Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 721Question →

Match each operational feature or interface component to its correct classification when comparing traditional network architectures with controller-based software-defined networks (SDN).

Click a left item, then click its matching right item

Items

Routing protocols run locally on each device to compute paths independently
RESTful APIs used by management applications to communicate policy intent to the network controller
Protocols such as NETCONF or OpenFlow used by the controller to program network device forwarding tables
Manual node-by-node configuration applied directly via SSH or console command-line interface

Matches

Show answer & explanation

Answer

Independent protocol path computation matches Traditional Network Distributed Control Plane; RESTful APIs for application-to-controller policy intent match Controller-Based Northbound Interface (NBI); NETCONF/OpenFlow for controller-to-device programming matches Controller-Based Southbound Interface (SBI); Node-by-node CLI configuration matches Traditional Network Decentralized Management Plane.
In traditional networking, control plane processing and management operations are decentralized across every network node. Conversely, controller-based SDN centralizes the control plane into a single logical controller, using Northbound APIs (REST) to expose network services to applications and Southbound APIs (NETCONF, RESTCONF, OpenFlow) to program policy onto hardware devices.

Step-by-Step Solution

1
Analyze how control plane decisions are processed in traditional networks.
Identify that traditional networks distribute control plane processing across every individual device.
Each switch and router maintains its own control plane intelligence and routing protocols.
2
Identify the API direction connecting applications to the central controller.
Recognize that interfaces facing upward toward applications are Northbound Interfaces (NBIs).
Northbound APIs allow software applications to programmatically convey network requirements to the SDN controller.
3
Identify the API direction connecting the central controller to forwarding hardware.
Recognize that interfaces facing downward toward network nodes are Southbound Interfaces (SBIs).
Southbound protocols like NETCONF, RESTCONF, and OpenFlow carry instructions from the controller to network switches and routers.
4
Evaluate traditional device management practices.
Identify manual box-by-box CLI access as a characteristic of traditional management planes.
Unlike controller-driven centralized policy pushing, traditional management relies on individual device CLI interaction.

Key Concept

Architectural plane separation and interface distinction between traditional and controller-based networks
Estimated Time:1m 0s
Question 722Question →

An enterprise organization is updating its Cisco Wireless LAN Controller (WLC) security baseline to align with WPA3 specification standards across all branch locations. Which TWO architectural and security protocol enhancements are introduced when transitioning infrastructure from WPA2 to WPA3? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: WPA3-Personal replaces the PSK 4-way handshake with Simultaneous Authentication of Equals (SAE) to provide forward secrecy and mitigate offline dictionary attacks.; WPA3 mandates the implementation of Protected Management Frames (PMF / IEEE 802.11w) for all client connections to protect unicast and multicast management actions against spoofing.

Answer

WPA3 introduces key cryptographic enhancements: WPA3-Personal replaces standard PSK handshakes with Simultaneous Authentication of Equals (SAE) to guard against offline brute-force attacks, and WPA3 mandates Protected Management Frames (PMF/802.11w) to stop management frame spoofing.
WPA3 enhances wireless network security by introducing Simultaneous Authentication of Equals (SAE) for Personal modes to defend against offline dictionary attacks and enforcing Protected Management Frames (PMF / IEEE 802.11w) to stop deauthentication attacks.

Step-by-Step Solution

1
Analyze WPA3-Personal authentication improvements over WPA2-PSK.
Identified that WPA3-Personal replaces the 4-way PSK handshake with Simultaneous Authentication of Equals (SAE), preventing offline dictionary attacks even with weak passwords.
SAE uses Dragonfly key exchange providing forward secrecy.
2
Evaluate Management Frame Protection requirements in WPA3.
Identified that IEEE 802.11w (PMF) is mandatory for WPA3 connections.
PMF prevents attackers from forging deauthentication or disassociation frames to cause denial of service.
3
Evaluate cipher suite and enterprise authentication claims.
Disqualified TKIP as legacy/insecure and verified that 802.1X authentication remains a requirement for enterprise mode.
WPA3 mandates strong ciphers (CCMP/GCMP) and standard RADIUS/802.1X for WPA3-Enterprise.

Key Concept

WPA3 Wireless Security Enhancements (SAE and PMF)
Estimated Time:1m 30s
Question 723Question →

A network administrator is upgrading a wireless deployment to implement the WPA3-Personal security standard. Which key exchange mechanism does WPA3-Personal introduce to protect against offline dictionary attacks?

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE)

Answer

Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the mandatory replacement for Pre-Shared Key (PSK) authentication in WPA3-Personal. SAE utilizes the Dragonfly handshake protocol, which prevents attackers from performing offline dictionary attacks against captured wireless handshakes.

