Examkin

All practice questions

229 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 101Question →

Match each AAA framework operational characteristic or protocol mechanism on the left to its corresponding protocol or architectural implementation on the right.

Click a left item, then click its matching right item

Items

TACACS+ Authorization Mechanics
RADIUS Accounting Architecture
TACACS+ Packet Security Architecture
RADIUS Authentication & Authorization Coupling

Matches

Show answer & explanation

Answer

TACACS+ Authorization Mechanics pairs with discrete command verification per transaction over TCP; RADIUS Accounting Architecture pairs with separate UDP transport streams (port 1813/1646); TACACS+ Packet Security Architecture pairs with encrypting the entire payload body over TCP port 49; RADIUS Authentication & Authorization Coupling pairs with combining access-request and response attribute-value pairs while encrypting only the password field over UDP port 1812.
TACACS+ provides full-payload encryption over TCP port 49 and separates AAA pillars, enabling discrete per-command authorization checks. RADIUS couples authentication and authorization into single Access-Request/Accept exchanges over UDP port 1812 (encrypting only the password attribute) and utilizes separate UDP port streams (port 1813) for accounting.

Step-by-Step Solution

1
Analyze transport protocols and functional separation differences between TACACS+ and RADIUS.
TACACS+ relies on reliable connection-oriented TCP (port 49) and separates AAA functions completely. RADIUS relies on connectionless UDP (ports 1812/1813 or 1645/1646) and combines authentication with authorization.
Understanding transport layer and structural coupling determines how requests are framed.
2
Evaluate encryption scope differences across packet payloads.
TACACS+ encrypts the entire payload body of the packet following the TACACS+ header. RADIUS obfuscates only the User-Password attribute using an MD5-based mechanism, leaving username and other attributes in plaintext.
This key security distinction defines how sensitive payload administrative data is protected in transit.
3
Map command-level authorization and transaction flow.
Because TACACS+ isolates authorization from authentication, a network device can send an authorization request for every command entered at the CLI prompt. RADIUS delivers user profile authorization attributes back during the initial access granting phase.
TACACS+ is optimized for device administration due to per-command granularity.

Key Concept

AAA Protocol Architecture: TACACS+ vs RADIUS mechanics, transport protocols, functional coupling, and payload encryption scope.
Question 102Question →

A network administrator is implementing the AAA framework on an enterprise switch to manage access. Match each administrative operational task on the left to its corresponding AAA framework pillar on the right.

Click a left item, then click its matching right item

Items

Validating user credentials against a centralized database before granting access
Restricting an authenticated engineer to specific privilege levels and CLI commands
Logging session start times, duration, and executed commands for compliance tracking

Matches

Show answer & explanation

Answer

Validating user credentials matches Authentication; Restricting privilege levels and CLI commands matches Authorization; Logging session times and executed commands matches Accounting.
Authentication verifies identity ('who you are'), Authorization determines permissions and command rights ('what you can do'), and Accounting logs user activity and session details ('what you did').

Step-by-Step Solution

1
Analyze the task of validating user credentials.
Credential validation verifies identity (Who are you?), which is the function of Authentication.
Authentication is the first pillar of AAA responsible for verifying identity.
2
Analyze the task of restricting privilege levels and CLI commands.
Restricting access and capabilities enforces permission rules (What can you do?), which is the function of Authorization.
Authorization determines the scope of actions granted to an authenticated identity.
3
Analyze the task of logging session details and command history.
Logging activities creates an audit trail (What did you do?), which is the function of Accounting.
Accounting measures resource consumption and records session event logs.

Key Concept

Core Pillars of the AAA Framework (Authentication, Authorization, Accounting)
Estimated Time:45s
Question 103Question →

Match each network operational model feature to its corresponding architectural characteristic when comparing traditional networks with controller-based networking environments.

Click a left item, then click its matching right item

Items

Distributed Control Plane
Centralized Control Plane
Manual Hop-by-Hop Management
Intent-Based Orchestration

Matches

Show answer & explanation

Answer

Distributed Control Plane pairs with localized independent routing decisions; Centralized Control Plane pairs with a software controller maintaining an end-to-end network view; Manual Hop-by-Hop Management pairs with configuring devices individually via CLI; Intent-Based Orchestration pairs with defining high-level policies translated automatically across the fabric.
Distributed control planes refer to traditional networks where every node builds its own routing table. Centralized control planes belong to SDN/controller-based models where a central controller manages routing logic. Manual hop-by-hop management describes per-device CLI configuration sessions, whereas intent-based orchestration represents centralized policy translation across the network fabric.

Step-by-Step Solution

1
Analyze control plane placement in traditional vs. software-defined models.
Distributed control planes correspond to independent per-device protocol execution, whereas centralized control planes rely on a single controller for network-wide intelligence.
Control plane separation is the foundational distinction between traditional and controller-based architectures.
2
Analyze management paradigms and configuration methods.
Manual hop-by-hop configuration corresponds to CLI management per device, while intent-based orchestration maps to centralized GUI/API policy translation across the network.
Software-defined networking eliminates direct per-box CLI tasks in favor of automated, controller-driven policy deployment.

