS 'show ip route' display to its correct protocol source classification and administrative properties.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each routing table entry matches its corresponding protocol code, administrative distance, and metric: 'D' maps to Internal EIGRP (AD 90), 'O' maps to OSPF (AD 110), 'S' maps to Static (AD 1), and 'C' maps to Directly Connected (AD 0).

Routing table entries display their learning source code followed by the prefix, bracketed administrative distance and metric values [AD/Metric], next-hop IP, and outgoing interface. Code D identifies EIGRP (default AD 90), code O identifies OSPF (default AD 110), code S identifies Static routes (default AD 1), and code C identifies Connected networks (AD 0).

Step-by-Step Solution

1

Identify the protocol code prefix at the start of each routing entry.

D corresponds to EIGRP, O corresponds to OSPF, S corresponds to Static, and C corresponds to Connected.

Cisco IOS routing tables use single-letter prefix codes to identify how each route was learned.

2

Parse the bracketed values [Administrative Distance / Metric] for dynamically learned and static routes.

The first number inside brackets represents Administrative Distance (AD), and the second number represents the protocol metric.

AD measures route source trustworthiness while metric determines path preference within the protocol.

3

Match each entry to its exact functional description based on AD and metric values.

Entry with code D matches EIGRP (AD 90), entry with code O matches OSPF (AD 110), entry with code S matches Static (AD 1), and entry with code C matches Directly Connected (AD 0).

Each routing protocol has standard default administrative distance values recognized by Cisco IOS.

Key Concept

Routing Table Components and Source Codes

Question 185Question →

Match each OSPFv2 network type or election property on the left to its corresponding default operation or behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Broadcast Multiaccess matches electing a DR/BDR with 10s/40s timers; Point-to-Point matches forming adjacencies without DR/BDR election with 10s/40s timers; Interface Priority 0 matches excluding the router from DR elections; Equal Priority Tie-Breaker matches using the highest Router ID.

Each OSPF network type operates with specific election rules and default timers under standard Cisco OSPFv2 behavior: Broadcast multiaccess requires a DR/BDR with 10-second Hello timers; Point-to-Point bypasses DR selection with 10-second Hello timers; priority 0 excludes a device from election; and highest Router ID breaks priority ties.

Step-by-Step Solution

1

Determine which OSPFv2 network types perform DR/BDR election.

Broadcast multiaccess networks elect DR/BDR, whereas Point-to-Point networks bypass DR/BDR election.

DR/BDR selection is only required on multiaccess media to minimize full mesh neighbor adjacencies.

2

Evaluate the impact of configuring an interface priority of 0.

The router interface is disqualified from DR and BDR elections.

An interface priority value of 0 explicitly instructs OSPF to keep the interface in DROTHER status regardless of Router ID.

3

Identify the deterministic tie-breaker for DR elections when priorities match.

The router with the highest OSPF Router ID is elected.

OSPF DR election precedence evaluates interface priority first, followed by the highest Router ID.

Key Concept

OSPFv2 Network Types and DR/BDR Selection Rules

Question 186Question →

Match each Cisco IOS IPv4 routing table entry component to its correct functional definition or metric descriptor.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Administrative Distance matches the measure of route source trustworthiness; Routing Metric matches the path cost calculated by a specific protocol; Next-Hop Address matches the IPv4 address of the adjacent router interface; Prefix Length matches the subnet mask specifier in CIDR notation used for longest prefix match.

Each entry component in a Cisco IOS routing table plays a distinct role: Administrative Distance measures source believability (0-255), Routing Metric determines the best path within a specific routing protocol, the Next-Hop Address defines the adjacent router's interface IP for forwarding, and the Prefix Length dictates how many bits match the destination address during lookup.

Step-by-Step Solution

1

Analyze Administrative Distance (AD)

AD evaluates protocol trustworthiness (e.g., lower AD is preferred when different protocols report the same prefix).

It allows Cisco IOS to prioritize route sources.

2

Analyze Routing Metric

Metric measures path desirability within a single routing protocol.

It acts as a tie-breaker when multiple paths exist within the same protocol.

3

Analyze Next-Hop Address

Next-hop represents the forwarding neighbor's IP interface.

It tells the router where to transmit layer 3 packets.

4

Analyze Prefix Length

Prefix length defines the network mask.

It is used by the forwarding engine during longest prefix matching.