Step-by-Step Solution

1
Identify the key security enhancement introduced specifically in WPA3-Personal over WPA2-Personal.
WPA3-Personal replaces the standard PSK 4-way handshake with a key exchange protocol resistant to password guessing attacks.
WPA2-Personal relied on a pre-shared key (PSK) 4-way handshake that was susceptible to offline dictionary attacks if an attacker captured the initial handshake frames.
2
Match the protocol mechanism name with its function in WPA3.
Simultaneous Authentication of Equals (SAE) is the Dragonfly-based key exchange mechanism that fulfills this requirement.
SAE provides forward secrecy and prevents brute-force passive offline dictionary cracking attempts even when weak passphrases are used.

Key Concept

WPA3-Personal SAE Key Exchange Mechanism
Question 724Question →

Place the operational events in chronological order from first to last during an HSRP interface tracking failover scenario, assuming preemption is enabled on the standby router.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order for HSRP interface tracking failover is: (1) The monitored uplink interface on the Active router fails; (2) The Active router decrements its HSRP priority; (3) The Active router broadcasts an HSRP Hello packet with the reduced priority; (4) The Standby router detects its higher priority and sends a Coup message; (5) The newly promoted Active router broadcasts a Gratuitous ARP to update Layer 2 MAC address tables.
HSRP interface tracking failover follows a precise operational order: First, the tracked uplink interface fails on the Active router. Second, the Active router decrements its configured HSRP priority locally. Third, it advertises this reduced priority in an HSRP Hello packet. Fourth, the Standby router (with preemption enabled) receives the Hello, recognizes its priority advantage, and sends a Coup message to claim the Active role. Finally, the newly active router sends a Gratuitous ARP (GARP) to refresh Layer 2 switch forwarding tables for the virtual MAC address.

Step-by-Step Solution

1
Identify the initial trigger for tracking failover.
The monitored uplink interface fails, activating the tracking object on the Active router.
Interface tracking relies on physical or logical link state changes to initiate priority modification.
2
Determine the immediate local router response to the trigger.
The Active router reduces its operational priority by the configured decrement value.
HSRP tracking dynamically adjusts priority values to allow healthier backup routers to take over.
3
Determine how the priority change is communicated to the network.
The Active router advertises the lowered priority in its next HSRP Hello packet.
Peers must receive an updated Hello packet to learn about priority changes on neighboring devices.
4
Analyze the reaction of the Standby router.
The Standby router notices its priority is superior and sends a Coup message to assume the Active role.
Preemption permits a router with higher priority to claim the Active role immediately upon detecting lower priority Hellos.
5
Identify how Layer 2 network topology adjusts to the new Active router.
The newly active router broadcasts a Gratuitous ARP to force switches to update their MAC tables for the Virtual MAC.
Layer 2 switch ports must point to the new physical port holding the Virtual MAC to prevent traffic blackholing.

Key Concept

HSRP Interface Tracking and Preemption Failover
Question 725Question →

A network administrator configures an extended IPv4 access control list (ACL 102) on a Cisco IOS router to restrict traffic from the internal LAN subnet 172.16.10.0/24172.16.10.0/24 to an external server at IP address 192.168.50.10192.168.50.10. The administrator enters the following CLI commands:

`access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 80`
`access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 443`

After applying ACL 102 inbound on interface GigabitEthernet0/0, users report that HTTP and HTTPS access to 192.168.50.10192.168.50.10 works properly, but all DNS resolution queries to an internal server at 172.16.10.2172.16.10.2 and internet browsing to other hosts are failing. Which statement correctly explains why all other traffic originating from the internal subnet is being blocked?

Show answer & explanation

Answer: The router processes traffic sequentially and drops all unlisted traffic due to the implicit deny clause located at the end of the access control list.

Answer

The router evaluates traffic against ACL 102 sequentially from top to bottom and drops all unlisted packets because of the invisible implicit deny clause ('deny ip any any') appended at the end of every IPv4 ACL.
In Cisco IOS networking, all standard and extended IPv4 Access Control Lists end with an invisible 'implicit deny' statement (conceptually `deny ip any any`). Packets entering an interface with an applied ACL are compared against statements top-down. Because ACL 102 only explicitly permits TCP ports 80 and 443 to host 192.168.50.10192.168.50.10, all other traffic—including DNS (UDP port 53) and traffic destined for other IP addresses—reaches the end of the ACL and is dropped by the implicit deny rule.