Key Concept

Contrasting Traditional Network Architecture with Controller-Based Software-Defined Networking
Question 104Question →

Match each Quality of Service (QoS) mechanism, field, or per-hop behavior on the left to its corresponding operational description or header specification on the right.

Click a left item, then click its matching right item

Items

Assured Forwarding (AF31)
Class of Service (CoS)
Traffic Shaping
Strict Priority Queuing (PQ)

Matches

Show answer & explanation

Answer

Assured Forwarding (AF31) corresponds to the 6-bit DSCP value specifying Class 3 traffic with low drop probability (011010); Class of Service (CoS) corresponds to the 3-bit PCP field in the IEEE 802.1Q header; Traffic Shaping corresponds to buffering excess egress packets in memory queues to smooth traffic bursts; Strict Priority Queuing corresponds to servicing delay-sensitive traffic ahead of all other queues.
Each term correctly aligns with its exact QoS definition: AF31 represents DSCP value 26 (011010), CoS utilizes the 3-bit 802.1Q header field, Traffic Shaping smooths bursts via packet buffering, and Strict Priority Queuing services high-priority packets ahead of all other queues.

Step-by-Step Solution

1
Identify Layer 3 marking specifications for Per-Hop Behaviors (PHBs).
Assured Forwarding (AF) uses 6 bits in the DSCP field. AF31 breaks down into Class 3 (3×8=243 \times 8 = 24, or binary 011000) with low drop probability (add 2, resulting in decimal 26 or binary 011010).
DSCP AF values use the formula 8x+2y8x + 2y where xx is the class (1-4) and yy is the drop precedence (1-3).
2
Identify Layer 2 marking specifications.
Class of Service (CoS) resides exclusively in the 3-bit Priority Code Point (PCP) field of the 802.1Q VLAN tag header.
CoS is a Layer 2 QoS marking mechanism and does not persist across non-trunked Ethernet hops or Layer 3 boundaries.
3
Differentiate between traffic conditioning mechanisms (shaping vs policing).
Traffic Shaping uses software queues to buffer packets that exceed the configured rate, smoothing egress flow.
Unlike policing (which drops or remarks excess packets), shaping delays out-of-profile traffic by placing it into memory queues.
4
Evaluate queuing algorithms and packet scheduling.
Strict Priority Queuing always services its designated queue first until empty before serving lower-priority queues.
Strict priority scheduling provides minimal latency for real-time traffic (such as voice), but requires policing to prevent queue starvation of other traffic classes.

Key Concept

QoS Classification, Marking, Queuing, and Traffic Conditioning Mechanics
Question 105Question →

A network administrator is implementing Layer 2 security controls on Cisco Catalyst access switches. Match each Layer 2 security feature mechanism on the left to its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

DHCP Snooping Option 82 Insertion
Dynamic ARP Inspection (DAI)
Port Security Sticky MAC Learning
Port Security Restrict Violation Mode

Matches

Show answer & explanation

Answer

DHCP Snooping Option 82 Insertion attaches relay agent information to DHCP requests on untrusted ports. Dynamic ARP Inspection (DAI) intercepts and checks ARP requests against the DHCP binding database on untrusted interfaces. Port Security Sticky MAC Learning dynamically converts learned MAC addresses into running configuration entries. Port Security Restrict Violation Mode drops unauthorized frames, increments the violation counter, and sends a Syslog message without shutting down the interface.
Each feature is paired with its precise Layer 2 operational behavior. DHCP Snooping Option 82 inserts circuit details into client requests. DAI mitigates ARP poisoning by cross-referencing ARP headers against the DHCP snooping database. Sticky MAC converts dynamic address learning into explicit running-configuration statements. Restrict mode drops offending frames and logs an alert while preserving link availability.

Step-by-Step Solution

1
Analyze DHCP Snooping Option 82 mechanism
Identified that Option 82 adds relay agent metadata (such as switch chassis ID and port interface ID) to client requests on untrusted ports.
Option 82 provides location information to help DHCP servers assign IP addresses and policy parameters.
2
Analyze Dynamic ARP Inspection (DAI) verification mechanism
Determined that DAI validates incoming ARP packets against IP-to-MAC mappings stored in the DHCP snooping binding table.
DAI prevents ARP spoofing and poisoning by dropping invalid ARP packets on untrusted ports.
3
Examine Port Security sticky MAC functionality
Confirmed that sticky MAC dynamically discovers connected devices and writes them to running-config as static MAC entries.
Sticky MAC saves administrators from manually entering host MAC addresses while enforcing access restrictions.
4
Differentiate Port Security violation modes (protect vs restrict vs shutdown)
Matched restrict mode to dropping frames, logging Syslog messages, and incrementing violation counters without err-disabling the interface.
Protect mode drops frames silently without logging, whereas shutdown mode disables the interface entirely.

Key Concept

Layer 2 Security Mechanisms and Operational Characteristics
Question 106Question →

Match each wireless security protocol standard on the left with its defining cryptographic capability or key exchange mechanism on the right.

