Examkin

Security Fundamentals

298 questions

All types298Multiple choice157Multiple select64Matching56Ordering21
Question 261Question →

A network engineer is hardening an enterprise access layer switch using Cisco Layer 2 security features. Match each specific Layer 2 security feature configuration component on the left with its exact operational behavior or validation requirement on the right.

Click a left item, then click its matching right item

Items

Dynamic ARP Inspection (DAI) on an untrusted access port
DHCP Snooping Option 82 handling on an untrusted port
Port Security sticky MAC address learning (`switchport port-security mac-address sticky`)
DHCP Snooping Rate Limiting (`ip dhcp snooping limit rate`)

Matches

Show answer & explanation

Answer

Dynamic ARP Inspection matches validating ARP sender MAC/IP pairings against the DHCP snooping binding table. DHCP Snooping Option 82 handling on untrusted ports matches dropping incoming DHCP packets containing non-zero GIADDR or Option 82 payloads by default. Port Security sticky MAC learning matches adding dynamically learned MACs to running-config requiring an explicit copy to startup-config for boot persistence. DHCP Snooping rate limiting matches tracking incoming DHCP packet frequency and err-disabling interfaces that exceed configured thresholds.
Each feature is correctly matched to its functional behavior: Dynamic ARP Inspection validates ingress ARP packets against the DHCP snooping database; DHCP Snooping drops untrusted packets containing Option 82 or non-zero GIADDR fields; Sticky Port Security writes learned MACs to running-config (requiring manual saving for persistence); and DHCP Snooping rate limiting places interfaces in an err-disabled state upon threshold violations.

Step-by-Step Solution

1
Analyze Dynamic ARP Inspection (DAI) operation on untrusted interfaces.
DAI inspects all incoming ARP packets on untrusted ports and compares the sender MAC address and sender IP address against valid entries in the DHCP snooping binding database.
This prevents man-in-the-middle ARP spoofing attacks across Layer 2 VLANs.
2
Analyze DHCP Snooping Option 82 untrusted port enforcement.
DHCP snooping drops incoming packets on untrusted interfaces if the packet contains Option 82 information or a non-zero GIADDR value.
Untrusted access ports are intended for end hosts, which should not generate relay agent information fields.
3
Analyze sticky MAC address persistence in Port Security.
Configuring sticky MAC learning adds dynamically discovered MAC addresses into the active running-configuration.
Because these MAC addresses reside only in running-config, administrators must save the configuration (`copy running-config startup-config`) to make them permanent across switch reboots.
4
Analyze DHCP Snooping Rate Limiting behavior.
Enforcing `ip dhcp snooping limit rate` places an untrusted interface in the `err-disabled` state if incoming DHCP frames exceed the configured rate limit.
This protects switch CPU resources and DHCP infrastructure against denial-of-service starvation attacks.

Key Concept

Layer 2 Security Feature Operations and Verification (DAI, DHCP Snooping, Port Security)
Question 262Question →

A network security administrator configures mutual certificate-based authentication (EAP-TLS) for remote access VPN endpoints. During initial validation testing, client endpoints successfully verify the identity of the VPN gateway. However, the VPN gateway fails to authenticate the client certificates. Detailed inspection reveals that the gateway is configured for mandatory certificate status checking using the Online Certificate Status Protocol (OCSP), but outbound HTTP requests sent to the Uniform Resource Identifier (URI) listed in the Authority Information Access (AIA) extension are being dropped by a perimeter security policy. Which statement correctly identifies the cause of the failure and the necessary resolution?

Show answer & explanation

Answer: The gateway is unable to verify client certificate revocation status because egress filtering blocks OCSP traffic on port 80; allowing outbound HTTP to the OCSP responder resolves the authentication failure.

Answer

The gateway is unable to verify client certificate revocation status because egress filtering blocks OCSP traffic on port 80; allowing outbound HTTP to the OCSP responder resolves the authentication failure.
The correct answer identifies that OCSP queries rely on HTTP (TCP port 80) to reach the responder address indicated in the client certificate's AIA extension. When an egress firewall drops outbound HTTP connections to that IP/domain, the security gateway cannot verify whether the client certificate has been revoked, causing the authentication process to fail under strict revocation policy settings.

Step-by-Step Solution

1
Analyze the certificate revocation checking mechanism
OCSP is used for real-time certificate status queries sent to the responder URI specified in the certificate's AIA extension.
When strict revocation checking is enabled, failing to contact the OCSP responder causes the validating party to treat the certificate as untrusted/unverified.
2
Identify the transport protocol used by OCSP
OCSP requests and responses travel over standard HTTP (TCP port 80).
If an egress security policy or ACL blocks outbound HTTP requests to the target OCSP server, status checks fail.
3
Determine the necessary remediation step
Permit outbound TCP port 80 traffic destined for the OCSP responder address.
Restoring reachability allows the gateway to receive valid OCSP responses and complete EAP-TLS client authentication.

Key Concept

Digital Certificates and Revocation Checking (OCSP vs CRL)
Question 263Question →

A network administrator needs to record and audit the specific CLI commands executed by engineers during their active management sessions on enterprise routers. Which component of the AAA framework provides this record-keeping functionality?

