Examkin

Security Fundamentals

298 questions

All types298Multiple choice157Multiple select64Matching56Ordering21
Question 281Question →

An enterprise network administrator is deploying Layer 2 security controls across an access switch. The administrator configures DHCP Snooping and Dynamic ARP Inspection (DAI) on VLAN 15 to safeguard clients against rogue DHCP servers and ARP spoofing attacks. Which TWO statements accurately describe the operational requirements and behaviors of Dynamic ARP Inspection (DAI) in this environment?

Select all that apply

Show answer & explanation

Answer: DAI intercepts and validates incoming ARP requests and responses on untrusted interfaces against the DHCP snooping binding database.; Uplink interfaces connected to core switches or default gateway routers must be designated as DAI trusted ports to allow legitimate ARP traffic without inspection.

Answer

The correct operational behaviors are that Dynamic ARP Inspection (DAI) intercepts and validates ARP packets on untrusted ports against the DHCP snooping binding table, and that switch uplink/gateway interfaces must be configured as trusted ports to allow valid infrastructure ARP traffic to bypass inspection.
Dynamic ARP Inspection (DAI) protects networks against Man-in-the-Middle ARP spoofing by intercepting all ARP requests and responses on untrusted interfaces and verifying their sender IP and MAC address pairs against the DHCP snooping binding database. Additionally, ports connected to trusted network infrastructure (such as default gateways and switch uplinks) must be configured as DAI trusted interfaces so legitimate network traffic is passed without being dropped.

Step-by-Step Solution

1
Analyze DAI untrusted port behavior
DAI intercepts incoming ARP packets on untrusted interfaces and compares the IP-and-MAC sender fields against the DHCP snooping binding database (or static ARP ACLs). Unmatched packets are dropped.
Untrusted ports are host-facing access ports where malicious ARP poisoning attacks might originate.
2
Analyze DAI trusted port role
Ports connected to authorized switches, routers, or servers bypass DAI validation checks.
Infrastructure ports carry traffic for multiple hosts or network devices that may not have dynamic DHCP bindings on the local switch, so inspecting them would result in false-positive packet drops.
3
Evaluate distractor mechanisms
DAI does not query Port Security NVRAM configurations nor does it require native VLAN alignment to inspect VLAN-specific ARP frames.
DAI relies specifically on Layer 2/3 IP-to-MAC mapping databases generated via DHCP Snooping.

Key Concept

Dynamic ARP Inspection (DAI) database binding dependencies and interface trust state roles.
Estimated Time:2m 0s
Question 282Question →

An auditor examines the device management settings on a Cisco IOS XE switch and observes the following running configuration snippet:

text
service password-encryption
!
username auditor privilege 3 algorithm-type scrypt secret Security2026!
username operator privilege 1 password 0 C1sc0123!
!
line vty 0 4
login local
transport input ssh

Which TWO statements correctly describe the security posture and operational behavior of this configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The auditor account credential uses Type 9 hash storage, which provides strong protection against password cracking via key stretching.; The operator account credential will be rendered as weak Type 7 reversible ciphertext in the running configuration.

Answer

The auditor account uses strong Type 9 scrypt password hashing, and the operator account cleartext password is obfuscated as Type 7 ciphertext due to service password-encryption.
The configuration correctly demonstrates two password security characteristics: the 'scrypt' algorithm type generates a secure Type 9 hash for the auditor user, while global 'service password-encryption' converts cleartext 'password 0' statements into Type 7 weak reversible obfuscation for display purposes.

Step-by-Step Solution

1
Analyze the 'auditor' username configuration line.
The command 'username auditor privilege 3 algorithm-type scrypt secret ...' generates a Type 9 encrypted password using the scrypt algorithm.
Type 9 scrypt hashes provide robust protection against offline password cracking due to key stretching.
2
Analyze the global 'service password-encryption' command and 'operator' account configuration.
Cleartext passwords specified with 'password 0' are encoded into Type 7 obfuscated strings in the configuration file.
'service password-encryption' applies weak reversible Type 7 encryption to prevent shoulder surfing.

Key Concept

Local User Database Password Storage and Encryption Types
Question 283Question →

Which encryption cipher suite does the WPA2 wireless security standard use by default to ensure data confidentiality and integrity for wireless network traffic?