Click a left item, then click its matching right item

Items

WPA (Legacy)
WPA2-Personal
WPA3-Personal
WPA3-Enterprise

Matches

Show answer & explanation

Answer

WPA (Legacy) pairs with TKIP/RC4 cipher suite; WPA2-Personal pairs with AES-CCMP and PSK 4-way handshake; WPA3-Personal pairs with SAE key exchange; WPA3-Enterprise pairs with mandatory PMF and optional 192-bit security mode.
Each wireless security protocol standard corresponds directly to its cryptographic cipher suite and authentication mechanism: legacy WPA uses TKIP/RC4, WPA2-Personal uses AES-CCMP with PSK authentication, WPA3-Personal uses SAE to defend against dictionary attacks, and WPA3-Enterprise enforces Protected Management Frames (PMF) alongside an optional 192-bit encryption suite.

Step-by-Step Solution

1
Identify the legacy WPA mechanism
WPA relies on TKIP and RC4 encryption.
Original WPA was created as an interim standard to improve WEP security without replacing hardware.
2
Identify WPA2-Personal standard features
WPA2-Personal standardizes AES-CCMP encryption with PSK authentication using a 4-way handshake.
IEEE 802.11i compliance mandated AES encryption for strong baseline confidentiality.
3
Identify WPA3-Personal enhancements
WPA3-Personal uses SAE (Simultaneous Authentication of Equals) instead of PSK.
SAE provides forward secrecy and protects against passive eavesdropping and offline dictionary attacks.
4
Identify WPA3-Enterprise features
WPA3-Enterprise mandates Protected Management Frames (PMF) and supports optional 192-bit encryption.
PMF protects management traffic against spoofing, while 192-bit mode supports high-security environments.

Key Concept

Wireless Security Protocols (WPA, WPA2, WPA3)
Question 107Question →

A wireless network architect is reviewing enterprise security standards to align wireless LAN controller (WLC) profiles with IEEE 802.11 security specifications. Match each wireless security implementation on the left with its corresponding key exchange mechanism, cipher suite, or framing requirement on the right.

Click a left item, then click its matching right item

Items

WPA2-Personal Key Exchange
WPA3-Personal Key Exchange
WPA3-Enterprise 192-bit Security Mode
WPA2-Enterprise Core Architecture

Matches

Show answer & explanation

Answer

WPA2-Personal Key Exchange matches the standard 4-Way Handshake utilizing a static Pre-Shared Key (PSK); WPA3-Personal Key Exchange matches Simultaneous Authentication of Equals (SAE) via Dragonfly handshake; WPA3-Enterprise 192-bit Security Mode matches GCMP-256 with mandatory BIP-GMAC-256 Protected Management Frames; WPA2-Enterprise Core Architecture matches IEEE 802.1X framework with dynamic EAP/RADIUS authentication.
Each wireless security protocol implementation correctly pairs with its key exchange protocol, authentication framework, and cipher suite requirements according to IEEE 802.11i and 802.11ax standards.

Step-by-Step Solution

1
Analyze WPA2-Personal authentication and encryption mechanics.
Identify that WPA2-Personal relies on a Pre-Shared Key (PSK) converted via PBKDF2 into a static PMK, which undergoes a 4-Way Handshake to establish the PTK.
Understanding the vulnerability of WPA2-Personal to passive capture and offline dictionary cracking helps distinguish it from SAE.
2
Analyze WPA3-Personal key exchange enhancements over WPA2.
Identify that WPA3-Personal introduces Simultaneous Authentication of Equals (SAE) using the Dragonfly key exchange protocol.
SAE prevents dictionary attacks by requiring interactive proof of password knowledge without transmitting password derivatives directly usable in offline calculation.
3
Evaluate WPA3-Enterprise 192-bit mode cryptographic primitives.
Confirm requirement of 256-bit symmetric encryption using GCMP-256 and BIP-GMAC-256 for management frame protection.
192-bit mode aligns with NSA Commercial National Security Algorithm (CNSA) suite specifications, upgrading from CCMP-128.
4
Differentiate Enterprise authentication models from Personal authentication models.
Associate 802.1X, EAP types (PEAP, EAP-TLS, EAP-FAST), and RADIUS integration with enterprise mode.
Enterprise implementations utilize centralized identity stores and dynamic key generation rather than shared static credentials.

Key Concept

Wireless Security Protocols, Authentication Frameworks, and Cipher Suites (WPA2/WPA3 Personal vs Enterprise)
Question 108Question →

Match each operational feature or interface component to its correct classification when comparing traditional network architectures with controller-based software-defined networks (SDN).

