Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 621Question →

A network administrator configures a Cisco IOS router to restrict access to a financial database server (192.168.50.100/32192.168.50.100/32) from the HR subnet (192.168.10.0/24192.168.10.0/24). All other traffic between subnets must be permitted. The administrator applies the following access list in the inbound direction on interface GigabitEthernet0/0:

text
ip access-list extended FILTER_HR
deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100

After applying this ACL, users report that all traffic targeting any server in the 192.168.50.0/24192.168.50.0/24 network is being dropped, including traffic from non-HR subnets. Which configuration change will resolve the issue and permit intended traffic?

Show answer & explanation

Answer: Append the statement `permit ip any any` to the end of the `FILTER_HR` access list.

Answer

Appending the statement `permit ip any any` to the end of the `FILTER_HR` access list resolves the issue by explicitly permitting all traffic that does not match the deny rule.
Every IPv4 ACL in Cisco IOS ends with an invisible, mandatory `deny ip any any` statement. When an ACL contains only `deny` statements, any packet that does not match those deny statements reaches the bottom of the list and is dropped. Appending `permit ip any any` allows all other IP traffic to pass through as intended.

Step-by-Step Solution

1
Analyze the existing ACL configuration and traffic processing logic.
The current ACL contains only a single statement: `deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100`.
Cisco IOS Access Control Lists append an unwritten, implicit `deny ip any any` statement at the very end of every access list.
2
Trace packet evaluation for non-matching traffic.
Traffic from HR targeting other servers, or traffic from non-HR subnets, fails to match the `deny` line and falls through to the implicit deny at the end of the list, resulting in all traffic being dropped.
Top-down sequential processing drops any packet that reaches the end of an ACL without matching an explicit `permit` line.
3
Determine the necessary configuration addition.
Adding `permit ip any any` at the end ensures that traffic not matching the specific host deny rule is allowed through.
An explicit permit statement overrides the implicit deny clause for all remaining traffic.

Key Concept

Access Control List Sequential Processing and the Implicit Deny Any Clause
Question 622Question →

An organization configures a remote access VPN solution using the Cisco AnyConnect Secure Mobility Client for mobile employees. To conserve corporate headquarter bandwidth, the network administrator must enable a feature that encrypts and routes traffic destined for internal corporate subnets through the VPN tunnel, while permitting general internet traffic to access the internet directly via the remote user's local network connection. Which VPN feature should the administrator configure to satisfy this requirement?

Show answer & explanation

Answer: Split tunneling

Answer

The correct feature is split tunneling, which selectively routes corporate-bound traffic over the VPN tunnel while allowing local internet traffic to bypass the tunnel.
Split tunneling is explicitly designed for remote access VPN deployments to separate traffic destined for internal corporate networks from public internet traffic. By defining specific corporate destination subnets in the VPN gateway policy, the client software only sends traffic matching those destination networks into the IPsec/SSL VPN tunnel, allowing all other internet traffic to egress locally.

Step-by-Step Solution

1
Analyze the scenario requirements
Identified the need to separate traffic into corporate-bound traffic (which requires VPN encryption) and general internet traffic (which should bypass the VPN to save bandwidth).
Routing all traffic through the corporate headquarter creates unnecessary WAN bottlenecking and high internet bandwidth consumption on corporate firewalls.
2
Compare remote access VPN operational modes
Split tunneling segregates traffic based on destination IP address rules defined by an access control list on the VPN concentrator.
Full tunneling redirects 100% of client traffic through the tunnel, whereas split tunneling selectively encrypts specified subnet traffic while permitting local breakout for all other destinations.

Key Concept

Split Tunneling vs Full Tunneling in Remote Access VPNs
Question 623Question →

A network administrator is evaluating First Hop Redundancy Protocols (FHRPs) for deployment across enterprise campus VLANs. The engineering team requires a precise comparison of HSRPv2 and VRRPv2 operational mechanics regarding multicast communication, virtual IP assignment, and role terminology. Which two statements accurately describe the differences and similarities between HSRPv2 and VRRPv2?

Select all that apply

Show answer & explanation

Answer: HSRPv2 uses the multicast IPv4 address 224.0.0.102 for protocol messages, whereas VRRPv2 sends advertisements to the multicast IPv4 address 224.0.0.18.; VRRPv2 allows a router's physical interface IP address to be configured as the virtual IP address, whereas HSRPv2 rejects using an active physical interface IP address as the virtual IP address.

