Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 661Question →

A network administrator applies an extended IPv4 Access Control List (ACL) containing only a single rule to an interface: `access-list 100 permit tcp host 192.168.1.10 host 10.0.0.5 eq 80`. What happens when a host with IP address 192.168.1.11 attempts to send HTTP traffic to 10.0.0.5?

Show answer & explanation

Answer: The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

Answer

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.
Every Cisco IPv4 Access Control List ends with an invisible implicit deny statement (implicit deny ip any any). Because the single configured line only permits traffic from 192.168.1.10, any packet coming from 192.168.1.11 fails to match rule 1 and is dropped by the implicit deny clause.

Step-by-Step Solution

1
Evaluate the incoming packet details against the ACL rule.
Host 192.168.1.11 does not match source IP host 192.168.1.10 in line 1.
The configured line specifically permits traffic only from host 192.168.1.10.
2
Proceed to subsequent lines in the ACL.
The packet hits the unwritten implicit deny statement at the end of the list.
All Cisco IOS IPv4 ACLs end with an implicit 'deny ip any any' rule.
3
Determine the forwarding decision.
The router drops the packet from host 192.168.1.11.
Traffic that fails to match any explicit permit line is denied.

Key Concept

Implicit Deny in IPv4 Access Control Lists
Question 662Question →

A network administrator configures the following IPv4 extended named Access Control List (ACL) on a Cisco IOS router to control access to an internal application server at IP address 192.168.50.10:

text
ip access-list extended APP_FILTER
10 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 80
20 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 443
30 deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10
40 permit ip host 10.10.20.5 host 192.168.50.10

The ACL is applied outbound on GigabitEthernet0/1. An administrator attempts an SSH connection (TCP port 22) from management host 10.10.20.5 to the application server (192.168.50.10), while a user on host 10.10.20.100 attempts a web connection (TCP port 80) to the same server.

Which statement accurately describes how the router processes these two traffic flows?

Show answer & explanation

Answer: The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

Answer

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.
Cisco IOS Access Control Lists process statements sequentially in top-down numerical order. For HTTP traffic (port 80) originating from 10.10.20.100, sequence 10 matches the subnet source 10.10.20.0/24, destination host 192.168.50.10, and TCP port 80, allowing the flow immediately. For SSH traffic (port 22) originating from 10.10.20.5, sequences 10 and 20 fail to match due to destination port mismatches (80 and 443). Sequence 30 specifies protocol 'ip', which encompasses all Layer 4 protocols (including TCP/22), matching host 10.10.20.5 within the 10.10.20.0/24 subnet and dropping the packet. Sequence 40 is never reached for host 10.10.20.5 because sequence 30 matches first.

Step-by-Step Solution

1
Evaluate the HTTP flow (Source: 10.10.20.100, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 80) against sequence 10.
Sequence 10 permits TCP traffic from 10.10.20.0/24 to host 192.168.50.10 on port 80. Match found; processing stops and traffic is permitted.
Top-down evaluation stops immediately at the first matching entry.
2
Evaluate the SSH flow (Source: 10.10.20.5, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 22) against sequence 10 and 20.
Port 22 does not match port 80 (sequence 10) or port 443 (sequence 20). Evaluation moves to sequence 30.
Extended ACLs require all specified criteria (protocol, source, destination, port) to match.
3
Evaluate the SSH flow against sequence 30 (deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10).
Host 10.10.20.5 is within 10.10.20.0/24, destination is 192.168.50.10, and 'ip' matches all IP protocols including TCP. Match found; traffic is denied.
Sequence 30 catches all remaining IP traffic from the subnet before sequence 40 can ever be reached.

Key Concept

Top-Down Sequential Processing in Cisco IPv4 Extended ACLs
Question 663Question →

A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?

Show answer & explanation

Answer: Local switch authentication fallback relies solely on the local database credentials (something you know), omitting the secondary possession factor managed by the offline central AAA server.

Answer

Local switch authentication fallback relies solely on local database credentials (something you know), which omits the secondary possession factor (dynamic token/OTP) handled by the central AAA infrastructure.
The correct answer highlights that local network device databases maintain static passwords (knowledge factors) but typically lack integration with time-based one-time password (TOTP) generators or push notifications (possession factors). When a central AAA server is unreachable and authentication falls back to the local database, the access control degrades from multi-factor to single-factor authentication.

Step-by-Step Solution

1
Analyze the authentication factors in normal operation versus fallback mode.
Normal AAA operation combines a static password (knowledge factor) and a dynamic OTP token (possession factor).
MFA requires two or more distinct categories of authentication factors.
2
Evaluate local router/switch database capabilities.
Local switch user accounts store hash values of local passwords/secrets and cannot natively validate dynamic RADIUS/TACACS+ TOTP security tokens.
Local databases act as a emergency single-factor fallback unless specialized external key hardware is attached.
3
Identify the root cause of the MFA bypass.
Fallback to local authentication drops the possession factor, resulting in single-factor authentication.
Centralized RADIUS/TACACS+ failure isolates the secondary factor provider.