Key Concept

Interpretation of Routing Table Components and Attributes

Question 187Question →

Match each core network security term on the left with its corresponding enterprise security description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Vulnerability pairs with the unpatched operating system bug; Threat pairs with the malicious external actor; Exploit pairs with the crafted software script taking advantage of a flaw; Risk pairs with the likelihood and impact of an intrusion.

Vulnerability refers to a system flaw such as an unpatched OS bug. Threat describes the danger agent such as a malicious actor. Exploit is the actual method or script used to weaponize the flaw. Risk measures the calculated financial or operational impact resulting from a threat leveraging a vulnerability.

Step-by-Step Solution

1

Review the formal definitions of key security terminology.

Differentiate between systemic weaknesses (vulnerability), external dangers (threat), attack tools (exploit), and calculated impact (risk).

CCNA security fundamentals require distinguishing between internal weaknesses, external danger vectors, attack implementations, and business exposure.

2

Match each term to the enterprise scenario.

Pair Vulnerability to the OS bug, Threat to the attacker, Exploit to the attack script, and Risk to the impact assessment.

Each scenario illustrates a distinct element of the risk and threat landscape.

Key Concept

Key Security Concepts: Threat, Vulnerability, Exploit, and Risk

Estimated Time:1m 0s

Question 188Question →

Match each OSPFv2 network type or interface configuration on the left to its corresponding election behavior and default timer characteristics on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Broadcast Multiaccess matches electing DR/BDR with 10s/40s timers; Point-to-Point matches suppressing DR/BDR election with 10s/40s timers; Interface priority 0 matches disqualifying from DR/BDR election; Non-Broadcast matches electing DR/BDR with 30s/120s timers.

Broadcast multiaccess interfaces use 10s/40s timers and elect a DR/BDR. Point-to-Point interfaces use 10s/40s timers but suppress DR/BDR elections. Configuring priority 0 explicitly disqualifies an interface from election eligibility. Non-Broadcast interfaces elect a DR/BDR but use 30s/120s timers by default.

Step-by-Step Solution

1

Determine DR/BDR election requirements for each network type.

Broadcast Multiaccess and Non-Broadcast networks require DR/BDR elections to manage multiaccess adjacencies, while Point-to-Point interfaces bypass DR/BDR elections completely.

Direct peer-to-peer topologies do not suffer from the

N(N-1)/2

adjacency scaling problem of multiaccess media.

2

Evaluate default Hello and Dead timers for OSPF network types.

Broadcast and Point-to-Point network types use 10-second Hello and 40-second Dead timers. Non-Broadcast (NBMA) networks use 30-second Hello and 120-second Dead timers.

NBMA interfaces default to longer timers to account for WAN link characteristics.

3

Analyze the role of interface priority zero in DR/BDR selection.

An interface assigned a priority value of 0 is ineligible for election to DR or BDR status.

A priority value of 0 acts as an explicit override to prevent a router interface from becoming DR or BDR regardless of Router ID.

Key Concept

OSPFv2 Network Types, DR/BDR Selection Rules, and Default Timers

Question 189Question →

Match each SNMP component or operational term on the left with its correct defining characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SNMP Trap matches the unacknowledged notification on UDP port 162; SNMP Inform matches the acknowledged notification requiring response; MIB matches the hierarchical database of OIDs; SNMPv3 authPriv matches the security level providing authentication and encryption.

Each SNMP term correctly maps to its defining operational characteristic. Traps provide unacknowledged alerts on UDP port 162, Informs provide acknowledged alerts, MIB represents the OID database structure, and SNMPv3 authPriv combines authentication with encryption.

Step-by-Step Solution

1

Identify the transmission mechanics of SNMP notifications

Traps are unacknowledged notifications sent on UDP 162, while Informs use acknowledgments for reliable delivery.

Traps rely on best-effort UDP transmission, whereas Informs guarantee receipt via NMS confirmation messages.

2

Identify data structure definitions in SNMP

The MIB defines all readable and writable objects on a managed device structured hierarchically using OIDs.

Network Management Systems query or modify specific OID paths defined within the MIB schema.

3

Evaluate SNMPv3 security levels

authPriv stands for authentication and privacy (encryption).

Unlike noAuthNoPriv (no security) or authNoPriv (authentication without encryption), authPriv enforces both cryptographic verification and payload encryption.

