Examkin

Security Fundamentals

298 questions

All types298Multiple choice157Multiple select64Matching56Ordering21
Question 1Question →

A network security administrator is deploying a site-to-site IPsec VPN tunnel between two corporate edge routers across a private WAN. The security policy requires data confidentiality and integrity for the IP payload. To minimize encapsulation overhead, the design mandates retaining the original IP packet header rather than encapsulating the packet with an additional new IP header. Which IPsec protocol and mode combination fulfills these requirements?

Show answer & explanation

Answer: Encapsulating Security Payload (ESP) in transport mode

Answer

Encapsulating Security Payload (ESP) in transport mode
Encapsulating Security Payload (ESP) provides confidentiality through data encryption as well as data integrity and origin authentication. In transport mode, ESP encrypts only the IP payload while keeping the original IP header intact, satisfying both the security policy for confidentiality and the constraint to minimize packet overhead.

Step-by-Step Solution

1
Identify the protocol requirement for data confidentiality and integrity.
Encapsulating Security Payload (ESP) must be selected because Authentication Header (AH) does not support encryption (confidentiality).
AH provides integrity and authentication only, whereas ESP provides encryption, integrity, and authentication.
2
Determine the operational mode based on IP header overhead constraints.
Transport mode must be used rather than tunnel mode.
Transport mode encrypts only the payload and retains the original IP header, avoiding the extra overhead of adding a new outer IP header as required in tunnel mode.

Key Concept

IPsec Security Protocols (AH vs ESP) and Operational Modes (Transport vs Tunnel)
Question 2Question →

Which physical security control uses a set of two interlocking doors to directly prevent unauthorized individuals from tailgating into a secure data center facility?

Show answer & explanation

Answer: A mantrap vestibule

Answer

A mantrap vestibule is the correct physical security control designed specifically to prevent tailgating by utilizing interlocking doors.
A mantrap vestibule features two interlocking doors where only one door can be open at a time. Once a user scans their credentials to enter the first door, that door must close fully before the second door unlocks, isolating individuals and preventing unauthorized tailgating into restricted areas.

Step-by-Step Solution

1
Identify the primary threat described in the scenario.
The target threat is tailgating (piggybacking), where an unauthorized individual physically follows an authorized person through a secure doorway.
Preventing tailgating requires physical barriers capable of enforcing single-person entry verification.
2
Differentiate physical security controls from logical network security controls.
A mantrap vestibule physically holds an individual between two interlocking doors until identity/access is verified. Logical controls (ACLs, AAA, Port Security) operate entirely inside network software/hardware interfaces.
Only physical access controls like mantraps physically constrain human movement at facility entrances.

Key Concept

Physical Access Controls - Mantraps
Question 3Question →

An infrastructure analyst is performing a security review of an enterprise management network. The organization requires per-command authorization for administrative CLI access on routers and switches, along with full packet payload encryption between network devices and the central AAA server. Which security protocol satisfies these requirements?

Show answer & explanation

Answer: TACACS+, because it encrypts the entire packet payload and separates authentication, authorization, and accounting functions.

Answer

TACACS+, because it encrypts the entire packet payload and separates authentication, authorization, and accounting functions.
TACACS+ operates over TCP port 49 and separates the authentication, authorization, and accounting (AAA) functions. This modular separation permits granular authorization checks for every individual administrative command entered on a network device. Furthermore, TACACS+ encrypts the full body of every packet after the standard header, meeting the requirement for complete payload confidentiality.

Step-by-Step Solution

1
Analyze requirement 1: Full payload encryption.
TACACS+ encrypts the entire packet payload after the header, whereas RADIUS only encrypts the password attribute.
Security requirement demands full payload protection during network transmission.
2
Analyze requirement 2: Per-command authorization.
TACACS+ decouples authentication, authorization, and accounting, allowing every CLI command to be individually authorized by the TACACS+ server.
RADIUS binds authentication and authorization together, which prevents per-command authorization.
3
Select protocol matching both conditions.
TACACS+ meets both full payload encryption and granular per-command authorization criteria.
Only TACACS+ satisfies all architectural constraints.

Key Concept

TACACS+ vs RADIUS Protocol Characteristics and AAA Separation
Question 4Question →

Match each VPN framework element on the left with its primary functional purpose on the right.

Click a left item, then click its matching right item

Items

Diffie-Hellman (DH) Group
Encapsulating Security Payload (ESP)
Authentication Header (AH)
Internet Key Exchange (IKE)

Matches

Show answer & explanation

Answer

Diffie-Hellman (DH) Group pairs with deriving shared secret keys over unsecure networks; Encapsulating Security Payload (ESP) pairs with providing confidentiality through encryption along with integrity; Authentication Header (AH) pairs with providing data integrity without confidentiality; Internet Key Exchange (IKE) pairs with establishing control channels and negotiating SAs.
Each IPsec component performs a distinct function: Diffie-Hellman derives shared secret keys over an untrusted link, ESP delivers packet encryption and integrity, AH delivers authentication without confidentiality, and IKE manages negotiation and Security Associations.