Show answer & explanation

Answer: AES-CCMP

Answer

AES-CCMP is the default encryption cipher suite used by WPA2.
WPA2 requires the use of Advanced Encryption Standard (AES) operating in Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). This combination guarantees strong data confidentiality and frame authenticity.

Step-by-Step Solution

1
Identify the primary encryption mechanism required by the WPA2 standard.
WPA2 implements the full IEEE 802.11i standard, which specifies AES with CCMP as the mandatory cipher suite.
AES-CCMP provides strong 128-bit encryption along with Message Integrity Check (MIC) to ensure data privacy and authenticity.

Key Concept

WPA2 Default Encryption (AES-CCMP)
Question 284Question →

A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to mitigate ARP spoofing attacks across the corporate subnet. Although DHCP clients operate without interruption, several critical servers using statically configured IP addresses immediately lose network access. Switch logs indicate that DAI is actively dropping all ARP packets generated by these static servers because their IP-to-MAC bindings do not exist in the DHCP snooping binding database. Which configuration step must be performed to restore network connectivity for the static servers while maintaining DAI protection on VLAN 10?

Show answer & explanation

Answer: Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.

Answer

Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.
Dynamic ARP Inspection relies by default on the DHCP snooping binding database to verify IP-to-MAC address relationships in ARP packets on untrusted ports. Because static servers never request an IP address via DHCP, their bindings are absent from the database. Defining an ARP ACL with static IP-to-MAC entries and binding it to DAI using the `ip arp inspection filter` command allows the switch to validate and permit legitimate ARP traffic from static hosts.

Step-by-Step Solution

1
Identify the cause of packet drops under Dynamic ARP Inspection (DAI).
DAI intercepts all ARP requests and responses on untrusted ports and validates them against the DHCP snooping binding database. Statically addressed hosts do not use DHCP, so they lack entries in the database, causing DAI to drop their ARP packets.
Understanding why static hosts fail under DAI is essential for selecting the correct non-disruptive bypass mechanism.
2
Define an ARP ACL for static IP-to-MAC mappings.
Configuring an ARP ACL (`arp access-list <name>`) allows explicit static mapping of IP addresses to MAC addresses (e.g., `permit ip host <IP> mac host <MAC>`).
ARP ACLs provide a manual binding table that DAI checks when validating ARP packets.
3
Apply the ARP ACL to the affected VLAN.
Executing `ip arp inspection filter <acl-name> vlan 10 [static]` instructs DAI to consult the ARP ACL for validation on VLAN 10.
Linking the ARP ACL to DAI ensures static server ARP traffic is validated and permitted without disabling DAI security.

Key Concept

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Question 285Question →

A network engineer creates a local user account on a Cisco IOS XE router using the command `username admin privilege 15 secret C1sc0#Pass`. However, when attempting to establish a session through the console port, the router displays only a `Password:` prompt rather than asking for a username.

Which command must be executed under `line con 0` configuration mode to require local database user authentication?

Show answer & explanation

Answer: login local

Answer

The correct action is to execute the `login local` command under `line con 0` configuration mode.
Executing `login local` under line configuration mode explicitly binds line authentication to the local IOS user database created with global `username` commands. This forces the device to prompt for both a username and password during connection establishment.

Step-by-Step Solution

1
Analyze line authentication behavior
By default or when configured with the simple `login` command, a Cisco line interface expects a line password defined by the `password` line subcommand.
Without instructing the line to check the local database, the router ignores defined `username` accounts for line access.
2
Identify the command that references the local user database
The `login local` command tells Cisco IOS to check credentials against accounts created via `username` global configuration commands.
This causes the line to present a `Username:` prompt followed by a `Password:` prompt.

Key Concept

Cisco IOS Line Local Database Authentication
Question 286Question →

A network engineer is troubleshooting host connectivity issues on a Cisco Catalyst switch after enabling Dynamic ARP Inspection (DAI) on VLAN 50. Most clients receive their network settings dynamically via DHCP, but a legacy server connected to interface GigabitEthernet1/0/10 uses a static IP address. Because the server's IP-to-MAC mapping is absent from the DHCP snooping binding database, the switch drops all ARP packets originating from GigabitEthernet1/0/10. Which configuration sequence allows ARP traffic from this static server while maintaining active DAI inspection for all other hosts on VLAN 50?