Step-by-Step Solution

1
Analyze the configured access list statements
ACL 102 explicitly permits only TCP destination port 80 (HTTP) and TCP destination port 443 (HTTPS) traffic from source 172.16.10.0/24172.16.10.0/24 to destination 192.168.50.10192.168.50.10.
Top-down ACL evaluation checks each incoming packet against these two rules first.
2
Evaluate how non-HTTP/HTTPS traffic is handled
DNS queries (UDP/TCP port 53) and general IP traffic destined for other IP addresses do not match either of the explicit permit statements.
When no explicit permit statement matches a packet, processing reaches the end of the access list.
3
Apply Cisco IOS default ACL behavior
All non-matching traffic is dropped by the unwritten implicit deny clause ('deny ip any any').
To allow other traffic, explicit permit statements (such as 'permit ip any any' or specific service permits) must be configured.

Key Concept

Implicit Deny Clause in IPv4 ACLs
Estimated Time:1m 30s
Question 726Question →

A network engineering team requires strict per-command authorization and per-command audit logging for administrative CLI access on core Cisco switches. Every individual command entered by a logged-in administrator must be evaluated against central security policies before execution. Which protocol selection and architectural behavior correctly satisfies these operational requirements?

Show answer & explanation

Answer: TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.

Answer

TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.
The correct selection identifies TACACS+ as the protocol that decouples authentication and authorization over TCP port 49 with full-packet payload encryption. This modular separation enables network devices to send an authorization request for every CLI command entered by an administrator.

Step-by-Step Solution

1
Analyze the functional access control requirement.
The requirement calls for per-command administrative authorization and CLI logging on network infrastructure devices.
Device administration requires fine-grained control over CLI commands, which is supported natively by TACACS+.
2
Compare protocol separation mechanics between TACACS+ and RADIUS.
TACACS+ completely decouples Authentication, Authorization, and Accounting (AAA), whereas RADIUS combines Authentication and Authorization into single protocol exchanges.
Decoupling authorization allows a NAS (network access server) to request explicit permission for individual CLI commands after a user has already authenticated.
3
Evaluate transport and security mechanisms for TACACS+ vs RADIUS.
TACACS+ uses TCP port 49 and encrypts the entire packet payload (body). RADIUS uses UDP ports 1812/1813 and encrypts only the password attribute.
TCP guarantees reliable delivery for per-command authorization packets, and full-payload encryption protects command strings and output sent across the network.

Key Concept

TACACS+ vs RADIUS Protocol Architecture and AAA Function Separation
Question 727Question →

An administrator applies the following IPv4 extended named access control list (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco IOS router:

ip access-list extended FILTER_WEB
permit tcp 10.10.1.0 0.0.0.255 host 172.16.10.50 eq 80
permit tcp 10.10.1.0 0.0.0.255 host 172.16.10.50 eq 443

Which two statements accurately describe how traffic arriving on interface GigabitEthernet0/0/1 is evaluated by this ACL?

Select all that apply

Show answer & explanation

Answer: HTTP traffic originating from host 10.10.1.25 and destined for server 172.16.10.50 on port 80 is permitted.; ICMP echo requests sent from host 10.10.1.25 to destination server 172.16.10.50 are dropped by the router.

Answer

HTTP traffic on port 80 from subnet 10.10.1.0/24 to 172.16.10.50 is permitted by the first ACL entry, while ICMP traffic is dropped due to the implicit deny at the end of the access list.
The extended ACL explicitly allows TCP traffic on port 80 from the 10.10.1.0/24 network to destination host 172.16.10.50. Any protocol or traffic type not explicitly permitted—such as ICMP or UDP traffic—matches the implicit deny clause at the end of the ACL and is dropped by the router.

Step-by-Step Solution

1
Evaluate the explicit permit statements in the ACL configuration sequentially from top to bottom.
Rule 1 permits TCP traffic from 10.10.1.0/24 to host 172.16.10.50 on port 80. Rule 2 permits TCP traffic from 10.10.1.0/24 to host 172.16.10.50 on port 443.
Top-down sequential matching permits HTTP and HTTPS traffic matching the specified source subnet and destination host IP.
2
Evaluate non-matching traffic types (such as ICMP and UDP) against the ACL end condition.
Traffic types not matched by explicit permit statements fall through to the default implicit deny clause (deny ip any any).
All Cisco IOS ACLs end with an implicit deny all statement that drops any packet not explicitly permitted.

Key Concept

Extended IPv4 Access Control List Sequential Processing and Implicit Deny Behavior
Question 728Question →

A network administrator configures HSRP group 10 on two Cisco IOS routers to provide high availability for the 192.168.10.0/24192.168.10.0/24 network.