Click a left item, then click its matching right item

Items

Routing protocols run locally on each device to compute paths independently
RESTful APIs used by management applications to communicate policy intent to the network controller
Protocols such as NETCONF or OpenFlow used by the controller to program network device forwarding tables
Manual node-by-node configuration applied directly via SSH or console command-line interface

Matches

Show answer & explanation

Answer

Independent protocol path computation matches Traditional Network Distributed Control Plane; RESTful APIs for application-to-controller policy intent match Controller-Based Northbound Interface (NBI); NETCONF/OpenFlow for controller-to-device programming matches Controller-Based Southbound Interface (SBI); Node-by-node CLI configuration matches Traditional Network Decentralized Management Plane.
In traditional networking, control plane processing and management operations are decentralized across every network node. Conversely, controller-based SDN centralizes the control plane into a single logical controller, using Northbound APIs (REST) to expose network services to applications and Southbound APIs (NETCONF, RESTCONF, OpenFlow) to program policy onto hardware devices.

Step-by-Step Solution

1
Analyze how control plane decisions are processed in traditional networks.
Identify that traditional networks distribute control plane processing across every individual device.
Each switch and router maintains its own control plane intelligence and routing protocols.
2
Identify the API direction connecting applications to the central controller.
Recognize that interfaces facing upward toward applications are Northbound Interfaces (NBIs).
Northbound APIs allow software applications to programmatically convey network requirements to the SDN controller.
3
Identify the API direction connecting the central controller to forwarding hardware.
Recognize that interfaces facing downward toward network nodes are Southbound Interfaces (SBIs).
Southbound protocols like NETCONF, RESTCONF, and OpenFlow carry instructions from the controller to network switches and routers.
4
Evaluate traditional device management practices.
Identify manual box-by-box CLI access as a characteristic of traditional management planes.
Unlike controller-driven centralized policy pushing, traditional management relies on individual device CLI interaction.

Key Concept

Architectural plane separation and interface distinction between traditional and controller-based networks
Estimated Time:1m 0s
Question 109Question →

Match each Quality of Service (QoS) field or traffic conditioning mechanism on the left to its correct header specification or operational characteristic on the right.

Click a left item, then click its matching right item

Items

IP Precedence
Differentiated Services Code Point (DSCP)
Explicit Congestion Notification (ECN)
Traffic Shaping

Matches

Show answer & explanation

Answer

IP Precedence matches the 3-bit Layer 3 ToS field; DSCP matches the 6-bit Layer 3 field in ToS/Traffic Class; ECN matches the 2-bit IP congestion notification field; Traffic Shaping matches the egress buffering mechanism.
Each item accurately maps to its defined QoS header specification or operational mechanics. IP Precedence uses 3 bits in the ToS byte; DSCP uses 6 bits in the ToS/Traffic Class byte; ECN uses 2 bits to signal congestion without packet drops; Traffic Shaping buffers excess packets on egress interfaces.

Step-by-Step Solution

1
Analyze header field bit lengths and layer classifications
Identify IP Precedence as the legacy 3-bit Layer 3 field (8 values) and DSCP as the modern 6-bit Layer 3 field (64 values).
Classification standards define specific bit positions within the 8-bit Type of Service byte.
2
Identify signaling and traffic conditioning functions
Map ECN to its 2-bit congestion notification role and Traffic Shaping to egress buffering.
ECN signals congestion proactively to TCP endpoints without packet loss, while traffic shaping buffers bursty packets to conform to a configured rate.

Key Concept

QoS Header Markings and Traffic Conditioning Functions
Estimated Time:1m 30s
Question 110Question →

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

Port Security (Restrict Mode)
DHCP Snooping Untrusted Interface
Dynamic ARP Inspection (DAI)
Port Security (Sticky MAC)

Matches

Show answer & explanation

Answer

Port Security (Restrict Mode) matches with dropping unauthorized frames, incrementing the violation counter, and logging without shutting the interface down. DHCP Snooping Untrusted Interface matches with blocking incoming DHCP server responses and building the binding table from client traffic. Dynamic ARP Inspection (DAI) matches with intercepting and validating ARP packets against the binding database. Port Security (Sticky MAC) matches with dynamically adding learned MAC addresses as secure entries in the running configuration.
Each feature maps to its exact Cisco IOS operational behavior: Restrict mode logs and drops without disabling the port; DHCP Snooping untrusted ports drop server responses; DAI validates ARP frames against the DHCP binding table; and Sticky MAC converts dynamically learned addresses into running-config entries.

Step-by-Step Solution

1
Analyze Port Security violation modes
Identify that 'restrict' drops traffic, logs a message, and increments counters without disabling the port (unlike 'shutdown' mode which err-disables the interface).
Differentiating between protect, restrict, and shutdown modes is essential for Layer 2 access control.
2
Analyze DHCP Snooping interface roles
Recognize that untrusted ports drop DHCP server response packets (DHCPOFFER, DHCPACK) to prevent rogue DHCP server attacks.
DHCP Snooping enforces trust boundaries between user access ports (untrusted) and legitimate DHCP server ports (trusted).
3
Analyze Dynamic ARP Inspection mechanics
Confirm DAI checks incoming ARP packets on untrusted interfaces against the DHCP Snooping IP-to-MAC binding database.
DAI depends on the integrity of the DHCP Snooping binding table to mitigate man-in-the-middle ARP spoofing.
4
Analyze Sticky MAC address persistence
Verify that sticky MAC learning places dynamically discovered MAC addresses directly into the active running configuration.
Sticky MAC addresses persist in memory until saved to startup-config via copy running-config startup-config.