Show answer & explanation

Answer: Define an ARP access control list matching the server's IP and MAC addresses, then apply it globally to VLAN 50 using the ip arp inspection filter command with the static keyword.

Answer

The correct action is to define an ARP access control list specifying the static host's IP and MAC address mapping, and bind it to VLAN 50 using the command `ip arp inspection filter <acl-name> vlan 50 static`.
Dynamic ARP Inspection relies on the DHCP snooping binding database to validate ARP packets on untrusted interfaces. When network endpoints use static IP addressing, their entries do not exist in the DHCP binding database. To resolve this, administrators must configure an ARP ACL (`arp access-list`) containing the static host's MAC and IP address, and apply it to the VLAN via `ip arp inspection filter <acl_name> vlan <vlan-id> [static]`. The optional `static` keyword ensures that for IPs specified in the ACL, DAI only permits packets matching the configured MAC address and drops all others.

Step-by-Step Solution

1
Identify why Dynamic ARP Inspection (DAI) is dropping packets on interface GigabitEthernet1/0/10.
DAI inspects incoming ARP packets on untrusted ports against the DHCP snooping binding database. Statically configured hosts do not perform DHCP transactions, so their IP-to-MAC mappings are missing from the binding table.
Without a valid binding table entry, DAI flags incoming ARP requests/replies as invalid and drops them.
2
Determine the Cisco IOS mechanism to manually define static IP-to-MAC bindings for DAI.
Configuring an ARP Access Control List (ARP ACL) using `arp access-list <name>` allows explicit mapping of IP addresses to MAC addresses.
ARP ACLs supply static verification entries to DAI for hosts that do not utilize DHCP.
3
Apply the ARP ACL to the VLAN using the correct DAI command option.
Executing `ip arp inspection filter <acl-name> vlan 50 static` forces the switch to check the ARP ACL first.
Including the `static` keyword specifies an implicit deny for IP addresses defined in the ACL if their MAC addresses do not match, ensuring static hosts are authenticated without relying on DHCP snooping.

Key Concept

Dynamic ARP Inspection (DAI) ARP ACL Integration
Question 287Question →

A network engineer needs to configure secure SSH remote management on a Cisco IOS XE router using local database authentication. Place the CLI configuration steps in the correct logical and CLI dependency order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Configure the IP domain name (`ip domain name enterprise.lab`), 2) Generate the RSA key pair (`crypto key generate rsa general-keys modulus 2048`), 3) Create a local user account with secret encryption (`username netadmin secret S3cur3!Pass2026`), 4) Enter VTY line configuration submode (`line vty 0 4`), and 5) Enforce local login and SSH protocol access (`login local` and `transport input ssh`).
To successfully enable SSH remote access authenticated by the local user database, CLI commands must follow specific mode hierarchy and operational dependencies. First, `ip domain name` must be configured in global configuration mode to form the system FQDN. Next, `crypto key generate rsa` creates the encryption keys required to initialize SSH server functionality. Third, a local user account is configured with `username secret`. Fourth, line configuration mode is entered via `line vty 0 4`. Finally, `login local` and `transport input ssh` are applied to enforce local database authentication and disallow unencrypted transport.

Step-by-Step Solution

1
Set the domain name in global configuration mode.
Defines the domain context required for cryptographic key creation.
Cisco IOS XE constructs the default RSA key pair name using host.domain syntax; without a domain name, SSH key generation fails or requests manual domain assignment.
2
Generate RSA keys for SSH encryption.
Activates the SSH server subsystem on the router.
SSH requires asymmetric key pairs to establish secure encrypted tunnels for remote sessions.
3
Define local database user credentials.
Adds an administrative username with a Type 5 or Type 8/9 secret hash to the local running configuration.
Local password authentication relies on pre-created accounts in the local device database.
4
Enter line VTY configuration submode (`line vty 0 4`).
Changes prompt context to line configuration mode.
Line-specific access controls must be executed within the target line context.
5
Apply `login local` and `transport input ssh` commands.
Enforces local database credential checking and blocks unencrypted protocols like Telnet.
`login local` instructs VTY lines to authenticate inbound connections against the local user database, while `transport input ssh` secures transport security.

Key Concept

Cisco IOS XE SSH configuration sequence and local database authentication dependencies
Estimated Time:1m 30s
Question 288Question →

During a network security audit, an enterprise engineering team is reviewing AAA operations across campus switches and routers. Match each specific administrative operation or security scenario on the left with its corresponding AAA component or protocol mechanism on the right.