Step-by-Step Solution

1
Identify the key exchange method
Diffie-Hellman allows peer routers to compute a shared secret key over an unsecure medium.
Symmetric encryption key material must be securely established before encrypting tunnel data.
2
Differentiate between IPsec data encapsulation protocols
ESP provides payload encryption (confidentiality) plus authentication. AH provides authentication only, leaving payload plaintext.
AH lacks an encryption algorithm, whereas ESP encapsulates and encrypts payload data.
3
Identify the management and SA negotiation protocol
IKE negotiates security parameters and manages Security Associations (SAs).
IKE handles control plane negotiation prior to data plane forwarding.

Key Concept

IPsec Protocol Framework Components
Question 5Question →

During a physical security compliance evaluation of a remote edge facility, an auditor notes three vulnerability findings: unauthorized personnel entering the main telecommunications enclosure by following authorized employees (tailgating), unmonitored physical patch panel connections in public hallways, and employee badges left unattended at desktop terminals. To address these vulnerabilities, the security team must implement controls classified specifically under physical access control mechanisms and administrative security program elements. Which combination of measures correctly pairs a physical access control with an administrative security program element to directly address these findings?

Show answer & explanation

Answer: Installing mantrap vestibules with biometric authentication at enclosure entry points, and mandating recurring security awareness training alongside clear desk and badge policies.

Answer

Installing mantrap vestibules with biometric authentication at enclosure entry points, and mandating recurring security awareness training alongside clear desk and badge policies.
The correct response accurately identifies physical access controls (mantrap vestibules and biometric access systems, which physically block unauthorized piggybacking/tailgating) and administrative security program elements (security awareness training and physical badge management policies, which establish governance and educate users on physical security standards).

Step-by-Step Solution

1
Analyze the audit findings and categorize required remediation domains.
Findings involve physical perimeter breaches (tailgating), exposed wiring closet access, and poor employee security habits.
Security measures fall into three primary categories: physical controls, technical/logical controls, and administrative/program controls.
2
Evaluate candidate controls for physical access control classification.
Mantrap vestibules, biometric readers, locks, and physical barriers directly restrict physical access to hardware enclosures.
Physical access controls prevent unauthorized physical contact with network assets and prevent physical intrusion techniques like tailgating.
3
Evaluate candidate controls for administrative security program element classification.
Security awareness training programs, badge handling procedures, and clear desk policies represent organizational policies and human governance.
Administrative controls focus on human policy enforcement, compliance, awareness campaigns, and operational guidelines.

Key Concept

Physical Access Controls vs. Administrative Security Program Elements
Estimated Time:1m 30s
Question 6Question →

A network administrator needs to configure an extended IPv4 access control list (ACL) to implement a specific traffic policy on a Cisco router interface. Arrange the following ACL statements and actions in the correct top-down evaluation order to ensure that host 10.1.1.15 is allowed SSH access to server 172.16.0.5, all other SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 is blocked, all other IP traffic from subnet 10.1.1.0/24 is permitted, and unmatched traffic is dropped by default.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places specific permit statements first (permit tcp host 10.1.1.15 host 172.16.0.5 eq 22), followed by broader subnet restrictions (deny tcp 10.1.1.0 0.0.0.255 host 172.16.0.5 eq 22), then general subnet permits (permit ip 10.1.1.0 0.0.0.255 any), and concludes with the automatic implicit deny rule.
Cisco IOS IPv4 access control lists process entries in strict sequential top-down order, stopping processing as soon as a packet matches an Access Control Entry (ACE). Therefore, specific host exceptions must be placed above broader subnet rules. The permit statement for host 10.1.1.15 must be evaluated first so it is not dropped by the subnet-wide SSH deny rule. Placing general subnet permit traffic third allows other protocols from the subnet, and any packet not matching these three lines falls into the automatic implicit deny rule at the bottom.

Step-by-Step Solution

1
Identify specific host exception rules
Position the permit rule for host 10.1.1.15 SSH traffic at line 1.
Cisco IOS processes ACLs top-down sequentially; specific host permissions must precede subnet-wide blocks to prevent false matches.
2
Identify broader subnet restriction rules
Position the deny rule for SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 at line 2.
This blocks all other hosts in 10.1.1.0/24 from SSH access to 172.16.0.5 after the allowed host exception is processed.
3
Identify general permit rules for remaining subnet traffic
Position the permit IP rule for 10.1.1.0/24 to any destination at line 3.
This allows non-SSH traffic from 10.1.1.0/24 to pass after specific SSH security checks have been evaluated.
4
Account for default ACL termination behavior
Acknowledge the implicit deny ip any any statement at the end of the evaluation list.
Cisco IOS appends an unseen implicit deny statement to the end of every ACL, dropping any packet that does not match preceding lines.

