Security Fundamentals

An organization needs to deploy a virtual private network (VPN) solution for contractors connecting from untrusted public networks using standard web browsers without requiring software installation on their endpoint devices. Additionally, corporate policy mandates that only traffic bound for internal enterprise applications should pass through the VPN tunnel, while general internet traffic routes directly out through the local internet connection. Which VPN deployment model and traffic management feature combination fulfills these security and operational requirements?

An enterprise network administrator is conducting a security risk assessment across the organization's infrastructure. Match each security incident description on the left to its appropriate technical mitigation control on the right.

A financial enterprise requires a secure connection for dynamic, roaming field auditors back to corporate headquarter applications while allowing them to maintain simultaneous access to local subnet resources such as home printers. Concurrently, the organization must maintain a permanent, always-on encrypted connection between a fixed regional branch router and the headquarter security appliance to route entire subnet traffic transparently.

Which architectural combination correctly satisfies the operational requirements for both deployment models?

An administrator configures port security on a Cisco Catalyst switch access interface using the command switchport port-security mac-address sticky. End devices connect to the port, and their MAC addresses are dynamically converted to sticky MAC addresses. Following a scheduled reload of the switch, the connected devices lose network connectivity. What is the root cause of this issue?

Match each IPsec VPN framework component or feature on the left with its correct primary operational function on the right.

Match each VPN deployment scenario or operational requirement on the left with the corresponding VPN technology or protocol implementation on the right.

During a security audit of an enterprise network infrastructure, an engineer reviews several identified security vulnerabilities and proposed mitigation steps across administrative access, ACL filtering, and switchport security. Which of the following correctly pairs an identified security threat or vulnerability with its proper mitigation strategy?

A network administrator needs to secure remote administrative access to a Cisco IOS switch by requiring users to authenticate against the local user database. Which two steps are required to implement local user database authentication for remote VTY line access? (Select two.)

A network security engineering team is analyzing threat vectors affecting enterprise switch and router infrastructure. Match each security threat scenario on the left with its primary technical mitigation mechanism on the right.

A network administrator configures an IPv4 extended access control list (ACL) on a Cisco router interface to allow web traffic using the following command:

`access-list 100 permit tcp host 192.168.1.50 any eq 80`

No other ACL entries are configured on the router. What happens when host 192.168.1.50 sends an ICMP echo request (ping) packet through the interface where this ACL is applied?

Match each Cisco Layer 2 security feature or interface trust state on the left with its correct operational behavior or dependency on the right.

An administrator configures the following extended IPv4 access control list on a Cisco IOS router to control traffic between subnets:

ip access-list extended SECURE_ACCESS
10 deny tcp host 192.168.10.15 host 10.1.20.10 eq 22
20 permit tcp host 192.168.10.15 10.1.20.0 0.0.0.255 eq 80
30 permit tcp host 192.168.10.15 10.1.20.0 0.0.0.255 eq 443
40 permit icmp 192.168.10.0 0.0.0.255 host 10.1.20.254 echo

The access list is applied inbound on the interface facing the 192.168.10.0/24 subnet. Which TWO statements accurately describe how traffic will be processed by this access control list?

An administrator attempts to secure VLAN 20 on a Cisco Catalyst switch by executing the commands `ip dhcp snooping vlan 20` and `ip arp inspection vlan 20`. Access interface GigabitEthernet0/2 is in VLAN 20 and remains in its default untrusted state for both security features. Clients connected to GigabitEthernet0/2 are configured with static IP addresses, but all outgoing ARP packets from these clients are intercepted and dropped by the switch, preventing any network communication. Which root cause explains why Dynamic ARP Inspection (DAI) is dropping this ARP traffic?

A corporate web application suddenly becomes unresponsive after an external adversary directs a massive, synchronized volume of HTTP request traffic from thousands of compromised hosts, fully saturating the internet edge routers. A subsequent incident investigation confirms that no sensitive data was intercepted or modified, but internal employees were completely prevented from accessing the application during the outage. Which principle of the CIA triad was directly violated by this attack?

A network engineer configures the following named extended IPv4 Access Control List (ACL) on a Cisco IOS router to regulate inbound traffic from a branch office subnet ($10.20.0.0/22$) destined for a data center network ($172.16.100.0/24$):

`ip access-list extended BRANCH_POLICY`
` 10 permit tcp host 10.20.2.45 host 172.16.100.10 eq 22`
` 20 permit tcp host 10.20.2.45 host 172.16.100.10 eq 443`
` 30 deny tcp 10.20.0.0 0.0.3.255 172.16.100.0 0.0.0.255 eq 80`
` 40 deny tcp 10.20.0.0 0.0.3.255 172.16.100.0 0.0.0.255 eq 443`

The ACL is applied to the inbound direction of the interface facing the branch network. What happens when a user at host $10.20.1.10$ attempts to send ICMP echo request packets to server $172.16.100.1$?

A network administrator performs a security audit on a remote branch's main Intermediate Distribution Frame (IDF) closet. The auditor discovers two primary compliance issues: unbadged visitors routinely tailgate behind employees through the entrance door, and staff members frequently leave the access door propped open during work hours due to a lack of security protocol knowledge. Which pair of measures—consisting of one physical access control and one security program element—most effectively remediates these specific vulnerabilities?

A network administrator configures Multi-Factor Authentication (MFA) for engineers establishing SSH connections to core routers. The login policy requires engineers to enter their domain password followed by a dynamic time-based passcode generated by a mobile application on their corporate-managed phone. Which two authentication factor categories are being used in this scenario?

Match each enterprise security initiative to the corresponding element classification within an overall enterprise security framework.

An organization's Chief Financial Officer receives a highly tailored email that appears to originate from the company's primary banking institution. The message references specific details regarding a recent internal corporate transaction and directs the executive to a credential-harvesting website disguised as the bank's portal. Which security threat is demonstrated in this scenario?

An organization is updating its enterprise security program policy for network edge enclosures located in multi-tenant facilities. The Chief Information Security Officer (CISO) requires a security architecture that combines an administrative security program element with a physical access control mechanism to prevent unauthorized physical hardware tampering by facility personnel. Which set of measures correctly pairs an administrative security program element with a physical access control to fulfill this mandate?