Click a left item, then click its matching right item

Items

Evaluating whether an authenticated administrator possesses the privilege level to execute specific CLI commands such as reload or configure terminal.
Authenticating 802.1X wireless or wired client network access requests while encrypting only the user password in transit over UDP port 1812.
Tracking administrative activity by logging session start/stop timestamps, executed CLI commands, and total bytes transferred for compliance auditing.
Authenticating router console logins using a locally defined database user account when centralized TACACS+ servers become unreachable.

Matches

Show answer & explanation

Answer

Evaluating command execution privileges maps to Command-Level Authorization (TACACS+); authenticating 802.1X client access over UDP port 1812 with password-only encryption maps to Network Access Authentication (RADIUS); tracking session activity and logged commands maps to AAA Accounting; and authenticating against a local database during server outages maps to Local AAA Authentication Fallback.
Evaluating CLI command privileges requires per-command authorization, which is a native capability of TACACS+ (Command-Level Authorization). Authenticating 802.1X clients over UDP port 1812 with password-only encryption describes standard RADIUS operation for network access control. Collecting log metrics such as command usage, duration, and session timestamps is the core responsibility of AAA Accounting. Falling back to an on-box database when central AAA servers fail represents Local AAA Authentication Fallback.

Step-by-Step Solution

1
Analyze the first scenario regarding CLI command permissions.
Restricting or permitting specific commands like 'configure terminal' per user relies on Authorization, specifically leveraging TACACS+ due to its support for granular per-command authorization.
RADIUS combines Authentication and Authorization and cannot authorize individual CLI commands dynamically per session.
2
Analyze the second scenario involving 802.1X and password-only encryption over UDP.
802.1X access control relies on RADIUS (UDP 1812), which encrypts only the password field rather than the entire packet payload.
TACACS+ uses TCP port 49 and encrypts the entire packet body, making UDP 1812 and password-only encryption distinct indicators of RADIUS.
3
Analyze the third scenario focused on logging session activity and command history.
Logging timestamps, executed commands, and byte counts falls directly under the Accounting pillar of the AAA framework.
Accounting records 'what the user did' during a session, distinguishing it from Authentication ('who you are') and Authorization ('what you can do').
4
Analyze the fourth scenario addressing administrator login when central servers fail.
Using a local router username/password database as a backup mechanism when AAA server groups do not respond is Local AAA Authentication Fallback.
Configuring 'aaa authentication login default group tacacs+ local' instructs the device to query local credentials only if server group unreachable errors occur.

Key Concept

AAA Framework Pillars and Operational Protocol Mechanisms (TACACS+ vs RADIUS)
Estimated Time:2m 0s
Question 289Question →

A network administrator is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco router to regulate traffic sent from the internal LAN (192.168.1.0/24) to an application server (10.0.0.10).

The access policy requires:
1. Host 192.168.1.50 must be allowed full IP access to the application server (including HTTP).
2. All other hosts on the 192.168.1.0/24 subnet must be blocked from accessing HTTP (TCP port 80) on the application server.
3. All other IP traffic originating from the 192.168.1.0/24 subnet to the application server must be permitted.

Arrange the ACL statements in the correct top-down execution order to achieve this security policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from top to bottom is: 1) permit ip host 192.168.1.50 host 10.0.0.10, 2) deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80, 3) permit ip 192.168.1.0 0.0.0.255 host 10.0.0.10, and 4) implicit deny ip any any.
Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a match occurs, stopping further evaluation. To satisfy all requirements: 1) The host-specific permit statement for 192.168.1.50 must be placed first so its HTTP traffic is allowed before subnet rules apply. 2) The HTTP deny rule for subnet 192.168.1.0/24 must be placed second so HTTP packets from all other hosts in the subnet are caught and dropped. 3) The broader subnet IP permit statement must be placed third to permit non-HTTP traffic. 4) The implicit deny statement operates at the bottom, dropping any other un-matched traffic.

Step-by-Step Solution

1
Place specific host exception rules at the top of the ACL.
Host 192.168.1.50 is permitted full IP access before any subnet-level restrictions are evaluated.
Cisco IOS ACLs evaluate top-down and stop processing on the first match. Host 192.168.1.50 must be matched first so its HTTP traffic is not dropped by the subnet HTTP block.
2
Place specific service block rules for the subnet after host exceptions.
HTTP traffic (TCP port 80) from subnet 192.168.1.0/24 to 10.0.0.10 is denied.
This rule must appear before the general permit rule for the subnet, ensuring HTTP traffic is filtered out first.
3
Place general subnet permit rules after specific service deny rules.
All remaining IP traffic from subnet 192.168.1.0/24 to 10.0.0.10 is permitted.
Placing this rule after the HTTP deny rule ensures non-HTTP traffic from the subnet passes successfully.
4
Rely on the implicit deny at the end of the ACL.
All other traffic not matching the explicit rules is dropped.
Cisco ACLs automatically append an unwritten implicit deny statement at the end of every list.

Key Concept

Top-down sequential processing of IPv4 ACLs and ordering from most specific to least specific statements.
Question 290Question →

A network administrator is implementing Layer 2 security controls across corporate access switches. Which TWO operational characteristics correctly describe how DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security function on untrusted interfaces? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: DHCP Snooping drops incoming DHCP server messages, such as DHCPOFFER and DHCPACK, when received on untrusted ports.; Dynamic ARP Inspection intercept and validate ARP packets on untrusted ports by comparing source IP and MAC addresses against the DHCP snooping binding database.

Answer

The correct operational behaviors are that DHCP Snooping drops DHCP server messages on untrusted ports and Dynamic ARP Inspection uses the DHCP snooping binding database to validate ARP packets on untrusted ports.
DHCP Snooping designates user-facing access ports as untrusted by default, causing any DHCP server responses (DHCPOFFER, DHCPACK) to be discarded to prevent rogue server deployment. Furthermore, Dynamic ARP Inspection (DAI) checks incoming ARP packets on untrusted ports against the IP-to-MAC bindings in the DHCP snooping table to stop ARP spoofing attacks.

Step-by-Step Solution

1
Analyze the operational rules of DHCP Snooping on untrusted interfaces.
Untrusted interfaces are designated for end-user devices. Server responses such as DHCPOFFER, DHCPACK, and DHCPLEASEQUERY are dropped to block unauthorized DHCP servers.
Ensures rogue DHCP servers cannot distribute incorrect IP addresses or gateway information.
2
Analyze how Dynamic ARP Inspection (DAI) operates on untrusted interfaces.
DAI intercepts incoming ARP requests and replies on untrusted interfaces and validates their source MAC and IP against the DHCP snooping database.
Prevents ARP poisoning and man-in-the-middle attacks.
3
Evaluate sticky MAC address storage behavior in Port Security.
Sticky MACs are placed into the running configuration in volatile memory and will be lost upon reboot if not saved.
Port security does not automatically update NVRAM.

Key Concept

Layer 2 Security Integration (DHCP Snooping, DAI, Port Security)
Estimated Time:1m 30s
Question 291Question →

A network technician enables DHCP Snooping globally and on VLAN 10 using the commands `ip dhcp snooping` and `ip dhcp snooping vlan 10`. However, clients connected to access ports on VLAN 10 are failing to acquire IP addresses from the central DHCP server reachable via trunk interface GigabitEthernet0/1. Which condition accounts for the DHCP packet drops on the switch?

Show answer & explanation

Answer: Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.

Answer

Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.
When DHCP Snooping is globally activated on a Cisco switch, every interface is set to an untrusted state by default. Untrusted interfaces only allow DHCP client broadcast requests to enter the switch, while dropping any incoming DHCP server response messages (DHCPOFFER, DHCPACK). Because GigabitEthernet0/1 connects to the central DHCP server, it must be explicitly configured with `ip dhcp snooping trust` to permit server responses to reach clients on VLAN 10.

Step-by-Step Solution

1
Analyze default DHCP Snooping port trust states upon enabling the feature.
By default, all switch interfaces are categorized as untrusted.
DHCP Snooping enforces security by filtering unauthorized DHCP server traffic on untrusted ports.
2
Evaluate packet handling rules on untrusted ports.
Untrusted ports permit client requests (DHCPDISCOVER, DHCPREQUEST) but drop server replies (DHCPOFFER, DHCPACK, DHCPNAK).
Prevents rogue DHCP servers from offering unauthorized IP configurations to clients.
3
Determine the required resolution to restore DHCP functionality.
Configure `ip dhcp snooping trust` on interface GigabitEthernet0/1.
Designating the server-facing uplink as trusted allows legitimate server offer and acknowledgment packets to pass.