Key Concept

SNMP Notification Types, MIB Structures, and Security Levels

Question 190Question →

Match each OSPFv2 interface scenario or configuration on the left to its corresponding election behavior or timer characteristics on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings are: 1) GigabitEthernet interface with 'ip ospf network point-to-point' matches 'Uses 10-second Hello / 40-second Dead timers and dynamically forms adjacencies without electing a DR or BDR.'; 2) Ethernet interface with 'ip ospf priority 0' matches 'Remains in the DROTHER state and is completely excluded from participating in DR/BDR elections regardless of Router ID.'; 3) Frame Relay main interface with default OSPF network type matches 'Defaults to Non-Broadcast (NBMA) mode using 30-second Hello / 120-second Dead timers and requires manual unicast neighbor statements.'; 4) Interface with priority 200 added to a segment with an active DR (priority 100) matches 'Does not preempt the operational DR upon initialization, assuming BDR or DROTHER status until an election event occurs.'

Each OSPF network type and interface parameter dictates distinct neighbor discovery methods, timer values, and election roles. Converting a broadcast interface to point-to-point maintains 10-second timers while removing DR/BDR election. Setting priority to 0 explicitly forces a DROTHER state. Default Frame Relay main interfaces employ NBMA mode with 30-second timers requiring unicast neighbor commands. Finally, introducing a high-priority router to a segment with an existing active DR honors OSPF's non-preemptive election rule.

Step-by-Step Solution

1

Analyze OSPF network type override on broadcast interfaces.

Configuring 'ip ospf network point-to-point' on a broadcast interface (such as GigabitEthernet) instructs OSPF to treat the link logically as point-to-point. This retains the 10/40 second timers but suppresses DR/BDR election.

Point-to-point interfaces only connect two routers, making DR/BDR election unnecessary.

2

Evaluate the effect of interface priority 0.

An OSPF interface priority of 0 explicitly disqualifies the router interface from becoming a DR or BDR, locking its state into DROTHER.

Priority 0 is a reserved value designed specifically to prevent specific routers from taking on DR/BDR responsibilities.

3

Determine default behavior on Non-Broadcast Multi-Access (NBMA) media.

Frame Relay main interfaces default to the Non-Broadcast (NBMA) OSPF network type, which has 30-second Hello / 120-second Dead timers and does not send multicast Hello packets.

NBMA interfaces support multiple access without native broadcast/multicast capability, requiring static unicast neighbor configuration.

4

Analyze non-preemptive DR/BDR election mechanics.

When a router boots or connects to an existing multi-access network with an established DR, it accepts the existing DR and BDR regardless of its own interface priority.

DR/BDR elections in OSPF are non-preemptive to maintain routing stability and prevent unnecessary adjacency updates.

Key Concept

OSPFv2 Network Types, Timers, Priority Exclusions, and Non-preemptive Election Behavior

Question 191Question →

Match each Cisco IPv4 routing table entry format on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

D 192.168.10.0/24 [90/2170112] matches the EIGRP-learned route description; O 10.1.1.0/24 [110/65] matches the OSPF-learned route description; C 172.16.1.0/24 matches the directly connected route description; S 0.0.0.0/0 [1/0] via 192.168.1.1 matches the static default route description.

Each routing table notation correctly matches its protocol source code ('D' for EIGRP, 'O' for OSPF, 'C' for connected, 'S' for static) and accurately decodes the bracketed administrative distance and metric values.

Step-by-Step Solution

1

Identify routing protocol source codes

Map 'D' to EIGRP, 'O' to OSPF, 'C' to Directly Connected, and 'S' to Static.

Cisco IOS routing tables use standard single-letter source codes to indicate route origins.

2

Interpret bracket notation [AD/Metric]

Extract administrative distance as the first value and route metric as the second value inside the brackets.

The bracketed syntax standardizes administrative distance (route trustworthiness) and metric (path cost).

3

Pair routing lines to functional descriptions

Match each left routing entry string with its corresponding description on the right.

Ensures all routing table components are correctly identified and defined.

Key Concept

Cisco IPv4 Routing Table Component Interpretation

Estimated Time:1m 30s

Question 192Question →

Match each SNMP term or operation on the left with its defining characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SNMP Trap pairs with the unacknowledged notification on UDP port 162; SNMP Inform pairs with the reliable notification requiring NMS acknowledgment; SNMP GetNext pairs with the operation to walk consecutive OID entries; MIB pairs with the hierarchical database structure of managed objects.

Each item correctly matches its defining operational characteristic: SNMP Traps are unacknowledged alerts on UDP port 162, SNMP Informs are acknowledged alerts ensuring reliable delivery, SNMP GetNext sequentially iterates through MIB OIDs, and the MIB is the structured database of all managed object definitions.