Key Concept

Multi-Factor Authentication (MFA) and Fallback Security Policies
Question 664Question →

A network security administrator is configuring digital certificate services and Multi-Factor Authentication (MFA) to secure management sessions on enterprise network infrastructure. Which of the following statements accurately describe digital certificate verification and MFA factor rules? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The verifying client validates the Certificate Authority (CA) digital signature on a presented certificate by using the public key of the issuing CA.; Effective Multi-Factor Authentication requires combining credentials from at least two distinct factor categories, such as a passphrase and a hardware OTP token.

Answer

The correct statements are that certificate verification requires validating the CA's digital signature using the CA's public key, and that MFA requires combining credentials from at least two distinct authentication factor categories (such as a passphrase and an OTP token).
Verifying a digital certificate involves checking the issuing CA's signature using that CA's public key. For MFA, authentication requires at least two independent factor types (such as something you know combined with something you have).

Step-by-Step Solution

1
Analyze certificate validation mechanics.
Digital certificates are signed by a trusted Certificate Authority (CA). Receivers verify the validity of the signature using the CA's public key.
This establishes the chain of trust in Public Key Infrastructure (PKI).
2
Analyze Multi-Factor Authentication (MFA) requirements.
MFA requires combining factors from different categories (Knowledge, Possession, Inherence). Combining a passphrase (something you know) with a hardware token (something you have) fulfills MFA requirements.
Using two items from the same category (e.g., two passwords) is multi-step authentication, not multi-factor authentication.

Key Concept

PKI Certificate Verification and MFA Authentication Factor Requirements
Question 665Question →

A network engineer configures the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to filter traffic between host 10.20.5.1510.20.5.15 and web server 192.168.100.50192.168.100.50:

text
ip access-list extended SECURE_VLAN
deny icmp host 10.20.5.15 host 192.168.100.50
permit tcp host 10.20.5.15 host 192.168.100.50 eq 80
permit tcp host 10.20.5.15 host 192.168.100.50 eq 443

Which two statements accurately describe the traffic filtering behavior enforced by this ACL? (Choose two.)

Select all that apply

Show answer & explanation

Answer: ICMP packets sent from host 10.20.5.1510.20.5.15 targeting server 192.168.100.50192.168.100.50 are explicitly dropped by the first entry.; UDP traffic originating from host 10.20.5.1510.20.5.15 bound for server 192.168.100.50192.168.100.50 is dropped due to the implicit deny clause at the end of the ACL.

Answer

The statement identifying that ICMP packets are explicitly dropped by the first entry and the statement noting that UDP traffic is dropped by the implicit deny clause are both correct.
The first entry in the ACL explicitly denies ICMP packets sent from host 10.20.5.1510.20.5.15 to host 192.168.100.50192.168.100.50. Additionally, because Cisco IPv4 ACLs automatically append an unwritten implicit deny clause (`deny ip any any`) at the end of the evaluation list, any protocol not explicitly permitted—such as UDP—is automatically dropped.

Step-by-Step Solution

1
Evaluate the first ACL statement against ICMP traffic
Statement 'deny icmp host 10.20.5.15 host 192.168.100.50' matches ICMP packets from host 10.20.5.15 to 192.168.100.50 and explicitly denies them.
Top-down ACL processing stops at the first matching rule.
2
Evaluate unlisted traffic types such as UDP or non-web TCP (e.g. port 22)
Unlisted traffic types do not match statements 1, 2, or 3 and hit the default 'deny ip any any' rule at the bottom.
All Cisco IOS ACLs end with an invisible implicit deny clause.
3
Evaluate directionality for return traffic originating from server 192.168.100.50
Return traffic has source 192.168.100.50 and destination 10.20.5.15, failing to match the source/destination fields of the permit rules.
Standard and Extended ACL statements evaluate traffic directional fields strictly as defined.

Key Concept

Top-down sequential processing and implicit deny clause evaluation in IPv4 Extended ACLs
Estimated Time:1m 30s
Question 666Question →

A network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to prevent ARP spoofing. DHCP snooping is enabled and functioning properly. However, several servers connected to untrusted access ports use statically assigned IP addresses, causing DAI to drop their legitimate ARP requests because they lack entries in the DHCP snooping binding database. Which configuration action should the administrator perform to permit ARP traffic from these static servers while maintaining DAI protection on VLAN 10?

Show answer & explanation

Answer: Configure an ARP Access Control List (ARP ACL) with static IP-to-MAC bindings and apply it to VLAN 10 using the ip arp inspection filter command.