Key Concept

DHCP Snooping Trusted vs Untrusted Port Operational Behavior
Question 292Question →

A network administrator configures a dual-mode WLAN on a Cisco Wireless LAN Controller (WLC) intended to support both modern WPA3-Personal devices and legacy WPA2-Personal client hardware during a corporate migration. WPA3-capable endpoints connect seamlessly; however, older WPA2-only devices consistently fail during the 802.11 association phase and cannot establish network connectivity. Frame captures reveal that the legacy stations receive association responses containing mandatory Protected Management Frames (PMF/802.11w) requirements. Which WLC configuration modification resolves this association failure for legacy endpoints while continuing to support WPA3-Personal clients?

Show answer & explanation

Answer: Set Management Frame Protection (MFP/PMF) to Optional (Capable) on the WLAN profile, allowing legacy stations without 802.11w support to associate.

Answer

Setting Management Frame Protection (MFP/PMF) to Optional (Capable) on the WLAN profile allows legacy stations without 802.11w support to associate.
The choice stating to set Management Frame Protection (MFP/PMF) to Optional (Capable) is correct because IEEE 802.11w PMF is mandatory in WPA3. When configuring WPA3-Personal Transition Mode to accommodate legacy WPA2 devices, setting PMF to Required prevents legacy clients that lack PMF code or hardware support from completing the 802.11 association process. Changing PMF to Optional enables WPA3 endpoints to use PMF while permitting WPA2 endpoints to connect without it.

Step-by-Step Solution

1
Analyze the WPA3-Personal vs WPA2-Personal migration requirements.
WPA3 mandates Protected Management Frames (PMF / IEEE 802.11w) and Simultaneous Authentication of Equals (SAE).
WPA3 security standards enforce PMF to prevent management frame spoofing attacks such as deauthentication attacks.
2
Evaluate the cause of the association failure for legacy WPA2 devices in transition mode.
Setting PMF to Required on the WLC forces all associating clients to support IEEE 802.11w. Legacy devices lacking 802.11w capabilities reject or are rejected during the association frame exchange.
Transition mode requires backward-compatible settings for optional feature negotiation.
3
Determine the correct WLC configuration adjustment.
Configuring PMF as Optional (Capable) on the WLAN allows WPA3 clients to negotiate PMF while permitting legacy WPA2 clients lacking 802.11w to complete association.
This configuration balances the strict security requirements of WPA3 with the physical hardware limitations of legacy WPA2 endpoints.

Key Concept

WPA3 Transition Mode and Protected Management Frames (PMF / IEEE 802.11w) compatibility requirements
Question 293Question →

A network administrator configures port security on access interface GigabitEthernet0/1 of a Cisco Catalyst switch by executing `switchport port-security` and `switchport port-security mac-address sticky`. Hosts connect successfully and their MAC addresses are dynamically learned by the switch. However, after an unscheduled switch reboot, the administrator discovers that the dynamically learned MAC addresses were removed and hosts must re-trigger learning. Which operational step was omitted prior to the switch restart?

Show answer & explanation

Answer: Saving the running configuration to the startup configuration in NVRAM using the `copy running-config startup-config` command.

Answer

The network administrator omitted saving the running configuration to the startup configuration using the `copy running-config startup-config` command.
When `switchport port-security mac-address sticky` is configured, the switch dynamically adds learned MAC addresses into the active `running-config` file. Because `running-config` resides in volatile RAM memory, any dynamically learned MAC addresses are lost upon a reboot unless the administrator explicitly copies the running configuration to the startup configuration using `copy running-config startup-config` (or `write memory`).

Step-by-Step Solution

1
Analyze how sticky MAC addresses operate in Cisco Port Security.
When sticky MAC learning is enabled (`switchport port-security mac-address sticky`), the switch dynamically learns MAC addresses and writes them directly into the running configuration (`running-config`) as static-like entries.
Sticky MAC learning converts dynamically learned addresses into running configuration entries.
2
Evaluate the behavior of running-config during a switch reload.
RAM memory housing `running-config` is volatile. Unless `running-config` is saved to `startup-config` in NVRAM, all unsaved dynamic sticky MAC entries are erased when the switch reboots.
Volatile memory contents do not survive system reboots.
3
Identify the missing command required for persistence.
Executing `copy running-config startup-config` (or `write memory`) copies the learned sticky MAC entries into non-volatile memory so they load automatically upon boot.
Saving the configuration persists sticky MAC addresses across reboots.