Step-by-Step Solution

1

Differentiate SNMP notification types based on delivery reliability.

Identify that SNMP Traps are fire-and-forget unacknowledged messages, while SNMP Informs require an explicit response packet from the SNMP manager.

Traps use UDP port 162 without delivery confirmation, whereas Informs store messages in memory until an acknowledgment is received.

2

Analyze SNMP manager request operations.

Identify that SNMP GetNext retrieves the next object instance in the MIB hierarchy.

GetNext allows traversal of structured data tables across an OID tree.

3

Define the role of the Management Information Base.

Recognize the MIB as the blueprint database defining object properties and OIDs.

The MIB organizes device data hierarchically so managers and agents speak a standardized variable namespace.

Key Concept

SNMP Operations, MIB Hierarchy, and Notification Delivery Mechanics

Question 193Question →

Match each enterprise network security threat on the left with its corresponding operational description or attack vector characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Distributed Denial of Service (DDoS) matches flooding resources from multiple distributed endpoints; Man-in-the-Middle (MitM) matches intercepting traffic in the active communication path; Spear Phishing matches targeted social engineering targeting specific individuals; Zero-Day Exploit matches attacking an undisclosed vulnerability before a patch exists.

Each security threat term is accurately mapped to its primary attack vector and operational impact within enterprise network environments.

Step-by-Step Solution

1

Analyze Distributed Denial of Service (DDoS)

Identified as a multi-source resource exhaustion attack targeting availability.

DDoS specifically leverages multiple distributed hosts to saturate network bandwidth or host processing capacity.

2

Analyze Man-in-the-Middle (MitM)

Identified as an active path insertion and packet interception attack.

MitM relies on tricking two endpoints into routing data through an adversary's host to eavesdrop or modify traffic.

3

Analyze Spear Phishing

Identified as a tailored social engineering vector.

Spear phishing differs from generic mass phishing by customizing content to deceive specific targeted individuals or organizations.

4

Analyze Zero-Day Exploit

Identified as an attack on unpatched, publicly unknown code vulnerabilities.

Zero-day refers to software flaws exploited prior to patch availability or public security advisory release.

Key Concept

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

Question 194Question →

Match each SNMP administrative requirement or operational workflow on the left with its corresponding SNMP version, message type, or transport characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Matching pairs: 1) Unsolicited acknowledged alert -> SNMP Inform Request, 2) Sequential MIB table traversal -> SNMP GetNext Operation, 3) Unacknowledged community-based notification -> SNMPv2c Trap, 4) Authentication and encryption model -> SNMPv3 authPriv Security Level.

Each match accurately reflects standard Cisco SNMP protocol behaviors: SNMP Informs require receiver acknowledgements via Response PDUs; SNMP GetNext requests iteratively traverse MIB instances sequentially; SNMPv2c Traps send unacknowledged alerts over UDP port 162 using community strings; and SNMPv3 authPriv enforces both authentication hashing and data encryption.

Step-by-Step Solution

1

Differentiate notification reliability mechanics.

Identify that Informs require explicit NMS acknowledgement via a Response PDU, whereas Traps are unacknowledged fire-and-forget notifications sent to UDP 162.

Relates the requirement for receiver verification to the SNMP Inform mechanism and unacknowledged delivery to SNMP Traps.

2

Analyze MIB polling operation types.

Recognize that walking or retrieving contiguous MIB variables without knowing explicit instance index values uses the GetNext PDU.

GetNext inspects the lexicographical MIB tree structure sequentially.

3

Evaluate SNMPv3 security model features.

Match the combination of message hashing (authentication) and payload encryption (privacy) directly to the authPriv security level.

SNMPv3 defines three security levels: noAuthNoPriv (none), authNoPriv (authentication only), and authPriv (both authentication and privacy encryption).

Key Concept

SNMP Messaging Mechanics, MIB Traversal, and SNMPv3 Security Models

Question 195Question →

Match each enterprise security threat scenario on the left with its most effective primary mitigation strategy on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Password Spray Attack matches Multi-Factor Authentication (MFA) and smart lockout policies. Man-in-the-Middle eavesdropping matches end-to-end cryptographic transport protocols (TLS/IPsec). Spear Phishing matches email authentication standards (SPF/DKIM/DMARC) and user training. Zero-Day software vulnerability matches vendor micro-segmentation, IPS signatures, and rapid patching.

