Security Fundamentals

A network security engineer is hardening a Cisco IOS router for remote administrative access. The running configuration contains the following entries:

text
username opsadmin privilege 15 secret 9 $9$ eG8H $kQzP8vX... username opstech secret 5$ 1 $mER7$ h8GzK2Pq...
username opsguest password 0 Cisco12345!
service password-encryption
!
line vty 0 4
exec-timeout 10 0
privilege level 5
login local
transport input ssh

Based on this configuration, which operational behavior will occur when users authenticate remotely via SSH?

An organization is updating its network management policy to mitigate the threat of credential sniffing and unauthorized command execution during administrative access to network devices across an untrusted network. Which protocol should be deployed to enforceAAA administrative access while ensuring that the complete payload—including all authorization commands—is fully encrypted in transit?

An enterprise needs to grant external consultants secure access to web-based internal applications from their personal, unmanaged laptops. The security policy strictly forbids requiring local administrative rights or installing persistent client software on the end-user endpoints. Which VPN deployment model best satisfies these operational constraints?

A company is establishing operational guidelines to meet compliance mandates for its core data facility. The chief security officer highlights the necessity of administrative safeguards working in tandem with physical access mechanisms. Which initiative is properly classified as an administrative element of a security program?

Match each physical access control or security program element to its primary purpose within an enterprise network security framework.

A network security administrator is designing an IPsec site-to-site VPN to interconnect a main office and a remote branch office across the Internet. Which TWO statements correctly describe the operational functions and behavior of IPsec framework protocols in this deployment?

Match each VPN operational feature or protocol component on the left with its corresponding functional description on the right.

A network administrator applies the following IPv4 extended named access control list (ACL) inbound on the GigabitEthernet0/1 interface of a Cisco IOS router to restrict access to a server network:

text
ip access-list extended SERVER_POLICY
10 permit tcp 172.16.5.0 0.0.0.255 host 172.20.10.25 eq 22
20 permit tcp 172.16.5.128 0.0.0.127 172.20.10.0 0.0.0.255 eq 443
30 deny tcp host 172.16.5.150 172.20.10.0 0.0.0.255
40 permit ip 172.16.5.0 0.0.0.255 172.20.10.0 0.0.0.255

The router receives two distinct packets on interface GigabitEthernet0/1:
- Packet 1: Source IP 172.16.5.150, Destination IP 172.20.10.25, Protocol UDP (DNS, destination port 53)
- Packet 2: Source IP 172.16.5.150, Destination IP 172.20.10.30, Protocol TCP (HTTP, destination port 80)

Which statement accurately describes how the router processes these two packets?

A network engineer applies the following local authentication and access configuration to a Cisco IOS XE router:

text
username opsuser privilege 7 secret OpsPass#2026
username auditor privilege 1 secret AuditPass#2026
enable secret EnablePass#2026
!
line vty 0 15
transport input ssh
login local

When `opsuser` successfully establishes an SSH session to the router using local database credentials, which initial operational state and privilege level behavior does the user experience?

A network administrator configures an IPv4 extended named Access Control List (ACL) on router R1 to control access to a server farm located on subnet 10.120.16.0/20, which connects locally to interface GigabitEthernet0/0. The policy requirements state that:
1. Management traffic (SSH and HTTPS) from 192.168.100.0/24 to the server farm must be allowed.
2. ICMP echo requests from host 192.168.200.5 to the server farm must be allowed.
3. All traffic originating inside the server farm (10.120.16.0/20) bound for its default gateway (10.120.16.1) must be allowed.
4. All other IPv4 traffic entering the server farm interface must be denied and logged.

The engineer applies the following configuration:

text
ip access-list extended SEC_SERVER_MGMT
permit tcp 192.168.100.0 0.0.0.255 10.120.16.0 0.0.15.255 eq 22
permit tcp 192.168.100.0 0.0.0.255 10.120.16.0 0.0.15.255 eq 443
permit icmp host 192.168.200.5 10.120.16.0 0.0.15.255 echo
permit ip 10.120.16.0 0.0.15.255 host 10.120.16.1
!
interface GigabitEthernet0/0
ip access-group SEC_SERVER_MGMT in

Which two statements correctly identify flaws or operational outcomes of this ACL deployment?

An enterprise requires remote employees using corporate laptops to establish a secure network-layer tunnel back to the headquarters firewall. The solution must support all IP-based applications and operate seamlessly across restrictive public networks by encapsulating traffic inside TLS or DTLS on port 443. Which VPN technology should the administrator deploy to satisfy these requirements?

A technician configures initial administrative security on a newly racked Cisco IOS XE switch using the following CLI commands:

text
username netadmin secret C1sco!Pass2026
line console 0
password C1sco!Pass2026
login

During validation, the technician observes that connecting via the serial console prompts only for a password, allowing login without entering the username `netadmin` stored in the local database.

Which command must be executed under `line console 0` to require authentication against the local user database?

An administrator enables port security on a Cisco switch interface using default settings without specifying a violation mode. What default action will the switch take if an unauthorized device connects to this interface?

An enterprise organization is updating security measures for its core telecommunications enclosure to protect critical network hardware. Which mechanism serves as a physical access control specifically designed to prevent unauthorized individuals from tailgating authorized personnel into the facility?

Match each port security violation mode on the left with its corresponding switch behavior when an unauthorized MAC address is detected on an interface.

A network engineer applies the following IPv4 extended named Access Control List (ACL) inbound on interface GigabitEthernet0/0 of a Cisco IOS router:

text
ip access-list extended SERVER_ACCESS
permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 443
permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 80

A workstation with IPv4 address 172.16.10.45 attempts to establish an SSH management session (TCP port 22) to the server at 192.168.50.10. Which result describes how the router processes this SSH traffic?

A network administrator is auditing the infrastructure security measures for a newly constructed enterprise data center facility. Which two measures represent physical access controls specifically designed to protect physical hardware and prevent unauthorized physical entry? (Select two.)

A network administrator needs to configure an extended IPv4 ACL (ACL 101) on a Cisco router to control access from the User Subnet ($10.2.2.0/24$) to the Server Subnet ($10.1.1.0/24$) according to the following security requirements:

1. Host $10.2.2.50$ must be permitted SSH access (TCP port 22) to Server $10.1.1.10$.
2. Host $10.2.2.50$ must be denied all other IP traffic to any destination on the Server Subnet ($10.1.1.0/24$).
3. All other hosts on the User Subnet ($10.2.2.0/24$) must be permitted HTTP access (TCP port 80) to Server $10.1.1.20$.
4. All other traffic from the User Subnet to the Server Subnet must be explicitly denied.

Arrange the given ACL statements in the correct top-down evaluation order (from first line processed to last line processed) to successfully enforce these security requirements.

A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch. DHCP Snooping is enabled on VLAN 20, but several legacy printers on untrusted access ports use static IPv4 addresses and are not recorded in the DHCP snooping binding database. Consequently, DAI drops legitimate ARP packets originating from these printers. Which two configuration actions must the administrator perform to allow ARP traffic from the static hosts while maintaining DAI inspection on those untrusted ports? (Select two.)

A network administrator is evaluating local password storage mechanisms on a Cisco IOS XE device to align with security hardening standards. Arrange the following Cisco IOS password storage types in order from WEAKEST security protection to STRONGEST security protection.