Key Concept

Port Security Sticky MAC Persistence across Switch Reboots
Question 294Question →

A network security engineer is configuring digital certificate enrollment on a Cisco IOS router to establish secure IPsec VPN tunnels. Before submitting a Certificate Signing Request (CSR) to an enterprise Certificate Authority (CA), which item must be generated directly on the local router?

Show answer & explanation

Answer: An asymmetric public and private key pair

Answer

An asymmetric public and private key pair must be generated on the local router prior to creating and submitting the Certificate Signing Request (CSR).
In Public Key Infrastructure (PKI) enrollment, an endpoint must generate its own asymmetric public/private key pair locally. The private key is securely stored in local memory/NVRAM and never transmitted, while the public key is packaged into the Certificate Signing Request (CSR) sent to the Certificate Authority (CA) for signing.

Step-by-Step Solution

1
Identify the initial step in the Public Key Infrastructure (PKI) enrollment workflow on a Cisco device.
The router must generate an RSA or ECDSA asymmetric key pair locally.
The private key must never leave the local device to maintain security integrity.
2
Construct the Certificate Signing Request (CSR).
The router embeds its newly generated public key and identity information (Subject Name/SAN) into the CSR structure.
The CA requires the public key to embed it into the signed X.509 identity certificate.
3
Submit the CSR to the Certificate Authority (CA).
The CA validates identity details and issues the final signed identity certificate back to the router.
The CA signs the public key and identity data using its own private key to establish trust.

Key Concept

PKI Certificate Signing Request (CSR) and Local Key Pair Generation
Question 295Question →

A security policy requires that all locally configured administrative accounts on Cisco network devices store passwords using strong one-way cryptographic hashing instead of reversible encryption. During an audit, an engineer inspects a switch configuration and discovers the command `username netadmin password 7 0822455D0A16`. Which action must the engineer take to bring this account configuration into compliance with the security policy?

Show answer & explanation

Answer: Reconfigure the account using the `username netadmin secret` command so the password is saved using a one-way hash algorithm.

Answer

Reconfigure the account using the `username netadmin secret` command so the password is saved using a one-way hash algorithm.
Replacing the configuration with `username netadmin secret` ensures that Cisco IOS stores the password using a strong one-way hash (such as Type 5 MD5 or Type 8/9 SHA-256/scrypt). Because it is a one-way function, the original password cannot be decrypted from the configuration file, satisfying the security policy.

Step-by-Step Solution

1
Analyze the existing password type in the device configuration.
The configuration entry uses `password 7`, which indicates Cisco Type 7 weak reversible encryption.
Type 7 encryption uses a simple Vigenère cipher that can be instantly decrypted using publicly available tools.
2
Identify the command required to store local account passwords securely as one-way hashes.
The `username <name> secret <password>` syntax creates a one-way cryptographic hash (Type 5 MD5, Type 8 PBKDF2 with SHA-256, or Type 9 scrypt).
One-way hashing prevents administrative passwords from being reversed or recovered if the configuration file is exposed.

Key Concept

Cisco IOS Password Storage (Type 7 reversible encryption vs. Type 5/8/9 one-way secret hashes)
Question 296Question →

A network administrator configures an IPv4 standard access control list on a Cisco router and applies it inbound on interface GigabitEthernet0/1:

text
access-list 15 permit host 172.16.20.50
access-list 15 permit 172.16.30.0 0.0.0.255

A technician attempts to send traffic through interface GigabitEthernet0/1 from host 172.16.20.51 destined for a server on an internal network. The traffic is dropped by the router. Which statement accurately explains why traffic from host 172.16.20.51 is dropped?

Show answer & explanation

Answer: Traffic from host 172.16.20.51 does not match any explicit permit entry in ACL 15 and is dropped by the implicit deny statement at the end of the access list.

