All practice questions

Match each Public Key Infrastructure (PKI) component on the left with its primary function on the right.

A Cisco router receives an IPv4 packet destined for $192.168.10.45$. The router has a single static route configured as follows: `ip route 192.168.10.0 255.255.255.0 10.1.1.2`. Arrange the steps of the router's lookup and packet forwarding process in the correct sequential order from first to last.

A network administrator needs to enable DHCP relay functionality on a Cisco IOS router so that hosts located in VLAN 40 ($10.40.0.0/24$) can receive dynamic IP addresses from a centralized DHCP server located at $192.168.100.50$ in the management network. Subinterface GigabitEthernet0/0/0.40 serves as the default gateway for VLAN 40, while GigabitEthernet0/0/1 connects directly to the core switch leading to the DHCP server. On which interface must the administrator execute the `ip helper-address 192.168.100.50` command?

A network engineering team is updating management access policies to reduce vulnerabilities associated with credential sniffing, brute-force access attempts, and unauthenticated administrative sessions across enterprise devices. Which two security controls directly mitigate these specific vulnerabilities and threats? (Select two.)

A network engineer is configuring HSRP version 2 on interface GigabitEthernet0/1 of a Cisco IOS router. The interface has been assigned an IPv4 address of $192.168.50.1/24$. The engineer enters the command `standby 10 ip 192.168.50.1` under interface configuration mode. Which statement accurately describes the operational result of executing this command?

An administrator hardens interface GigabitEthernet1/0/5 on a Cisco Catalyst switch by executing `switchport port-security`, `switchport port-security maximum 2`, and `switchport port-security mac-address sticky`. During business hours, two authorized workstations connect to the switch port and successfully transmit data. However, following a scheduled power outage that causes an ungraceful switch reload, users report that connecting the exact same workstations to GigabitEthernet1/0/5 triggers a security violation, placing the port into an err-disabled state. Inspection via `show port-security interface gigabitEthernet1/0/5` shows a Total MAC Addresses count of 0. Which administrative oversight directly caused this loss of MAC address bindings?

A network administrator initializes OSPFv2 process 1 on a Cisco router named Branch-GW. The router does not have an explicit `router-id` command configured under `router ospf 1`. The operational status and IPv4 addresses of the router interfaces are listed below:

- Loopback1: 10.10.10.10/32 (Up / Up)
- Loopback2: 10.200.1.1/32 (Up / Up)
- Loopback3: 172.16.50.1/32 (Up / Up)
- GigabitEthernet0/0: 192.168.100.1/24 (Up / Up)
- GigabitEthernet0/1: 192.168.200.1/24 (Up / Up)

What IPv4 address will OSPFv2 elect as the router ID for Branch-GW?

A network engineer is configuring a Cisco IOS router to relay DHCP requests from hosts on VLAN 50 ($192.168.50.0/24$) to a centralized DHCP server with the IP address $10.10.10.5$ located on VLAN 10. The default gateway for VLAN 50 is configured on subinterface GigabitEthernet 0/0/0.50.

Which two statements accurately describe the required configuration and behavior of the DHCP relay agent in this scenario? (Select TWO.)

An network administrator is implementing Multi-Factor Authentication (MFA) to secure access to network infrastructure devices. Which two of the following options represent a possession factor ('something you have')? (Select two.)

A network administrator enables HSRP version 2 on a Cisco IOS router interface configured with the highest priority in the group. In what order does the router progress through the standard HSRP operational states from initial interface bring-up to becoming the primary gateway?

An enterprise network engineer is designing a Quality of Service (QoS) traffic conditioning policy on a WAN edge router connecting to a service provider with a Committed Information Rate (CIR) lower than the physical link bandwidth. Which two statements accurately describe the operational mechanics and application constraints of traffic shaping versus traffic policing in this scenario?

A network administrator needs to configure static routes on a Cisco IOS router for destination subnet $10.15.0.0/16$. The primary route should use next-hop IP address $192.168.1.2$ with default priority. Additionally, a floating static backup route must be configured via next-hop IP address $192.168.2.2$ to take over only if the primary path learned via OSPF (Administrative Distance 110) becomes unavailable. Which two CLI commands correctly configure this static routing behavior? (Select TWO options.)

An enterprise security analyst is categorizing security audit findings and incident events into core cybersecurity governance definitions. Match each operational scenario on the left with its corresponding fundamental security concept on the right.

A network administrator is establishing password security policies on network devices to protect administrative logins from brute-force attacks. Which security policy control directly ensures that users choose strong passwords that resist dictionary attacks?

An organization is deploying 802.1X authentication using EAP-TLS to secure network access. During testing, a user laptop fails the TLS handshake when attempting to authenticate against the Cisco Identity Services Engine (ISE) RADIUS server. Inspection of the server logs reveals that the client presented a valid user certificate issued by an Intermediate Certificate Authority (CA), and the root CA certificate is present in the server's trusted store. However, the handshake fails because ISE cannot verify whether the client certificate has been revoked due to an unreachable Revocation Check endpoint. Which mechanism or component must be accessible to resolve this authentication failure?

An engineer is monitoring an HSRP group on VLAN 30 between two switches, DSW1 and DSW2. DSW1 is configured with an HSRP priority of $115$, preemption enabled, and interface tracking on interface GigabitEthernet1/0/1 with a priority decrement of $20$. DSW2 is configured with an HSRP priority of $105$ and preemption enabled. Under normal operating conditions, DSW1 is the Active router. If interface GigabitEthernet1/0/1 on DSW1 goes down, which switch becomes the Active router for HSRP group 30, and what is DSW1's updated priority?

A network technician configures a standard IPv4 access control list on a Cisco router using the command `access-list 5 permit host 172.16.10.15` and applies it inbound on an interface. What happens when host 172.16.10.20 sends traffic into that interface?

A network security engineer is reviewing the defense-in-depth posture for a sensitive financial processing facility. The engineer needs to implement controls that belong specifically to the physical security domain or administrative security program elements, distinguishing them from technical and logical network mechanisms. Which two options represent physical access controls or security program elements? (Select two.)

A network security architect is hardening a newly initialized Cisco IOS XE enterprise router. Arrange the following CLI configuration commands in the mandatory order required to establish local database authentication for remote management, ensuring that local privileged credentials using scrypt hashing are created prior to entering the line context, local authentication is bound to the VTY lines, and unencrypted management sessions are blocked.

A network administrator is hardening remote management access on a gateway router named WAN-Edge01. The router already has a non-default hostname, a domain name configured (enterprise.net), and a 2048-bit RSA key generated. Security standards mandate that SSH Version 1 connections must be explicitly disabled and incoming VTY sessions must authenticate using the local router user database.

Which combination of commands satisfies these operational requirements?