Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 741Question →

A network administrator needs to configure an IPv4 extended named Access Control List (ACL) named SECURE_FLOW on a Cisco IOS router. The ACL must implement the following policy requirements in order:
1. Permit SSH access (TCP port 22) specifically from management host 10.20.1.15 to server 172.16.50.10.
2. Deny all other IP traffic originating from the 10.20.1.0/24 subnet targeted to server 172.16.50.10.
3. Permit all remaining IPv4 traffic originating from the 10.20.1.0/24 subnet to any destination.
4. Ensure all other IP traffic from any source not explicitly permitted is implicitly dropped.

Arrange the configuration command statements into the correct top-to-bottom sequential order to achieve this policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by entering named extended ACL configuration mode ('ip access-list extended SECURE_FLOW'), followed by the specific SSH permit statement ('permit tcp host 10.20.1.15 host 172.16.50.10 eq 22'), then the broader subnet server deny statement ('deny ip 10.20.1.0 0.0.0.255 host 172.16.50.10'), and finally the general subnet permit statement ('permit ip 10.20.1.0 0.0.0.255 any').
Cisco ACLs process rules sequentially from top to bottom and stop evaluating as soon as a packet matches an entry. Therefore, specific host exceptions must precede broader subnet rules. Entering named ACL configuration mode ('ip access-list extended SECURE_FLOW') is required first. Next, permitting SSH from host 10.20.1.15 to server 172.16.50.10 must come before denying the entire 10.20.1.0/24 subnet to host 172.16.50.10; otherwise, 10.20.1.15 would match the subnet deny rule and be blocked. Permitting 10.20.1.0/24 to any destination must come after the specific server block so other outbound traffic is allowed before hitting the implicit deny any.

Step-by-Step Solution

1
Define the ACL header
Enter configuration mode for named extended ACL 'SECURE_FLOW'
Cisco IOS requires defining the ACL scope before adding sequential filtering statements.
2
Place the most specific exception statement at the top
Add 'permit tcp host 10.20.1.15 host 172.16.50.10 eq 22'
Cisco ACL processing evaluates entries sequentially top-to-bottom and stops at the first match. The specific host-to-host SSH permit must be evaluated before any broader block rule.
3
Place the restrictive subnet-to-server block rule next
Add 'deny ip 10.20.1.0 0.0.0.255 host 172.16.50.10'
This blocks all remaining hosts on 10.20.1.0/24 from reaching server 172.16.50.10 while allowing host 10.20.1.15's SSH traffic already permitted in step 2.
4
Place the general subnet permit rule last among explicit statements
Add 'permit ip 10.20.1.0 0.0.0.255 any'
This allows the 10.20.1.0/24 subnet to reach all other destinations while relying on the built-in implicit deny at the bottom to drop any unmentioned traffic.

Key Concept

Cisco IOS Access Control Lists evaluate matching statements in sequential top-down order, terminating evaluation immediately upon finding the first match.
Question 742Question →

A network administrator captures traffic on an Ethernet segment and identifies an ARP reply originating from a virtual default gateway with the MAC address 0000.5E00.01140000.5E00.0114. Which protocol and group number generated this virtual MAC address?

Show answer & explanation

Answer: VRRP with group number 20

Answer

VRRP with group number 20 is correct because VRRP for IPv4 utilizes the virtual MAC address format 0000.5E00.01XX0000.5E00.01XX, where the last byte 1414 in hexadecimal corresponds to decimal group number 20.
VRRP for IPv4 assigns virtual MAC addresses using the IANA OUI prefix 0000.5E00.01XX0000.5E00.01XX, where XXXX is the group identifier in 2-digit hexadecimal. Converting hexadecimal 1414 to decimal results in group 20.

Step-by-Step Solution

1
Identify the protocol vendor prefix from the virtual MAC address
The MAC address 0000.5E00.01140000.5E00.0114 uses the prefix 0000.5E00.01XX0000.5E00.01XX, which is standard for VRRP IPv4 router redundancy.
VRRP specifies 00−00−5E−00−01−XX00-00-5E-00-01-XX as its standard virtual MAC address block, whereas HSRP v1 uses 00−00−0C−07−AC−XX00-00-0C-07-AC-XX and HSRP v2 uses 00−00−0C−9F−FX−XX00-00-0C-9F-F X-XX.
2
Convert the final byte from hexadecimal to decimal to determine the group number
1416=(1×161)+(4×160)=16+4=2014_{16} = (1 \times 16^1) + (4 \times 16^0) = 16 + 4 = 20
The last byte of the VRRP virtual MAC address encodes the group number in hexadecimal notation.

Key Concept

VRRP and HSRP Virtual MAC Address Formats and Group Encoding
Question 743Question →

Match each Software-Defined Networking (SDN) architectural component or layer on the left with its primary function on the right.