Key Concept

Cisco IPv4 ACL sequential top-down evaluation logic and implicit deny enforcement
Question 7Question →

A network administrator applies a standard IPv4 access control list containing a single line, `access-list 10 permit 192.168.1.0 0.0.0.255`, to a router interface. What happens to incoming packets originating from host 10.0.0.5?

Show answer & explanation

Answer: The packets are dropped due to the implicit deny statement at the end of the access list.

Answer

The packets are dropped due to the implicit deny statement at the end of the access list.
In Cisco IOS IPv4 Access Control Lists, an unwritten 'implicit deny' statement exists at the end of every list. Any traffic that does not match one of the explicit permit statements will be dropped by default when it reaches the end of the ACL.

Step-by-Step Solution

1
Evaluate the incoming packet source address against the ACL statements.
The packet source IP 10.0.0.5 is compared against the first entry: `permit 192.168.1.0 0.0.0.255`.
ACL entries are processed sequentially from top to bottom.
2
Determine if the packet matches the explicit entry.
Host 10.0.0.5 does not belong to the 192.168.1.0/24 network, so it does not match.
The wildcard mask 0.0.0.255 restricts matching strictly to the 192.168.1.0/24 subnet.
3
Apply the default action at the end of the list.
The packet hits the invisible `deny ip any any` (or `deny any`) statement at the bottom of the ACL and is dropped.
Every Cisco IPv4 ACL automatically ends with an implicit deny all clause.

Key Concept

Implicit Deny Clause in Cisco IPv4 ACLs
Question 8Question →

A network engineer is configuring a named extended IPv4 Access Control List (ACL) on a Cisco IOS router to implement a multi-tier security policy. The ACL must process rules top-down to meet the following requirements:
1. Permit SSH access (TCPTCP port 22) from the specific management host 192.168.100.50192.168.100.50 to the core server interface 10.1.1.110.1.1.1.
2. Deny all other IP traffic originating from the Management subnet (192.168.100.0/24192.168.100.0/24) destined for the Server Farm subnet (10.1.0.0/1610.1.0.0/16).
3. Permit ICMP echo traffic from the Operations subnet (172.16.20.0/24172.16.20.0/24) to any destination.
4. Permit all remaining IPv4 traffic across all subnets.

In what order should the access-list statements be configured from top (first statement executed) to bottom (last statement executed) to ensure proper sequential traffic processing without unintended dropping of packets?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: 1) permit tcp host 192.168.100.50 host 10.1.1.1 eq 22, 2) deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255, 3) permit icmp 172.16.20.0 0.0.0.255 any echo, 4) permit ip any any.
Cisco Access Control Lists evaluate matching statements in a strict top-down sequential order. Once a packet matches an Access Control Entry (ACE), processing stops for that packet. Therefore, more specific rules (such as permitting TCP port 22 from host 192.168.100.50192.168.100.50 to host 10.1.1.110.1.1.1) must appear before broader rules (such as denying 192.168.100.0/24192.168.100.0/24 to 10.1.0.0/1610.1.0.0/16). Finally, 'permit ip any any' must be placed at the end to prevent unmentioned traffic from being dropped by the implicit deny rule.

Step-by-Step Solution

1
Identify specific host permit exception
Recognize that 'permit tcp host 192.168.100.50 host 10.1.1.1 eq 22' is a specific exception to a broader subnet blocking rule.
Cisco ACLs process rules sequentially from top to bottom and stop at the first match. Specific host rules must always precede general subnet rules that overlap with them.
2
Place broader subnet deny rule
Position 'deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255' immediately after the specific permit rule.
This blocks all other hosts in 192.168.100.0/24192.168.100.0/24 from accessing any hosts in 10.1.0.0/1610.1.0.0/16.
3
Add specific subnet feature permits
Add 'permit icmp 172.16.20.0 0.0.0.255 any echo' to allow Operations ICMP traffic.
Matches the requirement for ICMP echo traffic from 172.16.20.0/24172.16.20.0/24.
4
Add explicit catch-all permit rule
Append 'permit ip any any' at the very bottom.
Without this rule, Cisco IOS ACLs end with an implicit 'deny ip any any' clause, which would drop all other traffic across the network.

Key Concept

Cisco IPv4 Extended ACL sequential top-down evaluation and implicit deny override.
Question 9Question →

A network engineer is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco IOS router. Place the following ACL entries in the correct top-down execution sequence (from top/first line to bottom/last line) to ensure that SSH traffic from management host 192.168.1.10 to server 10.1.1.50 is allowed, HTTP traffic from subnet 192.168.1.0/24 to server 10.1.1.50 is allowed, and all remaining IPv4 traffic to server 10.1.1.50 is denied.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order from top to bottom is: first, the specific host SSH permit statement ('access-list 105 permit tcp host 192.168.1.10 host 10.1.1.50 eq 22'); second, the subnet HTTP permit statement ('access-list 105 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.50 eq 80'); and third, the explicit deny statement ('access-list 105 deny ip any host 10.1.1.50').
Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a matching rule is found. To function correctly, specific rules (single host 192.168.1.10 on port 22) must come first, followed by broader rules (subnet 192.168.1.0/24 on port 80), and finally any explicit deny statement intended to block remaining traffic to host 10.1.1.50.