Router R1 configuration:
text interface GigabitEthernet0/1 ip address 192.168.10.2 255.255.255.0 standby 10 ip 192.168.10.1 standby 10 priority 115 standby 10 preempt standby 10 track GigabitEthernet0/0 30

Router R2 configuration:
text interface GigabitEthernet0/1 ip address 192.168.10.3 255.255.255.0 standby 10 ip 192.168.10.1 standby 10 priority 100 standby 10 preempt

Initially, both routers and interfaces are fully operational, and R1 is the Active router. If interface GigabitEthernet0/0 on R1 experiences a link failure, which router will become the Active router for HSRP group 10, and what is R1's effective priority?

Show answer & explanation

Answer: R2 becomes the Active router because R1's priority decrements to 85, which is lower than R2's priority of 100.

Answer

R2 becomes the Active router because R1's priority decrements to 85, which is lower than R2's priority of 100.
When the tracked uplink GigabitEthernet0/0 on R1 fails, HSRP interface tracking decrements R1's priority from 115 by 30, bringing its effective priority down to 85. Since R2 has preemption enabled and its priority of 100 is higher than R1's new priority of 85, R2 preempts R1 and becomes the Active router for HSRP group 10.

Step-by-Step Solution

1
Calculate the initial priorities and state of both HSRP routers.
R1 initial priority is 115 (Active). R2 priority is 100 (Standby). Both have preemption enabled.
Higher priority wins the Active role when preemption is enabled.
2
Evaluate the impact of GigabitEthernet0/0 failure on R1.
R1's tracked interface drops, reducing R1's priority by 30: 115−30=85115 - 30 = 85.
The command 'standby 10 track GigabitEthernet0/0 30' decrements the priority by 30 upon link down.
3
Determine the outcome of HSRP preemption.
R2's priority (100) is now higher than R1's effective priority (85). R2 sends coup messages and becomes Active.
R2 has 'standby 10 preempt' configured, allowing it to assume the Active role whenever its priority exceeds the current Active router's priority.

Key Concept

HSRP Priority Tracking and Preemption
Question 729Question →

Match each Quality of Service (QoS) field or traffic conditioning mechanism on the left to its correct header specification or operational characteristic on the right.

Click a left item, then click its matching right item

Items

IP Precedence
Differentiated Services Code Point (DSCP)
Explicit Congestion Notification (ECN)
Traffic Shaping

Matches

Show answer & explanation

Answer

IP Precedence matches the 3-bit Layer 3 ToS field; DSCP matches the 6-bit Layer 3 field in ToS/Traffic Class; ECN matches the 2-bit IP congestion notification field; Traffic Shaping matches the egress buffering mechanism.
Each item accurately maps to its defined QoS header specification or operational mechanics. IP Precedence uses 3 bits in the ToS byte; DSCP uses 6 bits in the ToS/Traffic Class byte; ECN uses 2 bits to signal congestion without packet drops; Traffic Shaping buffers excess packets on egress interfaces.

Step-by-Step Solution

1
Analyze header field bit lengths and layer classifications
Identify IP Precedence as the legacy 3-bit Layer 3 field (8 values) and DSCP as the modern 6-bit Layer 3 field (64 values).
Classification standards define specific bit positions within the 8-bit Type of Service byte.
2
Identify signaling and traffic conditioning functions
Map ECN to its 2-bit congestion notification role and Traffic Shaping to egress buffering.
ECN signals congestion proactively to TCP endpoints without packet loss, while traffic shaping buffers bursty packets to conform to a configured rate.

Key Concept

QoS Header Markings and Traffic Conditioning Functions
Estimated Time:1m 30s
Question 730Question →

A network security administrator needs to configure a local database user account named 'opsman' on a Cisco IOS XE router. The requirement specifies using PBKDF2 with SHA-256 hashing (Type 8 encryption) to securely store the plaintext password 'Secur3#Pass2026'. Which Cisco IOS global configuration command correctly satisfies this requirement?

Show answer & explanation

Answer: username opsman secret algorithm-type pbkdf2 Secur3#Pass2026

Answer

The command 'username opsman secret algorithm-type pbkdf2 Secur3#Pass2026' correctly configures the local account with PBKDF2 (Type 8) password hashing.
In Cisco IOS XE, creating a local database user account with PBKDF2 hashing (Type 8) from a cleartext string requires the syntax 'username <name> secret algorithm-type pbkdf2 <plaintext_password>'. The router automatically computes the SHA-256 PBKDF2 hash and stores it in the running configuration as a Type 8 secret.