Click a left item, then click its matching right item

Items

Underlay Network
Overlay Network
Fabric Control Plane
Network Fabric

Matches

Show answer & explanation

Answer

Underlay Network matches with providing physical Layer 3 IP reachability; Overlay Network matches with creating virtual logical tunnels to encapsulate host traffic; Fabric Control Plane matches with tracking location mappings between EIDs and RLOCs; Network Fabric matches with integrating underlay, overlay, and control plane protocols into a unified network system.
Each architectural layer serves a specific distinct function: the underlay delivers physical Layer 3 IP reachability, the overlay handles logical encapsulation tunnels (such as VXLAN), the fabric control plane manages host location mapping (EID to RLOC via LISP), and the fabric refers to the integrated end-to-end software-defined solution.

Step-by-Step Solution

1
Identify the role of physical IP infrastructure in software-defined architectures.
The underlay network provides basic Layer 3 unicast routing and physical IP reachability across all fabric nodes.
Overlay encapsulation protocols rely on underlying IP reachability between tunnel endpoints.
2
Determine the encapsulation and virtualization layer.
The overlay network uses tunneling protocols such as VXLAN to create logical topologies over the physical underlay.
Overlays abstract tenant network services from the underlying physical cabling and routing topology.
3
Associate control plane functions with endpoint location tracking.
The control plane protocol (e.g., LISP) maps Endpoint Identifiers (EIDs) to Routing Locators (RLOCs).
Decoupling endpoint identity from physical location enables mobility and simplified policy enforcement within the fabric.
4
Define the overarching fabric structure.
The network fabric is the combined system encompassing underlay, overlay, and control plane elements.
Together, these elements form the unified software-defined architectural ecosystem.

Key Concept

Software-Defined Architecture Components: Underlay, Overlay, Control Plane, and Fabric
Estimated Time:45s
Question 744Question →

A network engineer observes the following partial running configuration on a Cisco IOS XE switch:

text
username netops privilege 15 secret Cisc0#2026!
!
line vty 0 4
password 7 094F471A1A0A
login
!

When administrators attempt to establish a remote SSH session to the switch, the prompt requests only a line password rather than asking for user credentials. Which command must be configured under line configuration mode to enforce authentication against the local user database?

Show answer & explanation

Answer: login local

Answer

The command 'login local' must be configured under line configuration mode to require local database authentication.
Configuring 'login local' under line configuration mode instructs Cisco IOS to authenticate incoming VTY session users using usernames and passwords stored in the router's local user database.

Step-by-Step Solution

1
Analyze current line configuration
The current line configuration contains the keyword 'login', which only checks the line password specified by 'password 7 094F471A1A0A'.
The standard 'login' keyword directs Cisco IOS to validate against line-specific passwords rather than individual user accounts.
2
Determine the required authentication behavior
Local user account 'netops' exists in global configuration, requiring VTY lines to perform local database lookups.
Security best practices demand individual accountability using local database credentials instead of shared line passwords.
3
Select the correct CLI command for line configuration mode
Configuring 'login local' under 'line vty 0 4' replaces line password authentication with local database authentication.
The 'local' parameter appended to 'login' explicitly directs the line interface to consult the device local account database for login verification.

Key Concept

Local Database Authentication on Cisco IOS Lines
Estimated Time:1m 0s
Question 745Question →

An enterprise router connects to an Internet Service Provider over a 1 Gbps physical Ethernet interface, but the WAN contract strictly enforces a Committed Information Rate (CIR) of 50 Mbps. The network engineer notices that bursty corporate traffic periodically exceeds 50 Mbps, causing the service provider to immediately drop the non-conforming packets. Which Quality of Service (QoS) mechanism should be applied to the router's WAN egress interface to buffer excess packets during spikes and release them at a rate matching the 50 Mbps contract?

Show answer & explanation

Answer: Traffic shaping

Answer

Traffic shaping
Traffic shaping is designed to rate-limit outbound traffic by holding excess packets in a queue and scheduling them for delayed transmission. This smoothes out bursty traffic profiles so that egress rates do not exceed a service provider's sub-rate Committed Information Rate (CIR), preventing ISP packet drops.

Step-by-Step Solution

1
Analyze the network requirement and problem statement
The physical interface speed is 1 Gbps, but the ISP enforces a lower sub-rate CIR of 50 Mbps and drops bursts exceeding this limit.
When a physical link speed exceeds the purchased CIR, unconditioned egress traffic will burst at the line rate of 1 Gbps, triggering rate-limiting drops at the provider edge.
2
Compare traffic conditioning mechanisms (Policing vs Shaping)
Traffic policing discards or remarks out-of-profile traffic without buffering. Traffic shaping uses memory buffers to queue excess packets and transmit them at a metered pace matching the target rate.
To prevent tail drop at the provider edge during traffic spikes, the customer edge device must smooth output using queue buffering.
3
Select the mechanism that buffers bursts to match a CIR
Traffic shaping is the correct QoS technique designed specifically to buffer micro-bursts on egress and pace packet output to fit sub-rate WAN contracts.
Traffic shaping aligns egress throughput with the 50 Mbps CIR, preventing packet loss at the ISP's policing boundary.