Show answer & explanation

Answer: Accounting

Answer

Accounting is the AAA component responsible for tracking user activity and maintaining audit logs of executed commands.
Accounting is designed to track user activity and resource consumption. In device administration, command accounting specifically records each command entered by an administrator into an audit log on the TACACS+ server.

Step-by-Step Solution

1
Analyze the functional requirement described in the scenario.
The requirement specifies logging and auditing actions taken by users after gaining system access.
The AAA framework divides security management into three distinct operational pillars: Authentication, Authorization, and Accounting.
2
Map the requirement to the corresponding AAA service.
Accounting tracks network resource utilization and logs user administrative commands and session metrics.
Authentication asks 'Who are you?', Authorization asks 'What are you allowed to do?', and Accounting asks 'What did you actually do?'.

Key Concept

AAA Framework Core Functions
Question 264Question →

A network engineer configures an inbound IPv4 extended Access Control List (ACL) on GigabitEthernet0/1 to filter traffic entering a corporate network segment:

text
ip access-list extended FILTER_WEB
permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 80
permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 443

A workstation at 172.16.10.15172.16.10.15 attempts to send ICMP echo request packets (ping) to the server at 192.168.1.50192.168.1.50. What happens to these ICMP packets when processed by the router interface?

Show answer & explanation

Answer: The ICMP packets are dropped because they do not match any explicit permit statement, causing them to hit the implicit deny all clause.

Answer

The ICMP packets are dropped because they do not match any explicit permit statement, causing them to hit the implicit deny all clause.
Extended IPv4 ACL rules are processed top-down until a match is found. The ACL in the scenario only permits TCP traffic destined for port 80 or port 443. Because ICMP echo requests use the ICMP protocol (not TCP), they do not match either explicit permit statement. Unmatched traffic falls through to the implicit `deny ip any any` entry present at the end of every Cisco ACL, resulting in the packet being dropped.

Step-by-Step Solution

1
Evaluate the protocol and traffic parameters of the incoming packet.
The packet is an ICMP echo request originating from 172.16.10.15172.16.10.15 destined for 192.168.1.50192.168.1.50.
Extended ACLs filter based on source IP, destination IP, protocol type, and port numbers.
2
Compare the packet against the explicit ACL rules sequentially from top to bottom.
Line 1 specifies TCP port 80 (HTTP) and Line 2 specifies TCP port 443 (HTTPS). Neither rule matches ICMP traffic.
ICMP is a Layer 3 protocol (IP protocol number 1) and does not use TCP (IP protocol number 6) transport headers.
3
Determine the outcome when no explicit permit rule is matched.
The packet reaches the unwritten end of the access list, matching the default `deny ip any any` rule.
Every Cisco IOS IPv4 Access Control List ends with an invisible implicit deny statement that drops all unmatched traffic.

Key Concept

ACL Sequential Evaluation and the Implicit Deny Any Clause
Question 265Question →

In enterprise Cisco switch implementations, Layer 2 security controls govern frame processing, metadata insertion, and hardware lookup behaviors. Match each Layer 2 security operation or feature context to its exact functional mechanism.

Click a left item, then click its matching right item

Items

Port Security Restrict Violation Mode
Dynamic ARP Inspection (DAI) Payload Validation
DHCP Snooping Option 82 Insertion
DAI ARP Access Control List (ARP ACL) Inspection Filter

Matches

Show answer & explanation

Answer

Port Security Restrict Violation Mode matches with dropping frames, incrementing violation counters, and logging syslogs without err-disabling the port. Dynamic ARP Inspection Payload Validation matches with intercepting ARP packets on untrusted ports and inspecting payload sender IP/MAC pairs against bindings. DHCP Snooping Option 82 Insertion matches with appending relay agent circuit/remote ID metadata to client requests on untrusted ports. DAI ARP ACL Inspection Filter matches with evaluating static IP-to-MAC rules prior to checking the DHCP snooping database.
Each feature pair matches its fundamental operational behavior. Port Security restrict mode drops frames and logs alerts without placing the port in err-disabled status. DAI inspects inner ARP payload fields on untrusted ports against the binding database. DHCP Snooping Option 82 appends relay agent sub-options to requests arriving on untrusted ports. DAI ARP ACL filters allow manually configured static IP-to-MAC checks before querying dynamic DHCP bindings.

Step-by-Step Solution

1
Analyze Port Security Restrict Violation Mode
Identify that restrict mode drops unauthorized frames, increments the violation counter, and generates SNMP/syslog alerts while maintaining interface link state up/up.
Differentiates restrict mode from protect mode (which drops silently without logging) and shutdown mode (which disables the interface).
2
Analyze Dynamic ARP Inspection (DAI) Payload Validation
Identify that DAI inspects the inner ARP payload fields (sender MAC and sender IP) on untrusted ports against the DHCP snooping binding database.
Prevents ARP poisoning attacks by verifying MAC-to-IP resolution integrity at Layer 2.
3
Analyze DHCP Snooping Option 82 Insertion
Identify that Option 82 appends circuit ID and remote ID sub-options to DHCP requests on untrusted ports before forwarding toward trusted DHCP servers.
Enables upstream DHCP servers to apply localized IP allocation policies based on switch port location.
4
Analyze DAI ARP ACL Inspection Filter
Identify that ARP ACLs provide static mapping validation override prior to falling back to the dynamic DHCP snooping binding database lookup.
Required to prevent DAI from dropping valid ARP packets generated by static IP assigned hosts that lack DHCP lease entries.