Step-by-Step Solution

1
Identify the target requirement
The goal is to configure a local user secret using PBKDF2 (Type 8 encryption) from a cleartext input password on Cisco IOS XE.
Cisco IOS XE supports enhanced password hashing algorithms via the 'secret' command branch.
2
Evaluate Cisco IOS XE syntax rules for local user database creation
The 'username <name> secret algorithm-type <type> <password>' syntax is used to define cleartext passwords hashed with specific algorithms such as pbkdf2 or scrypt.
Using 'secret algorithm-type pbkdf2' specifies Type 8 SHA-256 PBKDF2 hashing.
3
Differentiate from incorrect options
The 'password' keyword cannot take hashing algorithms, the literal number '8' expects an already computed hash string, and 'service password-encryption' is a global command for legacy Type 7 encryption.
Syntax elements must match the command state and input format expected by IOS XE.

Key Concept

Local database user authentication and password hashing algorithms (Type 5 MD5, Type 8 PBKDF2, Type 9 scrypt, Type 7 service password-encryption).
Question 731Question →

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

Port Security (Restrict Mode)
DHCP Snooping Untrusted Interface
Dynamic ARP Inspection (DAI)
Port Security (Sticky MAC)

Matches

Show answer & explanation

Answer

Port Security (Restrict Mode) matches with dropping unauthorized frames, incrementing the violation counter, and logging without shutting the interface down. DHCP Snooping Untrusted Interface matches with blocking incoming DHCP server responses and building the binding table from client traffic. Dynamic ARP Inspection (DAI) matches with intercepting and validating ARP packets against the binding database. Port Security (Sticky MAC) matches with dynamically adding learned MAC addresses as secure entries in the running configuration.
Each feature maps to its exact Cisco IOS operational behavior: Restrict mode logs and drops without disabling the port; DHCP Snooping untrusted ports drop server responses; DAI validates ARP frames against the DHCP binding table; and Sticky MAC converts dynamically learned addresses into running-config entries.

Step-by-Step Solution

1
Analyze Port Security violation modes
Identify that 'restrict' drops traffic, logs a message, and increments counters without disabling the port (unlike 'shutdown' mode which err-disables the interface).
Differentiating between protect, restrict, and shutdown modes is essential for Layer 2 access control.
2
Analyze DHCP Snooping interface roles
Recognize that untrusted ports drop DHCP server response packets (DHCPOFFER, DHCPACK) to prevent rogue DHCP server attacks.
DHCP Snooping enforces trust boundaries between user access ports (untrusted) and legitimate DHCP server ports (trusted).
3
Analyze Dynamic ARP Inspection mechanics
Confirm DAI checks incoming ARP packets on untrusted interfaces against the DHCP Snooping IP-to-MAC binding database.
DAI depends on the integrity of the DHCP Snooping binding table to mitigate man-in-the-middle ARP spoofing.
4
Analyze Sticky MAC address persistence
Verify that sticky MAC learning places dynamically discovered MAC addresses directly into the active running configuration.
Sticky MAC addresses persist in memory until saved to startup-config via copy running-config startup-config.

Key Concept

Layer 2 security mitigations (Port Security violation modes, DHCP Snooping trust roles, and Dynamic ARP Inspection validation mechanics).
Question 732Question →

An engineer is deploying a software-defined fabric architecture across an enterprise network. Which two operational functions are handled exclusively by the overlay network rather than the underlying physical network? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Encapsulating virtual tenant traffic inside VXLAN packets at the fabric edge; Maintaining the mapping database that resolves Endpoint Identifiers (EIDs) to Routing Locators (RLOCs)

Answer

Encapsulating virtual tenant traffic inside VXLAN packets at the fabric edge and maintaining the mapping database that resolves Endpoint Identifiers (EIDs) to Routing Locators (RLOCs) are the two functions operating exclusively within the overlay network.
In software-defined network fabrics, the overlay network is responsible for creating virtual networks on top of physical infrastructure. Encapsulating traffic using VXLAN at fabric edge nodes forms the overlay data plane, while maintaining the LISP mapping database (EID to RLOC) forms the overlay control plane.

Step-by-Step Solution

1
Identify the primary role of the overlay network.
The overlay network provides virtualized layer 2 and layer 3 connectivity on top of the underlay using encapsulation and mapping protocols.
Overlay architectures decouple endpoint identity and virtual topology from the physical network infrastructure.
2
Evaluate data plane mechanisms.
VXLAN encapsulates original tenant frames with outer headers at Virtual Tunnel Endpoints (VTEPs).
This packet encapsulation allows virtual networks to span across physical IP boundaries.
3
Evaluate control plane mechanisms.
LISP maintains mapping tables between EIDs (endpoint addresses) and RLOCs (underlay IP addresses).
LISP serves as the control plane for locating endpoints within the fabric overlay.