Answer

The correct statements are that HSRPv2 uses multicast IPv4 address 224.0.0.102 while VRRPv2 uses 224.0.0.18, and VRRPv2 permits configuring a physical interface IP address as the virtual IP address while HSRPv2 requires a distinct virtual IP address.
The correct choices accurately identify the fundamental protocol differences: HSRPv2 sends messages to multicast IP 224.0.0.102 while VRRPv2 uses 224.0.0.18, and VRRPv2 allows configuring the IP address owner (where physical IP equals virtual IP) whereas HSRPv2 strictly prohibits using a physical interface IP address as the virtual IP.

Step-by-Step Solution

1
Analyze multicast destination address mechanics for HSRPv2 and VRRPv2.
HSRPv1 uses 224.0.0.2, HSRPv2 uses 224.0.0.102, and VRRP (v2/v3) uses 224.0.0.18. The comparison regarding multicast addresses is correct.
FHRP routers send periodic keepalive packets to specific well-known multicast IPv4 destination addresses.
2
Evaluate Virtual IP address assignment rules for both protocols.
VRRP supports IP Address Owner functionality (matching physical IP to virtual IP with priority 255). HSRP does not support assigning an interface's physical IP address as the virtual IP address.
Cisco IOS enforces distinct virtual IP addresses for HSRP to prevent ARP conflicts and interface state ambiguity.
3
Verify virtual MAC address structure and role terminology for HSRPv2 and VRRPv2.
HSRPv2 virtual MAC prefix is 0000.0c9f.fXXX and active role is 'Active'. VRRPv2 virtual MAC prefix is 0000.5e00.01XX and active role is 'Master'.
Reversing these prefixes or role names represents common protocol confusion.

Key Concept

HSRPv2 vs VRRPv2 Feature Comparison
Estimated Time:1m 15s
Question 624Question →

A network administrator is deploying SSHv2 on a newly installed Cisco IOS branch gateway router named BR-GW01. Place the required CLI configuration tasks in the correct logical execution sequence from initial global configuration mode to final line security binding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence to configure SSHv2 on Cisco IOS is: 1) Set hostname and domain name to construct the FQDN, 2) Generate RSA keys with at least 768 bits modulus (e.g., 1024 bits), 3) Enforce SSH version 2 globally, 4) Create local user credentials, and 5) Configure line VTY for local login and SSH transport input.
The correct sequence follows the mandatory dependency hierarchy of Cisco IOS SSHv2 configuration. First, an FQDN must exist by defining a non-default host name and IP domain name. Second, an RSA key pair of at least 768 bits (1024 bits in this case) must be generated, which enables the SSH daemon. Third, 'ip ssh version 2' explicitly locks SSH to version 2. Fourth, local user credentials must be created in global configuration mode. Finally, virtual terminal lines (line vty) must be configured with 'login local' to use the local user database and 'transport input ssh' to restrict incoming traffic strictly to SSH.

Step-by-Step Solution

1
Set Hostname and Domain Name
Defines the Fully Qualified Domain Name (FQDN) for the device (BR-GW01.enterprise.net).
Cisco IOS cannot generate RSA keys without an established FQDN because the key pair name is derived directly from the host name and domain name.
2
Generate RSA Cryptographic Key Pair
Creates the public/private RSA key pair and automatically enables the SSH server process.
An RSA modulus size of 768 bits or greater (such as 1024 or 2048 bits) is strictly required to support SSH version 2 operations.
3
Specify SSH Version 2
Globally locks SSH operations to version 2 only.
By default, Cisco IOS supports both SSH v1.5 and v2 upon key generation. Forcing version 2 eliminates vulnerability to v1 protocol negotiation downgrades.
4
Create Local User Credentials
Populates the local database with an administrative user account.
SSH connection attempts require user authentication; creating a local account provides local database verification when AAA is not using remote RADIUS/TACACS+ servers.
5
Bind Authentication and Transport Restrictions to Line VTY
Configures 'login local' and 'transport input ssh' on virtual terminal lines.
This step ensures inbound remote management connections require local username/password verification and explicitly blocks unencrypted protocols like Telnet.

Key Concept

Cisco IOS SSHv2 Configuration Dependencies and Deployment Sequence
Question 625Question →

A network administrator configures a Cisco IOS switch for secure management access. The following excerpt is retrieved from the running configuration:

text
username secadmin privilege 15 secret 8 88 k9A$eP2xL1...
service password-encryption
!
line vty 0 4
transport input ssh
login

When a network engineer attempts to establish an SSH session using the `secadmin` account credentials, the authentication attempt is rejected. Which configuration change must be applied to line vty 0 4 to allow authentication using the local user database?

Show answer & explanation

Answer: Replace the `login` command with `login local` under line vty 0 4 configuration mode.