Key Concept

Operational mechanics of Layer 2 security features including Port Security violation handling, DHCP Snooping Option 82 insertion, DAI payload validation, and ARP ACL filtering.
Question 266Question →

A network administrator is configuring an extended IPv4 Access Control List (ACL) named `MGMT_FILTER` to implement sequential top-down filtering on a Cisco router interface. The policy requires four explicit criteria:
1. Permit SSH administrative access (TCP port 22) from source subnet `192.168.50.0/24` to target server `10.10.10.25`.
2. Permit SNMP monitoring queries (UDP port 161) from source subnet `192.168.50.0/24` to target server `10.10.10.25`.
3. Deny and log all other IP traffic from source subnet `192.168.50.0/24` destined to target server `10.10.10.25`.
4. Permit all remaining traffic originating from subnet `192.168.50.0/24` to any other destination, overriding the default implicit deny statement for this subnet.

In what top-down sequential order must these ACL statements be placed to satisfy all policy requirements without shadowing rules?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct top-down sequence is: 1) permit tcp 192.168.50.0 0.0.0.255 host 10.10.10.25 eq 22, 2) permit udp 192.168.50.0 0.0.0.255 host 10.10.10.25 eq 161, 3) deny ip 192.168.50.0 0.0.0.255 host 10.10.10.25 log, 4) permit ip 192.168.50.0 0.0.0.255 any.
Cisco IOS ACLs process traffic sequentially from top to bottom until the first match occurs. To permit specific services (SSH and SNMP) to host 10.10.10.25 while blocking all other traffic to that host, the explicit permit rules for TCP port 22 and UDP port 161 must appear first. The host-specific deny rule must follow these permits so that non-management traffic to host 10.10.10.25 is logged and dropped. Finally, the general permit statement allowing traffic from subnet 192.168.50.0/24 to any destination must be placed last among explicit rules; this ensures traffic destined for other IP addresses is allowed through while preventing the implicit deny clause from dropping all other traffic.

Step-by-Step Solution

1
Place specific service permits first
SSH (TCP 22) and SNMP (UDP 161) rules from 192.168.50.0/24 to host 10.10.10.25 are processed at the top of the ACL.
Cisco IOS processes Access Control Lists sequentially from top to bottom. Specific permits must appear before more general deny statements to prevent permitted traffic from being matched and dropped early.
2
Place the host-specific deny rule next
deny ip 192.168.50.0 0.0.0.255 host 10.10.10.25 log is placed after the allowed services for host 10.10.10.25.
Any non-SSH and non-SNMP traffic targeted at 10.10.10.25 will fail to match the first two permits and will be caught by this statement, logged, and dropped.
3
Place the general subnet permit rule at the bottom
permit ip 192.168.50.0 0.0.0.255 any is placed fourth in the order.
If this rule were placed above the host deny rule, all traffic destined for 10.10.10.25 would be permitted, shadowing the deny statement. Placing it fourth ensures subnet traffic to other destinations is allowed while overriding the final implicit deny any clause.

Key Concept

Top-down sequential evaluation and rule shadowing in IPv4 Access Control Lists
Estimated Time:2m 0s
Question 267Question →

A network engineer configures an extended IPv4 Access Control List (ACL) on a Cisco IOS router interface with the following commands:

text
access-list 105 permit tcp 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255 eq 22
access-list 105 permit icmp 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255 echo

This ACL is applied in the inbound direction on interface GigabitEthernet0/1 (192.168.10.1/24192.168.10.1/24). Which two statements correctly describe how traffic entering interface GigabitEthernet0/1 is processed by this ACL?

Select all that apply

Show answer & explanation

Answer: An SSH session initiated from host 192.168.10.50192.168.10.50 to destination host 172.16.1.10172.16.1.10 will be permitted.; HTTP requests (TCP port 80) from host 192.168.10.50192.168.10.50 to host 172.16.1.10172.16.1.10 will be dropped because of the implicit deny clause.

Answer

SSH sessions to 172.16.1.10 are permitted by the explicit TCP port 22 permit statement, and HTTP requests to 172.16.1.10 are dropped due to the implicit deny at the end of the ACL.
The extended access list explicitly permits TCP packets destined for port 22 (SSH) originating from 192.168.10.0/24192.168.10.0/24 toward 172.16.1.0/24172.16.1.0/24. Traffic on unlisted destination ports, such as HTTP port 80, does not match either permit rule and is filtered by the implicit deny any clause at the end of the ACL processing sequence.

Step-by-Step Solution

1
Analyze rule 1 of ACL 105
Matches TCP traffic from source 192.168.10.0/24 to destination 172.16.1.0/24 on destination port 22 (SSH).
Permits SSH traffic from the internal host subnet to the target destination subnet.
2
Analyze rule 2 of ACL 105
Matches ICMP echo requests from 192.168.10.0/24 to 172.16.1.0/24.
Permits outgoing ping requests from source subnet to destination subnet.
3
Evaluate unlisted traffic types (such as HTTP)
Unlisted traffic reaches the end of the access list without matching any permit statement.
All Cisco IOS ACLs end with an unwritten 'deny ip any any' statement that drops any non-matching packets.

