Security Fundamentals

A network administrator is implementing Layer 2 security on VLAN 30 of a Cisco Catalyst switch. The VLAN contains both dynamic DHCP clients and devices with statically configured IP addresses. DHCP Snooping is active on VLAN 30.

To allow traffic from the static IP devices that do not exist in the DHCP snooping binding database, the administrator creates an ARP Access Control List (ACL) named `STATIC_DEVICES` matching the static MAC and IP pairs, and executes the following command:

`Switch(config)# ip arp inspection filter STATIC_DEVICES vlan 30`

Immediately after applying this command, static IP hosts communicate successfully, but all dynamic DHCP clients on VLAN 30 lose connectivity because their ARP packets are dropped by Dynamic ARP Inspection (DAI).

Which configuration modification must be made to permit ARP traffic from both static IP devices and dynamic DHCP clients?

Match each core network security term on the left with its corresponding enterprise security description on the right.

A network engineer configures port security on a Cisco Catalyst switch interface using the command `switchport port-security mac-address sticky`. The switch successfully learns the MAC address of the connected host and dynamically adds it to the running configuration. However, after the switch is rebooted, the port security configuration no longer retains the previously learned host MAC address. Which administrative oversight caused this issue?

An enterprise network administrator discovers that an unauthorized host on an internal VLAN is performing a Man-in-the-Middle (MitM) attack by broadcasting spoofed ARP messages, associating its own MAC address with the IP address of the default gateway. Which Layer 2 security mechanism should be implemented on the access switches to mitigate this specific threat?

An attacker on a local Ethernet network sends spoofed ARP messages to associate their MAC address with the IP address of the default gateway, allowing them to secretly intercept and relay network traffic between a victim host and the router. Which type of security threat is being executed?

Place the following Cisco IOS password encryption types in order of security strength, from weakest (least secure) to strongest (most secure).

Match each enterprise network security threat on the left with its corresponding operational description or attack vector characteristic on the right.

Match each enterprise security threat scenario on the left with its most effective primary mitigation strategy on the right.

A security analyst is reviewing measures to enforce the Confidentiality, Integrity, and Availability (CIA) triad across an enterprise network. Which of the following security controls directly address the Integrity leg of the CIA triad? (Select two.)

An enterprise organization suffers a security incident where an unauthorized actor intercepts and alters router configuration files in transit across an unencrypted network link, causing network routing tables to become corrupted. The security team must implement controls to ensure that data cannot be modified in transit without detection. Which core principle of the CIA triad was violated during this attack, and which security mechanism directly mitigates this specific vulnerability?

An enterprise network administrator discovers a weakness in a router's firmware that has not yet been patched by the vendor. This weakness could potentially allow unauthorized access if targeted by malicious traffic. Which security term specifically describes this software weakness?

During an enterprise security audit following a system compromise, an incident response team discovers that a database server was accessed without authorization. The investigation shows that an outdated operating system service contained a coding flaw, which permitted an attacker to run a publicly available script to gain administrative access. Which security term specifically describes the flaw in the outdated operating system service?

A network engineer configures IPsec encryption on a site-to-site VPN tunnel connecting two corporate offices to ensure that intercepted data packets cannot be read by unauthorized individuals. Which core security principle of the CIA triad is directly achieved by this control?

An enterprise network experiences an internal security incident where an unauthorized host on access VLAN 10 poisons the ARP caches of adjacent endpoints by advertising its own MAC address as the default gateway. A network engineer must implement a Layer 2 mitigation strategy that intercepts, inspects, and validates ARP requests and responses against a trusted IP-to-MAC binding table built by DHCP snooping. Which security mechanism directly mitigates this threat?

An infrastructure auditor reviews the local access credentials and line configuration snippet on an enterprise Cisco IOS switch:

text
username auditmgr privilege 15 secret 8 $8$ vG4k$9mP...
username techuser privilege 1 password 0 Cisco123!
service password-encryption
!
line console 0
login local
!
line vty 0 4
login local
transport input ssh
!
line vty 5 15
login
transport input ssh

Based on this configuration, which statement accurately describes the operational and security impact on administrative access?

A network administrator is conducting a security baseline review for an enterprise network to distinguish key security concepts and apply suitable mitigation strategies. Which two statements accurately describe key security principles or valid mitigation practices? (Select two.)

Match each network security threat on the left with its corresponding primary mitigation strategy on the right.

An enterprise network administrator needs to securely connect a fixed branch office network to the corporate headquarters over the public Internet. The connection must operate transparently to end users and encrypt all traffic between the two network gateways without requiring software installation on individual host computers. Which VPN deployment model and technology best satisfies this requirement?

A company requires a VPN solution for mobile employees working from personal laptops. The organization wants to grant secure remote access to internal web-based applications without requiring users to install dedicated VPN client software on their endpoints. Which VPN deployment model best satisfies this requirement?

Match each VPN technology or deployment concept to its corresponding operational characteristic.