Answer

Configure an ARP Access Control List (ARP ACL) with the static IP-to-MAC address mappings of the servers and apply it to VLAN 10 using the 'ip arp inspection filter' command.
Dynamic ARP Inspection (DAI) validates ARP requests and responses against the DHCP snooping binding database on untrusted ports. Because statically configured hosts do not send DHCP requests, they lack entries in the binding database. To prevent DAI from dropping legitimate traffic from these static hosts, administrators must create an ARP Access Control List (ARP ACL) with static IP-to-MAC mappings and map it to the VLAN using the 'ip arp inspection filter' command.

Step-by-Step Solution

1
Identify the cause of dropped ARP packets
DAI inspects ARP packets on untrusted ports by matching their IP and MAC addresses against the DHCP snooping binding database. Statically addressed hosts have no entries in this database, causing DAI to drop their packets.
DAI relies by default on the DHCP snooping binding table for validation.
2
Determine the correct mitigation mechanism for static IP hosts
Cisco IOS allows creating an ARP ACL (`arp access-list`) containing explicit `permit ip host <IP> mac host <MAC>` statements for static hosts.
ARP ACLs act as a static reference database alongside DHCP snooping for DAI validation.
3
Apply the ARP ACL to Dynamic ARP Inspection
Execute `ip arp inspection filter <arp-acl-name> vlan 10` in global configuration mode.
This command instructs DAI to check the ARP ACL before or instead of the DHCP snooping database for traffic on VLAN 10.

Key Concept

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Question 667Question →

A network administrator is creating an IPv4 extended Access Control List (ACL 105) to allow HTTPS access from host 192.168.10.5 to web server 10.0.0.5, block all other TCP traffic from the 192.168.10.0/24 subnet to the 10.0.0.0/8 network, and permit all remaining traffic. In what sequential order from top to bottom should these ACL statements be configured to enforce the intended policy correctly?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places the specific host permit rule first, followed by the broader subnet TCP deny rule, and ends with the general permit ip any any rule.
Cisco IOS ACL entries are evaluated sequentially from top to bottom. Specific permit statements (such as host-to-host HTTPS traffic) must always precede broader deny statements (such as an entire /24 subnet destination block). Finally, an explicit permit ip any any statement must be placed at the end to prevent unrelated traffic from being dropped by the hidden implicit deny rule.

Step-by-Step Solution

1
Place the specific host-to-host HTTPS permit statement at the top of the ACL.
HTTPS traffic from host 192.168.10.5 to host 10.0.0.5 is matched immediately and allowed.
Cisco IOS ACLs evaluate rules top-down sequentially and stop processing once a match is found. Specific exception rules must precede broader restrictive rules.
2
Place the subnet-wide TCP deny statement second.
All other TCP traffic originating from 192.168.10.0/24 to 10.0.0.0/8 is denied.
Placing this rule after the specific host exception ensures that only non-exempt TCP traffic from the subnet gets blocked.
3
Place the permit ip any any statement at the bottom of the ACL.
All remaining IP traffic that does not match the first two rules is explicitly allowed.
Without an explicit permit statement at the end of the ACL, unmatched traffic would be dropped by the implicit deny any rule at the end of ACL processing.

Key Concept

Access Control List sequential top-down processing and rule specificity
Question 668Question →

A host client on a remote subnetwork requires an IPv4 address assignment from a centralized server. Place the operational steps in the correct sequential order to illustrate how a Cisco router configured with `ip helper-address` processes and relays the initial discovery and offer messages.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the client broadcasting a DHCPDISCOVER packet on the local subnet. Next, the relay agent router intercepts the broadcast, inserts its ingress interface IP into the giaddr field, and forwards the packet as a unicast transmission to the DHCP server. The central DHCP server then matches the giaddr to its address pool and returns a unicast DHCPOFFER to the router's giaddr address. Finally, the router receives the DHCPOFFER and forwards it onto the local subnet to the host client.
The workflow follows standard DHCP relay behavior: (1) Host sends broadcast DHCPDISCOVER, (2) Relay agent populates the giaddr field with its interface IP and unicasts the request to the central server, (3) Server evaluates giaddr to select the subnet pool and unicasts DHCPOFFER back to giaddr, and (4) Relay agent forwards the offer to the local client.

Step-by-Step Solution

1
Identify host initialization
Host generates a local Layer 3 broadcast DHCPDISCOVER (0.0.0.0→255.255.255.2550.0.0.0 \rightarrow 255.255.255.255).
Clients without IP addresses must broadcast locally to locate an active DHCP server.
2
Identify relay agent header modification and forwarding
Router populates giaddr with its subinterface IP and unicasts the packet to the server address specified by the ip helper-address command.
Routers drop Layer 3 broadcasts by default; the helper address command enables broadcast-to-unicast conversion and inserts gateway context.
3
Identify server pool matching and reply
DHCP server matches the giaddr to the appropriate IP scope and sends a unicast DHCPOFFER back to the relay agent IP.
The central server uses the giaddr field to identify which remote subnet requires an IP lease.
4
Identify relay delivery to the client
Router receives the DHCPOFFER and delivers it to the target client on the local subnet.
The relay agent completes the forward relay process by sending the offer down to the originating host.

