All practice questions

Question 221Question →

Match each enterprise security initiative to the corresponding element classification within an overall enterprise security framework.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Workforce education aligns with User Security Awareness; Mantraps and biometric access align with Physical Access Control; Incident response planning aligns with Administrative Policy; 802.1X network access control aligns with Technical/Logical Access Control.

Each security initiative maps precisely to its functional classification: regular employee training addresses user security awareness, physical barriers like mantraps provide physical access control, incident management policies establish administrative governance, and 802.1X network access protocol provides technical access control.

Step-by-Step Solution

1

Analyze human-focused education initiatives.

Identify that employee training on social engineering and security practices builds the human defense layer (User Security Awareness).

Security awareness focuses on human behaviors and risk reduction through training.

2

Evaluate tangible facility barriers and hardware entry controls.

Classify physical vestibules (mantraps) and biometric locks as Physical Access Control mechanisms.

Physical security controls restrict direct physical exposure to hardware and network facilities.

3

Review governance and operational framework documentation.

Map incident response policies, guidelines, and management escalation rules to Administrative Policy and Governance.

Administrative controls define organizational rules, emergency procedures, and operational expectations.

4

Distinguish technical/logical security configurations from physical/administrative elements.

Map port-based network authentication (802.1X) to Technical/Logical Access Control.

Software and protocol-level mechanisms enforcing network boundary security are technical controls.

Key Concept

Distinction among Security Program Elements (Physical Access Controls, User Security Awareness, Administrative Policies, and Technical Controls)

Estimated Time:2m 0s

Question 222Question →

Match each physical access control or security program element to its primary purpose within an enterprise network security framework.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Mantrap matches with preventing piggybacking/tailgating via interlocking doors. Security Awareness Training matches with educating personnel on social engineering and phishing. Biometric Access Control matches with verifying human biological features for physical entry. Incident Response Plan matches with formal administrative breach response procedures.

Each physical access control (mantrap, biometric scanner) directly mitigates physical entry threats through hardware mechanisms or biological authentication. Each security program element (awareness training, incident response plan) provides administrative structure, human education, and process governance.

Step-by-Step Solution

1

Analyze each physical access control mechanism on the left.

Identify that a mantrap uses interlocking doors to combat tailgating, while biometrics validate biological features like fingerprints.

Physical controls manage direct bodily entry into hardware facilities.

2

Analyze each security program element on the left.

Identify that security awareness training targets human education against phishing, while an incident response plan is an administrative document outlining breach remediation steps.

Administrative elements establish policies, procedures, and human awareness program goals.

3

Pair each item on the left with its corresponding description on the right.

Establish the 4 correct pairings accurately.

Aligning controls with their functional definitions demonstrates mastery of physical and administrative program elements.

Key Concept

Classification and functional roles of physical access controls and administrative security program elements.

Question 223Question →

Match each VPN operational feature or protocol component on the left with its corresponding functional description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Dead Peer Detection matches with monitoring tunnel liveness via keepalives; Split Tunneling matches with selectively routing corporate traffic through the tunnel while internet traffic bypasses it; Authentication Header matches with providing integrity and authentication without data encryption; Dynamic Multipoint VPN matches with leveraging GRE, NHRP, and IPsec to dynamically establish spoke-to-spoke tunnels.

Each feature corresponds to its specific technical function in VPN architecture: Dead Peer Detection detects dead VPN peers via keepalives; Split Tunneling optimizes bandwidth by routing only targeted subnets over the VPN; Authentication Header provides integrity without encryption; Dynamic Multipoint VPN uses mGRE and NHRP for dynamic spoke-to-spoke WAN connectivity.

Step-by-Step Solution

1

Analyze Dead Peer Detection (DPD)

Identify that DPD handles connection liveness monitoring using hello/keepalive messages between IPsec peers.

VPN gateways need a mechanism to reclaim security association resources when a peer unexpectedly crashes or loses power.

2

Analyze Split Tunneling

Identify that split tunneling separates corporate-bound traffic (sent inside the VPN) from general internet traffic (sent outside the VPN).

This conserves central corporate internet bandwidth while maintaining secure access to private enterprise resources.

3

Analyze Authentication Header (AH)

Identify that AH provides integrity and authentication for the whole packet, but does not provide encryption (confidentiality).

AH (IP protocol 51) computes a hashed MAC over packet headers and payload, whereas ESP (IP protocol 50) is required for encryption.