Each threat targets a specific layer or operational vulnerability, requiring an aligned mitigation control: Password Spraying is countered by Multi-Factor Authentication; Man-in-the-Middle transit interception is countered by TLS/IPsec encryption; Spear Phishing is countered by SPF/DKIM/DMARC and security awareness; and Zero-Day software flaws are countered by IPS signatures, network segmentation, and prompt patching.

Step-by-Step Solution

1

Analyze the Password Spray threat vector.

Identify that password spraying avoids single-account lockout by trying one password against many accounts.

MFA is the primary defense because even if a password matches, login fails without the second factor.

2

Analyze the Man-in-the-Middle (MitM) threat vector.

Identify that MitM exploits cleartext communication channels.

Cryptographic transport protocols like TLS and IPsec encrypt payload data and verify server identity via certificates.

3

Analyze the Spear Phishing threat vector.

Identify that spear phishing uses targeted fraudulent emails to fool specific personnel.

Combining domain verification controls (SPF/DKIM/DMARC) with human security training reduces email spoofing and link clicking.

4

Analyze the Zero-Day vulnerability threat vector.

Identify that zero-day exploits target unpatched software weaknesses.

Deploying IPS signatures, micro-segmentation, and timely vendor security patches directly mitigates software vulnerability risks.

Key Concept

Threat, Vulnerability, and Mitigation Mapping

Question 196Question →

Match each OSPFv2 interface scenario or configuration on the left to its corresponding election behavior or operational characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Interface configured with `ip ospf network broadcast` matches 'Performs DR/BDR elections and uses default Hello/Dead timers of 10s and 40s.'
Interface configured with `ip ospf network point-to-point` matches 'Establishes neighbor adjacencies without electing a DR/BDR using 10s/40s timers.'
Interface configured with `ip ospf priority 0` on a multiaccess link matches 'Permanently remains a DROTHER and is excluded from DR/BDR election.'
Router with priority 255 added to a link with an active, established DR matches 'Fails to take over the DR role due to the non-preemptive nature of OSPF elections.'

Each OSPF interface setting dictates specific operational properties: Broadcast links use 10s/40s timers and elect DR/BDR; Point-to-Point links use 10s/40s timers without electing DR/BDR; Priority 0 prevents any DR/BDR candidacy resulting in DROTHER status; and DR/BDR elections are non-preemptive, preventing new higher-priority routers from taking over an active DR role.

Step-by-Step Solution

1

Analyze OSPF network type behaviors regarding DR/BDR election requirement.

Broadcast networks elect a DR and BDR to reduce adjacency overhead over multiaccess media. Point-to-point networks connect exactly two routers and omit the DR/BDR election process entirely.

DR/BDR selection depends on the underlying OSPF network type setting.

2

Evaluate the effect of interface priority configuration.

Setting `ip ospf priority 0` explicitly removes a router from participating in DR or BDR election, locking its state as DROTHER.

Priority values range from 0 to 255, where 0 represents absolute exclusion from election eligibility.

3

Determine election preemption behavior when topology changes occur.

OSPF elections are non-preemptive; an existing DR retains its role even if a router with a higher priority (such as 255) joins the network after election completion.

Non-preemption prevents network instability and continuous routing recalculations upon router reboots or link flaps.

Key Concept

OSPFv2 Network Types, Interface Priority, and Election Preemption Rules

Question 197Question →

Match each element of a Cisco IPv4 routing table entry on the left with its corresponding operational role on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The first integer inside the brackets matches the Administrative Distance (trustworthiness of the route source). The second integer inside the brackets matches the Metric (routing protocol path cost). The IP address following 'via' matches the next-hop address. The interface designation matches the local egress interface.

In Cisco IOS routing table output entries (such as O 192.168.10.0/24 [110/65] via 10.1.1.2, GigabitEthernet0/0/1), the components strictly follow a defined syntax: the first bracketed integer is the Administrative Distance (believability/trustworthiness rating), the second bracketed integer is the routing protocol metric (cost of the path), the IP address following 'via' is the next-hop address of the adjacent router, and the ending interface identifier is the local exit port.

Step-by-Step Solution

1

Analyze the Cisco routing table entry bracket notation [AD/Metric].

Identify that the first number represents Administrative Distance and the second number represents Metric cost.

Cisco IOS routes display bracketed values formatted strictly as [Administrative Distance / Metric].

2

Examine the forwarding path descriptors ('via IP' and interface name).

Map 'via IP' to the next-hop router's address and the interface name to the local outbound port.

'via' indicates the immediate upstream router address, while the final parameter indicates the local exit interface.