Key Concept

DHCP Relay Agent Operational Processing Sequence
Question 669Question →

A network administrator is configuring an extended IPv4 access control list (ACL) named `FILTER_INTERNAL` on GigabitEthernet0/0/0 (inbound) on a Cisco IOS router. The objective is to enforce the following security policy for internal users on network 10.50.10.0/2410.50.10.0/24:

1. Allow HTTPS traffic (TCP port 443) to the DMZ web server at 172.16.100.50172.16.100.50.
2. Allow DNS domain queries (UDP port 53) to the DMZ DNS server at 172.16.100.53172.16.100.53.
3. Explicitly drop and log all other traffic from 10.50.10.0/2410.50.10.0/24 directed to any host in the DMZ subnet (172.16.100.0/24172.16.100.0/24).
4. Permit all remaining traffic originating from 10.50.10.0/2410.50.10.0/24 destined to other corporate subnets or the Internet.

Which two configuration statements or operational logic requirements must be included in the ACL design to satisfy these requirements without blocking non-DMZ traffic?

Select all that apply

Show answer & explanation

Answer: An explicit statement `permit ip 10.50.10.0 0.0.0.255 any` must be placed at the end of the ACL to override the implicit deny any clause.; The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be sequenced immediately after the specific HTTPS and DNS permit rules.

Answer

The correct configuration requires placing the subnet deny statement (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`) after the specific HTTPS and DNS permit entries, as well as appending an explicit `permit ip 10.50.10.0 0.0.0.255 any` at the end of the ACL.
Cisco IOS IPv4 Access Control Lists evaluate entries sequentially from top to bottom. Specific permit rules for host-level services (HTTPS and DNS) must be evaluated before broader subnet restrictions (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`). Furthermore, because every ACL terminates with an implicit `deny ip any any` rule, an explicit `permit ip 10.50.10.0 0.0.0.255 any` statement must be placed at the end of the ACL structure to allow non-DMZ traffic to pass.

Step-by-Step Solution

1
Analyze top-down sequential processing of Cisco IOS ACLs.
Specific permit lines for HTTPS (TCP 443 to 172.16.100.50172.16.100.50) and DNS (UDP 53 to 172.16.100.53172.16.100.53) must precede broad deny statements for the 172.16.100.0/24172.16.100.0/24 subnet.
If a broad subnet deny rule appears higher in the ACL sequence, matching packets are dropped before reaching lower permit statements.
2
Evaluate subnet isolation and logging requirement.
Adding `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` directly after the permit rules catches and logs any other attempt to access the DMZ network.
This explicitly satisfies requirement 3 without interfering with legitimate HTTPS/DNS flows.
3
Account for the default implicit deny behavior.
Adding `permit ip 10.50.10.0 0.0.0.255 any` at the end prevents non-DMZ traffic from being dropped.
All IPv4 Cisco ACLs end with an unwritten `deny ip any any` entry. Without an explicit permit rule at the end, all traffic to external networks or other subnets would be discarded.

Key Concept

Top-down ACL rule evaluation sequence and handling of the implicit deny any clause
Question 670Question →

A network administrator wants to restrict access on a switch port to an authorized end device. If an unauthorized MAC address sends traffic to the port, the interface must drop the frames, avoid incrementing the security violation counter, and avoid disabling the port. Which port security violation mode meets this requirement?

Show answer & explanation

Answer: protect

Answer

The protect violation mode silently drops packets from unknown MAC addresses without incrementing the security violation counter or placing the interface into an err-disabled state.
The protect violation mode silently drops packets with unauthorized source MAC addresses. It does not increment the interface's security violation counter, nor does it send SNMP traps or Syslog notifications.

Step-by-Step Solution

1
Analyze the operational requirements
The requirement specifies dropping unauthorized frames silently without raising violation counters or bringing down the link.
Port security violation modes differ in how they react to unauthorized MAC addresses.
2
Evaluate Port Security violation mode options
Protect mode drops frames silently without counter increments. Restrict mode drops frames but logs violations and increments counters. Shutdown mode err-disables the interface.
Matching the behavior to the protect keyword fulfills all prompt criteria.

Key Concept

Port Security Violation Modes (Protect, Restrict, Shutdown)
Question 671Question →

An enterprise network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 using the command `ip arp inspection vlan 10`. Host devices dynamically receiving IPv4 configuration via DHCP operate without issue. However, a critical server connected to access switchport GigabitEthernet0/2 in VLAN 10 is configured with a static IPv4 address (192.168.10.50/24192.168.10.50/24) and MAC address (0011.2233.44550011.2233.4455). Network telemetry indicates that all network traffic from this server is dropped because DAI marks its ARP packets as invalid. Which configuration step correctly resolves the ARP packet drop for this static host while maintaining active DAI protection on VLAN 10?