4

Analyze Dynamic Multipoint VPN (DMVPN)

Identify that DMVPN combines mGRE, NHRP, and IPsec to form on-demand site-to-site tunnels dynamically.

DMVPN scales enterprise WAN topologies by allowing spokes to communicate directly without hair-pinning traffic through the hub.

Key Concept

Remote Access and Site-to-Site VPN Components & Operation

Question 224Question →

Match each port security violation mode on the left with its corresponding switch behavior when an unauthorized MAC address is detected on an interface.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Protect mode matches silent packet dropping without counters; Restrict mode matches packet dropping with violation counter increments and Syslog notifications; Shutdown mode matches error-disabling the port and generating notifications.

Each violation mode dictates how Cisco IOS handles unauthorized frames on a secured port. Protect silently drops unauthorized traffic; Restrict drops unauthorized traffic while logging and counting violations; Shutdown disables the entire port by placing it into the err-disabled state.

Step-by-Step Solution

1

Identify the behavior of Protect mode.

Protect mode drops frames from unauthorized MAC addresses without logging or updating counters.

Protect is designed for silent dropping of unauthorized frames.

2

Identify the behavior of Restrict mode.

Restrict mode drops frames from unauthorized MAC addresses while actively logging Syslog alerts and incrementing violation counters.

Restrict mode alerts administrators while leaving the interface active for authorized traffic.

3

Identify the behavior of Shutdown mode.

Shutdown mode disables the port entirely, transitioning it to the err-disabled state upon a violation.

Shutdown is the most restrictive default mode in Cisco IOS port security.

Key Concept

Port Security Violation Modes (Protect, Restrict, Shutdown)

Question 225Question →

A network engineer is hardening an enterprise access layer switch using Cisco Layer 2 security features. Match each specific Layer 2 security feature configuration component on the left with its exact operational behavior or validation requirement on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Dynamic ARP Inspection matches validating ARP sender MAC/IP pairings against the DHCP snooping binding table. DHCP Snooping Option 82 handling on untrusted ports matches dropping incoming DHCP packets containing non-zero GIADDR or Option 82 payloads by default. Port Security sticky MAC learning matches adding dynamically learned MACs to running-config requiring an explicit copy to startup-config for boot persistence. DHCP Snooping rate limiting matches tracking incoming DHCP packet frequency and err-disabling interfaces that exceed configured thresholds.

Each feature is correctly matched to its functional behavior: Dynamic ARP Inspection validates ingress ARP packets against the DHCP snooping database; DHCP Snooping drops untrusted packets containing Option 82 or non-zero GIADDR fields; Sticky Port Security writes learned MACs to running-config (requiring manual saving for persistence); and DHCP Snooping rate limiting places interfaces in an err-disabled state upon threshold violations.

Step-by-Step Solution

1

Analyze Dynamic ARP Inspection (DAI) operation on untrusted interfaces.

DAI inspects all incoming ARP packets on untrusted ports and compares the sender MAC address and sender IP address against valid entries in the DHCP snooping binding database.

This prevents man-in-the-middle ARP spoofing attacks across Layer 2 VLANs.

2

Analyze DHCP Snooping Option 82 untrusted port enforcement.

DHCP snooping drops incoming packets on untrusted interfaces if the packet contains Option 82 information or a non-zero GIADDR value.

Untrusted access ports are intended for end hosts, which should not generate relay agent information fields.

3

Analyze sticky MAC address persistence in Port Security.

Configuring sticky MAC learning adds dynamically discovered MAC addresses into the active running-configuration.

Because these MAC addresses reside only in running-config, administrators must save the configuration (`copy running-config startup-config`) to make them permanent across switch reboots.

4

Analyze DHCP Snooping Rate Limiting behavior.

Enforcing `ip dhcp snooping limit rate` places an untrusted interface in the `err-disabled` state if incoming DHCP frames exceed the configured rate limit.

This protects switch CPU resources and DHCP infrastructure against denial-of-service starvation attacks.

Key Concept

Layer 2 Security Feature Operations and Verification (DAI, DHCP Snooping, Port Security)

Question 226Question →

In enterprise Cisco switch implementations, Layer 2 security controls govern frame processing, metadata insertion, and hardware lookup behaviors. Match each Layer 2 security operation or feature context to its exact functional mechanism.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Port Security Restrict Violation Mode matches with dropping frames, incrementing violation counters, and logging syslogs without err-disabling the port. Dynamic ARP Inspection Payload Validation matches with intercepting ARP packets on untrusted ports and inspecting payload sender IP/MAC pairs against bindings. DHCP Snooping Option 82 Insertion matches with appending relay agent circuit/remote ID metadata to client requests on untrusted ports. DAI ARP ACL Inspection Filter matches with evaluating static IP-to-MAC rules prior to checking the DHCP snooping database.