Key Concept

Layer 2 security mitigations (Port Security violation modes, DHCP Snooping trust roles, and Dynamic ARP Inspection validation mechanics).
Question 111Question →

Match each Software-Defined Networking (SDN) architectural component or layer on the left with its primary function on the right.

Click a left item, then click its matching right item

Items

Underlay Network
Overlay Network
Fabric Control Plane
Network Fabric

Matches

Show answer & explanation

Answer

Underlay Network matches with providing physical Layer 3 IP reachability; Overlay Network matches with creating virtual logical tunnels to encapsulate host traffic; Fabric Control Plane matches with tracking location mappings between EIDs and RLOCs; Network Fabric matches with integrating underlay, overlay, and control plane protocols into a unified network system.
Each architectural layer serves a specific distinct function: the underlay delivers physical Layer 3 IP reachability, the overlay handles logical encapsulation tunnels (such as VXLAN), the fabric control plane manages host location mapping (EID to RLOC via LISP), and the fabric refers to the integrated end-to-end software-defined solution.

Step-by-Step Solution

1
Identify the role of physical IP infrastructure in software-defined architectures.
The underlay network provides basic Layer 3 unicast routing and physical IP reachability across all fabric nodes.
Overlay encapsulation protocols rely on underlying IP reachability between tunnel endpoints.
2
Determine the encapsulation and virtualization layer.
The overlay network uses tunneling protocols such as VXLAN to create logical topologies over the physical underlay.
Overlays abstract tenant network services from the underlying physical cabling and routing topology.
3
Associate control plane functions with endpoint location tracking.
The control plane protocol (e.g., LISP) maps Endpoint Identifiers (EIDs) to Routing Locators (RLOCs).
Decoupling endpoint identity from physical location enables mobility and simplified policy enforcement within the fabric.
4
Define the overarching fabric structure.
The network fabric is the combined system encompassing underlay, overlay, and control plane elements.
Together, these elements form the unified software-defined architectural ecosystem.

Key Concept

Software-Defined Architecture Components: Underlay, Overlay, Control Plane, and Fabric
Estimated Time:45s
Question 112Question →

A network security administrator is aligning enterprise network management requirements with AAA framework services and protocol architecture. Match each operational task or network access requirement on the left with its corresponding AAA component or protocol mechanism on the right.

Click a left item, then click its matching right item

Items

Validating user credentials against a centralized directory server during an initial 802.1X supplicant connection
Restricting an authenticated operator from executing specific privilege level configuration commands on a router
Logging start and stop timestamps, user identity, and session byte counts for administrative sessions to a central database
Encrypting the complete body of transmission packets over connection-oriented TCP port 49 during administrative sessions

Matches

Show answer & explanation

Answer

Validating credentials maps to Authentication; restricting command execution maps to Authorization; logging timestamps and session data maps to Accounting; encrypting full packet bodies over TCP port 49 maps to TACACS+ Protocol Mechanics.
Each operational requirement directly corresponds to a fundamental pillar of the AAA framework or a specific protocol implementation detail: Authentication handles identity verification, Authorization enforces command and resource access rights, Accounting logs session and audit data, and TACACS+ provides full-payload encryption over TCP port 49.

Step-by-Step Solution

1
Identify the AAA pillar responsible for identity verification.
Validating user credentials against a central directory service establishes identity, which is the core function of Authentication.
Authentication answers the question 'Who are you?' by checking credentials.
2
Identify the AAA pillar responsible for enforcing permissions and command restrictions.
Controlling command access and restricting operational privileges maps to Authorization.
Authorization answers the question 'What are you allowed to do?' after identity has been established.
3
Identify the AAA pillar responsible for audit trailing and session metrics.
Recording timestamps, session statistics, and user activities maps to Accounting.
Accounting answers the question 'What did you do and for how long?' for compliance auditing.
4
Identify the security protocol characteristic involving full packet body encryption over TCP 49.
TCP port 49 transport with complete payload encryption is a defining feature of TACACS+.
Unlike RADIUS, which uses UDP and encrypts only the password field, TACACS+ encrypts the entire payload over TCP.

Key Concept

AAA Framework Functional Separation & TACACS+ vs RADIUS Architecture
Question 113Question →

Match each Public Key Infrastructure (PKI) component or Multi-Factor Authentication (MFA) element on the left to its corresponding function or definition on the right.

Click a left item, then click its matching right item

Items

Certificate Signing Request (CSR)
Certificate Authority (CA)
Online Certificate Status Protocol (OCSP)
Time-based One-Time Password (TOTP)

Matches

Show answer & explanation

Answer

Certificate Signing Request (CSR) matches the encoded block containing a public key and metadata; Certificate Authority (CA) matches the entity issuing signed certificates; Online Certificate Status Protocol (OCSP) matches the real-time revocation query protocol; Time-based One-Time Password (TOTP) matches the dynamic MFA factor generated using a shared secret and timestamp.
Each item accurately aligns with its standard PKI or security definition: CSR is the initial request containing public key and identity data, CA is the signing body, OCSP is the query protocol for checking revocation status, and TOTP is a time-synchronized dynamic multi-factor credential.