Show answer & explanation

Answer: Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.

Answer

Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.
Dynamic ARP Inspection (DAI) intercepts and validates all ARP packets on untrusted switch interfaces against the DHCP snooping binding database. Statically addressed hosts do not use DHCP and therefore lack entries in this database, causing DAI to discard their ARP traffic. To resolve this issue without disabling DAI, an administrator must create an ARP access list (`arp access-list`) defining the static IP and MAC address pairing, and associate it with the VLAN using `ip arp inspection filter <acl-name> vlan <vlan-id>`.

Step-by-Step Solution

1
Diagnose the root cause of packet drops under Dynamic ARP Inspection (DAI)
DAI intercepts ARP requests and responses on untrusted ports and validates the sender's IP-to-MAC mapping against the DHCP snooping binding database. Because the server uses a static IP address, no DHCP transaction occurred, resulting in no database entry and subsequent ARP packet drops.
Static IP devices naturally lack dynamic entries in the switch DHCP snooping binding database.
2
Identify the Cisco IOS mechanism for authorizing non-DHCP static hosts under DAI
Define an ARP Access Control List (`arp access-list <name>`) and add a permit entry binding the host's static IP (192.168.10.50192.168.10.50) to its MAC address (0011.2233.44550011.2233.4455).
ARP ACLs provide a static verification table for DAI validation.
3
Apply the static ARP ACL to the VLAN inspection filter
Execute `ip arp inspection filter <acl-name> vlan 10` in global configuration mode.
This permits the static host's ARP packets to pass inspection while preserving DAI security enforcement for all other hosts in VLAN 10.

Key Concept

Dynamic ARP Inspection (DAI) Static ARP Access List Filtering
Question 672Question →

Match each Layer 2 security mechanism or feature component on the left with its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

DHCP Snooping Binding Database
Dynamic ARP Inspection (DAI)
Port Security Sticky MAC Learning
DAI Interface Rate Limiting

Matches

Show answer & explanation

Answer

DHCP Snooping Binding Database maps to tracking client MAC, IP, lease, VLAN, and interface details. Dynamic ARP Inspection matches intercepting and validating IP-to-MAC bindings in ARP packets on untrusted ports. Port Security Sticky MAC Learning matches dynamically converting learned MAC addresses into running configuration entries. DAI Interface Rate Limiting matches enforcing a maximum threshold of incoming ARP packets per second.
Each feature component directly performs its specified security role: DHCP Snooping creates the authoritative binding database; DAI utilizes that database to validate ARP packets on untrusted interfaces; Sticky MAC learning writes dynamically learned MACs into the running configuration; and DAI rate limiting protects switch hardware by capping incoming ARP frames per second.

Step-by-Step Solution

1
Analyze the operational function of DHCP Snooping.
DHCP snooping acts as a firewall between untrusted hosts and DHCP servers, building a binding database containing IP address, MAC address, lease time, bind type, VLAN number, and interface information.
This database serves as the authoritative mapping reference for other Layer 2 features such as DAI and IP Source Guard.
2
Analyze the operational function of Dynamic ARP Inspection (DAI).
DAI inspects ARP packets on untrusted interfaces to prevent ARP poisoning and man-in-the-middle attacks.
DAI discards invalid ARP packets where the Sender IP and Sender MAC do not match an entry in the DHCP snooping binding database.
3
Analyze the function of sticky MAC learning in Port Security.
Sticky MAC learning dynamically converts learned MAC addresses into sticky addresses that are automatically added to the running-config file.
This eliminates the need to manually enter static MAC addresses on switchports while maintaining MAC persistence across reboots if saved.
4
Analyze DAI interface rate limiting.
Enforcing an ARP rate limit drops excess ARP packets when incoming packet rates exceed the configured threshold per second.
Rate limiting protects the switch CPU from control plane starvation caused by ARP flooding attacks.

Key Concept

Layer 2 Security Feature Operation and Interdependencies
Question 673Question →

A network administrator needs to back up a Cisco IOS router's running configuration to a remote FTP server that requires user authentication. Arrange the Cisco IOS CLI operational and configuration steps in the correct chronological sequence to perform this transfer.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with defining global FTP credentials ('ip ftp username' / 'ip ftp password'), testing reachability via 'ping', issuing 'copy running-config ftp:', supplying the destination address and file details at the CLI prompts, and finally verifying the completed transfer output.
FTP file management in Cisco IOS relies on control connection authentication and valid network routing. Pre-defining FTP credentials via global configuration ensures seamless connection establishment. Verifying IP reachability with ping confirms path availability before starting data transfer. The interactive 'copy running-config ftp:' command guides the user through target address and filename parameters, culminating in confirmation of the completed transfer.