Key Concept

Difference between Traffic Shaping (buffering traffic bursts to a CIR) and Traffic Policing (dropping/remarking excess traffic immediately)
Estimated Time:1m 15s
Question 746Question →

An administrator applies the following extended IPv4 access control list outbound on interface GigabitEthernet0/0/1 to permit HTTP traffic from the Sales VLAN (10.1.10.0/2410.1.10.0/24) to an internal Web Server (192.168.1.100192.168.1.100):

text
access-list 110 permit tcp 10.1.10.0 0.0.0.255 host 192.168.1.100 eq 80

After applying `ip access-group 110 out` on the interface, users in the Sales VLAN report that while HTTP access works, they can no longer send ICMP echo requests to the Web Server or access the corporate DNS server (192.168.1.2192.168.1.2) located on the same subnet. Which condition is causing this traffic interruption?

Show answer & explanation

Answer: The unwritten implicit deny clause at the end of the ACL drops all IP traffic that does not explicitly match the permit statement.

Answer

The implicit deny statement at the end of the ACL drops all IP traffic that does not explicitly match the single permit entry.
Every Cisco IPv4 Access Control List includes an invisible implicit deny statement at the end (`deny ip any any`). Because ACL 110 only explicitly permits TCP traffic to port 80 on host 192.168.1.100, all other IP traffic—including ICMP ping requests and UDP DNS traffic to 192.168.1.2—is dropped by the implicit deny clause.

Step-by-Step Solution

1
Analyze the applied ACL configuration
ACL 110 contains only one line permitting TCP traffic from 10.1.10.0/24 to host 192.168.1.100 on port 80.
Identify what traffic is explicitly allowed by the configured rules.
2
Evaluate non-matching traffic behavior
ICMP (ping) and UDP port 53 (DNS) traffic do not match the TCP port 80 rule.
Traffic that fails to match any explicit ACL rule falls through to the implicit deny at the end of the list (`deny ip any any`).
3
Determine the solution to restore required connectivity
Additional permit statements (such as permitting ICMP or DNS, or a trailing `permit ip any any` if general traffic is allowed) must be appended to the ACL.
Explicit permit entries are required to prevent unintended traffic drops caused by the implicit deny.

Key Concept

ACL Implicit Deny Any behavior and extended IPv4 statement evaluation order
Question 747Question →

A network engineer is implementing Layer 2 security controls across access switches in an enterprise network. The design requires deploying Dynamic ARP Inspection (DAI) alongside DHCP Snooping to mitigate ARP spoofing attacks. Which TWO statements correctly describe the operational interactions and interface trust requirements for these features?

Select all that apply

Show answer & explanation

Answer: DAI inspects incoming ARP requests and responses on untrusted interfaces by validating the IP-to-MAC mapping against the DHCP snooping binding database.; Access ports connected to end-user host workstations should be configured as untrusted for both DHCP Snooping and Dynamic ARP Inspection.

Answer

The correct statements are that DAI inspects incoming ARP packets on untrusted interfaces against the DHCP snooping binding database, and that user-facing access ports must be set as untrusted for both security features.
Dynamic ARP Inspection (DAI) relies directly on the binding table populated by DHCP Snooping to validate ARP packets received on untrusted ports. In standard Layer 2 security deployments, host-facing access ports are designated as untrusted for both DHCP Snooping (blocking rogue DHCP server offers) and DAI (blocking spoofed ARP announcements).

Step-by-Step Solution

1
Analyze how Dynamic ARP Inspection (DAI) operates on untrusted interfaces.
DAI intercepts all ARP requests and responses on untrusted ports and verifies their IP-to-MAC bindings using the DHCP snooping binding database or static ARP ACLs.
This mechanism prevents man-in-the-middle ARP poisoning attacks on the local switch segment.
2
Evaluate port trust configurations for host-facing interfaces.
Access ports connecting client endpoints must remain untrusted for both DHCP Snooping and DAI.
Untrusted ports are subjected to rate limiting and packet validation checks to block unauthorized DHCP responses and spoofed ARP replies.
3
Evaluate misconceptions regarding database persistence and trunk VLAN mismatches.
Dynamic bindings are stored in RAM and not automatically written to startup-config. Furthermore, native VLAN mismatches affect trunking semantics but do not disable DAI filtering.
Understanding feature isolation prevents incorrect troubleshooting assumptions regarding switch state saving and multi-vlan trunking errors.

Key Concept

Dynamic ARP Inspection (DAI) and DHCP Snooping Integration and Port Trust States
Question 748Question →

A network administrator is deploying a dual-compatibility wireless network on a Cisco Wireless LAN Controller (WLC) to support both modern WPA3-Personal endpoints and legacy WPA2-Personal devices under a single SSID. During initial validation, legacy WPA2 devices fail to complete the 802.11 association phase, while WPA3 devices connect successfully. Investigation reveals that the WLAN security profile is configured with Simultaneous Authentication of Equals (SAE) enabled, Protected Management Frames (PMF) set to "Required", and the encryption cipher suite restricted exclusively to GCMP-256. Which configuration modification on the WLC will enable legacy WPA2 clients to successfully associate while maintaining standard WPA3 Transition Mode operation?