Step-by-Step Solution

1
Identify the role of a Certificate Signing Request (CSR).
Recognize that a CSR is created by the requester and contains the public key along with subject details destined for a CA.
CSR generation is the initial step in obtaining an X.509 digital certificate.
2
Identify the role of a Certificate Authority (CA).
Associate the CA with the trusted issuer that signs certificates.
The CA establishes trust in PKI by signing certificates with its own private key.
3
Differentiate between certificate validation protocols and authentication mechanisms.
Link OCSP to real-time revocation checks and TOTP to temporary time-based MFA factor generation.
OCSP provides efficient status checks over HTTP, whereas TOTP serves as a possession-based authentication factor.

Key Concept

PKI Components and MFA Authentication Factors
Question 114Question →

Match each Differentiated Services Code Point (DSCP) Per-Hop Behavior (PHB) standard on the left to its corresponding bit/decimal value and network application profile on the right.

Click a left item, then click its matching right item

Items

Expedited Forwarding (EF)
Assured Forwarding 41 (AF41)
Class Selector 6 (CS6)
Default Forwarding (DF)

Matches

Show answer & explanation

Answer

Expedited Forwarding (EF) matches DSCP 46 (voice/low-latency queue); Assured Forwarding 41 (AF41) matches DSCP 34 (high-priority data with low drop precedence); Class Selector 6 (CS6) matches DSCP 48 (network control traffic); Default Forwarding (DF) matches DSCP 0 (best-effort standard FIFO).
Each DiffServ PHB maps directly to a standardized 6-bit DSCP value: EF maps to DSCP 46 for priority low-latency queues, AF41 maps to DSCP 34 for high-priority low-drop data, CS6 maps to DSCP 48 for network control traffic, and DF maps to DSCP 0 for best-effort traffic.

Step-by-Step Solution

1
Identify the DSCP encoding and purpose of Expedited Forwarding (EF).
EF uses binary 101110101110 (DSCP 46) to provide a guaranteed low-delay, low-jitter expedited path for voice media.
RFC 2598 defines EF for real-time applications using a priority queue.
2
Determine the DSCP binary and decimal values for Assured Forwarding AF41.
For AF class xx and drop precedence yy (AF xyxy), the 6-bit DSCP structure is xxxyy0xxxyy0. For AF41, x=4x=4 (1002100_2) and y=1y=1 (01201_2), giving binary 100010100010 (decimal 34).
AF41 allocates guaranteed bandwidth while maintaining low drop probability under congestion.
3
Map Class Selector 6 (CS6) to its corresponding 6-bit DSCP value.
Class Selector values set the 3 MSBs to match IP Precedence while zeroing the 3 LSBs, yielding binary 110000110000 (DSCP 48).
CS6 is reserved by network equipment for critical control traffic like OSPF and BGP routing updates.
4
Identify the characteristics of Default Forwarding (DF).
DF uses binary 000000000000 (DSCP 0).
DF describes standard best-effort traffic subject to FIFO queuing and tail drop when queues overflow.

Key Concept

DiffServ Per-Hop Behaviors (PHB) and DSCP Marking Standards
Question 115Question →

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding system action or behavior on the right.

Click a left item, then click its matching right item

Items

Port Security Protect Mode
Port Security Restrict Mode
Dynamic ARP Inspection (DAI)
DHCP Snooping Untrusted Port

Matches

Show answer & explanation

Answer

Port Security Protect Mode matches dropping traffic silently without counter increments or log messages. Port Security Restrict Mode matches dropping traffic while incrementing the violation counter and logging. Dynamic ARP Inspection matches validating ARP packets against the DHCP binding database. DHCP Snooping Untrusted Port matches discarding incoming DHCP server packets like DHCPOFFER and DHCPACK.
Each feature is correctly matched to its specific control-plane or data-plane enforcement mechanism: Protect mode drops frames without logging; Restrict mode drops frames with logging and counter increments; Dynamic ARP Inspection verifies ARP packets using the DHCP snooping binding database; untrusted DHCP snooping ports drop inbound server messages (DHCPOFFER/DHCPACK).

Step-by-Step Solution

1
Analyze Port Security violation modes (Protect vs. Restrict)
Protect mode drops unauthorized MAC traffic silently (no counter increment, no syslog). Restrict mode drops unauthorized traffic, increments the security violation counter, and generates syslog/SNMP alerts.
Differentiating violation modes requires knowing which modes generate alerts and counters versus silent frame drops.
2
Analyze Dynamic ARP Inspection operational requirements
DAI inspects ARP packets on untrusted ports and verifies the MAC-to-IP binding against the switch's DHCP snooping binding table.
DAI relies directly on the DHCP snooping database (or static ARP ACLs) to mitigate ARP poisoning and spoofing attacks.
3
Analyze DHCP Snooping port trust roles
Untrusted ports permit client requests (DHCPDISCOVER/DHCPREQUEST) but drop incoming server responses (DHCPOFFER/DHCPACK).
Preventing rogue DHCP servers requires blocking DHCP server response messages on user-facing untrusted ports.