Answer

Replacing `login` with `login local` under line vty 0 4 configuration mode resolves the authentication failure by directing Cisco IOS to check credentials against accounts in the local running-config database.
The correct answer specifies changing `login` to `login local` on line vty 0 4. In Cisco IOS, the simple `login` command restricts authentication to a line password. If no line password is configured, access is refused. Executing `login local` forces Cisco IOS to authenticate incoming SSH connections against accounts defined in the global local database, such as `secadmin`.

Step-by-Step Solution

1
Analyze the VTY line authentication configuration.
The configuration shows `login` under `line vty 0 4` without a line-level `password` statement or the `local` keyword.
The bare `login` command expects a password defined directly on the line using `password <string>`. Without it, all login attempts are blocked.
2
Evaluate local database user configuration.
A local user `secadmin` is present with a valid Type 8 PBKDF2 secret hash (`secret 8 ...`).
Local credentials exist, but Cisco IOS must be instructed to consult the local account database for line access.
3
Identify the required CLI command fix.
Configuring `login local` under `line vty 0 4` binds incoming VTY authentication to the local username database.
This allows `secadmin` credentials to be validated successfully during SSH setup.

Key Concept

Cisco IOS Line VTY Local Database Authentication
Question 626Question →

Match each VPN deployment characteristic or operational mode on the left with its corresponding VPN technology concept on the right.

Click a left item, then click its matching right item

Items

Always-on encrypted tunnel established between two static network gateways to interconnect distinct local area networks transparently.
User-initiated session that connects an individual mobile endpoint to the enterprise internal network over an untrusted network.
IPsec mode that encrypts the entire original IP packet and prepends a new outer IP header for gateway-to-gateway delivery.
IPsec mode that encrypts only the IP payload and leaves the original IP header intact, typically used for host-to-host communications.

Matches

Show answer & explanation

Answer

The correct pairings match Site-to-Site VPN to the persistent gateway-to-gateway network link, Remote Access VPN to the user-initiated endpoint connection, IPsec Tunnel Mode to whole-packet encapsulation with a new IP header, and IPsec Transport Mode to payload-only encryption preserving the original header.
The correct pairings accurately reflect the core differences between site-to-site network connectivity and remote endpoint access, as well as the structural differences between IPsec Tunnel mode (new outer header) and Transport mode (payload encryption only).

Step-by-Step Solution

1
Differentiate between VPN deployment topologies.
Identify that connecting static branch networks via perimeter devices describes a Site-to-Site VPN, while connecting individual mobile devices describes a Remote Access VPN.
Topologies differ fundamentally by whether connections are established permanently between network infrastructure nodes or dynamically by remote client devices.
2
Analyze IPsec operation modes.
Identify that adding a new outer IP header to protect the entire packet is IPsec Tunnel Mode, whereas retaining the original outer header while encrypting only the payload is IPsec Transport Mode.
Tunnel Mode protects end-to-end internal addressing across public networks between security gateways, while Transport Mode protects communications between hosts whose addresses are already routable.

Key Concept

Remote Access vs Site-to-Site VPN architecture and IPsec encapsulation modes (Tunnel vs Transport).
Question 627Question →

An enterprise network uses a centralized DHCP server located at IP address 172.16.10.100172.16.10.100 in VLAN 10. Clients in VLAN 20 (172.16.20.0/24172.16.20.0/24) are connected to a router via subinterface `GigabitEthernet0/0.20` (172.16.20.1/24172.16.20.1/24), while the DHCP server connects to subinterface `GigabitEthernet0/0.10` (172.16.10.1/24172.16.10.1/24). Hosts in VLAN 20 are currently unable to acquire IP addresses dynamically. Which configuration command must be applied under the `GigabitEthernet0/0.20` interface to forward DHCP broadcasts from VLAN 20 hosts to the central DHCP server?

Show answer & explanation

Answer: ip helper-address 172.16.10.100

Answer

The command `ip helper-address 172.16.10.100` configured under interface `GigabitEthernet0/0.20` correctly enables the DHCP relay functionality.
To relay DHCP messages from hosts on a local subnet to a remote DHCP server, the `ip helper-address <DHCP-Server-IP>` command must be configured on the router interface (or subinterface) that acts as the default gateway for those clients. When configured on `GigabitEthernet0/0.20`, the router listens for incoming UDP port 67 broadcast messages from VLAN 20 clients, places its own interface IP (172.16.20.1172.16.20.1) into the `giaddr` (Gateway IP Address) field of the packet, and unicasts the request directly to the DHCP server at 172.16.10.100172.16.10.100.