Key Concept

Routing Table Components & Cisco IOS Route Entry Structure

Question 198Question →

Match each network security threat on the left with its corresponding primary mitigation strategy on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Ransomware infection matches maintaining immutable offsite backups and deploying endpoint protection software. IP address spoofing matches configuring anti-spoofing Access Control Lists and Unicast Reverse Path Forwarding. Password brute-force attack matches enforcing multi-factor authentication and account lockout threshold policies. Unescorted server room access matches installing biometric scanners, smart card locks, and physical security logs.

Each threat item is correctly paired with the corresponding operational defense: Ransomware requires immutable backups and endpoint detection; IP spoofing requires packet header validation via anti-spoofing ACLs or uRPF; Brute-force attacks require authentication controls like lockout thresholds and multi-factor authentication; and unauthorized facility access requires physical security controls such as biometric devices and locks.

Step-by-Step Solution

1

Analyze each security threat to determine its attack vector.

Identified four distinct threat vectors: file encryption (Ransomware), packet header manipulation (IP spoofing), credential guessing (Brute-force), and physical intrusion (Server room access).

Selecting the correct mitigation requires identifying whether the threat is physical, network-layer, identity-based, or software-based.

2

Match each threat vector with the technical or physical security control engineered to mitigate it.

Ransomware maps to backups/endpoint defense; IP spoofing maps to ACLs/uRPF; Brute-force maps to MFA/Lockout policies; Physical intrusion maps to biometrics/badge controls.

Effective defense-in-depth requires applying targeted controls aligned with specific vulnerability types and threat vectors.

Key Concept

Security Threats and Mitigation Controls

Question 199Question →

Match each VPN technology or deployment concept to its corresponding operational characteristic.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Site-to-Site IPsec VPN matches fixed network gateway interconnection; Remote Access SSL VPN matches individual remote user connections; Split Tunneling matches selective corporate destination routing; IPsec ESP matches payload confidentiality and integrity.

Each concept correctly aligns with its core CCNA VPN definition: Site-to-Site links gateways, Remote Access links individual endpoints, Split Tunneling routes selectively to conserve bandwidth, and ESP encrypts payload data.

Step-by-Step Solution

1

Identify the deployment topology of Site-to-Site IPsec VPNs.

Match Site-to-Site VPNs to the description of connecting fixed location gateways without host software.

Site-to-Site VPNs join static remote subnets seamlessly across an untrusted network.

2

Identify the primary use case of Remote Access SSL VPNs.

Match Remote Access VPNs to secure client connections for mobile and remote workers.

Remote access VPN solutions cater to individual user endpoints dynamically establishing secure sessions.

3

Analyze the operational traffic behavior of Split Tunneling.

Match Split Tunneling to routing corporate traffic into the tunnel while internet traffic bypasses it.

Split tunneling isolates targeted internal subnets for tunnel routing while preserving local internet connectivity.

4

Identify the core security service offered by IPsec ESP.

Match IPsec ESP to data confidentiality via payload encryption.

ESP encapsulates and encrypts payload data to maintain privacy across IP networks.

Key Concept

Remote Access and Site-to-Site VPN Concepts

Question 200Question →

A network security engineer is categorizing security threats and mapping them to appropriate defense controls. Match each security incident description on the left with the corresponding primary defense control on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Deceptive targeted communications match security awareness training; Rogue AP deployment matches Wireless Intrusion Prevention Systems (WIPS); Password spraying across multiple accounts matches Multi-Factor Authentication (MFA); Eavesdropping on cleartext management traffic matches SSH enforcement.

Each threat scenario maps directly to its optimal mitigation strategy: social engineering requires user awareness training; rogue wireless access points require rogue detection and WIPS; multi-account password spraying requires MFA enforcement; cleartext session eavesdropping requires encrypted communication via SSH.

Step-by-Step Solution

1

Analyze each threat scenario to identify the primary attack vector.

Identified attack vectors: social engineering (human element), rogue wireless hardware, password spraying (credential guessing), and unencrypted session interception.

Accurate threat classification is required to match appropriate mitigation controls.

2

Map each attack vector to its corresponding security control mechanism.

Social engineering maps to user training; Rogue AP hardware maps to WIPS; Password spraying maps to MFA; Unencrypted traffic interception maps to SSH encryption.

Each defense mechanism directly addresses the specific vulnerability exploited by the attack vector.

Key Concept

Threat Vectors and Primary Security Mitigation Controls

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept