Examkin

Security Fundamentals

298 questions

All types298Multiple choice157Multiple select64Matching56Ordering21
Question 61Question →

A network administrator applies the following standard IPv4 access control list (ACL) inbound on a router interface:

`access-list 10 permit 192.168.1.0 0.0.0.255`

A host with the IPv4 address `192.168.2.50` attempts to send traffic through this interface. What action will the router take on this packet?

Show answer & explanation

Answer: The router drops the packet because it matches the implicit deny statement at the end of the ACL.

Answer

The router drops the packet because it matches the implicit deny statement at the end of the ACL.
Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any configured rule, it reaches the final unwritten entry: the implicit deny (deny ip any). Because the source IP 192.168.2.50 is not in the 192.168.1.0/24 subnet specified in the single permit line, it is silently dropped by this implicit deny feature.

Step-by-Step Solution

1
Evaluate the packet source IPv4 address against the ACL entries.
The packet source address 192.168.2.50 does not match the permit rule for network 192.168.1.0/24.
Standard ACL 10 only matches host IP addresses falling within the 192.168.1.0 to 192.168.1.255 range.
2
Apply default ACL processing logic when no explicit entries match.
The packet reaches the bottom of the ACL and hits the implicit deny clause.
All Cisco IPv4 ACLs end with an unwritten 'deny ip any' rule that drops any traffic not explicitly permitted.

Key Concept

Access Control List (ACL) Implicit Deny Clause
Estimated Time:45s
Question 62Question →

During a security assessment of a financial institution, a network administrator reviews the measures implemented to protect network infrastructure. The measures include installing biometric door locks on the main data center, deploying TACACS+ for switch administration authentication, implementing Port Security on access switches, and conducting quarterly user security awareness campaigns. Which of these measures is classified specifically as a physical access control?

Show answer & explanation

Answer: Installing biometric door locks on the main data center entry

Answer

Installing biometric door locks on the main data center entry
Installing biometric door locks directly controls physical access to the building and server room facilities housing network devices. Physical security controls include physical barriers, door locks, mantraps, security guards, and surveillance cameras that prevent unauthorized physical entry.

Step-by-Step Solution

1
Categorize each listed security measure into physical, technical/logical, or administrative program elements.
Biometric door locks limit physical proximity to hardware. TACACS+ and Port Security manage network interface access electronically. Security awareness training educates personnel.
Security controls are broadly classified into physical controls, technical controls, and administrative/policy elements.
2
Identify which measure specifically restricts physical access to network equipment.
Biometric door locks prevent unauthorized individuals from physically entering the room containing servers and network devices.
Physical access controls prevent physical touch, intrusion, or theft of physical IT assets.

Key Concept

Classification of Security Controls (Physical Access Controls vs. Technical Access Controls and Security Program Elements)
Question 63Question →

A network technician configures port security on an access switch interface using the command `switchport port-security mac-address sticky`. Which TWO statements accurately describe how sticky MAC address learning operates on this interface?

Select all that apply

Show answer & explanation

Answer: Dynamically learned MAC addresses are automatically added to the active running configuration file.; Learned sticky MAC addresses will be lost if the switch reboots before the running configuration is saved.

Answer

Dynamically learned MAC addresses are automatically added to the active running configuration file, and learned sticky MAC addresses will be lost if the switch reboots before the running configuration is saved.
Enabling sticky MAC learning allows switch interfaces to convert dynamically learned MAC addresses into sticky MAC addresses and append them directly to the active running configuration. Because these entries reside in volatile memory, saving the running configuration to the startup configuration is required to maintain the learned addresses after a reboot.

Step-by-Step Solution

1
Analyze the function of sticky MAC address learning in Cisco IOS Port Security.
When 'mac-address sticky' is configured, the switch dynamically learns connected MAC addresses and automatically converts them into sticky entries in RAM.
Sticky MAC learning dynamically writes learned addresses into the running configuration so administrators do not have to enter them manually.
2
Determine the memory persistence of the running configuration.
The running configuration exists in volatile RAM and is erased upon device reboot unless explicitly saved to NVRAM.
To persist sticky MAC addresses across switch reboots, an administrator must execute 'copy running-config startup-config'.