Answer

Traffic from host 172.16.20.51 does not match any explicit permit entry in ACL 15 and is dropped by the implicit deny statement at the end of the access list.
In Cisco IOS IPv4 Access Control Lists, statements are processed sequentially from top to bottom. If incoming packet headers do not match any explicit permit or deny statement in the list, the traffic reaches the end of the ACL where an unwritten implicit deny clause ('deny any') drops the packet.

Step-by-Step Solution

1
Evaluate host IP address 172.16.20.51 against the first ACL line: access-list 15 permit host 172.16.20.50
No match (172.16.20.51 does not equal 172.16.20.50). Proceed to line 2.
Sequential top-down ACL processing rules.
2
Evaluate 172.16.20.51 against the second ACL line: access-list 15 permit 172.16.30.0 0.0.0.255
No match (172.16.20.51 is in subnet 172.16.20.0/24, not 172.16.30.0/24). Proceed past the last explicit line.
Wildcard mask 0.0.0.255 requires exact matching on the first three octets (172.16.30).
3
Determine the action taken by the implicit default mechanism at the end of the ACL.
Traffic is dropped.
Every IPv4 ACL in Cisco IOS ends with an invisible, unwritten 'deny ip any any' (or 'deny any' for standard ACLs).

Key Concept

Implicit Deny Clause in Cisco IPv4 ACLs
Question 297Question →

A network engineer is selecting a protocol to manage administrative CLI access to enterprise routers. The security policy mandates two key capabilities: full-packet payload encryption for all AAA transactions and the independent authorization of individual executive commands after initial login authentication. Which protocol fulfills these requirements?

Show answer & explanation

Answer: TACACS+, because it encrypts the entire packet payload and separates authentication and authorization functions.

Answer

TACACS+, because it encrypts the entire packet payload and separates authentication and authorization functions.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49 and is optimized for device administration. It encrypts the entire payload of every packet (except the standard header) and separates AAA into three distinct, modular components. This modularity allows an administrator to authenticate a user once and then perform independent authorization checks for each CLI command entered.

Step-by-Step Solution

1
Analyze encryption requirements specified in the security policy.
Full-packet encryption is required. TACACS+ encrypts the entire body of the packet, whereas RADIUS only encrypts the password attribute.
Protecting administrative sessions against payload inspection requires encrypting all transaction data.
2
Analyze authorization architecture requirements.
Per-command authorization requires independent authorization functionality separate from authentication. TACACS+ modularly separates Authentication, Authorization, and Accounting.
RADIUS binds authentication and authorization together in single exchange packets (Access-Request/Accept), making granular per-command CLI authorization impractical.
3
Synthesize protocol characteristics to select the compliant protocol.
TACACS+ is the correct choice because it fulfills both full-payload encryption and decoupled authorization capabilities.
TACACS+ is designed specifically for router and switch device administration (Cisco TACACS+ architecture).

Key Concept

AAA Architectural Differences between TACACS+ and RADIUS
Question 298Question →

A network technician is inspecting authentication behavior on a newly deployed Wi-Fi network configured for personal use. The security policy mandates protection against passive eavesdropping and offline password-dictionary attacks by utilizing a Dragonfly Key Exchange during association. Which wireless security protocol mechanism provides this specific key exchange functionality?

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE)

Answer

Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the key exchange mechanism specified in WPA3-Personal. Built upon the Dragonfly Key Exchange protocol, SAE establishes a secure cryptographic key between the client and access point without revealing the passphrase, rendering captured authentication traffic immune to offline dictionary brute-force attempts.

Step-by-Step Solution

1
Identify the primary requirement in the scenario
The scenario requires a wireless security mechanism that uses Dragonfly Key Exchange to prevent offline dictionary attacks in a personal Wi-Fi deployment.
WPA3-Personal replaces the vulnerable WPA2 Pre-Shared Key (PSK) handshake with a secure zero-knowledge proof exchange.
2
Evaluate the key exchange protocol associated with WPA3-Personal
Simultaneous Authentication of Equals (SAE) is the standard protocol defined in IEEE 802.11-2016 / WPA3 for secure peer-to-peer key agreement using Dragonfly algorithm cryptography.
SAE guarantees forward secrecy and prevents brute-force dictionary attacks even when weak passwords are used.

Key Concept

WPA3-Personal Key Exchange via SAE
PreviousPage 15 / 15
Security Fundamentals Practice Questions — Cisco CCNA — Page 15 | Examkin