Step-by-Step Solution

1
Identify the ingress interface for client DHCP broadcasts
The client gateway interface receiving broadcast DISCOVER messages is `GigabitEthernet0/0.20` (172.16.20.1/24172.16.20.1/24).
DHCP Relay functionality must be enabled on the incoming interface facing the clients so the router can intercept broadcast requests.
2
Determine the destination IP address for the relay command
The target DHCP server IP address is 172.16.10.100172.16.10.100.
The `ip helper-address` command converts UDP broadcasts into unicast traffic directed at the specific DHCP server IP address.
3
Synthesize the correct Cisco IOS interface command
Apply `ip helper-address 172.16.10.100` under `interface GigabitEthernet0/0.20`.
This sets `giaddr` to 172.16.20.1172.16.20.1 and forwards client DHCP requests across subnets to the centralized server.

Key Concept

DHCP Relay Agent Interface Placement and Configuration
Estimated Time:1m 15s
Question 628Question →

An administrator on a campus core switch named Core-SW1 is configuring SSH for secure management access. The administrator sets a hostname of Core-SW1 and attempts to run the command `crypto key generate rsa`, but receives the system message: `% Please define a domain-name first.` Which configuration command must be entered in global configuration mode to resolve this issue and allow key generation?

Show answer & explanation

Answer: ip domain-name example.com

Answer

Configure an IP domain name using the global configuration command `ip domain-name example.com`.
Generating an RSA key pair on a Cisco IOS device requires both a non-default hostname and an IP domain name. The device uses these two parameters to form the fully qualified domain name (FQDN) that names the key pair. Executing `ip domain-name example.com` supplies the missing parameter so that `crypto key generate rsa` can run successfully.

Step-by-Step Solution

1
Identify the prerequisite requirement for Cisco IOS RSA key pair generation.
Cisco IOS derives the default name of the RSA key pair from the device hostname appended with the IP domain name (e.g., Core-SW1.example.com).
Without an IP domain name explicitly configured, the router or switch cannot form the key pair name.
2
Select the proper command to define the IP domain name.
Executing `ip domain-name example.com` in global configuration mode defines the domain name context.
This satisfies the missing prerequisite indicated by the CLI prompt '% Please define a domain-name first.'

Key Concept

SSH Prerequisite Configuration and RSA Key Pair Naming
Estimated Time:1m 0s
Question 629Question →

An organization is designing the physical security and security program elements for a newly constructed enterprise facility housing core network hardware and server racks. Which two measures represent physical access controls or physical security program elements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Installing biometric door scanners and proximity card readers at all entrances to the server room; Deploying security guards and automated physical keycard locks on rack enclosures containing network hardware

Answer

The two physical access controls are installing biometric scanners with proximity card readers at server room entrances, and deploying security guards alongside lockable equipment rack enclosures.
Physical access controls prevent unauthorized physical entry to infrastructure assets. Biometric scanners combined with proximity readers protect room perimeters, while security guards and lockable rack cabinets protect the physical hardware directly from unauthorized physical contact or theft.

Step-by-Step Solution

1
Differentiate between physical security controls and technical/logical security controls.
Physical controls manage tangible entry, environmental protection, and direct physical access to hardware (e.g., doors, locks, guards, biometrics, video surveillance). Logical/technical controls enforce access via software, protocols, or network configuration (e.g., ACLs, AAA/TACACS+, Port Security).
Security program elements explicitly separate physical safeguards from technical software safeguards.
2
Evaluate option choices to select physical security elements.
Biometric door access with card readers restricts physical human movement into the facility. Guards and lockable rack cabinets restrict physical human tampering with server and network gear.
Both represent physical access controls essential for defense-in-depth in enterprise physical environments.

Key Concept

Physical Access Controls and Security Program Safeguards
Question 630Question →

An enterprise organization is updating its infrastructure security baseline to comply with zero-trust architecture guidelines. The network security team is establishing policies governing administrative SSH access to core switches and 802.1X EAP-TLS client authentication across corporate wireless networks. Which TWO of the following implementation details correctly align with Cisco recommended standards for multi-factor authentication (MFA) factor classification and Public Key Infrastructure (PKI) digital certificate validation? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Prompting an administrator for a complex local console password alongside a hardware TOTP token generator fulfills multi-factor authentication by combining a knowledge factor with a possession factor.; Validating an incoming client digital certificate during an 802.1X TLS handshake requires verifying the Certificate Authority signature chain, checking current timestamp validity, and querying a CRL or OCSP server to confirm the certificate has not been revoked.

Answer

The statements confirming that combining an administrative password with a hardware TOTP token fulfills MFA by pairing knowledge and possession factors, and that digital certificate validation mandates verifying signatures, validity dates, and CRL/OCSP revocation status are both correct.
Pairing a password (knowledge factor) with a hardware TOTP token generator (possession factor) correctly spans two distinct MFA factor categories. Additionally, PKI certificate validation strictly requires verifying the issuer chain, confirming current expiration bounds, and validating non-revocation status using CRL or OCSP.