Step-by-Step Solution

1
Set the global FTP authentication credentials in global configuration mode.
The IOS device is pre-configured to automatically supply credentials when opening FTP control connections.
FTP requires authentication; configuring 'ip ftp username' and 'ip ftp password' prevents connection drops during transfer.
2
Perform a ping to the FTP server IP address.
ICMP reply confirms Layer 3 IP routing and connectivity to the remote server.
Attempting a file transfer without basic connectivity verification leads to timeout failures.
3
Issue the copy running-config ftp: command in privileged EXEC mode.
Cisco IOS starts the interactive copy wizard for FTP.
This command specifies the running configuration as the source data stream.
4
Provide the remote IP address, destination filename, and confirm prompts.
IOS opens TCP port 21 control connection to the FTP server and streams the file over TCP port 20.
Interactive prompts ensure the file is routed to the exact server path designated by the administrator.
5
Examine the CLI summary output indicating bytes copied and elapsed time.
Confirmation that the configuration file was written cleanly to the remote storage directory.
Verifying transfer statistics ensures early detection of incomplete or corrupted transfers.

Key Concept

FTP requires pre-configuration of authentication credentials or URL-formatted inline credentials in Cisco IOS prior to initiating copy operations.
Question 674Question →

A network administrator is implementing administrative security controls for enterprise network switches and configuring Public Key Infrastructure (PKI) certificate validation for HTTPS management access. When evaluating multi-factor authentication (MFA) factor categories and PKI digital certificate validation mechanics, which two statements are correct?

Select all that apply

Show answer & explanation

Answer: An RSA hardware key fob generating a time-based passcode combined with a user password satisfies MFA by combining a possession factor with a knowledge factor.; During TLS certificate verification, the client uses the issuer Certificate Authority's public key to validate the digital signature on the switch certificate.

Answer

The correct statements are that combining an RSA hardware key fob passcode with a password satisfies MFA by using possession and knowledge factors, and that during TLS certificate verification, the client relies on the issuing Certificate Authority's public key to validate the switch certificate's digital signature.
Combining a hardware token generator (something you have) with a user password (something you know) uses two distinct authentication factor categories, satisfying true MFA requirements. Additionally, in PKI validation, clients verify the CA's signature on a switch's X.509 certificate using the CA's public key contained in their local trust store.

Step-by-Step Solution

1
Analyze the authentication factors in the proposed MFA scenario.
A hardware token generating a one-time passcode is a physical possession factor ('something you have'), while a standard password is a knowledge factor ('something you know'). Combining two distinct categories fulfills multi-factor authentication requirements.
MFA requires authentication elements from at least two different categories among knowledge, possession, and inherence.
2
Evaluate the PKI digital certificate signature verification mechanism.
When a Certificate Authority (CA) issues an X.509 certificate to a switch, the CA signs the certificate hash using the CA's private key. The connecting client verifies this signature using the CA's public key contained in its trusted root store.
Asymmetric cryptography dictates that data signed by a private key can only be verified using the corresponding public key.
3
Identify misclassifications and incorrect cryptographic roles in the remaining choices.
Digital certificates function as possession factors (not knowledge factors), signature verification utilizes the CA public key (never the switch private key), and password policies regulate password properties rather than session transport encryption.
Distinguishing between factor types, public/private key roles in PKI, and authentication versus transport encryption avoids operational security misconceptions.

Key Concept

Multi-Factor Authentication (MFA) Factor Classification and PKI Digital Certificate Verification
Question 675Question →

An network administrator is troubleshooting traffic drops on switch port GigabitEthernet1/0/10. The interface is configured with Layer 2 security features including DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security in restrict mode. The output of `show ip dhcp snooping binding` displays a valid IP-to-MAC entry for the connected client on GigabitEthernet1/0/10. However, executing `show port-security interface g1/0/10` shows that the `SecurityViolation` counter is actively incrementing every time the host attempts to transmit data, while the port status remains operational (`secure-up`). Which scenario accounts for these symptoms?

Show answer & explanation

Answer: The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.

Answer

The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.
The correct answer accounts for both symptoms: a valid DHCP Snooping entry and an incrementing Port Security violation counter. When a host NIC is replaced, the new MAC address successfully requests a DHCP lease (creating a valid DHCP Snooping database entry and allowing DAI validation to pass). However, because Port Security was configured with sticky MAC learning or a explicit MAC limit, the newly introduced MAC address violates port security parameters. In restrict mode, Port Security drops non-matching frames and increments the SecurityViolation counter without disabling the port.