Step-by-Step Solution

1
Identify the most specific traffic requirement.
SSH traffic (TCP port 22) from single host 192.168.1.10 to server 10.1.1.50 is identified.
Cisco ACLs process sequentially from top to bottom, stopping at the first match. More specific entries must be positioned above general ones.
2
Identify the broader permitted traffic requirement.
HTTP traffic (TCP port 80) from the entire 192.168.1.0/24 subnet to server 10.1.1.50 is placed next.
This permits web traffic for the broader subnet while allowing host 192.168.1.10 to have already matched its SSH permit entry on line 1.
3
Place the specific deny statement for remaining traffic destined to the server.
The entry 'access-list 105 deny ip any host 10.1.1.50' is placed after all permit entries.
Placing a deny rule above any permit rules would cause matching traffic to be dropped prematurely.

Key Concept

Cisco IPv4 ACL Top-Down Sequential Evaluation
Question 10Question →

A network engineer must construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy requirements for traffic originating from subnet 10.20.1.0/2410.20.1.0/24 destined for the server subnet 172.16.10.0/24172.16.10.0/24:

1. Host 10.20.1.510.20.1.5 must be permitted to access SSH (TCP port 22) on the server subnet.
2. Host 10.20.1.510.20.1.5 must be denied all other TCP traffic to the server subnet.
3. All other hosts on subnet 10.20.1.0/2410.20.1.0/24 must be permitted HTTP (TCP port 80) access to the server subnet.
4. All remaining IPv4 traffic from subnet 10.20.1.0/2410.20.1.0/24 to the server subnet must be dropped.

Arrange the ACL statements in the correct top-down sequence (from top/sequence 10 to bottom/sequence 40) to properly enforce this security policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22, followed by deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255, followed by permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80, and finally deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255.
Cisco IPv4 Access Control Lists evaluate statements sequentially from top to bottom until a first match occurs. To enforce host-specific exceptions within a larger subnet, more specific rules (host 10.20.1.5 permits and denies) must precede general rules (subnet 10.20.1.0/24 permits and denies). Placing the SSH permit for host 10.20.1.5 first guarantees SSH functionality. Placing the TCP deny for host 10.20.1.5 second prevents host 10.20.1.5 from matching the subnet HTTP permit rule placed third. Finally, the subnet-wide IP deny statement catches all other traffic from the subnet.

Step-by-Step Solution

1
Identify the most specific exception rule for host 10.20.1.5.
The permit statement for SSH (TCP port 22) for host 10.20.1.5 must be evaluated first.
Cisco ACLs process statements top-down until a match occurs. Placing host 10.20.1.5's SSH permit rule at the top ensures SSH traffic is not dropped by subsequent deny rules.
2
Block all remaining TCP traffic for host 10.20.1.5.
Place 'deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255' second.
Host 10.20.1.5 belongs to the 10.20.1.0/2410.20.1.0/24 subnet. If the general HTTP permit rule for the subnet were placed above this statement, host 10.20.1.5 would accidentally be permitted HTTP access.
3
Permit HTTP traffic for the rest of the 10.20.1.0/2410.20.1.0/24 subnet.
Place 'permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80' third.
Since host 10.20.1.5 has already matched earlier statements for its allowed/denied TCP traffic, remaining hosts in 10.20.1.0/2410.20.1.0/24 reach this step and are permitted HTTP access.
4
Catch all remaining IPv4 traffic from the source subnet.
Place 'deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255' last.
This explicitly drops any non-HTTP traffic from 10.20.1.0/2410.20.1.0/24 to 172.16.10.0/24172.16.10.0/24 before reaching the implicit deny any clause.

Key Concept

Top-Down Sequential Processing and Specific-to-General Ordering in IPv4 Extended ACLs
Question 11Question →

Match each Layer 2 security feature on the left with its primary mitigation purpose or operation on the right.

Click a left item, then click its matching right item

Items

Port Security
DHCP Snooping
Dynamic ARP Inspection (DAI)

Matches

Show answer & explanation

Answer

Port Security matches limiting ingress traffic based on source MAC addresses. DHCP Snooping matches filtering untrusted DHCP messages and building the IP-to-MAC binding database. Dynamic ARP Inspection (DAI) matches intercepting and verifying ARP packets against a binding database to prevent ARP poisoning.
Each feature secures a distinct Layer 2 operation: Port Security controls MAC-level access, DHCP Snooping filters DHCP traffic while tracking legitimate IP-MAC assignments, and DAI utilizes those assignments to drop spoofed ARP frames.

Step-by-Step Solution

1
Identify the role of Port Security.
Port Security operates at the MAC layer to restrict ingress traffic based on authorized source MAC addresses.
It prevents unauthorized devices from attaching to a switch port.
2
Identify the role of DHCP Snooping.
DHCP Snooping blocks unauthorized DHCP servers and records valid IP-to-MAC address assignments in its binding database.
It ensures rogue DHCP servers cannot distribute invalid network configurations and provides binding context for other features.
3
Identify the role of Dynamic ARP Inspection (DAI).
DAI inspects ARP packets and uses the DHCP snooping binding database to validate ARP requests and responses.
It prevents man-in-the-middle attacks caused by malicious ARP poisoning or spoofing.

Key Concept

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)
Question 12Question →

A network administrator configures an IPv4 extended numbered Access Control List (ACL 110) on a Cisco IOS router interface to prevent web traffic on TCP port 80 from reaching an internal web server at 192.168.10.50/32. The administrator enters the following single configuration command:

`R1(config)# access-list 110 deny tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80`

ACL 110 is then applied inbound on the GigabitEthernet0/0 interface serving subnet 10.1.1.0/24. Immediately after applying the ACL, users on the 10.1.1.0/24 network report that all network communication is blocked, including ICMP pings, SSH access, and traffic destined for other subnets. Which configuration oversight is causing all traffic from subnet 10.1.1.0/24 to be dropped?

Show answer & explanation

Answer: The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.

Answer

The ACL lacks an explicit permit statement, causing all unlisted IPv4 traffic to be dropped by the default implicit deny any clause at the end of the list.
Every standard and extended Cisco IPv4 ACL concludes with an unwritten, invisible implicit deny clause ('deny ip any any'). When an ACL contains only a deny statement, any traffic that does not meet the specific deny criteria drops through to the implicit deny clause and is blocked. To fix this, a network administrator must configure a subsequent permit statement (such as 'access-list 110 permit ip any any') to allow all other traffic to pass through.

Step-by-Step Solution

1
Analyze the sequential evaluation of IPv4 Access Control Lists in Cisco IOS.
Cisco ACLs process statements sequentially from top to bottom until a match occurs.
If a packet matches a specific permit or deny statement, no further statements in the list are evaluated.
2
Examine the default behavior when a packet reaches the end of an ACL without matching any explicit statement.
An invisible 'deny ip any any' statement exists at the end of every IPv4 ACL.
Traffic that does not match an explicit permit rule is automatically dropped.
3
Evaluate the configured ACL 110 against non-HTTP traffic (e.g., ICMP, SSH, or web traffic to other hosts).
Non-HTTP traffic does not match the single 'deny tcp ... eq 80' rule and falls through to the implicit deny statement.
To allow remaining legitimate traffic, an explicit 'access-list 110 permit ip any any' rule must be appended after the deny statement.

Key Concept

Implicit Deny Any Clause in IPv4 ACLs
Question 13Question →

A network administrator is creating an IPv4 extended named Access Control List (ACL) called `MGMT_FILTER` to enforce security policies on a router interface. The policy mandates the following conditions:
- Permit HTTP (8080) and SSH (2222) traffic originating from subnet 192.168.1.0/24192.168.1.0/24 destined to a specific management server at 10.0.5.1010.0.5.10.
- Deny all other IP traffic from subnet 192.168.1.0/24192.168.1.0/24 destined to subnet 10.0.5.0/2410.0.5.0/24.
- Allow all remaining IPv4 traffic traversing the interface to reach other destinations.

Which TWO statements or configuration requirements are necessary to correctly fulfill this policy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 80` and `permit tcp 192.168.1.0 0.0.0.255 host 10.0.5.10 eq 22` prior to the subnet deny entry.; Add an explicit `permit ip any any` entry at the end of the access list sequence.

Answer

The policy requires placing specific TCP permit statements for HTTP and SSH to host 10.0.5.10 before the broader subnet deny rule, and appending an explicit 'permit ip any any' at the end of the ACL to override the default implicit deny.
The solution requires two essential steps: placing specific permit statements for HTTP and SSH to host 10.0.5.10 ahead of the broader subnet deny rule (so specific allowed traffic is processed first), and adding an explicit 'permit ip any any' statement at the bottom of the ACL to override the invisible implicit 'deny ip any any' clause that would otherwise block all other traffic.

Step-by-Step Solution

1
Evaluate Top-Down Sequential Processing
Specific host rules must be placed above general subnet rules.
Cisco IOS processes ACL entries sequentially. If the subnet deny rule for 10.0.5.0/24 were placed first, traffic to 10.0.5.10 on ports 80 and 22 would match the deny rule and be dropped before hitting the permit rules.
2
Account for Implicit Deny Behavior
An explicit 'permit ip any any' line must be added to the end of the ACL.
All Cisco ACLs end with an invisible implicit 'deny ip any any' statement. To permit traffic destined for other subnets outside 10.0.5.0/24, an explicit permit all rule is required at the end.

Key Concept

Access Control List (ACL) Evaluation Order and Implicit Deny Behavior
Question 14Question →

A network administrator configures a single line standard IPv4 Access Control List (ACL) on a Cisco IOS router as follows:

`access-list 10 permit 192.168.1.50 0.0.0.0`

This ACL is applied inbound on interface GigabitEthernet0/0. What happens to incoming IP traffic with a source IPv4 address of 192.168.1.20 when it reaches interface GigabitEthernet0/0?

Show answer & explanation

Answer: The traffic is dropped because of the invisible implicit deny any clause at the end of the ACL.

Answer

The traffic is dropped because of the implicit deny any clause at the end of the access control list.
In Cisco IOS, every Access Control List ends with an unwritten, invisible implicit deny clause (`deny ip any any` or `deny any`). Because the packet from source address 192.168.1.20 does not match the explicit permit rule for host 192.168.1.50, it falls through to the end of the list and is dropped.

Step-by-Step Solution

1
Examine the configured access control list entries.
The ACL contains only one explicit permit line matching source host address 192.168.1.50.
Traffic from source IP 192.168.1.20 does not match this permit statement.
2
Evaluate default Cisco IOS ACL sequential processing behavior.
Every IPv4 ACL ends with an unwritten 'deny ip any any' (or 'deny any') statement.
Since the packet does not match any explicit permit line, it matches the implicit deny statement.
3
Determine the forwarding disposition of the packet.
The packet from source 192.168.1.20 is silently dropped by the router.
Implicit deny drops all traffic that is not explicitly permitted.

Key Concept

ACL Implicit Deny Clause
Question 15Question →

An enterprise network topology consists of Access-Switch-1 linked via trunk interface GigabitEthernet1/0/24 to Distribution-Switch-1, where the network DHCP server resides. DHCP Snooping is enabled globally and on VLAN 20 across both switches. End hosts connected to access ports on Access-Switch-1 fail to acquire dynamic IPv4 addresses. System logs on Distribution-Switch-1 indicate that incoming DHCP Discover packets arriving on interface GigabitEthernet1/0/24 are being dropped upon arrival. Which configuration oversight is the root cause of these packet drops?

Show answer & explanation

Answer: Interface GigabitEthernet1/0/24 on Distribution-Switch-1 remains untrusted for DHCP Snooping, causing it to drop incoming DHCP client requests that contain Option 82 information inserted by Access-Switch-1.

Answer

Interface GigabitEthernet1/0/24 on Distribution-Switch-1 remains untrusted for DHCP Snooping, causing it to drop incoming DHCP client requests that contain Option 82 information inserted by Access-Switch-1.
When DHCP Snooping is active, access switches append DHCP Option 82 (Relay Agent Information) to client requests. If an upstream switch receives a DHCP packet containing Option 82 on a port that is still in the default untrusted state, the switch drops the packet because untrusted ports are not allowed to receive DHCP packets with relay information when giaddr is 0.0.0.0. Designating the trunk interface as trusted using 'ip dhcp snooping trust' resolves the drops.

Step-by-Step Solution

1
Analyze DHCP Snooping default behaviors on Cisco Catalyst access switches.
When DHCP Snooping is enabled globally, Cisco switches automatically insert DHCP Option 82 relay agent information into client DHCP requests originating on untrusted access ports before forwarding them upstream.
Option 82 adds circuit ID and remote ID details to assist DHCP servers with address allocation and policy enforcement.
2
Evaluate the receiving switch interface trust state.
By default, all switch ports (including 802.1Q trunks) are untrusted for DHCP Snooping until explicitly configured with the 'ip dhcp snooping trust' command.
Untrusted ports drop incoming DHCP packets containing non-zero Option 82 data when the gateway address (giaddr) is 0.0.0.0 to prevent DHCP spoofing.
3
Identify the corrective action required on the inter-switch trunk link.
Configuring 'ip dhcp snooping trust' on interface GigabitEthernet1/0/24 of Distribution-Switch-1 allows DHCP requests with Option 82 to pass through to the central DHCP server.
Trunk links pointing toward legitimate network infrastructure and DHCP servers must be designated as trusted interfaces.

Key Concept

DHCP Snooping Option 82 untrusted interface validation rules
Question 16Question →

Match each component of the AAA security framework to its core administrative function.

Click a left item, then click its matching right item

Items

Authentication
Authorization
Accounting

Matches

Show answer & explanation

Answer

Authentication maps to identity verification; Authorization maps to privilege and resource permission determination; Accounting maps to tracking, logging, and usage recording.
Authentication is responsible for verifying identity, Authorization restricts or allows actions based on permissions, and Accounting logs session and command activity for auditing purposes.

Step-by-Step Solution

1
Identify the primary role of Authentication in the AAA framework.
Authentication answers 'Who are you?' by verifying credentials against a local database or remote AAA server.
Establishing identity is the essential first step before any network privileges can be evaluated.
2
Identify the primary role of Authorization in the AAA framework.
Authorization answers 'What are you allowed to do?' by specifying permissible CLI commands or VLAN assignments.
Access control policy enforcement requires explicit permission checks per user session.
3
Identify the primary role of Accounting in the AAA framework.
Accounting answers 'What did you do and for how long?' by capturing log entries and session statistics.
Auditing and compliance depend on maintaining accurate time-stamped logs of administrative actions.

Key Concept

Core Pillars of the AAA Security Framework (Authentication, Authorization, Accounting)
Question 17Question →

A network engineer is configuring a high-security wireless LAN on a Cisco Wireless LAN Controller (WLC) that must strictly comply with WPA3-Enterprise 192-bit mode requirements. Which cryptographic suite and management security setting must be enabled on the WLC profile to meet this standard?

Show answer & explanation

Answer: GCMP-256 encryption, EAP-TLS authentication with SHA-384, and mandatory Protected Management Frames (PMF)

Answer

GCMP-256 encryption, EAP-TLS authentication with SHA-384, and mandatory Protected Management Frames (PMF)
WPA3-Enterprise 192-bit mode mandates the 256-bit Galois/Counter Mode Protocol (GCMP-256) for wireless frame encryption, EAP-TLS with HMAC-SHA384 for robust key derivation and authentication, and mandatory Protected Management Frames (PMF / IEEE 802.11w) to prevent unicast/multicast management frame spoofing.

Step-by-Step Solution

1
Identify the target wireless security operational mode specified in the scenario
The scenario requires configuration of WPA3-Enterprise 192-bit mode (aligned with the Commercial National Security Algorithm / CNSA suite).
WPA3 defines distinct baseline specifications for WPA3-Personal, standard WPA3-Enterprise (128-bit), and WPA3-Enterprise 192-bit mode.
2
Determine the cryptographic ciphers, key management methods, and frame protection rules for 192-bit mode
WPA3-Enterprise 192-bit mode requires GCMP-256 for data confidentiality, EAP-TLS using SHA-384 for key derivation and authentication, and mandatory Protected Management Frames (PMF / IEEE 802.11w).
Standard 128-bit WPA3-Enterprise allows CCMP-128 or GCMP-128, whereas 192-bit mode enforces higher-grade cryptographic algorithms.
3
Evaluate the choices to select the option that contains all mandatory 192-bit mode specifications
The correct selection is the option combining GCMP-256, EAP-TLS with SHA-384, and mandatory PMF.
All other options mix in WPA3-Personal components (SAE), use 128-bit or legacy ciphers (CCMP-128, TKIP), use PSK, or misstate PMF requirements as optional or disabled.

Key Concept

WPA3-Enterprise 192-bit Mode Requirements
Question 18Question →

A network security architect is reviewing the organization's defense-in-depth posture following a risk assessment. Match each enterprise security threat scenario on the left with its most appropriate primary mitigation control on the right.

Click a left item, then click its matching right item

Items

An external attacker sends high volumes of UDP traffic with forged source IP addresses to exposed NTP servers to overwhelm enterprise edge routers.
An attacker sets up a proxy server mimicking a legitimate login portal to capture session cookies and bypass standard SMS-based two-factor authentication.
A malicious insider connects an unauthorized laptop to a dynamic switch port and floods the switch with generated MAC addresses to capture unencrypted traffic.
An automated botnet attempts a low-and-slow execution of common passwords against hundreds of user accounts to evade traditional lockout rules.

Matches

Show answer & explanation

Answer

NTP UDP amplification pairs with Control Plane Policing and NTP query restrictions; Adversary-in-the-Middle phishing pairs with FIDO2/WebAuthn domain-bound hardware key authentication; CAM table MAC flooding pairs with Port Security MAC limits; Password spraying across multiple accounts pairs with risk-based smart lockout policies.
Each security threat scenario directly maps to its precise technological defense: NTP amplification relies on CoPP and NTP service hardening; AiTM phishing proxies require FIDO2 domain binding; switch CAM flooding requires Port Security limits; and password spraying requires tenant-wide risk-based lockout controls.