Each feature pair matches its fundamental operational behavior. Port Security restrict mode drops frames and logs alerts without placing the port in err-disabled status. DAI inspects inner ARP payload fields on untrusted ports against the binding database. DHCP Snooping Option 82 appends relay agent sub-options to requests arriving on untrusted ports. DAI ARP ACL filters allow manually configured static IP-to-MAC checks before querying dynamic DHCP bindings.

Step-by-Step Solution

1

Analyze Port Security Restrict Violation Mode

Identify that restrict mode drops unauthorized frames, increments the violation counter, and generates SNMP/syslog alerts while maintaining interface link state up/up.

Differentiates restrict mode from protect mode (which drops silently without logging) and shutdown mode (which disables the interface).

2

Analyze Dynamic ARP Inspection (DAI) Payload Validation

Identify that DAI inspects the inner ARP payload fields (sender MAC and sender IP) on untrusted ports against the DHCP snooping binding database.

Prevents ARP poisoning attacks by verifying MAC-to-IP resolution integrity at Layer 2.

3

Analyze DHCP Snooping Option 82 Insertion

Identify that Option 82 appends circuit ID and remote ID sub-options to DHCP requests on untrusted ports before forwarding toward trusted DHCP servers.

Enables upstream DHCP servers to apply localized IP allocation policies based on switch port location.

4

Analyze DAI ARP ACL Inspection Filter

Identify that ARP ACLs provide static mapping validation override prior to falling back to the dynamic DHCP snooping binding database lookup.

Required to prevent DAI from dropping valid ARP packets generated by static IP assigned hosts that lack DHCP lease entries.

Key Concept

Operational mechanics of Layer 2 security features including Port Security violation handling, DHCP Snooping Option 82 insertion, DAI payload validation, and ARP ACL filtering.

Question 227Question →

Match each Quality of Service (QoS) concept or mechanism on the left to its corresponding operational characteristic or header specification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Expedited Forwarding (EF) matches DSCP value 46; Class-Based Weighted Fair Queuing (CBWFQ) matches bandwidth allocation without strict priority; Traffic Policing matches dropping or remarking excess packets without buffering; Class of Service (CoS) matches the 3-bit Layer 2 802.1Q header field.

Each QoS concept correctly aligns with its protocol layer, header field, or operational mechanism: Expedited Forwarding (EF) maps to DSCP 46; CBWFQ provides minimum bandwidth guarantees across user-defined classes; Traffic Policing enforces rate bounds by dropping/remarking packets without using buffers; and CoS utilizes the 3-bit field inside IEEE 802.1Q headers.

Step-by-Step Solution

1

Identify the DSCP Per-Hop Behavior (PHB) designated for delay-sensitive voice payload.

Expedited Forwarding (EF) corresponds to DSCP value 46 (

101110_2

).

EF PHB ensures a guaranteed service rate with minimal delay and jitter for real-time applications.

2

Analyze how Class-Based Weighted Fair Queuing (CBWFQ) manages bandwidth.

CBWFQ allocates guaranteed minimum bandwidth percentages to defined classes.

Standard CBWFQ guarantees bandwidth per class during congestion but does not offer strict latency prioritization unless paired with Low Latency Queuing (LLQ).

3

Distinguish Traffic Policing from Traffic Shaping mechanics.

Policing enforces rate limits by immediately dropping or remarking excess packets without queue buffers.

Traffic shaping buffers excess traffic to smooth burst profiles, whereas policing acts instantaneously without memory buffering.

4

Evaluate Layer 2 QoS marking standards.

Class of Service (CoS) resides in the 3-bit Priority Code Point (PCP) field within an IEEE 802.1Q Ethernet tag.

CoS operates strictly at Layer 2 across trunk links and allows values from 0 through 7.