Key Concept

Layer 2 Security Mechanisms (Port Security Violation Modes, DAI Operation, DHCP Snooping Trust States)
Question 116Question →

Match each network operation or traffic flow to its corresponding architectural plane.

Click a left item, then click its matching right item

Items

Exchanging OSPF Link-State Advertisements (LSAs) and computing the shortest path
Performing ingress packet header inspection and ASIC-based switching
Establishing an encrypted SSH session to configure device interfaces

Matches

Show answer & explanation

Answer

Exchanging OSPF LSAs matches the Control Plane; Performing ASIC-based switching matches the Data Plane; Establishing an encrypted SSH session matches the Management Plane.
Network operations are separated into functional planes based on their purpose: the Control Plane handles routing logic and network state signaling (e.g., OSPF); the Data Plane processes and forwards transit user data via hardware (e.g., ASIC packet switching); and the Management Plane handles direct administrative interactions (e.g., SSH).

Step-by-Step Solution

1
Analyze OSPF neighbor interactions and path calculations.
Determined to be control traffic responsible for maintaining topology information.
Protocols that create and maintain routing tables operate within the Control Plane.
2
Analyze ASIC-based frame/packet switching.
Determined to be user payload handling performed directly in hardware forwarding tables.
Transit traffic forwarding decisions and encapsulation changes belong to the Data Plane.
3
Analyze device access via SSH.
Determined to be user-to-device management traffic.
Administrative access protocols used to control and configure network nodes belong to the Management Plane.

Key Concept

Functional Plane Separation (Control, Data, and Management Planes)
Question 117Question →

An organization is updating its enterprise security standards for administrative access and infrastructure security. Match each security control or PKI concept on the left to its corresponding operational function on the right.

Click a left item, then click its matching right item

Items

Account Lockout Threshold
Possession Factor
Certificate Signing Request (CSR)
Certificate Revocation List (CRL)

Matches

Show answer & explanation

Answer

Account Lockout Threshold matches the control defining maximum failed attempts before disabling an account. Possession Factor matches identity verification using a physical or digital token. Certificate Signing Request (CSR) matches submitting a public key and identity info to a CA. Certificate Revocation List (CRL) matches the periodically published list of revoked certificate serial numbers.
The correct pairings accurately map security terms to their standard definitions. Account Lockout Threshold controls brute-force password attacks by disabling accounts after failed attempts. Possession Factor represents 'something you have' such as a TOTP token app. CSR represents the enrollment request payload sent to a CA containing the public key. CRL represents the list of invalidated certificate serial numbers published by a CA.

Step-by-Step Solution

1
Analyze the password policy control mechanism.
Identify that Account Lockout Threshold limits failed login attempts to protect administrative accounts from brute-force attacks.
Password security policies enforce lockout rules after a predefined number of incorrect password attempts.
2
Categorize the multi-factor authentication element.
Map Possession Factor to tangible or digital objects like TOTP hardware tokens or smartphone apps.
MFA requires factors from distinct categories: Knowledge (something you know), Possession (something you have), and Inherence (something you are).
3
Evaluate PKI certificate enrollment components.
Match Certificate Signing Request (CSR) to the payload containing identity info and public key sent to a CA.
Endpoints must generate a local keypair and send a CSR to a Certificate Authority to obtain an X.509 certificate.
4
Evaluate PKI certificate revocation mechanisms.
Match Certificate Revocation List (CRL) to the signed file listing revoked certificate serial numbers.
CAs publish CRLs so relying parties can verify whether a certificate was invalidated prior to its scheduled expiration.

Key Concept

Password Security Policies, Multi-Factor Authentication (MFA) Factors, and Public Key Infrastructure (PKI) Certificate Components
Question 118Question →

Match each wireless security deployment mode or protocol with its primary cryptographic cipher suite or key exchange mechanism.

Click a left item, then click its matching right item

Items

WPA3-Personal
Standard WPA2-Enterprise
WPA3-Enterprise 192-bit Mode
Enhanced Open (OWE)

Matches

Show answer & explanation

Answer

WPA3-Personal matches Simultaneous Authentication of Equals (SAE) using the Dragonfly handshake; Standard WPA2-Enterprise matches AES-CCMP-128 encryption paired with 802.1X/EAP authentication; WPA3-Enterprise 192-bit Mode matches 256-bit AES-GCMP encryption with HMAC-SHA384 key derivation; Enhanced Open (OWE) matches Unauthenticated Diffie-Hellman key exchange providing opportunistic encryption.
Each wireless protocol suite uses distinct cryptographic mechanisms: WPA3-Personal relies on SAE (Dragonfly key exchange) to prevent offline brute-force attacks; standard WPA2-Enterprise uses 802.1X/EAP with AES-CCMP-128 encryption; WPA3-Enterprise 192-bit mode upgrades encryption to 256-bit AES-GCMP and HMAC-SHA384; and Enhanced Open employs OWE with unauthenticated Diffie-Hellman key exchange for open Wi-Fi protection.

