All practice questions

Network device architecture is divided into distinct functional planes to handle traffic and protocol processing efficiently. Which of the following functions is handled exclusively by the control plane?

A network administrator configures port security on access interface GigabitEthernet0/10 of a Cisco Catalyst switch using the command `switchport port-security mac-address sticky`. Over the next week, several workstations connect to the port, and their MAC addresses are dynamically added to the running configuration. Following an unscheduled power outage and switch reboot, the administrator discovers that the connected workstations are unable to gain access and port security sticky entries are missing from the configuration. What was the root cause of this issue?

A network administrator is creating an IPv4 extended Access Control List (ACL) on a Cisco IOS router to regulate traffic flowing from internal hosts to the DMZ subnet ($172.16.1.0/24$). The ACL must enforce the following policy requirements in order of precedence:

1. Allow HTTP traffic from any host in the internal subnet ($192.168.10.0/24$) to the web server at $172.16.1.50$.
2. Block all other IP traffic from host $192.168.10.15$ to the DMZ subnet ($172.16.1.0/24$).
3. Allow all remaining IP traffic from the internal subnet ($192.168.10.0/24$) to the DMZ subnet ($172.16.1.0/24$).
4. Explicitly deny all other traffic.

Arrange the given ACL statements in the correct top-down execution order to achieve this security policy without unintended traffic drops.

Match each network operation or traffic flow to its corresponding architectural plane.

A network administrator is implementing Layer 2 security controls on an access switch, configuring Port Security with sticky MAC address learning alongside DHCP Snooping on edge switch ports. Which two statements correctly describe the operational behavior of these features? (Select two.)

An organization is updating its enterprise security standards for administrative access and infrastructure security. Match each security control or PKI concept on the left to its corresponding operational function on the right.

Match each wireless security deployment mode or protocol with its primary cryptographic cipher suite or key exchange mechanism.

A network engineer applies the following extended IPv4 access control list inbound on router interface GigabitEthernet0/0/0 to allow web administration access from an operations subnet ($172.16.50.0/24$) to a database server ($10.0.1.50/32$):

text
ip access-list extended ADMIN_TO_DB
permit tcp 172.16.50.0 0.0.0.255 host 10.0.1.50 eq 443

Immediately after applying the ACL, administrators report that HTTPS connections to $10.0.1.50$ work as expected, but SSH connections and ICMP echo requests (ping) from the operations subnet to $10.0.1.50$ fail. What is the root cause of this behavior?

An engineer is inspecting traffic processing on a core router during a network maintenance window. Which operation is handled directly within the data plane (forwarding plane) of the router?

An administrator configures the following IPv4 extended named access control list on a Cisco IOS router and applies it inbound on interface GigabitEthernet0/0/1:

text
ip access-list extended CORP_SEC
permit tcp 10.1.10.0 0.0.0.255 host 192.168.1.50 eq 22
permit tcp 10.1.10.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit tcp 10.1.10.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 443

Which two statements accurately describe how network traffic arriving on GigabitEthernet0/0/1 will be filtered by this access control list? (Select two options.)

A system administrator is configuring an authentication server to support 802.1X wireless client access across campus switch stacks. Which operational characteristic of RADIUS makes it the primary protocol choice for this network access scenario compared to TACACS+?

A network administrator installs a new identity certificate on a Cisco IOS router to secure HTTPS management access. However, when administrative workstations attempt to connect to the router via HTTPS, their web browsers display a security warning stating that the certificate issuer is untrusted. The router's system clock is synchronized via NTP, and the certificate is within its valid date range. What is the root cause of this trust failure?

A network infrastructure team is selecting a centralized AAA protocol to secure administrative CLI access to enterprise switches. The security policy dictates that all communication between the network devices and the AAA server must have its entire packet payload encrypted, and the solution must support granular authorization for individual CLI commands. Which protocol satisfies these security requirements?

An administrator needs to restrict access on a Cisco IOS router so that only traffic from host $192.168.10.15$ can reach the internal web server at $10.1.1.50$ via HTTPS (TCP port $443$). All other traffic originating from the $192.168.10.0/24$ network destined to any location must be allowed. Which set of IPv4 access control list statements correctly satisfies these requirements?

An enterprise network policy mandates Multi-Factor Authentication (MFA) for network administrators establishing SSH sessions to core infrastructure devices. The policy specifically requires combining a 'something you know' factor with a 'something you have' factor. Which authentication combination satisfies this policy requirement?

A network administrator is configuring Public Key Infrastructure (PKI) certificate services to secure administrative access and VPN connections on Cisco routers. Match each PKI component on the left with its correct operational description on the right.

A network administrator needs to construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy for internal users in the $192.168.1.0/24$ network:

1. Host $192.168.1.50$ must be permitted SSH access to the administrative server at $10.0.0.10$.
2. All other TCP traffic from the $192.168.1.0/24$ subnet destined to server $10.0.0.10$ must be blocked.
3. All hosts in the $192.168.1.0/24$ subnet must be permitted web access (HTTP) to any destination server.
4. General ICMP traffic must be allowed from any source to any destination.

Arrange the ACL statements from top to bottom (first line to last line) in the correct sequential order to achieve this policy without unintentionally blocking desired traffic.

A network security administrator is configuring centralized security management for enterprise switches and routers. Match each AAA pillar or protocol characteristic on the left with its correct operational description on the right.

A network administrator configures an IPv4 extended named Access Control List (ACL) on a Cisco router interface to restrict incoming traffic as follows:

text
ip access-list extended FILTER_MGMT
permit tcp 10.2.20.0 0.0.0.255 host 172.16.100.5 eq 443
permit tcp host 10.2.20.12 host 172.16.100.5 eq 22

A technician attempts to troubleshoot network connectivity by issuing a `ping` command from host $10.2.20.25$ to server $172.16.100.5$, but all ICMP echo request packets are dropped. Which statement correctly explains why the ping traffic fails?

An enterprise network policy mandates strict access controls for network engineers managing edge routers. The policy requires that user identity verification and command execution permission checks operate as completely decoupled processes, allowing individual CLI commands to be evaluated independently by a central server after a session is established. Which operational characteristic of TACACS+ satisfies this requirement?