Step-by-Step Solution

1
Analyze the reported operational symptoms
Port status is secure-up, SecurityViolation counter is incrementing, and DHCP Snooping binding table contains a valid entry.
Identify which security feature is actively dropping traffic.
2
Evaluate Port Security violation mode behavior
Restrict mode drops frames from unauthorized source MAC addresses, increments the violation counter, and logs a Syslog message while keeping the interface up.
The incrementing violation counter indicates Port Security is triggering, not DAI or DHCP Snooping.
3
Correlate DHCP Snooping binding presence with Port Security failure
The host successfully completed a DHCP exchange (populating the binding table), but its source MAC address does not match the statically or dynamically learned sticky MAC address on the port security database.
A replaced network interface card generates a new MAC address. DHCP Snooping will grant an IP and record the new MAC, but Port Security will block the frame if the maximum MAC address limit or specific sticky MAC entry is exceeded.

Key Concept

Port Security violation modes and multi-feature Layer 2 security interaction
Estimated Time:2m 0s
Question 676Question →

A network administrator is deploying Layer 2 security controls on a Cisco Catalyst switch. Which two statements accurately describe the operational requirements and default behaviors of DHCP Snooping? (Select two.)

Select all that apply

Show answer & explanation

Answer: DHCP server messages such as DHCP OFFER and DHCP ACK are dropped when received on untrusted ports.; DHCP snooping must be enabled globally on the switch as well as explicitly enabled for target VLANs.

Answer

DHCP server response messages (OFFER/ACK) received on untrusted interfaces are dropped, and DHCP snooping requires both global enablement and VLAN-specific configuration.
DHCP snooping categorizes switch interfaces into trusted and untrusted states. By default, all ports are untrusted and drop DHCP server responses (such as OFFER and ACK) to prevent rogue DHCP servers. Additionally, enabling the feature requires both global activation ('ip dhcp snooping') and VLAN-specific activation ('ip dhcp snooping vlan').

Step-by-Step Solution

1
Determine default port trust behavior for DHCP Snooping.
When DHCP snooping is enabled, all switch interfaces default to an untrusted state. Untrusted ports block incoming DHCP server response messages (OFFER, ACK, LEASEQUERY) to prevent rogue DHCP server attacks.
Restricting server traffic on user-facing access ports is the primary security function of DHCP snooping.
2
Identify mandatory switch configuration steps.
DHCP snooping requires global activation using the 'ip dhcp snooping' command in global configuration mode, as well as enabling the feature on specific VLANs via 'ip dhcp snooping vlan <vlan-id>'.
Both global and VLAN configuration commands are necessary for the switch to begin inspecting DHCP traffic.

Key Concept

DHCP Snooping Operational Rules and Port Trust Behavior
Question 677Question →

A network administrator configures switchport port security on a Cisco Catalyst switch access port using the command 'switchport port-security mac-address sticky'. An end device is connected to the port, and the switch dynamically learns its MAC address into the running configuration. The administrator verifies full network connectivity, but does not enter any additional CLI commands before the switch undergoes an unexpected reboot. Which outcome occurs regarding the port security bindings after the switch reboots?

Show answer & explanation

Answer: The dynamically learned sticky MAC address is lost, requiring the switch to relearn the address upon new traffic arrival.

Answer

The dynamically learned sticky MAC address is lost, requiring the switch to relearn the address upon new traffic arrival.
When port security is configured with sticky MAC address learning, the switch automatically converts dynamically learned MAC addresses into sticky secure MAC addresses and places them into the running configuration in volatile RAM. Because the running configuration was not saved to NVRAM prior to the switch reboot, all dynamically added sticky MAC entries are erased, requiring the switch to relearn host MAC addresses once traffic resumes.

Step-by-Step Solution

1
Analyze how sticky MAC addresses function in switch memory.
Sticky MAC addresses learned by port security are appended directly to the active running configuration stored in RAM.
The switch dynamic sticky learning feature acts as a shortcut to add static configuration lines into running-config without manual MAC typing.
2
Evaluate the effect of a switch reboot when running configuration has not been saved.
RAM contents are lost during a reboot, reverting the switch to the startup configuration stored in NVRAM.
Without executing 'copy running-config startup-config' or 'write memory', any dynamically learned sticky MAC entries are purged.

Key Concept

Port Security Sticky MAC Persistence
Estimated Time:1m 15s
Question 678Question →

A network technician is reviewing operational characteristics for standard IPv4 Access Control Lists (ACLs) on a Cisco router. Which of the following statements regarding standard IPv4 ACLs are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Standard ACLs filter network traffic based strictly on the source IPv4 address.; Standard ACLs should generally be placed as close to the destination network as possible.

Answer

Standard IPv4 ACLs filter traffic based only on the source IPv4 address and should be applied as close to the destination as possible to prevent unintentionally blocking traffic intended for other locations.
Standard IPv4 ACLs evaluate packets strictly by their source address. Because they lack the ability to inspect destination addresses or service ports, Cisco best practice is to place standard ACLs as close to the destination network as possible to avoid dropping legitimate traffic destined for other networks.