Key Concept

Extended IPv4 Access Control List matching logic and the implicit deny clause
Estimated Time:1m 30s
Question 268Question →

A network administrator executes the commands `ip dhcp snooping` and `ip arp inspection vlan 10` on a Cisco Catalyst switch to mitigate Layer 2 ARP spoofing attacks. However, users on VLAN 10 immediately lose all network connectivity because Dynamic ARP Inspection (DAI) drops all incoming ARP requests from client ports. Executing `show ip dhcp snooping binding` displays an empty binding table. Which command was omitted from the switch configuration?

Show answer & explanation

Answer: ip dhcp snooping vlan 10

Answer

The missing command is 'ip dhcp snooping vlan 10'. Enabling DHCP Snooping globally is a two-step process: global activation followed by VLAN-specific activation.
Dynamic ARP Inspection (DAI) depends directly on the DHCP snooping binding database to inspect and validate ARP traffic arriving on untrusted ports. On Cisco Catalyst switches, turning on DHCP snooping globally using `ip dhcp snooping` does not activate DHCP snooping on any VLAN by default. The administrator must also issue `ip dhcp snooping vlan 10` to inspect DHCP packets on VLAN 10 and dynamically build the binding database.

Step-by-Step Solution

1
Analyze DAI dependencies
DAI inspects incoming ARP requests on untrusted ports by comparing sender IP and MAC addresses against valid entries in the Layer 2 DHCP snooping binding table.
Without valid entries in the binding database, DAI treats all incoming ARP requests on untrusted interfaces as invalid and drops them.
2
Identify the missing DHCP snooping feature configuration
Executing 'ip dhcp snooping' globally enables the feature framework on the switch, but snooping remains disabled on all VLANs until 'ip dhcp snooping vlan <vlan-id>' is configured.
Because VLAN 10 was not explicitly enabled for DHCP snooping, host lease requests were not intercepted, the binding table remained empty, and DAI dropped legitimate host ARP traffic.

Key Concept

DAI reliance on the DHCP Snooping Binding Database
Estimated Time:1m 30s
Question 269Question →

A network engineer is hardening access to a Cisco IOS router. The local user account is created using `username admin1 secret P@ssw0rd123`. However, when administrators attempt to log in remotely via SSH, the router requests only a password rather than asking for a username first. Which command must be configured under `line vty 0 4` to force the router to authenticate users against the local user database?

Show answer & explanation

Answer: login local

Answer

The login local command must be configured under line vty configuration mode to enforce local username and password authentication.
The command 'login local' applied under line configuration mode instructs Cisco IOS to prompt remote users for both a username and a password, validating them against credentials stored in the router's local database.

Step-by-Step Solution

1
Analyze the observed behavior
The router prompts only for a password during remote access, indicating the default line password authentication (login command) is active rather than local user database authentication.
By default, VTY lines configured with the login keyword require a password set on the line itself and do not prompt for a username.
2
Identify the required command for local database authentication
Configuring login local under line vty 0 4 tells the router to prompt for both username and password.
The login local command directs Cisco IOS to verify incoming connection credentials against user accounts configured in the global local database.

Key Concept

Line VTY Local Authentication Configuration
Question 270Question →

Which TWO operational characteristics accurately describe the RADIUS protocol implementation? (Select TWO)

Select all that apply

Show answer & explanation

Answer: It relies on UDP ports 1812 and 1813 for transport communication.; It couples authentication and authorization together in single protocol transactions.

Answer

The correct characteristics are that RADIUS relies on UDP ports 1812 and 1813 for transport communication and couples authentication and authorization together in single protocol transactions.
RADIUS utilizes UDP ports 1812 (authentication/authorization) and 1813 (accounting) for transport communication. In addition, RADIUS combines authentication and authorization into unified client-server packet transactions.

Step-by-Step Solution

1
Analyze transport protocol and port requirements for RADIUS.
RADIUS operates using UDP transport on ports 1812 (Authentication/Authorization) and 1813 (Accounting).
Differentiating transport layer protocols (UDP vs TCP) and port assignments is fundamental to AAA protocol identification.
2
Evaluate how RADIUS handles the AAA architecture pillars.
RADIUS combines authentication and authorization into a single access-request and access-accept workflow.
Unlike TACACS+, which isolates authentication, authorization, and accounting, RADIUS merges authentication and authorization.

Key Concept

RADIUS Operational Characteristics and AAA Architecture
Question 271Question →

A network administrator applies the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to regulate access from the Sales department (192.168.30.0/24192.168.30.0/24) to the Finance server (10.2.2.5010.2.2.50):

text
ip access-list extended FILTER_SALES
permit tcp host 192.168.30.15 host 10.2.2.50 eq 443
deny ip 192.168.30.0 0.0.0.255 host 10.2.2.50
permit ip 192.168.30.0 0.0.0.255 any

Which two statements correctly describe the operational evaluation and deployment best practices for this ACL configuration? (Select two.)

Select all that apply

Show answer & explanation

Answer: Applying FILTER_SALES inbound on the router interface closest to the 192.168.30.0/24 network minimizes unnecessary traffic processing across the router backplane.; Traffic sent from host 192.168.30.15 to a web server at 10.4.4.100 on TCP port 80 will be permitted by the third ACL rule.

Answer

The correct statements are that applying the extended ACL inbound on the interface closest to the source subnet optimizes network performance by dropping blocked packets early, and that HTTP traffic from 192.168.30.15 destined to 10.4.4.100 is allowed by the third ACL rule.
Applying Extended IPv4 ACLs inbound on the interface closest to the traffic source adheres to Cisco best practices by dropping unauthorized packets at the edge. Additionally, traffic from host 192.168.30.15 destined to 10.4.4.100 bypasses the first two specific rules (which strictly filter traffic destined to 10.2.2.50) and matches the third rule permitting general egress traffic from the 192.168.30.0/24 subnet.

Step-by-Step Solution

1
Analyze extended ACL placement guidelines.
Extended ACLs filter based on source/destination IP addresses and layer 4 protocol/port information. Cisco design guidelines state extended ACLs should be applied as close to the traffic source as possible to eliminate prohibited traffic before it traverses the network core.
Applying FILTER_SALES inbound on the ingress interface facing 192.168.30.0/24 complies with standard Cisco architectural recommendations.
2
Evaluate packet matching logic for traffic sent to destination 10.4.4.100.
Line 1 checks for destination host 10.2.2.50 (no match). Line 2 checks for destination host 10.2.2.50 (no match). Line 3 permits any IP traffic from source 192.168.30.0/24 to any destination (MATCH).
Because lines 1 and 2 specify destination host 10.2.2.50, web traffic destined to 10.4.4.100 falls through to line 3 and is explicitly permitted.
3
Evaluate top-down matching for Telnet traffic from 192.168.30.20 to 10.2.2.50.
Line 1 matches only TCP port 443 from host 192.168.30.15 (no match). Line 2 matches all IP traffic from subnet 192.168.30.0/24 to destination host 10.2.2.50 (MATCH -> DENY).
Once a match occurs on line 2, evaluation stops immediately and the packet is dropped. Line 3 is never evaluated for this traffic.

Key Concept

Extended ACL sequential top-down rule evaluation and optimal interface placement
Question 272Question →

A network administrator is configuring initial administrative access security on a Cisco IOS XE router for remote management via SSH. Which TWO commands or configuration actions are required to enforce local database user authentication on the VTY lines and ensure local account passwords are saved using the scrypt (Type 9) hashing algorithm? (Select two.)

Select all that apply

Show answer & explanation

Answer: Execute the username <name> algorithm-type scrypt secret <password> command in global configuration mode.; Execute the login local command under line vty configuration mode.

Answer

The correct configuration requires executing 'username <name> algorithm-type scrypt secret <password>' in global configuration mode and executing 'login local' under line vty configuration mode.
To secure device access using local accounts with strong password storage, administrators must define local accounts using 'username <name> algorithm-type scrypt secret <password>' in global configuration mode. Furthermore, to instruct VTY lines to authenticate inbound SSH connections against these local accounts, the 'login local' command must be configured under line vty mode.

Step-by-Step Solution

1
Configure a local user account using scrypt encryption
Creating the user account with 'username <name> algorithm-type scrypt secret <password>' in global configuration mode stores the password as a Type 9 scrypt hash.
Type 9 scrypt hashing offers high resistance to brute-force attacks compared to older hashing types.
2
Enforce local database authentication on VTY lines
Entering line vty configuration mode (e.g., 'line vty 0 4') and applying 'login local' configures the virtual terminal lines to prompt for local credentials.
By default, VTY lines require explicit configuration to check credentials against the local username/password database.

Key Concept

Device Access Control and Local Password Hashing (Type 9 scrypt and VTY login local configuration)
Question 273Question →

A network administrator is creating an IPv4 extended Access Control List (ACL 101) on a Cisco IOS router to enforce security policies for traffic sent to Web Server 192.168.10.50. The policy requires:

1. Host 10.1.1.5 must be permitted HTTP access (TCP port 80) to Web Server 192.168.10.50.
2. Host 10.1.1.5 must be denied all other IP traffic to Web Server 192.168.10.50.
3. All other hosts in the 10.1.1.0/24 subnet must be permitted full IP access to Web Server 192.168.10.50.
4. All remaining traffic to Web Server 192.168.10.50 must be explicitly denied.

Arrange the ACL statements in the correct sequential top-down order (from line 1 at the top to line 4 at the bottom) to satisfy all security requirements.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from top to bottom is: access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80, followed by access-list 101 deny ip host 10.1.1.5 host 192.168.10.50, followed by access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50, and ending with access-list 101 deny ip any host 192.168.10.50.
Cisco IOS Access Control Lists evaluate rules sequentially from top to bottom until a match is found. Specific rules must always precede broader rules. The specific HTTP permit for host 10.1.1.5 must be line 1; otherwise, a broader deny statement would block it. Next, denying all other IP traffic from host 10.1.1.5 must be line 2, coming before the subnet permit line so that host 10.1.1.5 is restricted. Line 3 permits the rest of the 10.1.1.0/24 subnet. Finally, line 4 explicitly denies all other sources.

Step-by-Step Solution

1
Identify top-down sequential processing logic for Cisco IOS ACLs.
Router processes rules sequentially from top to bottom and stops at the first match.
More specific rules must precede more general rules to avoid being overridden.
2
Place the most specific permit rule for host 10.1.1.5.
access-list 101 permit tcp host 10.1.1.5 host 192.168.10.50 eq 80 is line 1.
If the host deny statement were placed above this permit, HTTP traffic from host 10.1.1.5 would be matched and dropped.
3
Place the host-specific restriction for host 10.1.1.5.
access-list 101 deny ip host 10.1.1.5 host 192.168.10.50 is line 2.
If the general subnet permit rule were placed above this line, host 10.1.1.5 would match the subnet permit and gain full access.
4
Place the general subnet permit rule for 10.1.1.0/24.
access-list 101 permit ip 10.1.1.0 0.0.0.255 host 192.168.10.50 is line 3.
This allows all remaining hosts in 10.1.1.0/24 (excluding host 10.1.1.5's non-HTTP traffic, which was caught in line 2).
5
Place the explicit catch-all deny rule.
access-list 101 deny ip any host 192.168.10.50 is line 4.
Ensures any traffic not originating from 10.1.1.0/24 destined to the server is explicitly dropped.

Key Concept

Top-down sequential evaluation in Cisco ACLs (specific host/port rules before broad subnet rules)
Question 274Question →

A network administrator configures an access port on a Cisco Catalyst switch using the commands `switchport port-security` and `switchport port-security mac-address sticky`. A host connects to the port, and its MAC address is dynamically learned and written to the running configuration. Shortly after, the switch experiences an unexpected reboot due to a brief power failure, before `copy running-config startup-config` or `write memory` was executed. What happens to the learned sticky MAC address on this interface after the switch completes its boot sequence?

Show answer & explanation

Answer: The learned sticky MAC address is lost from memory, and the switch port dynamically learns the MAC address of the first frame received post-reboot.

Answer

The learned sticky MAC address is lost from RAM, causing the port to dynamically re-learn the MAC address of the next device that transmits frames on the link.
Enabling sticky MAC learning (`switchport port-security mac-address sticky`) automatically adds dynamically learned MAC addresses into the volatile `running-config` stored in RAM. If the switch reboots before `copy running-config startup-config` is executed, the learned MAC entries are lost, and the port will learn the MAC address of the next frame transmitted post-reboot.

Step-by-Step Solution

1
Analyze how sticky MAC address learning operates in Cisco IOS.
When `switchport port-security mac-address sticky` is enabled, dynamically learned MAC addresses are converted into static-like entries added directly into the switch's `running-config` in RAM.
This avoids manual MAC address entry while retaining MAC restrictions during current uptime.
2
Evaluate the effect of a switch reboot without saving the running configuration.
Because RAM is volatile memory, any modifications to `running-config` that were not saved to `startup-config` in NVRAM (via `copy running-config startup-config`) are cleared upon reboot.
The startup configuration restored at boot lacks the dynamically added sticky MAC statement.
3
Determine the state of the interface after rebooting.
The port remains operational with sticky port security enabled, but its learned sticky MAC list is empty, allowing it to learn a new sticky MAC address from incoming frames.
The underlying port security feature configuration remains in startup-config, but the learned operational data was lost.

Key Concept

Port Security Sticky MAC Address Persistence
Question 275Question →

Match each Layer 2 security feature or operational scenario on the left to its corresponding switch behavior or implementation detail on the right.

Click a left item, then click its matching right item

Items

DHCP Snooping Option 82 insertion on untrusted access ports
Dynamic ARP Inspection (DAI) evaluation with static ARP ACLs
Port Security set to 'restrict' violation mode
DHCP Snooping binding database construction

Matches

Show answer & explanation

Answer

DHCP Snooping Option 82 insertion on untrusted access ports matches appending relay agent information (circuit ID and remote ID) to broadcast client requests before forwarding them upstream. Dynamic ARP Inspection (DAI) evaluation with static ARP ACLs matches checking IP-to-MAC mappings against configured ARP access lists prior to querying the DHCP snooping binding table. Port Security set to 'restrict' violation mode matches dropping frames from unauthorized MAC addresses, incrementing the violation counter, and generating SNMP traps/Syslog messages without disabling the port. DHCP Snooping binding database construction matches recording the host MAC address, leased IP address, lease duration, binding type, VLAN ID, and port interface upon intercepting a DHCPACK.
Each feature corresponds to its specific L2 operational behavior: DHCP Snooping Option 82 appends relay agent sub-options on untrusted ports; static ARP ACLs take precedence in DAI evaluation before querying the snooping database; restrict mode drops violating frames and generates Syslog/SNMP notifications without disabling the port; and the DHCP snooping binding database extracts host mappings from DHCPACK packets received on trusted ports.

Step-by-Step Solution

1
Analyze DHCP Snooping Option 82 functionality on untrusted ports.
Confirm Option 82 attaches sub-options (circuit ID and remote ID) to client requests on untrusted interfaces.
Option 82 provides relay agent details to the DHCP server to aid subnet allocation and security enforcement.
2
Evaluate Dynamic ARP Inspection (DAI) processing hierarchy.
Confirm static ARP ACLs take precedence over the DHCP snooping binding table during DAI validation.
Configuring `ip arp inspection filter` allows static hosts to pass DAI validation without needing dynamic DHCP snooping entries.
3
Differentiate Port Security violation modes (protect, restrict, shutdown).
Identify 'restrict' mode as dropping unauthorized traffic, logging via Syslog/SNMP, and keeping the interface active.
'Restrict' mode generates alert notifications and tracks violation statistics without causing an error-disabled port shutdown.
4
Examine DHCP Snooping binding table creation criteria.
Verify that snooping tracks DHCPACK messages to store host MAC, IP, lease time, binding type, VLAN, and interface details.
Snooping validates server responses on trusted ports to populate the IP-to-MAC binding database required by features like DAI and IP Source Guard.

Key Concept

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)
Question 276Question →

A network administrator applies the following standard IPv4 access control list (ACL) to a VTY line on a Cisco IOS switch to secure remote management access:

text
ip access-list standard VTY_ACCESS
permit host 192.168.10.25
permit 192.168.20.0 0.0.0.255

A monitoring server with IPv4 address 192.168.10.50192.168.10.50 attempts to initiate an SSH session to the switch. Based on this configuration, what action does the switch take on this traffic, and why?

Show answer & explanation

Answer: The traffic is dropped because it does not match any explicit permit entry, triggering the implicit deny clause at the end of the ACL.

Answer

The traffic is dropped because it does not match any explicit permit entry, triggering the implicit deny clause at the end of the ACL.
Cisco IOS Access Control Lists process statements in sequential order from top to bottom. The source IP address 192.168.10.50 does not match the first entry (which strictly permits only host 192.168.10.25) nor the second entry (which permits the 192.168.20.0/24 subnet). As a result, the packet reaches the end of the ACL where the invisible implicit 'deny any' statement blocks the connection attempt.

Step-by-Step Solution

1
Evaluate line 1 of the ACL: 'permit host 192.168.10.25'
No match (192.168.10.50 does not equal 192.168.10.25)
The 'host' keyword implies a wildcard mask of 0.0.0.0, matching only that exact single IP address.
2
Evaluate line 2 of the ACL: 'permit 192.168.20.0 0.0.0.255'
No match (192.168.10.50 is in the 192.168.10.0/24 subnet, not 192.168.20.0/24)
The wildcard mask 0.0.0.255 requires the first three octets to match 192.168.20.
3
Evaluate the implicit final clause of the ACL
Match on implicit 'deny any' clause; traffic is dropped.
All IPv4 ACLs in Cisco IOS feature an invisible default statement at the end of the list that blocks all remaining packets.

Key Concept

Cisco IPv4 ACL sequential top-down evaluation and implicit deny behavior
Estimated Time:1m 15s
Question 277Question →

Following an unexpected reboot of an enterprise access switch, users connected to interface GigabitEthernet1/0/12 report a complete loss of network connectivity. Upon investigation, the network administrator discovers that the dynamically learned MAC address added to the port security table prior to the switch reload is missing, causing the switch to reject traffic from the connected workstation. Which administrative action was omitted prior to the reboot that resulted in the loss of the sticky MAC address?

Show answer & explanation

Answer: Saving the running configuration to the startup configuration in NVRAM using the command `copy running-config startup-config`.

Answer

Saving the running configuration to the startup configuration in NVRAM using the command `copy running-config startup-config`.
The correct answer identifies that executing `copy running-config startup-config` is required to save dynamically learned sticky MAC entries from volatile RAM into NVRAM. Enabling sticky port security causes the switch to dynamically append learned MAC addresses into the running configuration. However, because RAM contents are lost during a reboot, failing to save the running configuration causes the switch to start up without those learned MAC addresses.

Step-by-Step Solution

1
Analyze how Port Security sticky MAC learning functions during switch operation.
When sticky learning is enabled with `switchport port-security mac-address sticky`, dynamically learned MAC addresses are converted into standard `switchport port-security mac-address sticky <MAC>` lines in the running configuration (RAM).
Sticky MAC learning dynamically converts dynamically learned addresses into running configuration statements so they behave similarly to statically configured addresses.
2
Evaluate the volatility of RAM versus non-volatile RAM (NVRAM) across switch reboots.
The running configuration stored in RAM is cleared whenever the switch reboots or loses power.
Changes in RAM must be explicitly copied to startup-config in NVRAM using `copy running-config startup-config` or `write memory` to survive a system reload.
3
Determine the root cause of the missing MAC address post-reboot.
Because the administrator failed to save the running configuration after the MAC address was learned, the running configuration reverted back to the startup configuration without the learned sticky MAC address entries.
Failing to save running-config to startup-config causes all dynamically learned sticky entries to be wiped upon switch reboot.

Key Concept

Port Security Sticky MAC Persistence across Reboots
Estimated Time:1m 15s
Question 278Question →

A network administrator is upgrading a wireless network from WPA2-Personal to WPA3-Personal to increase client authentication security. Which key exchange protocol does WPA3-Personal introduce to protect against offline dictionary attacks?