Step-by-Step Solution

1
Evaluate Multi-Factor Authentication (MFA) category criteria.
MFA mandates selecting authentication mechanisms from at least two separate factor categories: knowledge (something you know), possession (something you have), or inherence (something you are).
Using multiple methods within the exact same category (such as two separate phone-based alerts) fails the factor independence requirement.
2
Examine Public Key Infrastructure (PKI) certificate verification procedures.
Comprehensive certificate verification requires validating the issuing CA trust path, confirming the current time falls within the validity window, and checking revocation lists (CRL) or real-time status responders (OCSP).
A certificate signed by a trusted root CA can still be revoked due to private key compromise or endpoint decommission before its expiration date.

Key Concept

MFA Factor Classification and PKI Digital Certificate Revocation Verification
Question 631Question →

A network security administrator must perform a local password recovery procedure on a Cisco IOS router after administrative credentials were lost. Arrange the procedural steps in the correct chronological order required to restore administrative access without losing the active device configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for Cisco IOS password recovery is: 1) Interrupt the boot sequence in ROMMON and set the configuration register to `0x2142`. 2) Boot into Cisco IOS and enter privileged EXEC mode without password prompt. 3) Execute `copy startup-config running-config`. 4) Set a new password using `enable secret`. 5) Revert the configuration register to `0x2102` and save changes with `copy running-config startup-config`.
The correct sequence follows standard Cisco IOS administrative recovery: First, interrupt boot in ROMMON to change the register to `0x2142`, ignoring startup configuration. Second, complete boot into privileged EXEC mode without credentials. Third, copy startup configuration into running configuration (`copy startup-config running-config`) to restore network settings into RAM. Fourth, define a new password using `enable secret`. Fifth, reset the register to `0x2102` and save the configuration (`copy running-config startup-config`) to NVRAM.

Step-by-Step Solution

1
Change configuration register in ROMMON mode
Configuration register value set to `0x2142`
Forces Cisco IOS to bypass reading NVRAM (startup-config) during boot up.
2
Boot device and access privileged EXEC mode
Router boots to `Router>` and allows `enable` without credential prompt
Since startup-config is ignored, no local authentication controls or passwords are loaded.
3
Load startup configuration into active RAM using `copy startup-config running-config`
Original operational configuration is restored into RAM
Preserves all existing router settings so they are not accidentally wiped when saving.
4
Configure a new password using `enable secret` in global configuration mode
New encrypted password replaces the old locked password in running-config
Updates the local access password in RAM while keeping all restored settings.
5
Reset configuration register to `0x2102` and save running configuration to startup configuration
Router register set back to normal boot mode and startup-config in NVRAM updated
Ensures future reboots load configuration from NVRAM normally with the new password.

Key Concept

Cisco IOS Local Password Recovery Procedure and Configuration Register Values
Question 632Question →

A network engineer is configuring IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which of the following statements regarding the operation and behavior of IPv4 ACLs are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Standard IPv4 ACLs filter network traffic based solely on the packet source IPv4 address.; An implicit deny statement at the end of an IPv4 ACL automatically drops any packet that does not match an explicit permit statement.

Answer

Standard IPv4 ACLs filter traffic based solely on the source IP address, and an implicit deny statement drops any packet that does not match an explicit permit entry.
Standard IPv4 ACLs examine only packet source IP addresses. Additionally, every IPv4 ACL includes an unwritten implicit deny clause at the end of the rule list that drops any traffic not matched by explicit permit rules.

Step-by-Step Solution

1
Analyze standard IPv4 ACL criteria
Standard IPv4 ACLs only evaluate the source IP address.
Standard ACLs (numbered 1-99 and 1300-1999) cannot inspect destination addresses or layer 4 ports.
2
Evaluate default termination behavior of IPv4 ACLs
Unmatched packets encounter an implicit deny and are dropped.
Cisco IOS enforces security by defaulting to deny all traffic that is not explicitly permitted.

Key Concept

Standard vs Extended IPv4 ACL capabilities and the implicit deny feature
Question 633Question →

A network engineer enables preemption on router R1 (configured with HSRP priority 120120) while router R2 (configured with HSRP priority 100100) is currently acting as the Active gateway for HSRP Group 1. In what chronological sequence do the protocol events occur as router R1 takes over the Active role?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for HSRP active gateway preemption is: 1) Router R1 receives HSRP Hello packets from R2, 2) Router R1 compares priorities and triggers preemption, 3) Router R1 sends an HSRP Coup message, 4) Router R2 relinquishes the role and sends an HSRP Resign message, and 5) Router R1 becomes Active and broadcasts a Gratuitous ARP.
When a router configured with a higher HSRP priority and preemption comes online, it must first receive Hello packets from the current Active router to detect the priority difference. Once detected, it sends an HSRP Coup packet. The lower-priority router acknowledges this by issuing an HSRP Resign packet and moving to Standby. Finally, the new router enters the Active state and issues a Gratuitous ARP (GARP) to update Layer 2 switch forwarding tables.