Step-by-Step Solution

1
Identify the packet header fields evaluated by standard IPv4 ACLs.
Standard ACLs inspect only the source IPv4 address of incoming packets.
Standard ACL syntax (numbered 1-99 and 1300-1399) does not permit specifying destination addresses or protocol port numbers.
2
Determine the optimal interface placement for standard IPv4 ACLs.
Place standard ACLs near the destination network.
Filtering strictly by source address near the source router would prevent that host from reaching any other destination network.
3
Verify standard ACL default end behavior.
Recognize the presence of the implicit deny rule.
Cisco IOS automatically appends an invisible deny all statement at the end of every ACL list.

Key Concept

Standard IPv4 ACL Operational Rules and Recommended Placement
Question 679Question →

A network engineer is configuring a Cisco IOS router to act as a local DHCP server for hosts in the 10.0.10.0/2410.0.10.0/24 subnet. The default gateway address 10.0.10.110.0.10.1 and static server addresses 10.0.10.210.0.10.2 through 10.0.10.1010.0.10.10 must be reserved and never assigned dynamically to DHCP clients. Which two configuration steps are required to properly exclude these addresses and define the default gateway parameter? (Select two.)

Select all that apply

Show answer & explanation

Answer: Execute `ip dhcp excluded-address 10.0.10.1 10.0.10.10` in global configuration mode.; Execute `default-router 10.0.10.1` in DHCP pool configuration mode.

Answer

The correct steps are executing `ip dhcp excluded-address 10.0.10.1 10.0.10.10` in global configuration mode to reserve static addresses and executing `default-router 10.0.10.1` in DHCP pool configuration mode to define the default gateway for clients.
To configure a Cisco IOS router as a DHCP server, static IP addresses (such as gateway and server IPs) are excluded using `ip dhcp excluded-address` in global configuration mode. Pool options like the default gateway are configured using `default-router` inside DHCP pool configuration mode (`config-dhcp#`).

Step-by-Step Solution

1
Identify the proper mode for excluding IP addresses from DHCP dynamic allocation.
Recognize that `ip dhcp excluded-address <low-ip> [high-ip]` must be configured in global configuration mode.
Cisco IOS requires DHCP address exclusions to be defined globally before or after pool creation so the DHCP engine reserves those addresses across matching pools.
2
Identify the command for setting host network parameters such as the default gateway within a pool.
Select `default-router 10.0.10.1` within DHCP pool configuration mode (`config-dhcp#`).
Pool-specific parameters provided to clients, such as default gateways, DNS servers, and domain names, are configured under the specific DHCP pool.

Key Concept

Cisco IOS DHCP Server Configuration and Address Exclusion Syntax
Question 680Question →

A network engineer completes the configuration of Layer 2 security features on a Cisco Catalyst switch connecting client workstations to an upstream router. After enabling DHCP snooping and Dynamic ARP Inspection (DAI) globally and on VLAN 20, client devices on untrusted access ports fail to obtain IPv4 addresses from the DHCP server, and ARP packets arriving from the default gateway on interface GigabitEthernet0/1 are discarded by DAI. Which two configuration steps are required on interface GigabitEthernet0/1 to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure `ip dhcp snooping trust` on interface GigabitEthernet0/1 to allow incoming DHCP server offer and acknowledgment messages.; Configure `ip arp inspection trust` on interface GigabitEthernet0/1 to bypass DAI validation for incoming ARP traffic from the router.

Answer

Configure `ip dhcp snooping trust` and `ip arp inspection trust` on interface GigabitEthernet0/1.
When DHCP snooping and DAI are enabled on a VLAN, interfaces default to an untrusted state. Uplink interfaces connected to legitimate DHCP servers and routers must be configured as trusted using `ip dhcp snooping trust` and `ip arp inspection trust` so server replies and gateway ARP messages are permitted.

Step-by-Step Solution

1
Identify the cause of DHCP packet drops on uplink GigabitEthernet0/1.
By default, all switch interfaces are untrusted when DHCP snooping is enabled, causing the switch to drop incoming DHCP server reply messages (OFFER/ACK). Setting `ip dhcp snooping trust` on GigabitEthernet0/1 permits these responses.
Client ports require an authorized path to receive DHCP leases from the server.
2
Identify the cause of ARP packet drops on uplink GigabitEthernet0/1.
By default, DAI treats all ports as untrusted and intercepts all ARP traffic for validation against the DHCP snooping binding table. Setting `ip arp inspection trust` on GigabitEthernet0/1 bypasses this check for legitimate router ARP messages.
Router ARP packets arriving from the core network might not exist in the local DHCP snooping binding table and will be dropped unless the interface is trusted.

Key Concept

Layer 2 Security Interface Trust States for DHCP Snooping and DAI
Estimated Time:1m 30s
PreviousPage 34 / 100Next
All practice questions — Cisco CCNA | Examkin