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE)

Answer

Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the core key exchange protocol introduced in WPA3-Personal. Based on the Dragonfly handshake, SAE establishes a secure key exchange that prevents attackers from capturing handshakes over the air to perform offline dictionary attacks.

Step-by-Step Solution

1
Identify the authentication mechanism change between WPA2-Personal and WPA3-Personal.
WPA2-Personal uses a Pre-Shared Key (PSK) with a 4-Way Handshake, whereas WPA3-Personal upgrades to Simultaneous Authentication of Equals (SAE).
WPA3 mandates higher security standards to prevent offline password guessing attacks.
2
Analyze how SAE protects client authentication.
SAE provides a secure password-authenticated key exchange (based on the Dragonfly handshake) ensuring forward secrecy and resistance to passive capture/dictionary attacks.
Even if an attacker captures the wireless handshake, SAE prevents them from determining the pre-shared key offline.

Key Concept

WPA3-Personal Key Exchange (SAE vs PSK)
Question 279Question →

A network administrator is evaluating traffic filtering on a Cisco IOS router configured with the following extended IPv4 access control list:

access-list 110 permit tcp 10.2.0.0 0.0.255.255 host 192.168.50.25 eq 22
access-list 110 deny ip 10.2.0.0 0.0.255.255 host 192.168.50.25
access-list 110 permit ip any any

Which two operational outcomes will occur when this access control list is applied inbound on interface GigabitEthernet0/0? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: SSH traffic originating from host 10.2.15.5 and destined to host 192.168.50.25 is permitted by the router.; HTTP traffic (TCP port 80) originating from host 10.2.15.5 and destined to host 192.168.50.25 is denied by the router.

Answer

SSH traffic from host 10.2.15.5 to 192.168.50.25 is permitted, and HTTP traffic (TCP port 80) from host 10.2.15.5 to 192.168.50.25 is denied.
Access control lists evaluate packets sequentially from top to bottom until a match is found. For SSH traffic from host 10.2.15.5 to 192.168.50.25, line 1 matches because 10.2.15.5 falls within subnet 10.2.0.0/16 (wildcard 0.0.255.255) and SSH operates on TCP port 22; therefore, SSH traffic is permitted. For HTTP traffic (TCP port 80) from host 10.2.15.5 to 192.168.50.25, it bypasses line 1 because of the port mismatch, but matches line 2 because the 'ip' keyword encompasses all IPv4 payloads including TCP; therefore, HTTP traffic is denied.

Step-by-Step Solution

1
Evaluate the first ACL entry against incoming SSH traffic from 10.2.15.5 to 192.168.50.25.
Host 10.2.15.5 matches wildcard mask 0.0.255.255 (subnet 10.2.0.0/16), destination is host 192.168.50.25, and SSH uses TCP port 22. Line 1 permits this traffic.
ACLs are evaluated sequentially top-down; once a match occurs, no further entries are evaluated.
2
Evaluate HTTP traffic (TCP port 80) from 10.2.15.5 to 192.168.50.25 against the ACL statements.
Line 1 specifies port 22, so port 80 does not match line 1. Processing moves to line 2, which denies all IP traffic from 10.2.0.0/16 to 192.168.50.25. Line 2 denies HTTP traffic.
The 'ip' protocol keyword in extended ACLs includes all higher-layer protocols such as TCP, UDP, and ICMP.
3
Evaluate traffic from host 10.3.1.1 to 192.168.50.25.
Host 10.3.1.1 does not match 10.2.0.0/16 on line 1 or line 2. Processing reaches line 3 'permit ip any any', which explicitly permits the packet.
An explicit 'permit ip any any' statement overrides the default implicit deny for any traffic reaching line 3.

Key Concept

Extended IPv4 Access Control List sequential top-down evaluation, protocol matching, and implicit/explicit statement processing.
Question 280Question →

An network administrator is updating an enterprise wireless network configuration to implement WPA3-Personal. Which two enhancements does WPA3 provide over WPA2 to improve wireless connection security? (Select two)

Select all that apply

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE) to defend against offline dictionary attacks; Mandatory Protected Management Frames (PMF) to protect management traffic against eavesdropping and forging

Answer

WPA3 improves security over WPA2 by introducing Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks and mandating Protected Management Frames (PMF) to secure management frame exchanges.
WPA3 introduces Simultaneous Authentication of Equals (SAE) to replace the standard WPA2 pre-shared key 4-way handshake, offering protection against offline dictionary brute-force attempts. Additionally, WPA3 requires mandatory implementation of Protected Management Frames (PMF) to prevent malicious disassociation and deauthentication spoofing.

Step-by-Step Solution

1
Identify key authentication upgrades in WPA3-Personal
WPA3 replaces PSK with SAE (Simultaneous Authentication of Equals), rendering offline dictionary attacks ineffective even with weak passphrases.
SAE performs a resistant peer-to-peer key exchange (Dragonfly key exchange protocol).
2
Identify key management frame protections in WPA3
PMF (Protected Management Frames / IEEE 802.11w) is mandatory in WPA3 deployments.
PMF prevents attackers from forging management frames such as deauthentication attacks.

Key Concept

Wireless Security Protocols (WPA3 Features & Enhancements)
PreviousPage 14 / 15Next
Security Fundamentals Practice Questions — Cisco CCNA — Page 14 | Examkin