Key Concept

Overlay vs. Underlay Roles in Software-Defined Networking
Question 733Question →

A network operations team is auditing access control protocols used across enterprise routers and switches. When comparing TACACS+ and RADIUS protocol implementations, which TWO functional characteristics belong specifically to TACACS+? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It utilizes TCP port 49 and encrypts the entire payload of the packet.; It completely separates authentication and authorization into independent operational processes.

Answer

The two correct functional characteristics of TACACS+ are that it utilizes TCP port 49 while encrypting the entire packet payload, and it completely separates authentication and authorization into independent operational processes.
TACACS+ is primarily engineered for administrative device access control. It uses TCP port 49 and provides full-packet payload encryption. Furthermore, TACACS+ strictly separates the authentication, authorization, and accounting functions, which permits network administrators to implement granular command-level authorization policies independently of user authentication.

Step-by-Step Solution

1
Analyze transport layer behavior and security mechanics for TACACS+.
TACACS+ uses TCP port 49 and encrypts the entire payload.
TACACS+ relies on connection-oriented TCP for reliable communication and encrypts all packet payload data beyond the header.
2
Evaluate functional separation within the AAA architecture for TACACS+.
TACACS+ decouples authentication, authorization, and accounting.
Separating authorization from authentication enables precise, per-command CLI access control during device administration sessions.

Key Concept

TACACS+ vs RADIUS Protocol Architecture and Operational Mechanics
Estimated Time:2m 0s
Question 734Question →

A network administrator is evaluating default gateway redundancy protocol behavior on Cisco IOS switches for VLAN 10 (192.168.10.0/24192.168.10.0/24). Which two statements accurately contrast the default operational features of HSRPv1 and VRRPv2? (Choose two.)

Select all that apply

Show answer & explanation

Answer: VRRPv2 enables preemption by default, whereas HSRPv1 disables preemption by default.; HSRPv1 uses virtual MAC addresses formatted as 0000.0c07.acXX, whereas VRRPv2 uses virtual MAC addresses formatted as 0000.5e00.01XX.

Answer

VRRPv2 enables preemption by default while HSRPv1 disables it by default, and HSRPv1 uses virtual MAC addresses in the format 0000.0c07.acXX while VRRPv2 uses 0000.5e00.01XX.
The correct statements accurately identify key default operational differences between Cisco proprietary HSRPv1 and open standard VRRPv2: VRRPv2 preemption is enabled by default while HSRPv1 preemption is disabled by default, and HSRPv1 uses the virtual MAC structure 0000.0c07.acXX compared to VRRPv2's 0000.5e00.01XX.

Step-by-Step Solution

1
Analyze preemption defaults for HSRPv1 and VRRPv2.
HSRPv1 requires explicit configuration of preemption to allow a higher priority router to claim the Active role. VRRPv2 has preemption enabled natively out of the box.
Understanding protocol default behaviors is essential for predicting failover and failback behavior during topology changes.
2
Analyze Virtual MAC address structures.
HSRPv1 uses vendor MAC prefix 0000.0c07.acXX, while VRRPv2 uses standard MAC prefix 0000.5e00.01XX.
Virtual MAC formatting allows Layer 2 switch forwarding tables to map the default gateway IP to the virtual router.
3
Evaluate role terminology and physical IP assignment constraints.
HSRP uses Active/Standby terminology and forbids virtual IP overlap with interface IPs. VRRP uses Master/Backup terminology and allows IP address ownership (priority 255).
This rules out distractors that swap role terminology or misstate virtual IP assignment capabilities.

Key Concept

First Hop Redundancy Protocols Default Features and Architectural Comparison
Estimated Time:1m 30s
Question 735Question →

A network administrator configures a numbered standard IPv4 access control list on a Cisco IOS router to permit management access from the Network Operations Center (NOC) subnet 192.168.10.0/24192.168.10.0/24 while blocking all other hosts. The administrator enters the following commands:

text
Router(config)# access-list 15 permit 192.168.10.0 0.0.0.255
Router(config)# line vty 0 4
Router(config-line)# access-class 15 in

After applying this configuration, which traffic outcome occurs when an administrator at IP address 192.168.10.45192.168.10.45 attempts an SSH connection to the router's VTY interface, and why?

Show answer & explanation

Answer: The SSH session is permitted because the source IP address matches the permit entry in ACL 15.

Answer

The SSH connection attempt from IP address 192.168.10.45 is permitted because it matches the permit statement for network 192.168.10.0 with wildcard mask 0.0.0.255 in access-list 15.
The incoming SSH connection attempt originates from 192.168.10.45, which falls inside the 192.168.10.0/24 IP network range matched by wildcard mask 0.0.0.255. When the packet is checked against access-list 15 applied inbound on the VTY lines via the access-class command, it hits the first rule, matches, and is permitted.

Step-by-Step Solution

1
Analyze the ACL entry network range and wildcard mask
Network 192.168.10.0 with wildcard mask 0.0.0.255 matches source IP addresses in the range 192.168.10.0 to 192.168.10.255.
Wildcard mask bits of 0 require exact matching of octet values, while 255 allows any value in the fourth octet.
2
Evaluate the incoming SSH source IP address against ACL 15 sequentially
IP address 192.168.10.45 matches the first statement: access-list 15 permit 192.168.10.0 0.0.0.255.
ACL processing evaluates statements top-down until a match is found.
3
Determine line VTY access policy application
Traffic matching a permit line in an access-class in ACL applied to line vty is allowed through to establish the administrative management connection.
Once a permit match occurs, ACL evaluation terminates and the action specified in the matched statement (permit) is executed.

Key Concept

Standard IPv4 ACL Evaluation and VTY Line Application
Question 736Question →

A network administrator needs to harden administrative access on a Cisco IOS XE router. The requirement specifies that users connecting via SSH must authenticate against the local device user database, and privileged EXEC mode access must be protected using Type 9 (scrypt) password hashing. Which two CLI configuration tasks must be performed to meet these security requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure enable secret algorithm-type scrypt <password> in global configuration mode.; Execute the login local command under line vty configuration mode.

Answer

The two required CLI configuration tasks are configuring enable secret algorithm-type scrypt <password> in global configuration mode and executing login local under line vty configuration mode.
Configuring enable secret with the algorithm-type scrypt option enforces strong Type 9 hashing for privileged EXEC access, and issuing login local under line vty mode forces VTY remote access to validate credentials against local user database accounts.

Step-by-Step Solution

1
Identify the command required to enforce strong Type 9 privileged EXEC password protection.
Executing enable secret algorithm-type scrypt <password> creates a Type 9 password hash using the scrypt key derivation function for privileged EXEC mode.
Cisco IOS XE supports Type 9 scrypt encryption, which provides significantly stronger protection than standard Type 5 MD5 or Type 7 obfuscation.
2
Identify the line configuration command required for local user database authentication on VTY lines.
Navigating to line vty configuration mode and executing login local configures VTY sessions to authenticate incoming connections against accounts created in the local database.
Using the standalone login command checks only a line-level password, whereas login local directs authentication to the local username database.

Key Concept

Cisco IOS Local User Authentication and Password Hashing Types
Question 737Question →

A network administrator is designing a QoS marking policy to classify enterprise application traffic across both Layer 2 switch trunks and Layer 3 routed WAN links. Which statement accurately compares Class of Service (CoS) and Differentiated Services Code Point (DSCP) markings?

Show answer & explanation

Answer: CoS relies on a 3-bit field located inside the 802.1Q VLAN tag, whereas DSCP uses a 6-bit field inside the IP header.

Answer

Class of Service (CoS) relies on a 3-bit Priority Code Point (PCP) field within the Layer 2 802.1Q VLAN header, whereas Differentiated Services Code Point (DSCP) uses a 6-bit field within the Layer 3 IP header.
The statement identifying CoS as a 3-bit field inside the 802.1Q VLAN header and DSCP as a 6-bit field in the IP header is correct. CoS provides 8 priority levels (0 to 7) for Layer 2 tagged frames, while DSCP provides 64 values (0 to 63) in the Differentiated Services field of Layer 3 IP headers.

Step-by-Step Solution

1
Identify Layer 2 QoS classification mechanisms.
CoS (Class of Service / 802.1p) is defined in the 3-bit Priority Code Point field of an 802.1Q VLAN frame header, giving 8 possible priority levels (0-7).
Layer 2 headers are encapsulated per link and only exist on tagged Ethernet frames.
2
Identify Layer 3 QoS classification mechanisms.
DSCP (Differentiated Services Code Point) is defined in the 6-bit DiffServ field of the IPv4/IPv6 packet header, giving 64 possible code points (0-63).
Layer 3 headers persist across router hops end-to-end from source to destination.
3
Compare header locations and persistence capabilities.
CoS is restricted to tagged Layer 2 Ethernet trunks and is stripped by routers, while DSCP travels inside the IP packet across routed boundaries.
Routers decapsulate Layer 2 frames when forwarding IP packets, removing the 802.1Q tag containing CoS.

Key Concept

QoS Marking Fields (CoS 3-bit L2 vs DSCP 6-bit L3)
Question 738Question →

In a software-defined fabric architecture, which protocol operates specifically at the overlay layer to encapsulate end-host Ethernet frames inside IP/UDP packets across the physical transport infrastructure?

Show answer & explanation

Answer: VXLAN

Answer

VXLAN is the correct protocol operating at the overlay layer for encapsulation.
VXLAN (Virtual Extensible LAN) is the data plane encapsulation technology used in SDN overlays (such as Cisco SD-Access and VXLAN EVPN) to encapsulate original Layer 2 frames within IP/UDP headers to transport traffic over the physical underlay infrastructure.

Step-by-Step Solution

1
Identify the primary role of the overlay layer in software-defined network architectures.
The overlay layer creates virtual tunnels (tunnels end-user frames across the physical network) using data plane encapsulation.
Overlay networks decouple logical tenant services from physical topology.
2
Match the protocols to their architectural layers (Underlay vs. Overlay vs. Management).
VXLAN provides MAC-in-UDP encapsulation for overlay transport, whereas IS-IS provides underlay IP routing, SNMP manages devices, and LACP bundles physical ports.
VXLAN is designed specifically to encapsulate Layer 2/3 user payloads inside standard UDP packets.

Key Concept

Overlay Data Plane Encapsulation with VXLAN
Question 739Question →

A network engineer must enforce a security policy requiring real-time validation of individual CLI commands executed during administrator sessions on enterprise switches. Additionally, the policy dictates that the entire communication payload between the switch and the AAA server must be encrypted. Which protocol and operational mechanism fulfill these security requirements?

Show answer & explanation

Answer: TACACS+, because it operates over TCP and decouples authorization from authentication, allowing per-command validation while encrypting the entire packet payload.

Answer

TACACS+ is the correct choice because it uses TCP transport, decouples AAA functions to enable individual command authorization, and encrypts the entire packet payload.
TACACS+ separates the AAA pillars into discrete operations, allowing an administrator to configure per-command authorization on network devices. Furthermore, TACACS+ runs over TCP port 49 and encrypts the entire packet body beyond the 12-byte header, satisfying all requirements specified in the scenario.

Step-by-Step Solution

1
Evaluate transport protocol and encryption characteristics
TACACS+ uses TCP port 49 and encrypts the entire packet payload (everything after the standard TACACS+ header). RADIUS uses UDP ports 1812/1813 and encrypts only the password field within Access-Request packets.
Security requirements call for full packet payload encryption.
2
Evaluate AAA functional separation for command-level authorization
TACACS+ fully separates Authentication, Authorization, and Accounting into distinct modular services, enabling per-command authorization checks before execution. RADIUS combines authentication and authorization in unified exchange messages.
Administrative command validation requires standalone authorization requests per CLI command.
3
Select the protocol that satisfies both requirements
Only TACACS+ satisfies both full packet payload encryption and decoupled per-command authorization.
Matching all technical and policy constraints leads directly to TACACS+.

Key Concept

TACACS+ vs RADIUS Protocol Capabilities and AAA Functional Separation
Question 740Question →

A network administrator is configuring QoS mechanisms on a branch router edge interface to manage traffic bursts that periodically exceed the committed contract rate. Which two statements accurately describe the operational characteristics of traffic shaping?

Select all that apply

Show answer & explanation

Answer: Buffers excess packets in a queue and delays their transmission to smooth the outbound traffic flow.; Can only be implemented in the egress direction on a network interface.

Answer

Traffic shaping buffers excess packets in a queue to release them smoothly over time, and it can only be configured in the egress direction on an interface.
Traffic shaping is designed to smooth egress traffic rates by holding non-conforming packets in software queues and transmitting them as bandwidth becomes available. Because this queueing and scheduling process takes place before sending packets out of an interface, shaping is strictly an egress-only feature.

Step-by-Step Solution

1
Analyze the core operational mechanism of traffic shaping.
Traffic shaping retains packets in a queue when the traffic rate exceeds the configured rate (CIR) and transmits them gradually to achieve a regulated flow.
Understanding the role of internal buffers differentiates shaping from policing.
2
Determine the interface direction constraints for traffic shaping.
Since packets must enter an egress queue before being delayed and scheduled for transmission, shaping can only be applied in the egress direction.
Ingress interfaces cannot hold packets in an egress scheduling buffer.
3
Differentiate policing functions from shaping functions to rule out incorrect choices.
Actions such as dropping excess packets immediately or remarking packet header fields are characteristic of policing, which does not buffer traffic.
Policers handle traffic bursts by dropping or remarking rather than queueing.

Key Concept

Traffic Shaping vs. Traffic Policing Mechanisms
Estimated Time:1m 0s
PreviousPage 37 / 100Next
All practice questions — Cisco CCNA | Examkin