Step-by-Step Solution

1
Identify active discovery
R1 processes Hello packets from current active router R2 containing priority 100100.
Before preempting, the candidate router must learn the current active router's operating parameters.
2
Evaluate preemption condition
R1 determines its priority (120120) is higher than R2's (100100) and preemption is configured.
Preemption allows a router with a higher priority to take over the Active state automatically.
3
Send takeover notification
R1 generates and transmits an HSRP Coup message.
The Coup message signals to the existing Active router that a superior router is taking over.
4
Relinquish active role
R2 processes the Coup message, transitions to Standby, and emits a Resign message.
The lower-priority active router steps down upon verifying the higher priority in the Coup message.
5
Finalize activation and update network paths
R1 enters Active state and sends a Gratuitous ARP (GARP).
The GARP forces adjacent switches to map the virtual MAC address to R1's port, preventing blackholing of user traffic.

Key Concept

HSRP Preemption Mechanics and Message Sequence
Question 634Question →

A network administrator is configuring secure management access on a newly deployed access switch named SW-ACCESS-03. The switch already has a non-default hostname and an active IP domain name configured. The organization requires that all remote administrative sessions use SSH version 2 and that legacy Telnet connections are explicitly blocked. Which two CLI configuration steps are required to complete this task? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute 'crypto key generate rsa modulus 2048' in global configuration mode.; Execute 'transport input ssh' under the VTY line configuration mode.

Answer

The required steps are generating an RSA key pair with a modulus size of 2048 bits in global configuration mode and applying 'transport input ssh' under VTY line configuration mode.
Generating an RSA key with a 2048-bit modulus enables SSH version 2 on Cisco IOS, as SSH v2 requires a key size of at least 768 bits. Additionally, configuring 'transport input ssh' on the VTY lines enforces SSH as the sole inbound management protocol, effectively blocking insecure Telnet connections.

Step-by-Step Solution

1
Generate an RSA key pair required for SSH operational readiness.
Executing 'crypto key generate rsa modulus 2048' creates an encryption key pair. Because the modulus is greater than or equal to 768 bits, SSH version 2 capability is enabled.
Cisco IOS requires an RSA key pair to enable the SSH server daemon. Modulus sizes lower than 768 bits restrict the daemon to SSH v1.5.
2
Restrict incoming line vty protocols to SSH only.
Entering line vty configuration mode and running 'transport input ssh' restricts incoming management connections exclusively to encrypted SSH sessions.
By default, VTY lines may allow Telnet or all protocols. Setting transport input to SSH prevents cleartext management traffic.

Key Concept

SSHv2 Prerequisites and VTY Protocol Binding
Question 635Question →

A network engineer configures an extended IPv4 access control list named `CORP_SEC` on a Cisco IOS router to regulate access from the branch network (10.40.0.0/1610.40.0.0/16) to an internal web server (192.168.50.10/32192.168.50.10/32). The security requirement specifies that host 10.40.4.1510.40.4.15 in the IT subnet (10.40.4.0/2210.40.4.0/22) must be allowed HTTPS access (TCP port 443) to the web server, while all other traffic from 10.40.0.0/1610.40.0.0/16 to the 192.168.50.0/24192.168.50.0/24 network must be denied. Additionally, non-matching traffic must reach external destinations freely.

The engineer enters the following configuration commands:

text
ip access-list extended CORP_SEC
10 deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255
20 permit tcp host 10.40.4.15 host 192.168.50.10 eq 443
30 permit ip any any
!
interface GigabitEthernet0/0/1
ip access-group CORP_SEC in

During testing, HTTPS traffic from 10.40.4.1510.40.4.15 to 192.168.50.10192.168.50.10 is unexpectedly dropped. Which modification corrects the access control list logic to satisfy all requirements?

Show answer & explanation

Answer: Reorder the ACL so sequence 20 is processed before sequence 10, while leaving sequence 30 in place.

Answer

Reorder the access control list so sequence 20 is evaluated prior to sequence 10, retaining sequence 30 at the bottom.
Cisco IOS Access Control Lists process statements sequentially from top to bottom. The first statement that matches a packet determines the outcome, terminating further evaluation. In the original configuration, sequence 10 broad-denied all traffic from 10.40.0.0/1610.40.0.0/16 to 192.168.50.0/24192.168.50.0/24. Because host 10.40.4.1510.40.4.15 is part of 10.40.0.0/1610.40.0.0/16, its HTTPS packets matched sequence 10 first and were dropped before reaching sequence 20. Reordering sequence 20 above sequence 10 allows the specific HTTPS flow to be permitted first. Retaining sequence 30 (`permit ip any any`) ensures non-matching traffic to other networks is not blocked by the implicit deny any clause at the end of the list.

Step-by-Step Solution

1
Analyze top-down sequential processing logic of Cisco IPv4 ACLs.
Sequence 10 `deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255` matches all IP packets originating from 10.40.0.0/1610.40.0.0/16 heading to 192.168.50.0/24192.168.50.0/24.
Host 10.40.4.1510.40.4.15 resides within 10.40.0.0/1610.40.0.0/16. Therefore, HTTPS packets match line 10 first and are immediately dropped before reaching line 20.
2
Determine placement of specific versus general rules.
The specific exception (`permit tcp host 10.40.4.15 host 192.168.50.10 eq 443`) must precede the broad deny rule (`deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255`).
Top-down execution terminates search upon the first matching entry. Placing specific permit statements above broader deny statements ensures granular access controls work.
3
Verify requirement for non-matching traffic handling.
Sequence 30 `permit ip any any` must remain at the end of the ACL.
Without `permit ip any any`, all traffic going to external destinations outside 192.168.50.0/24192.168.50.0/24 would hit the implicit `deny ip any any` at the bottom of the ACL and be dropped.

Key Concept

Top-Down Sequential Processing and Placement Strategy in Extended IPv4 ACLs
Estimated Time:2m 0s
Question 636Question →

An administrator configures an IPv4 access control list on a router interface containing only the single entry `access-list 15 permit host 172.16.10.5`. What action will the router take when a packet originating from host 172.16.10.20 arrives on this interface?

Show answer & explanation

Answer: The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.

Answer

The packet is dropped because of the unwritten implicit deny statement at the end of the ACL.
Every Cisco IPv4 ACL ends with an invisible implicit deny statement (`deny any`). Because the packet from host 172.16.10.20 does not match the single permit rule for host 172.16.10.5, it reaches the end of the list and is dropped.

Step-by-Step Solution

1
Evaluate the packet against the ACL entries in sequential top-down order.
The packet source IP (172.16.10.20) is compared to line 1 (permit host 172.16.10.5), resulting in no match.
Host 172.16.10.20 is not equal to 172.16.10.5.
2
Proceed to the end of the access control list when no explicit match occurs.
The packet encounters the default invisible implicit deny clause (`deny any`).
Every Cisco IOS IPv4 ACL automatically terminates with an implicit deny all traffic statement.
3
Determine final packet disposition.
The router drops the packet.
Traffic failing to match any permit statement is dropped by the implicit deny.

Key Concept

Implicit Deny Any in IPv4 Access Control Lists
Estimated Time:45s
Question 637Question →

A network administrator is evaluating AAA protocols to manage CLI access to enterprise routers. Which feature is a key characteristic of TACACS+ compared to RADIUS?

Show answer & explanation

Answer: It encrypts the entire packet body during transmission.

Answer

TACACS+ encrypts the entire body of the packet during transmission.
TACACS+ encrypts the entire body of the packet, providing complete confidentiality for usernames, commands, and authorization details. In contrast, RADIUS encrypts only the password field.

Step-by-Step Solution

1
Identify the protocol characteristics of TACACS+.
TACACS+ is an administrative AAA protocol that operates over TCP port 49.
Understanding transport protocol mechanics and encryption features is fundamental when comparing TACACS+ and RADIUS.
2
Compare TACACS+ encryption mechanisms against RADIUS.
TACACS+ encrypts the entire packet payload (everything following the header), whereas RADIUS encrypts only the password attribute.
This structural difference ensures TACACS+ provides full-payload confidentiality for network device administration sessions.

Key Concept

TACACS+ vs. RADIUS AAA Protocol Differences
Estimated Time:45s
Question 638Question →

A network administrator enables Dynamic ARP Inspection (DAI) on a switch access VLAN to mitigate ARP spoofing attacks. Which database does DAI consult by default to validate ARP requests and responses received on untrusted ports?

Show answer & explanation

Answer: The DHCP snooping binding database

Answer

The DHCP snooping binding database
Dynamic ARP Inspection (DAI) is designed to prevent man-in-the-middle ARP spoofing attacks. When DAI is enabled on a VLAN, it intercepts all ARP requests and responses on untrusted ports and checks the sender IP address and sender MAC address against valid entries in the DHCP snooping binding database. If the IP-to-MAC binding does not match an entry in the database, the invalid ARP packet is dropped.

Step-by-Step Solution

1
Identify the primary function of Dynamic ARP Inspection (DAI)
DAI mitigates ARP poisoning/spoofing by intercepting and validating ARP requests and responses on untrusted switch ports.
Untrusted ports can receive malicious ARP messages attempting to misassociate IP addresses with attacker MAC addresses.
2
Determine the data source used by DAI for validation
DAI compares the sender IP address and MAC address in intercepted ARP packets against valid IP-to-MAC pairs.
DHCP Snooping dynamically builds and maintains the binding database containing MAC address, IP address, lease time, binding type, VLAN number, and interface information.

Key Concept

Dynamic ARP Inspection (DAI) operational dependency on DHCP Snooping
Question 639Question →

A network engineer is inspecting the CLI configuration of a Layer 3 switch named Site-Core-01 to ensure secure administrative access. The switch currently has a valid hostname, a configured IP domain name, and active local user accounts. The line vty configuration displays the following output:

text
Site-Core-01# show running-config | section line vty
line vty 0 15
transport input telnet
login local

Which command executed within line configuration mode will restrict remote management sessions exclusively to SSH while enforcing authentication against the local user database?

Show answer & explanation

Answer: transport input ssh

Answer

Executing 'transport input ssh' under VTY line configuration mode restricts inbound remote access strictly to SSH sessions.
Executing the command 'transport input ssh' under the VTY line configuration mode restricts inbound remote access to encrypted SSH sessions only. Because 'login local' is already present, the device will authenticate connecting users against its local user database over SSH.

Step-by-Step Solution

1
Identify the current transport input configuration on the VTY lines
The current setting 'transport input telnet' permits only unencrypted Telnet connections.
By default or explicit command, VTY lines may allow Telnet, which transmits data in cleartext.
2
Determine the line mode command required to enforce SSH remote access exclusively
Applying 'transport input ssh' under 'line vty 0 15' replaces 'telnet' with 'ssh'.
The 'transport input' command controls which protocols are permitted to connect to the switch's virtual terminal lines.

Key Concept

VTY Line Transport Input Binding and Hardening
Question 640Question →

A network administrator is configuring an IPv4 extended named access control list (ACL) on a Cisco router interface to implement security controls for the host subnet 10.50.1.0/2410.50.1.0/24. The ACL must satisfy the following traffic policies:

1. Allow ICMP echo requests from 10.50.1.0/2410.50.1.0/24 strictly to the default gateway at 10.50.1.110.50.1.1.
2. Allow HTTPS access from 10.50.1.0/2410.50.1.0/24 to the internal application server at 192.168.20.45192.168.20.45.
3. Explicitly deny all other IPv4 traffic originating from 10.50.1.0/2410.50.1.0/24 destined to the internal server subnet 192.168.20.0/24192.168.20.0/24.
4. Permit all remaining outbound traffic from 10.50.1.0/2410.50.1.0/24 to any other network destination.

Which two ACL entries must be placed in the access list to achieve this exact behavior without blocking general Internet access? (Select two.)

Select all that apply

Show answer & explanation

Answer: permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443; permit ip 10.50.1.0 0.0.0.255 any

Answer

The correct options are 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' and 'permit ip 10.50.1.0 0.0.0.255 any'.
The correct configuration requires allowing TCP port 443 traffic to the specific host 192.168.20.45 first. Following the explicit block of all other IP traffic to 192.168.20.0/24, an explicit permit ip entry from the source network to 'any' destination is mandatory to prevent the default implicit deny clause from blocking general Internet and external traffic.

Step-by-Step Solution

1
Analyze extended ACL processing order rules.
Cisco IOS ACLs process entries sequentially from top to bottom until the first match occurs.
Specific permit rules must precede broader deny rules to ensure target traffic is allowed.
2
Construct the rule for HTTPS access to the application server.
The entry 'permit tcp 10.50.1.0 0.0.0.255 host 192.168.20.45 eq 443' correctly permits SSL/TLS traffic to port 443 of the target server.
Requirements demand permitting HTTPS specifically to 192.168.20.45.
3
Address general outbound connectivity while maintaining subnet restrictions.
After specifying 'deny ip 10.50.1.0 0.0.0.255 192.168.20.0 0.0.0.255', the rule 'permit ip 10.50.1.0 0.0.0.255 any' must be appended.
Without an explicit permit statement at the end of the ACL, the invisible default 'implicit deny ip any any' clause drops all traffic destined for other locations.

Key Concept

ACL Sequential Evaluation and Implicit Deny Handling
PreviousPage 32 / 100Next
All practice questions — Cisco CCNA | Examkin