Step-by-Step Solution

1
Analyze WPA3-Personal key management requirements
Identify that WPA3-Personal mandates SAE (Simultaneous Authentication of Equals), replacing static PSK to protect against offline passphrase cracking.
SAE performs a forward-secret Dragonfly handshake during initial association.
2
Analyze standard WPA2-Enterprise default specifications
Identify that WPA2-Enterprise standard deployments use 802.1X with EAP methods for identity verification combined with AES-CCMP-128 for symmetric payload encryption.
AES-CCMP-128 is the default mandatory cipher suite defined in the IEEE 802.11i standard for WPA2.
3
Evaluate high-security WPA3 Enterprise requirements
Identify that WPA3-Enterprise 192-bit security mode specifies 256-bit AES Galois/Counter Mode (GCMP-256) and HMAC-SHA384 key derivation.
The 192-bit security profile aligns with Commercial National Security Algorithm (CNSA) suite standards.
4
Examine open wireless network encryption standards
Identify that Enhanced Open utilizes RFC 8110 Opportunistic Wireless Encryption (OWE) via an unauthenticated Diffie-Hellman key exchange.
OWE delivers pairwise encryption on guest or open SSIDs without requiring password authentication.

Key Concept

Wireless security standards (WPA2, WPA3, OWE) and their respective authentication, key exchange, and cipher mechanisms.
Question 119Question →

A network administrator is configuring Public Key Infrastructure (PKI) certificate services to secure administrative access and VPN connections on Cisco routers. Match each PKI component on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

Certificate Signing Request (CSR)
Certificate Revocation List (CRL)
Online Certificate Status Protocol (OCSP)
Certificate Authority (CA)

Matches

Show answer & explanation

Answer

Certificate Signing Request (CSR) matches the encoded request block with the public key; Certificate Revocation List (CRL) matches the signed file containing serial numbers of invalidated certificates; Online Certificate Status Protocol (OCSP) matches the real-time HTTP status checking protocol; Certificate Authority (CA) matches the trusted entity issuing signed certificates.
Each PKI component aligns with its specific role in the lifecycle of digital certificates: the CSR is the request payload created by an endpoint containing its public key; the CA is the trusted authority issuing certificates; the CRL is a published list of revoked serial numbers; and OCSP is an HTTP-based real-time certificate revocation protocol.

Step-by-Step Solution

1
Identify the creation and submission phase of PKI certificate enrollment.
The Certificate Signing Request (CSR) is the unsigned request file containing the public key and applicant identity details submitted to the CA.
Before a certificate can be issued, a key pair is generated locally and public details are placed in the CSR.
2
Identify the certificate issuing body.
The Certificate Authority (CA) is the trusted party that validates identity information and signs identity certificates using its private key.
The CA establishes trust by acting as the signing authority in the Public Key Infrastructure.
3
Distinguish between offline/periodic and online/real-time certificate revocation checks.
CRL refers to the periodically published file of revoked certificate serial numbers, while OCSP provides real-time revocation checking over HTTP.
CRLs require downloading full lists periodically, whereas OCSP queries the revocation status of individual certificates on demand.

Key Concept

Public Key Infrastructure (PKI) components and certificate validation mechanisms
Question 120Question →

A network security administrator is configuring centralized security management for enterprise switches and routers. Match each AAA pillar or protocol characteristic on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

Authentication
Authorization
Accounting
TACACS+ Security Architecture

Matches

Show answer & explanation

Answer

Authentication matches with verifying user credentials. Authorization matches with defining allowed privileges and commands. Accounting matches with logging user activity and session details. TACACS+ Security Architecture matches with encrypting the full payload and separating AAA functions over TCP port 49.
Authentication verifies credentials (who you are), Authorization controls permitted actions/commands (what you can do), Accounting logs user session details (what you did), and TACACS+ architecture relies on TCP port 49 while providing full-packet payload encryption and modular separation of AAA functions.

Step-by-Step Solution

1
Identify the core definition of Authentication
Authentication answers 'Who are you?' by verifying credentials such as usernames and passwords.
Establishing identity is the primary first step in the AAA framework.
2
Identify the core definition of Authorization
Authorization answers 'What can you do?' by defining permitted command levels and access rights.
Once identity is proven, permissions must be enforced per user role.
3
Identify the core definition of Accounting
Accounting answers 'What did you do?' by tracking session start/stop times and commands executed.
Auditing requires keeping log records of user actions.
4
Identify the architectural mechanics of TACACS+
TACACS+ decouples AAA operations and uses TCP port 49 with full-packet payload encryption.
Unlike RADIUS which combines authentication/authorization and encrypts passwords only, TACACS+ provides total payload encryption and modular AAA separation.

Key Concept

AAA Framework Pillars and TACACS+ Protocol Architecture
PreviousPage 6 / 12Next
All practice questions — Cisco CCNA | Examkin