Key Concept

Port Security Sticky MAC Address Dynamics and Configuration Persistence
Estimated Time:1m 0s
Question 64Question →

A network engineer must configure an IPv4 extended access control list (ACL 105) on a Cisco IOS router to enforce security policies for traffic originating from the internal subnet (10.1.1.0/2410.1.1.0/24) destined for an application server at 10.2.2.1010.2.2.10:

1. Allow host 10.1.1.5010.1.1.50 administrative SSH access (TCP port 22) to server 10.2.2.1010.2.2.10.
2. Prevent all other hosts in the 10.1.1.0/2410.1.1.0/24 subnet from accessing server 10.2.2.1010.2.2.10 via SSH.
3. Allow all hosts in the 10.1.1.0/2410.1.1.0/24 subnet web access (TCP port 80) to server 10.2.2.1010.2.2.10.
4. Explicitly block all remaining IP traffic from 10.1.1.0/2410.1.1.0/24 to server 10.2.2.1010.2.2.10.

In what order should the network engineer place the ACL statements from top to bottom to ensure the policy is correctly enforced?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The ACL statements must be placed from top to bottom in the sequence: 1) access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22, 2) access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22, 3) access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80, and 4) access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10.
Cisco IOS Access Control Lists enforce policies based on top-down, first-match evaluation logic. Once a packet matches an ACL line's source, destination, protocol, and port criteria, the router executes the action (permit or deny) and ignores all subsequent entries. To properly allow host 10.1.1.50 to access SSH while denying SSH to the rest of the 10.1.1.0/24 subnet, the host permit rule must appear first. Next, the subnet SSH deny rule blocks all other SSH attempts. Following that, the HTTP permit rule allows web traffic for the subnet. Finally, the broad IP deny statement catches any remaining traffic types from the subnet.

Step-by-Step Solution

1
Analyze top-down evaluation mechanics in Cisco IOS IPv4 ACLs.
Cisco IOS ACL entries are processed sequentially in top-down order until the first matching line is hit, at which point packet evaluation stops.
More specific exception rules must precede general or broader range rules to prevent premature match execution.
2
Place the specific host SSH permit statement first.
'access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22' is placed at position 1.
Host 10.1.1.50 is an IP within subnet 10.1.1.0/24. If the subnet SSH deny rule came first, 10.1.1.50 would match the subnet rule and be denied.
3
Place the subnet SSH deny statement second.
'access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22' is placed at position 2.
This guarantees that all other SSH packets originating from 10.1.1.0/24 (excluding 10.1.1.50) are dropped before subsequent permit lines are evaluated.
4
Place the subnet HTTP permit statement third.
'access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80' is placed at position 3.
This permits HTTP port 80 traffic for all hosts in the subnet after non-authorized SSH traffic has already been blocked.
5
Place the subnet broad IP deny statement fourth.
'access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10' is placed at position 4.
This catches and drops any remaining IP protocols from subnet 10.1.1.0/24 to server 10.2.2.10.

Key Concept

Cisco IOS ACL Top-Down Sequential First-Match Processing
Question 65Question →

A network administrator is reviewing the fundamental operation of standard IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which two statements correctly describe the operational characteristics of standard IPv4 ACLs?

Select all that apply

Show answer & explanation

Answer: Standard IPv4 ACLs filter network traffic based solely on the source IPv4 address.; Traffic that does not match any explicit permit or deny rule in the ACL is dropped by an implicit deny entry.

Answer

The correct statements are that standard IPv4 ACLs filter traffic based strictly on source IPv4 addresses, and that unmatched packets are dropped due to the implicit deny statement at the end of the list.
Standard IPv4 ACLs make forwarding or dropping decisions based exclusively on the packet's source IPv4 address. Additionally, any traffic that does not match an explicit rule in the list is dropped automatically by the default implicit deny clause at the end of the ACL.

Step-by-Step Solution

1
Identify the filtering criteria capability of standard IPv4 ACLs.
Standard IPv4 ACLs examine only the source address field within the IPv4 packet header.
Standard ACL syntax and logic lack fields to evaluate destination IP addresses, transport protocols, or port numbers.
2
Analyze default ACL evaluation behavior for unmatched packets.
Every Cisco ACL concludes with an implicit 'deny ip any' rule.
If a packet is evaluated against all explicit ACL statements without a match, it hits the implicit deny statement at the end and is discarded.

Key Concept

Standard IPv4 ACL Filtering Scope and Implicit Deny Mechanism
Question 66Question →

An enterprise network operations center is aligning its infrastructure security framework with Cisco security baseline recommendations. Match each security program element or access control type on the left to its corresponding operational implementation on the right.

Click a left item, then click its matching right item

Items

Physical Access Control
Security Awareness Training
Incident Response Plan
Administrative Policy Control

Matches

Show answer & explanation

Answer

Physical Access Control pairs with biometric scanners and mantrap portals; Security Awareness Training pairs with user education on phishing and tailgating; Incident Response Plan pairs with structured escalation workflows and containment procedures; Administrative Policy Control pairs with corporate documentation establishing acceptable use policies.
Physical access control directly limits physical proximity to network infrastructure using devices like mantrap portals and biometrics. Security awareness training educates users on recognizing threats like tailgating and phishing. Incident response plans outline emergency response steps following a breach. Administrative controls establish corporate rules, governance, and written security guidelines.

Step-by-Step Solution

1
Identify physical security measures.
Biometric readers, mantraps, locks, and badges directly restrict physical access to facilities.
Physical access control measures deal directly with spatial access to facilities and network hardware.
2
Differentiate human-focused educational controls from administrative rules.
Training sessions target user behavior (phishing, tailgating awareness), whereas administrative policies set the formal written rules (acceptable use).
User training is an operational program element, while governance rules represent administrative controls.
3
Categorize reactive security procedures.
Escalation workflows and containment procedures belong to incident management.
Incident response plans guide organizational actions during and after a security event.

Key Concept

Classification of Enterprise Security Program Elements and Controls
Question 67Question →

A network engineer is configuring digital certificate authentication for Cisco Identity Services Engine (ISE) and enterprise network infrastructure. To ensure proper certificate deployment and validation, the engineer must correctly identify the operational function of each Public Key Infrastructure (PKI) element. Match each PKI component on the left to its corresponding primary function on the right.

Click a left item, then click its matching right item

Items

Certificate Signing Request (CSR)
Root Certificate Authority (CA) Certificate
Subject Alternative Name (SAN)
Online Certificate Status Protocol (OCSP)

Matches

Show answer & explanation

Answer

Certificate Signing Request (CSR) matches the description of containing public key and identity details sent to an issuing authority; Root CA Certificate matches serving as the trusted anchor on client devices; Subject Alternative Name (SAN) matches allowing multiple domain names or IP addresses on a single certificate; Online Certificate Status Protocol (OCSP) matches enabling real-time verification of certificate revocation status.
Each PKI component plays a distinct role in digital certificate lifecycle management and authentication: CSRs initiate certificate issuance by bundling public keys and subject identity; Root CA certificates establish client-side trust anchors; SAN extensions allow single certificates to cover multiple FQDNs/IPs; and OCSP provides real-time revocation checks.

Step-by-Step Solution

1
Analyze the role of a Certificate Signing Request (CSR).
Identify that a CSR is generated prior to certificate issuance and holds the public key and subject attributes submitted to a CA.
CSR generation is the initial step in obtaining an identity certificate from a public or private PKI.
2
Analyze the function of a Root CA Certificate.
Identify that the Root CA Certificate acts as the implicit root of trust configured in device trust stores.
Without a trusted Root CA certificate, network entities cannot complete TLS handshakes because certificate signature chains cannot be validated.
3
Evaluate the X.509 extension Subject Alternative Name (SAN).
Identify that SAN extends the certificate capability to cover multiple IP addresses or hostnames beyond the primary Common Name (CN).
Modern enterprise applications like Cisco ISE require SAN entries for dual-node deployment FQDNs and management IP addresses.
4
Evaluate certificate validation using Online Certificate Status Protocol (OCSP).
Identify that OCSP sends specific certificate status queries to an online responder rather than downloading complete Certificate Revocation Lists (CRLs).
OCSP avoids the bandwidth overhead associated with parsing large, periodically published CRL files.

Key Concept

Public Key Infrastructure (PKI) components and certificate validation mechanisms in network access control
Question 68Question →

A network administrator applies an extended IPv4 Access Control List (ACL) containing only a single rule to an interface: `access-list 100 permit tcp host 192.168.1.10 host 10.0.0.5 eq 80`. What happens when a host with IP address 192.168.1.11 attempts to send HTTP traffic to 10.0.0.5?

Show answer & explanation

Answer: The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

Answer

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.
Every Cisco IPv4 Access Control List ends with an invisible implicit deny statement (implicit deny ip any any). Because the single configured line only permits traffic from 192.168.1.10, any packet coming from 192.168.1.11 fails to match rule 1 and is dropped by the implicit deny clause.

Step-by-Step Solution

1
Evaluate the incoming packet details against the ACL rule.
Host 192.168.1.11 does not match source IP host 192.168.1.10 in line 1.
The configured line specifically permits traffic only from host 192.168.1.10.
2
Proceed to subsequent lines in the ACL.
The packet hits the unwritten implicit deny statement at the end of the list.
All Cisco IOS IPv4 ACLs end with an implicit 'deny ip any any' rule.
3
Determine the forwarding decision.
The router drops the packet from host 192.168.1.11.
Traffic that fails to match any explicit permit line is denied.

Key Concept

Implicit Deny in IPv4 Access Control Lists
Question 69Question →

A network administrator configures the following IPv4 extended named Access Control List (ACL) on a Cisco IOS router to control access to an internal application server at IP address 192.168.50.10:

text
ip access-list extended APP_FILTER
10 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 80
20 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 443
30 deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10
40 permit ip host 10.10.20.5 host 192.168.50.10

The ACL is applied outbound on GigabitEthernet0/1. An administrator attempts an SSH connection (TCP port 22) from management host 10.10.20.5 to the application server (192.168.50.10), while a user on host 10.10.20.100 attempts a web connection (TCP port 80) to the same server.

Which statement accurately describes how the router processes these two traffic flows?

Show answer & explanation

Answer: The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

Answer

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.
Cisco IOS Access Control Lists process statements sequentially in top-down numerical order. For HTTP traffic (port 80) originating from 10.10.20.100, sequence 10 matches the subnet source 10.10.20.0/24, destination host 192.168.50.10, and TCP port 80, allowing the flow immediately. For SSH traffic (port 22) originating from 10.10.20.5, sequences 10 and 20 fail to match due to destination port mismatches (80 and 443). Sequence 30 specifies protocol 'ip', which encompasses all Layer 4 protocols (including TCP/22), matching host 10.10.20.5 within the 10.10.20.0/24 subnet and dropping the packet. Sequence 40 is never reached for host 10.10.20.5 because sequence 30 matches first.

Step-by-Step Solution

1
Evaluate the HTTP flow (Source: 10.10.20.100, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 80) against sequence 10.
Sequence 10 permits TCP traffic from 10.10.20.0/24 to host 192.168.50.10 on port 80. Match found; processing stops and traffic is permitted.
Top-down evaluation stops immediately at the first matching entry.
2
Evaluate the SSH flow (Source: 10.10.20.5, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 22) against sequence 10 and 20.
Port 22 does not match port 80 (sequence 10) or port 443 (sequence 20). Evaluation moves to sequence 30.
Extended ACLs require all specified criteria (protocol, source, destination, port) to match.
3
Evaluate the SSH flow against sequence 30 (deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10).
Host 10.10.20.5 is within 10.10.20.0/24, destination is 192.168.50.10, and 'ip' matches all IP protocols including TCP. Match found; traffic is denied.
Sequence 30 catches all remaining IP traffic from the subnet before sequence 40 can ever be reached.

Key Concept

Top-Down Sequential Processing in Cisco IPv4 Extended ACLs
Question 70Question →

A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?

Show answer & explanation

Answer: Local switch authentication fallback relies solely on the local database credentials (something you know), omitting the secondary possession factor managed by the offline central AAA server.

Answer

Local switch authentication fallback relies solely on local database credentials (something you know), which omits the secondary possession factor (dynamic token/OTP) handled by the central AAA infrastructure.
The correct answer highlights that local network device databases maintain static passwords (knowledge factors) but typically lack integration with time-based one-time password (TOTP) generators or push notifications (possession factors). When a central AAA server is unreachable and authentication falls back to the local database, the access control degrades from multi-factor to single-factor authentication.

Step-by-Step Solution

1
Analyze the authentication factors in normal operation versus fallback mode.
Normal AAA operation combines a static password (knowledge factor) and a dynamic OTP token (possession factor).
MFA requires two or more distinct categories of authentication factors.
2
Evaluate local router/switch database capabilities.
Local switch user accounts store hash values of local passwords/secrets and cannot natively validate dynamic RADIUS/TACACS+ TOTP security tokens.
Local databases act as a emergency single-factor fallback unless specialized external key hardware is attached.
3
Identify the root cause of the MFA bypass.
Fallback to local authentication drops the possession factor, resulting in single-factor authentication.
Centralized RADIUS/TACACS+ failure isolates the secondary factor provider.

Key Concept

Multi-Factor Authentication (MFA) and Fallback Security Policies
Question 71Question →

A network security administrator is configuring digital certificate services and Multi-Factor Authentication (MFA) to secure management sessions on enterprise network infrastructure. Which of the following statements accurately describe digital certificate verification and MFA factor rules? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The verifying client validates the Certificate Authority (CA) digital signature on a presented certificate by using the public key of the issuing CA.; Effective Multi-Factor Authentication requires combining credentials from at least two distinct factor categories, such as a passphrase and a hardware OTP token.

Answer

The correct statements are that certificate verification requires validating the CA's digital signature using the CA's public key, and that MFA requires combining credentials from at least two distinct authentication factor categories (such as a passphrase and an OTP token).
Verifying a digital certificate involves checking the issuing CA's signature using that CA's public key. For MFA, authentication requires at least two independent factor types (such as something you know combined with something you have).

Step-by-Step Solution

1
Analyze certificate validation mechanics.
Digital certificates are signed by a trusted Certificate Authority (CA). Receivers verify the validity of the signature using the CA's public key.
This establishes the chain of trust in Public Key Infrastructure (PKI).
2
Analyze Multi-Factor Authentication (MFA) requirements.
MFA requires combining factors from different categories (Knowledge, Possession, Inherence). Combining a passphrase (something you know) with a hardware token (something you have) fulfills MFA requirements.
Using two items from the same category (e.g., two passwords) is multi-step authentication, not multi-factor authentication.

Key Concept

PKI Certificate Verification and MFA Authentication Factor Requirements
Question 72Question →

A network engineer configures the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to filter traffic between host 10.20.5.1510.20.5.15 and web server 192.168.100.50192.168.100.50:

text
ip access-list extended SECURE_VLAN
deny icmp host 10.20.5.15 host 192.168.100.50
permit tcp host 10.20.5.15 host 192.168.100.50 eq 80
permit tcp host 10.20.5.15 host 192.168.100.50 eq 443

Which two statements accurately describe the traffic filtering behavior enforced by this ACL? (Choose two.)

Select all that apply

Show answer & explanation

Answer: ICMP packets sent from host 10.20.5.1510.20.5.15 targeting server 192.168.100.50192.168.100.50 are explicitly dropped by the first entry.; UDP traffic originating from host 10.20.5.1510.20.5.15 bound for server 192.168.100.50192.168.100.50 is dropped due to the implicit deny clause at the end of the ACL.

Answer

The statement identifying that ICMP packets are explicitly dropped by the first entry and the statement noting that UDP traffic is dropped by the implicit deny clause are both correct.
The first entry in the ACL explicitly denies ICMP packets sent from host 10.20.5.1510.20.5.15 to host 192.168.100.50192.168.100.50. Additionally, because Cisco IPv4 ACLs automatically append an unwritten implicit deny clause (`deny ip any any`) at the end of the evaluation list, any protocol not explicitly permitted—such as UDP—is automatically dropped.

Step-by-Step Solution

1
Evaluate the first ACL statement against ICMP traffic
Statement 'deny icmp host 10.20.5.15 host 192.168.100.50' matches ICMP packets from host 10.20.5.15 to 192.168.100.50 and explicitly denies them.
Top-down ACL processing stops at the first matching rule.
2
Evaluate unlisted traffic types such as UDP or non-web TCP (e.g. port 22)
Unlisted traffic types do not match statements 1, 2, or 3 and hit the default 'deny ip any any' rule at the bottom.
All Cisco IOS ACLs end with an invisible implicit deny clause.
3
Evaluate directionality for return traffic originating from server 192.168.100.50
Return traffic has source 192.168.100.50 and destination 10.20.5.15, failing to match the source/destination fields of the permit rules.
Standard and Extended ACL statements evaluate traffic directional fields strictly as defined.