Show answer & explanation

Answer: Configure PMF to "Optional" (Capable) and add AES-CCMP128 to the supported cipher suites alongside SAE and PSK authentication.

Answer

Configure PMF to "Optional" (Capable) and add AES-CCMP128 to the supported cipher suites alongside SAE and PSK authentication.
WPA3 Transition Mode allows a single SSID to service both WPA2-Personal and WPA3-Personal clients. WPA3 mandates Protected Management Frames (PMF/802.11w) and SAE key exchange. However, legacy WPA2 devices frequently do not support PMF or GCMP-256 ciphers. Configuring PMF to 'Optional' (Capable) and adding AES-CCMP128 cipher support permits legacy WPA2 devices to associate using standard PSK/CCMP-128 while allowing modern devices to connect using WPA3 SAE and mandatory PMF.

Step-by-Step Solution

1
Analyze WPA3-Personal requirements vs WPA2-Personal legacy compatibility.
WPA3 mandates Simultaneous Authentication of Equals (SAE) and Protected Management Frames (PMF / IEEE 802.11w). WPA2-Personal uses Pre-Shared Key (PSK) and optional PMF with AES-CCMP128.
Legacy devices fail association when PMF is set to 'Required' or when supported WPA2 ciphers (AES-CCMP128) are disabled.
2
Determine WPA3 Transition Mode configuration parameters on Cisco WLC.
PMF must be configured as 'Optional' (or 'Capable') rather than 'Required'. Both SAE and PSK must be enabled for Key Management, and AES-CCMP128 must be allowed as a cipher.
Setting PMF to Optional permits legacy WPA2 clients that lack 802.11w support to connect without PMF, while WPA3-capable clients are required to negotiate PMF and SAE.

Key Concept

WPA3 Transition Mode and Protected Management Frames (PMF/802.11w) Coexistence
Question 749Question →

A network security administrator is aligning enterprise network management requirements with AAA framework services and protocol architecture. Match each operational task or network access requirement on the left with its corresponding AAA component or protocol mechanism on the right.

Click a left item, then click its matching right item

Items

Validating user credentials against a centralized directory server during an initial 802.1X supplicant connection
Restricting an authenticated operator from executing specific privilege level configuration commands on a router
Logging start and stop timestamps, user identity, and session byte counts for administrative sessions to a central database
Encrypting the complete body of transmission packets over connection-oriented TCP port 49 during administrative sessions

Matches

Show answer & explanation

Answer

Validating credentials maps to Authentication; restricting command execution maps to Authorization; logging timestamps and session data maps to Accounting; encrypting full packet bodies over TCP port 49 maps to TACACS+ Protocol Mechanics.
Each operational requirement directly corresponds to a fundamental pillar of the AAA framework or a specific protocol implementation detail: Authentication handles identity verification, Authorization enforces command and resource access rights, Accounting logs session and audit data, and TACACS+ provides full-payload encryption over TCP port 49.

Step-by-Step Solution

1
Identify the AAA pillar responsible for identity verification.
Validating user credentials against a central directory service establishes identity, which is the core function of Authentication.
Authentication answers the question 'Who are you?' by checking credentials.
2
Identify the AAA pillar responsible for enforcing permissions and command restrictions.
Controlling command access and restricting operational privileges maps to Authorization.
Authorization answers the question 'What are you allowed to do?' after identity has been established.
3
Identify the AAA pillar responsible for audit trailing and session metrics.
Recording timestamps, session statistics, and user activities maps to Accounting.
Accounting answers the question 'What did you do and for how long?' for compliance auditing.
4
Identify the security protocol characteristic involving full packet body encryption over TCP 49.
TCP port 49 transport with complete payload encryption is a defining feature of TACACS+.
Unlike RADIUS, which uses UDP and encrypts only the password field, TACACS+ encrypts the entire payload over TCP.

Key Concept

AAA Framework Functional Separation & TACACS+ vs RADIUS Architecture
Question 750Question →

Match each Public Key Infrastructure (PKI) component or Multi-Factor Authentication (MFA) element on the left to its corresponding function or definition on the right.

Click a left item, then click its matching right item

Items

Certificate Signing Request (CSR)
Certificate Authority (CA)
Online Certificate Status Protocol (OCSP)
Time-based One-Time Password (TOTP)

Matches

Show answer & explanation

Answer

Certificate Signing Request (CSR) matches the encoded block containing a public key and metadata; Certificate Authority (CA) matches the entity issuing signed certificates; Online Certificate Status Protocol (OCSP) matches the real-time revocation query protocol; Time-based One-Time Password (TOTP) matches the dynamic MFA factor generated using a shared secret and timestamp.
Each item accurately aligns with its standard PKI or security definition: CSR is the initial request containing public key and identity data, CA is the signing body, OCSP is the query protocol for checking revocation status, and TOTP is a time-synchronized dynamic multi-factor credential.

Step-by-Step Solution

1
Identify the role of a Certificate Signing Request (CSR).
Recognize that a CSR is created by the requester and contains the public key along with subject details destined for a CA.
CSR generation is the initial step in obtaining an X.509 digital certificate.
2
Identify the role of a Certificate Authority (CA).
Associate the CA with the trusted issuer that signs certificates.
The CA establishes trust in PKI by signing certificates with its own private key.
3
Differentiate between certificate validation protocols and authentication mechanisms.
Link OCSP to real-time revocation checks and TOTP to temporary time-based MFA factor generation.
OCSP provides efficient status checks over HTTP, whereas TOTP serves as a possession-based authentication factor.

Key Concept

PKI Components and MFA Authentication Factors
Question 751Question →

A network administrator enables DHCP Snooping globally and on VLAN 20. To protect against DHCP denial-of-service (DoS) starvation attacks, the administrator configures `ip dhcp snooping limit rate 15` on all untrusted access interfaces. Shortly after, a user workstation interface transitions into the `err-disabled` state. Which operational behavior explains why this interface was placed into the `err-disabled` state?

Show answer & explanation

Answer: The interface received DHCP traffic exceeding the threshold of 15 packets per second configured on the untrusted port.

Answer

The interface received DHCP traffic exceeding the threshold of 15 packets per second configured on the untrusted port.
Configuring `ip dhcp snooping limit rate` on an untrusted interface imposes a ceiling on incoming DHCP control traffic. If a connected device sends DHCP messages faster than the configured threshold (15 packets per second in this scenario), the switch detects a rate violation and immediately transitions the port to the `err-disabled` state to protect network resources.

Step-by-Step Solution

1
Identify the Layer 2 security feature and command configured on the interface.
The switch has DHCP Snooping rate limiting configured via `ip dhcp snooping limit rate 15` on untrusted access interfaces.
This command sets a maximum allowed rate of 15 DHCP packets per second on untrusted ports.
2
Analyze the switch response when the rate limit threshold is exceeded.
If an untrusted host sends more than 15 DHCP packets per second, the switch shuts down the port and places it in the err-disabled state.
DHCP Snooping rate limiting enforces traffic ceilings to mitigate DHCP exhaustion/starvation attacks.

Key Concept

DHCP Snooping Interface Rate Limiting
Question 752Question →

An organization is updating its administrative access policy for Cisco enterprise network devices. To enforce multi-factor authentication (MFA) for secure SSH management access, network administrators configure AAA authentication to require both a static account password and a one-time passcode (OTP) generated by a physical hardware token fob. Which statement correctly classifies these two authentication controls under standard MFA factor categories?

Show answer & explanation

Answer: The static account password is a knowledge factor (something you know), while the hardware token passcode is a possession factor (something you have).

Answer

The static account password is a knowledge factor (something you know), while the hardware token passcode is a possession factor (something you have).
Multi-Factor Authentication (MFA) enhances security by combining two or more independent credential types: Knowledge (something you know, such as a password or PIN), Possession (something you have, such as a physical hardware token, smart card, or mobile authenticator app), and Inherence (something you are, such as a fingerprint or iris scan). A static password is memorized information (knowledge), whereas a hardware token passcode requires physical ownership of the generating device (possession).

Step-by-Step Solution

1
Identify the authentication controls presented in the scenario.
Control 1 is a static account password. Control 2 is a temporary passcode generated by a physical hardware token fob.
Categorizing MFA requires identifying the underlying mechanism of each credential.
2
Map each control to standard MFA factor categories: Knowledge (something you know), Possession (something you have), and Inherence (something you are).
The static password relies on memorized secret data (knowledge). The hardware token passcode relies on owning a physical key fob device (possession).
True multi-factor authentication requires using credentials from two or more distinct categories.

Key Concept

Multi-Factor Authentication (MFA) Factor Categorization
Question 753Question →

A network administrator is designing an IPv4 security policy and placing Access Control Lists (ACLs) across a corporate router topology. Which two statements accurately describe the operational characteristics and default behaviors of Cisco IPv4 ACLs? (Select two.)

Select all that apply

Show answer & explanation

Answer: Standard IPv4 ACLs inspect only the source IPv4 address of packets and should generally be applied as close to the destination as possible.; Traffic that does not match any explicit permit or deny entry in an ACL is dropped by an invisible implicit deny statement at the end of the list.

Answer

The correct statements are that standard IPv4 ACLs inspect only the source IPv4 address and should be placed close to the destination, and that unlisted traffic is dropped by the implicit deny statement at the end of the ACL.
Standard IPv4 ACLs evaluate only source IPv4 addresses, making destination-adjacent placement critical to prevent dropping traffic meant for other subnets. Furthermore, every Cisco IPv4 ACL features an unwritten implicit deny clause at the end of its list, which drops any packet that fails to match an explicit entry.

Step-by-Step Solution

1
Analyze standard IPv4 ACL filtering capabilities and placement guidelines.
Standard IPv4 ACLs filter strictly on source IPv4 addresses. Because they cannot filter on destination IP or ports, placing them close to the destination avoids prematurely dropping traffic intended for other routes.
Correct placement prevents unintended traffic filtering across the network topology.
2
Analyze ACL rule evaluation logic and final default action.
ACL statements are processed sequentially from top to bottom. If no explicit permit or deny rule matches a packet, it hits the implicit deny statement ('deny ip any any') at the end of the ACL and is dropped.
Understanding the implicit deny prevents accidental blocking of legitimate network traffic.

Key Concept

Standard IPv4 ACL Characteristics and Implicit Deny Behavior
Estimated Time:1m 30s
Question 754Question →

An enterprise security team is evaluating AAA protocol deployments across network devices. The security policy mandates that administrative CLI sessions on core routers must enforce per-command authorization and per-command accounting logs. During testing, the team observes that while RADIUS successfully authenticates incoming user sessions, it fails to perform real-time, per-command authorization checks during an active CLI session. Which architectural characteristic of RADIUS accounts for this limitation?

Show answer & explanation

Answer: RADIUS combines authentication and authorization into unified Access-Request and Access-Accept packet exchanges, preventing standalone authorization requests for individual CLI commands.

Answer

RADIUS combines authentication and authorization within its packet exchanges, making it unable to independently authorize individual CLI commands during an active administration session.
RADIUS is designed primarily for network access control (such as 802.1X and dial-up/VPN access) where authentication and authorization occur simultaneously upon connection. Because RADIUS packages authentication and authorization attributes together inside standard Access-Request and Access-Accept packets, it cannot easily initiate separate, isolated authorization requests for individual CLI commands executed after session establishment. TACACS+, by contrast, completely decouples AAA functions, allowing per-command authorization queries.

Step-by-Step Solution

1
Analyze the operational requirements for per-command administrative authorization.
Per-command authorization requires a protocol capable of sending separate, real-time authorization requests to the AAA server every time an administrator enters a command at the CLI.
Administrative device access requires granular command control after the initial authentication session is established.
2
Evaluate RADIUS architectural mechanics regarding AAA functional separation.
RADIUS combines authentication and authorization into unified packet exchanges (Access-Request, Access-Accept, Access-Reject).
Because authentication and authorization are coupled, RADIUS is optimized for network access control (e.g., 802.1X, VPNs) rather than per-command administrative authorization.
3
Contrast RADIUS mechanics with TACACS+ to select the correct architectural limitation.
TACACS+ modularly separates Authentication, Authorization, and Accounting, allowing standalone command authorization over TCP port 49 with full payload encryption.
The inability of RADIUS to separate authorization from initial authentication is the exact architectural reason it cannot support per-command authorization.

Key Concept

AAA Protocol Differences (TACACS+ vs RADIUS Functional Separation)
Question 755Question →

Match each Differentiated Services Code Point (DSCP) Per-Hop Behavior (PHB) standard on the left to its corresponding bit/decimal value and network application profile on the right.

Click a left item, then click its matching right item

Items

Expedited Forwarding (EF)
Assured Forwarding 41 (AF41)
Class Selector 6 (CS6)
Default Forwarding (DF)

Matches

Show answer & explanation

Answer

Expedited Forwarding (EF) matches DSCP 46 (voice/low-latency queue); Assured Forwarding 41 (AF41) matches DSCP 34 (high-priority data with low drop precedence); Class Selector 6 (CS6) matches DSCP 48 (network control traffic); Default Forwarding (DF) matches DSCP 0 (best-effort standard FIFO).
Each DiffServ PHB maps directly to a standardized 6-bit DSCP value: EF maps to DSCP 46 for priority low-latency queues, AF41 maps to DSCP 34 for high-priority low-drop data, CS6 maps to DSCP 48 for network control traffic, and DF maps to DSCP 0 for best-effort traffic.

Step-by-Step Solution

1
Identify the DSCP encoding and purpose of Expedited Forwarding (EF).
EF uses binary 101110101110 (DSCP 46) to provide a guaranteed low-delay, low-jitter expedited path for voice media.
RFC 2598 defines EF for real-time applications using a priority queue.
2
Determine the DSCP binary and decimal values for Assured Forwarding AF41.
For AF class xx and drop precedence yy (AF xyxy), the 6-bit DSCP structure is xxxyy0xxxyy0. For AF41, x=4x=4 (1002100_2) and y=1y=1 (01201_2), giving binary 100010100010 (decimal 34).
AF41 allocates guaranteed bandwidth while maintaining low drop probability under congestion.
3
Map Class Selector 6 (CS6) to its corresponding 6-bit DSCP value.
Class Selector values set the 3 MSBs to match IP Precedence while zeroing the 3 LSBs, yielding binary 110000110000 (DSCP 48).
CS6 is reserved by network equipment for critical control traffic like OSPF and BGP routing updates.
4
Identify the characteristics of Default Forwarding (DF).
DF uses binary 000000000000 (DSCP 0).
DF describes standard best-effort traffic subject to FIFO queuing and tail drop when queues overflow.

Key Concept

DiffServ Per-Hop Behaviors (PHB) and DSCP Marking Standards
Question 756Question →

An network administrator is analyzing an enterprise software-defined fabric deployment. Which two protocols operate within the overlay network to handle data plane frame encapsulation and control plane endpoint mapping? (Select two.)

Select all that apply

Show answer & explanation

Answer: VXLAN (Virtual Extensible LAN); LISP (Locator/ID Separation Protocol)

Answer

VXLAN and LISP operate within the overlay layer of a software-defined fabric. VXLAN provides data plane encapsulation (MAC-in-UDP), while LISP provides control plane address mapping (EID to RLOC).
VXLAN and LISP are overlay protocols. VXLAN performs data plane encapsulation by wrapping Layer 2 Ethernet frames inside Layer 3 UDP headers to cross the fabric. LISP operates as an overlay control plane protocol by maintaining a database mapping Endpoint Identifiers (EIDs) to Routing Locators (RLOCs).

Step-by-Step Solution

1
Distinguish between overlay protocol functions and underlay transport protocol functions.
The overlay requires encapsulation protocols for tunnel transport and tracking mechanisms for virtual endpoint locations.
Overlay networks run logically on top of the physical underlay infrastructure to abstract host locations.
2
Identify protocols specific to overlay encapsulation and control plane mapping.
VXLAN handles frame encapsulation and LISP handles endpoint identifier mapping. OSPF and IS-IS belong to the underlay layer, while STP is a traditional Layer 2 protocol.
Underlay protocols strictly provide IP connectivity for physical loopback addresses used by tunnel endpoints.

Key Concept

Overlay vs. Underlay Protocol Roles in Software-Defined Networking
Question 757Question →

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding system action or behavior on the right.

Click a left item, then click its matching right item

Items

Port Security Protect Mode
Port Security Restrict Mode
Dynamic ARP Inspection (DAI)
DHCP Snooping Untrusted Port

Matches

Show answer & explanation

Answer

Port Security Protect Mode matches dropping traffic silently without counter increments or log messages. Port Security Restrict Mode matches dropping traffic while incrementing the violation counter and logging. Dynamic ARP Inspection matches validating ARP packets against the DHCP binding database. DHCP Snooping Untrusted Port matches discarding incoming DHCP server packets like DHCPOFFER and DHCPACK.
Each feature is correctly matched to its specific control-plane or data-plane enforcement mechanism: Protect mode drops frames without logging; Restrict mode drops frames with logging and counter increments; Dynamic ARP Inspection verifies ARP packets using the DHCP snooping binding database; untrusted DHCP snooping ports drop inbound server messages (DHCPOFFER/DHCPACK).

Step-by-Step Solution

1
Analyze Port Security violation modes (Protect vs. Restrict)
Protect mode drops unauthorized MAC traffic silently (no counter increment, no syslog). Restrict mode drops unauthorized traffic, increments the security violation counter, and generates syslog/SNMP alerts.
Differentiating violation modes requires knowing which modes generate alerts and counters versus silent frame drops.
2
Analyze Dynamic ARP Inspection operational requirements
DAI inspects ARP packets on untrusted ports and verifies the MAC-to-IP binding against the switch's DHCP snooping binding table.
DAI relies directly on the DHCP snooping database (or static ARP ACLs) to mitigate ARP poisoning and spoofing attacks.
3
Analyze DHCP Snooping port trust roles
Untrusted ports permit client requests (DHCPDISCOVER/DHCPREQUEST) but drop incoming server responses (DHCPOFFER/DHCPACK).
Preventing rogue DHCP servers requires blocking DHCP server response messages on user-facing untrusted ports.

Key Concept

Layer 2 Security Mechanisms (Port Security Violation Modes, DAI Operation, DHCP Snooping Trust States)
Question 758Question →

A network administrator is implementing certificate-based client authentication (EAP-TLS) for 802.1X enterprise wireless access. When an authentication server receives a digital certificate presented by a client device, which two methods or attributes are used by the server to check whether the certificate has been explicitly revoked before its natural expiration date? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Querying an Online Certificate Status Protocol (OCSP) responder via HTTP to obtain real-time certificate status; Downloading and parsing a Certificate Revocation List (CRL) published periodically by the issuing Certificate Authority (CA)

Answer

The correct methods for checking certificate revocation are querying an Online Certificate Status Protocol (OCSP) responder for real-time status and checking a Certificate Revocation List (CRL) published by the issuing CA.
To verify that a certificate has not been revoked prior to expiration, an authentication server uses either Certificate Revocation Lists (CRLs), which are regularly updated lists of revoked serial numbers published by the CA, or Online Certificate Status Protocol (OCSP), which provides real-time revocation status checks over HTTP.

Step-by-Step Solution

1
Identify the primary mechanisms used in Public Key Infrastructure (PKI) to track and check revoked digital certificates.
The standard PKI mechanisms for revocation checking are CRLs (time-based list files) and OCSP (real-time protocol queries).
When a private key is compromised or a certificate is prematurely retired, the CA marks it as revoked via CRL or OCSP.
2
Evaluate the function of Certificate Revocation Lists (CRLs).
A CRL contains a list of serial numbers of revoked certificates published periodically to a Certificate Distribution Point (CDP).
Authentication servers download the list from the CDP to verify the client certificate serial number is not listed.
3
Evaluate the function of Online Certificate Status Protocol (OCSP).
OCSP performs an online query to check the revocation status of a specific certificate without downloading a full list.
This allows immediate, real-time revocation verification during dynamic EAP-TLS authentication.

Key Concept

Digital Certificate Revocation Checking (CRL and OCSP)
Question 759Question →

A network administrator is troubleshooting TCP application performance degradation on an enterprise egress WAN interface. Analysis shows that momentary traffic spikes above the contracted service rate are causing immediate packet drops, leading to TCP global synchronization and reduced throughput. Which QoS modification should be applied to the WAN interface to smooth out traffic bursts by delaying excess packets in a buffer rather than dropping them immediately?

Show answer & explanation

Answer: Apply a traffic shaping policy on the egress interface to queue and smooth out excess bursts.

Answer

Apply a traffic shaping policy on the egress interface to queue and smooth out excess bursts.
Traffic shaping regulates egress network traffic by holding excess packets in a buffer queue when traffic bursts exceed the configured Committed Information Rate (CIR). It then releases those packets smoothly over time, preventing packet drops and avoiding TCP global synchronization.

Step-by-Step Solution

1
Identify the cause of TCP global synchronization.
Immediate dropping of bursty packets by hard rate enforcement causes multiple TCP senders to slow down simultaneously.
When bursts exceed the rate limit and packets are discarded immediately, TCP sessions experience tail drop and enter slow start.
2
Compare traffic conditioning mechanisms (policing vs. shaping).
Policing discards or remarks non-conforming traffic without buffering. Shaping uses a software buffer to store excess packets and schedule them for later transmission.
To smooth bursts without dropping packets, a buffering mechanism (traffic shaping) is required.
3
Select the correct QoS policy implementation.
Configuring egress traffic shaping buffers out-of-profile traffic during short spikes and transmits it as rate tokens become available.
Traffic shaping is designed specifically for egress interface smoothing using packet queues.

Key Concept

Differences in operational mechanics between Traffic Shaping (buffering/smoothing) and Traffic Policing (dropping/remarking)
Question 760Question →

An administrator configures the following IPv4 extended named access control list on a Cisco IOS router:

text
ip access-list extended BLOCK_WEB_SERVICES
deny tcp 10.20.30.0 0.0.0.255 host 192.168.100.10 eq 80
deny tcp 10.20.30.0 0.0.0.255 host 192.168.100.10 eq 443

This ACL is applied inbound on interface GigabitEthernet0/0. A host with IP address 10.20.30.15 attempts to send ICMP echo request packets to 192.168.100.10. What occurs when this ICMP traffic reaches the router interface?

Show answer & explanation

Answer: The ICMP traffic is dropped because it encounters the implicit deny all statement at the end of the ACL.

Answer

The ICMP traffic is dropped because it encounters the implicit deny all statement at the end of the ACL.
Cisco IPv4 Access Control Lists evaluate entries sequentially from top to bottom. If a packet does not match any explicit permit or deny entry in the list, it hits the unwritten implicit deny clause ('deny ip any any') at the end of the ACL. Since the ACL only contains explicit deny entries for TCP ports 80 and 443, ICMP packets fail to match those specific lines and are dropped by the implicit deny.

Step-by-Step Solution

1
Evaluate the first entry (seq 10 / line 1) against the packet.
Packet is ICMP from 10.20.30.15 to 192.168.100.10. Line 1 checks for TCP port 80 traffic. No match occurs.
Protocol mismatch (ICMP vs TCP).
2
Evaluate the second entry (seq 20 / line 2) against the packet.
Line 2 checks for TCP port 443 traffic. No match occurs.
Protocol mismatch (ICMP vs TCP).
3
Evaluate the implicit default behavior at the bottom of the ACL.
Every Cisco IOS IPv4 ACL ends with an unwritten 'deny ip any any' rule. The ICMP packet matches this implicit rule.
Traffic not explicitly permitted is denied by default.

Key Concept

Every IPv4 ACL in Cisco IOS concludes with an invisible implicit deny statement ('deny ip any any'). To permit non-denied traffic, an explicit permit statement (such as 'permit ip any any') must be added.
PreviousPage 38 / 100Next
All practice questions — Cisco CCNA | Examkin