Key Concept

QoS Per-Hop Behaviors, Marking, Queuing, and Traffic Conditioning

Question 228Question →

Match each Layer 2 security feature or operational scenario on the left to its corresponding switch behavior or implementation detail on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

DHCP Snooping Option 82 insertion on untrusted access ports matches appending relay agent information (circuit ID and remote ID) to broadcast client requests before forwarding them upstream. Dynamic ARP Inspection (DAI) evaluation with static ARP ACLs matches checking IP-to-MAC mappings against configured ARP access lists prior to querying the DHCP snooping binding table. Port Security set to 'restrict' violation mode matches dropping frames from unauthorized MAC addresses, incrementing the violation counter, and generating SNMP traps/Syslog messages without disabling the port. DHCP Snooping binding database construction matches recording the host MAC address, leased IP address, lease duration, binding type, VLAN ID, and port interface upon intercepting a DHCPACK.

Each feature corresponds to its specific L2 operational behavior: DHCP Snooping Option 82 appends relay agent sub-options on untrusted ports; static ARP ACLs take precedence in DAI evaluation before querying the snooping database; restrict mode drops violating frames and generates Syslog/SNMP notifications without disabling the port; and the DHCP snooping binding database extracts host mappings from DHCPACK packets received on trusted ports.

Step-by-Step Solution

1

Analyze DHCP Snooping Option 82 functionality on untrusted ports.

Confirm Option 82 attaches sub-options (circuit ID and remote ID) to client requests on untrusted interfaces.

Option 82 provides relay agent details to the DHCP server to aid subnet allocation and security enforcement.

2

Evaluate Dynamic ARP Inspection (DAI) processing hierarchy.

Confirm static ARP ACLs take precedence over the DHCP snooping binding table during DAI validation.

Configuring `ip arp inspection filter` allows static hosts to pass DAI validation without needing dynamic DHCP snooping entries.

3

Differentiate Port Security violation modes (protect, restrict, shutdown).

Identify 'restrict' mode as dropping unauthorized traffic, logging via Syslog/SNMP, and keeping the interface active.

'Restrict' mode generates alert notifications and tracks violation statistics without causing an error-disabled port shutdown.

4

Examine DHCP Snooping binding table creation criteria.

Verify that snooping tracks DHCPACK messages to store host MAC, IP, lease time, binding type, VLAN, and interface details.

Snooping validates server responses on trusted ports to populate the IP-to-MAC binding database required by features like DAI and IP Source Guard.

Key Concept

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Question 229Question →

During a network security audit, an enterprise engineering team is reviewing AAA operations across campus switches and routers. Match each specific administrative operation or security scenario on the left with its corresponding AAA component or protocol mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Evaluating command execution privileges maps to Command-Level Authorization (TACACS+); authenticating 802.1X client access over UDP port 1812 with password-only encryption maps to Network Access Authentication (RADIUS); tracking session activity and logged commands maps to AAA Accounting; and authenticating against a local database during server outages maps to Local AAA Authentication Fallback.

Evaluating CLI command privileges requires per-command authorization, which is a native capability of TACACS+ (Command-Level Authorization). Authenticating 802.1X clients over UDP port 1812 with password-only encryption describes standard RADIUS operation for network access control. Collecting log metrics such as command usage, duration, and session timestamps is the core responsibility of AAA Accounting. Falling back to an on-box database when central AAA servers fail represents Local AAA Authentication Fallback.

Step-by-Step Solution

1

Analyze the first scenario regarding CLI command permissions.

Restricting or permitting specific commands like 'configure terminal' per user relies on Authorization, specifically leveraging TACACS+ due to its support for granular per-command authorization.

RADIUS combines Authentication and Authorization and cannot authorize individual CLI commands dynamically per session.

2

Analyze the second scenario involving 802.1X and password-only encryption over UDP.

802.1X access control relies on RADIUS (UDP 1812), which encrypts only the password field rather than the entire packet payload.

TACACS+ uses TCP port 49 and encrypts the entire packet body, making UDP 1812 and password-only encryption distinct indicators of RADIUS.

3

Analyze the third scenario focused on logging session activity and command history.

Logging timestamps, executed commands, and byte counts falls directly under the Accounting pillar of the AAA framework.

Accounting records 'what the user did' during a session, distinguishing it from Authentication ('who you are') and Authorization ('what you can do').

4

Analyze the fourth scenario addressing administrator login when central servers fail.

Using a local router username/password database as a backup mechanism when AAA server groups do not respond is Local AAA Authentication Fallback.

Configuring 'aaa authentication login default group tacacs+ local' instructs the device to query local credentials only if server group unreachable errors occur.

Key Concept

AAA Framework Pillars and Operational Protocol Mechanisms (TACACS+ vs RADIUS)

Estimated Time:2m 0s

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes