All practice questions

A network manager is implementing physical security controls at a branch office data room following an incident where an unauthorized visitor entered by closely following an authorized employee through a single access door. Which physical control specifically mitigates tailgating by utilizing a dual-door vestibule where the second door opens only after the first door closes and authentication is validated?

A company needs to provide temporary access to internal web application portals for third-party contractors working from unmanaged personal computers. The security policy mandates that no client software or persistent VPN configuration profiles can be pre-installed on these contractor endpoints. Which VPN technology best satisfies this operational requirement?

A newly connected host workstation requires an IPv4 address assignment. Place the steps of the standard DHCP address allocation and validation sequence in the correct chronological order from beginning to end.

A network security architect is enforcing local authentication policies on a Cisco IOS XE router. The organization requires local user accounts to utilize scrypt key derivation hashing algorithms and mandates that remote management lines authenticate users against the local device database. Which TWO actions or configuration commands meet these requirements?

A network administrator is hardening remote management access on a factory-reset Cisco IOS router currently running default factory settings. In what sequential order must the administrator execute the CLI commands to properly configure SSHv2 access using local user authentication?

An organization is upgrading the physical security posture of its main data center facility. The security team must implement controls that explicitly address tailgating mitigation at perimeter entryways and provide environmental surveillance inside server rooms. Which two physical security controls directly fulfill these specific requirements? (Select two.)

A network technician configures the following named IPv4 extended Access Control List (ACL) on a Cisco IOS router to restrict access from the Sales subnet ($192.168.20.0/24$) to an internal web server ($10.2.2.80$):

`ip access-list extended RESTRICT_SALES`
` deny tcp 192.168.20.0 0.0.0.255 host 10.2.2.80 eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 443`

The ACL is applied outbound on interface GigabitEthernet0/1 facing the internal network server segment. Following application, host $192.168.20.45$ can no longer resolve domain names using the internal DNS server at $10.2.2.53$ (UDP port 53) or receive DHCP lease updates. Which statement correctly explains why this non-HTTP traffic is blocked?

When DHCP snooping is enabled globally on a Cisco switch, what default trust state is assigned to all Layer 2 interfaces across the switch?

An enterprise network administrator is configuring a Cisco IOS router to forward DHCP requests from host clients in VLAN 30 ($192.168.30.0/24$) to a centralized DHCP server located in VLAN 10 at IP address $10.10.10.50$. Host workstations in VLAN 30 connect to the router via subinterface `GigabitEthernet0/0.30`, and the DHCP server resides behind egress interface `GigabitEthernet0/1`. Which command must be configured under subinterface `GigabitEthernet0/0.30` on the router to enable DHCP relay services for the VLAN 30 workstations?

A network administrator applies the following standard IPv4 access control list (ACL) inbound on a router interface:

`access-list 10 permit 192.168.1.0 0.0.0.255`

A host with the IPv4 address `192.168.2.50` attempts to send traffic through this interface. What action will the router take on this packet?

A Cisco router configured with the static route `ip route 172.16.10.0 255.255.255.0 10.1.1.2` receives an IPv4 packet destined for $172.16.10.45$. Place the steps performed by the router to process and forward this packet in the correct sequential order from first to last.

During a security assessment of a financial institution, a network administrator reviews the measures implemented to protect network infrastructure. The measures include installing biometric door locks on the main data center, deploying TACACS+ for switch administration authentication, implementing Port Security on access switches, and conducting quarterly user security awareness campaigns. Which of these measures is classified specifically as a physical access control?

A network engineer is troubleshooting secure remote management access on an enterprise router named EDGE-RTR-01. The router is currently permitting remote sessions, but output verification shows that SSH version 1.5 is active instead of SSH version 2.

The engineer gathers the following CLI output from EDGE-RTR-01:

text
EDGE-RTR-01# show ip ssh
SSH Enabled - version 1.5
Authentication timeout: 120 secs; Authentication retries: 3
EDGE-RTR-01# show running-config | include crypto key
crypto key generate rsa modulus 512

Which configuration change must be performed on EDGE-RTR-01 to support and enforce SSH version 2?

A network technician configures port security on an access switch interface using the command `switchport port-security mac-address sticky`. Which TWO statements accurately describe how sticky MAC address learning operates on this interface?

A network engineer must configure an IPv4 extended access control list (ACL 105) on a Cisco IOS router to enforce security policies for traffic originating from the internal subnet ($10.1.1.0/24$) destined for an application server at $10.2.2.10$:

1. Allow host $10.1.1.50$ administrative SSH access (TCP port 22) to server $10.2.2.10$.
2. Prevent all other hosts in the $10.1.1.0/24$ subnet from accessing server $10.2.2.10$ via SSH.
3. Allow all hosts in the $10.1.1.0/24$ subnet web access (TCP port 80) to server $10.2.2.10$.
4. Explicitly block all remaining IP traffic from $10.1.1.0/24$ to server $10.2.2.10$.

In what order should the network engineer place the ACL statements from top to bottom to ensure the policy is correctly enforced?

A network administrator is reviewing the fundamental operation of standard IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which two statements correctly describe the operational characteristics of standard IPv4 ACLs?

An enterprise network operations center is aligning its infrastructure security framework with Cisco security baseline recommendations. Match each security program element or access control type on the left to its corresponding operational implementation on the right.

A network engineer is configuring digital certificate authentication for Cisco Identity Services Engine (ISE) and enterprise network infrastructure. To ensure proper certificate deployment and validation, the engineer must correctly identify the operational function of each Public Key Infrastructure (PKI) element. Match each PKI component on the left to its corresponding primary function on the right.

An enterprise LAN uses HSRP for gateway redundancy with interface tracking configured on Router R1 (currently Active). Router R2 is in the Standby state with preemption enabled. When R1's tracked WAN uplink interface fails, a sequence of failover actions takes place. Place the operational steps in the correct chronological order from first to last.

A network engineer is selecting file transfer protocols to manage system images and configuration backups for enterprise edge routers. Which two statements accurately describe how TFTP and FTP differ in their underlying transport and operational characteristics?