Step-by-Step Solution

1
Analyze threat scenario 1 (NTP UDP traffic with spoofed IPs).
Identified as a Distributed Denial of Service (DDoS) reflection/amplification attack targeting network control planes.
Control Plane Policing (CoPP) rate-limits incoming control plane traffic and restricting open NTP query access prevents amplification.
2
Analyze threat scenario 2 (Proxy capturing session cookies and SMS 2FA).
Identified as an Adversary-in-the-Middle (AiTM) phishing attack targeting authentication mechanisms.
Phishing-resistant authentication protocols such as FIDO2/WebAuthn use origin-bound public key cryptography that fails if the domain name in the browser does not match.
3
Analyze threat scenario 3 (Flooding dynamic switch ports with generated MAC addresses).
Identified as a Layer 2 CAM table overflow/MAC flooding attack.
Port Security enforces maximum MAC address limits per access port, preventing switch CAM table exhaustion and fail-open behaviors.
4
Analyze threat scenario 4 (Low-and-slow execution of common passwords across many accounts).
Identified as a password spraying attack.
Traditional account lockout triggers per-user failure limits; smart/risk-based lockout policies evaluate tenant-wide password attempt patterns to block spraying.

Key Concept

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Question 19Question →

An enterprise security audit reveals two critical vulnerabilities in a campus network infrastructure: administrative command entries sent to network switches during remote management sessions are logged in cleartext without granular per-command authorization, and unauthorized rogue devices plugged into active wall jacks in common areas gain immediate access to internal network segments. Which two security mitigations directly resolve these specific vulnerabilities? (Select two.)

Select all that apply

Show answer & explanation

Answer: Implementing TACACS+ for network device administration to mandate command-by-command authorization and encrypt the full packet payload.; Configuring Port Security on access switch ports to restrict link connectivity to authorized MAC addresses.

Answer

Implementing TACACS+ for network device administration and configuring Port Security on access switch ports directly resolve the administrative cleartext/authorization gap and unauthorized physical access vulnerabilities.
The correct mitigations are implementing TACACS+ for device administration and configuring Port Security on access switch ports. TACACS+ operates over TCP port 49, encrypts the complete packet body, and permits granular authorization of individual administrative CLI commands. Port Security secures Layer 2 physical access ports by permitting only specified MAC addresses, effectively blocking rogue devices plugged into physical wall jacks.

Step-by-Step Solution

1
Analyze the first identified vulnerability regarding switch administrative command security.
The requirement demands full packet encryption and per-command authorization for network administration.
TACACS+ uses TCP port 49, encrypts the entire packet payload, and allows administrators to control exactly which CLI commands individual users can execute.
2
Analyze the second identified vulnerability regarding rogue physical connections in common areas.
The requirement demands Layer 2 ingress filtering on access ports.
Port Security restricts interface traffic to dynamically learned or statically defined MAC addresses, dropping traffic or shutting down the port when an unauthorized device plugs in.
3
Evaluate why RADIUS and Standard ACLs fail as correct solutions.
RADIUS lacks full payload encryption and per-command authorization, while standard ACLs on access ports trigger implicit deny behavior for non-management host traffic.
Correct mitigations must address the specific root vulnerabilities without causing protocol mismatches or dropping legitimate network traffic.

Key Concept

AAA Framework Differences and Layer 2 Access Control Mitigations
Question 20Question →

A network engineer is analyzing packet captures from a site-to-site IPsec VPN tunnel operating between two enterprise edge routers across an intermediate Internet Service Provider network with Port Address Translation (PAT). The captured traffic shows that Encapsulating Security Payload (ESP) is encapsulated inside UDP port 4500 packets rather than transmitted directly over IP protocol 50. Which statement correctly explains why UDP encapsulation was dynamically negotiated for this IPsec tunnel?

Show answer & explanation

Answer: Intermediate PAT devices require Layer 4 port numbers to multiplex traffic from multiple internal hosts, which raw IP protocol 50 headers lack.

Answer

Intermediate PAT devices require Layer 4 port numbers to multiplex traffic from multiple internal hosts, which raw IP protocol 50 headers lack.
ESP uses raw IP protocol 50, which does not contain TCP/UDP Layer 4 port numbers. When a NAT/PAT device sits between IPsec endpoints, it cannot multiplex multiple internal host connections onto a shared public IP address without port numbers. NAT-T dynamically detects intermediate NAT/PAT devices and encapsulates ESP packets inside UDP port 4500 headers, allowing PAT gateways to perform stateful port translation.

Step-by-Step Solution

1
Analyze the protocol characteristics of unencapsulated IPsec ESP traffic.
ESP operates directly above the IP layer as IP Protocol 50 and does not contain source or destination Layer 4 port numbers.
Without TCP or UDP port fields, a stateful Port Address Translation (PAT) device cannot track multiple internal IP address mappings to a single public IP address.
2
Identify how IPsec NAT Traversal (NAT-T) resolves PAT incompatibility.
During IKE negotiations, peers detect intermediate NAT devices and encapsulate ESP packets inside a UDP header using destination port 4500.
Adding the UDP header inserts valid Layer 4 port fields into the packet stream, enabling intermediate PAT routers to perform port translation and maintain session tables for ESP traffic.

Key Concept

IPsec NAT Traversal (NAT-T) and ESP Encapsulation Mechanics
Page 1 / 15Next