Key Concept

Top-down sequential processing and implicit deny clause evaluation in IPv4 Extended ACLs
Estimated Time:1m 30s
Question 73Question →

A network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to prevent ARP spoofing. DHCP snooping is enabled and functioning properly. However, several servers connected to untrusted access ports use statically assigned IP addresses, causing DAI to drop their legitimate ARP requests because they lack entries in the DHCP snooping binding database. Which configuration action should the administrator perform to permit ARP traffic from these static servers while maintaining DAI protection on VLAN 10?

Show answer & explanation

Answer: Configure an ARP Access Control List (ARP ACL) with static IP-to-MAC bindings and apply it to VLAN 10 using the ip arp inspection filter command.

Answer

Configure an ARP Access Control List (ARP ACL) with the static IP-to-MAC address mappings of the servers and apply it to VLAN 10 using the 'ip arp inspection filter' command.
Dynamic ARP Inspection (DAI) validates ARP requests and responses against the DHCP snooping binding database on untrusted ports. Because statically configured hosts do not send DHCP requests, they lack entries in the binding database. To prevent DAI from dropping legitimate traffic from these static hosts, administrators must create an ARP Access Control List (ARP ACL) with static IP-to-MAC mappings and map it to the VLAN using the 'ip arp inspection filter' command.

Step-by-Step Solution

1
Identify the cause of dropped ARP packets
DAI inspects ARP packets on untrusted ports by matching their IP and MAC addresses against the DHCP snooping binding database. Statically addressed hosts have no entries in this database, causing DAI to drop their packets.
DAI relies by default on the DHCP snooping binding table for validation.
2
Determine the correct mitigation mechanism for static IP hosts
Cisco IOS allows creating an ARP ACL (`arp access-list`) containing explicit `permit ip host <IP> mac host <MAC>` statements for static hosts.
ARP ACLs act as a static reference database alongside DHCP snooping for DAI validation.
3
Apply the ARP ACL to Dynamic ARP Inspection
Execute `ip arp inspection filter <arp-acl-name> vlan 10` in global configuration mode.
This command instructs DAI to check the ARP ACL before or instead of the DHCP snooping database for traffic on VLAN 10.

Key Concept

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Question 74Question →

A network administrator is creating an IPv4 extended Access Control List (ACL 105) to allow HTTPS access from host 192.168.10.5 to web server 10.0.0.5, block all other TCP traffic from the 192.168.10.0/24 subnet to the 10.0.0.0/8 network, and permit all remaining traffic. In what sequential order from top to bottom should these ACL statements be configured to enforce the intended policy correctly?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places the specific host permit rule first, followed by the broader subnet TCP deny rule, and ends with the general permit ip any any rule.
Cisco IOS ACL entries are evaluated sequentially from top to bottom. Specific permit statements (such as host-to-host HTTPS traffic) must always precede broader deny statements (such as an entire /24 subnet destination block). Finally, an explicit permit ip any any statement must be placed at the end to prevent unrelated traffic from being dropped by the hidden implicit deny rule.

Step-by-Step Solution

1
Place the specific host-to-host HTTPS permit statement at the top of the ACL.
HTTPS traffic from host 192.168.10.5 to host 10.0.0.5 is matched immediately and allowed.
Cisco IOS ACLs evaluate rules top-down sequentially and stop processing once a match is found. Specific exception rules must precede broader restrictive rules.
2
Place the subnet-wide TCP deny statement second.
All other TCP traffic originating from 192.168.10.0/24 to 10.0.0.0/8 is denied.
Placing this rule after the specific host exception ensures that only non-exempt TCP traffic from the subnet gets blocked.
3
Place the permit ip any any statement at the bottom of the ACL.
All remaining IP traffic that does not match the first two rules is explicitly allowed.
Without an explicit permit statement at the end of the ACL, unmatched traffic would be dropped by the implicit deny any rule at the end of ACL processing.

Key Concept

Access Control List sequential top-down processing and rule specificity
Question 75Question →

A network administrator is configuring an extended IPv4 access control list (ACL) named `FILTER_INTERNAL` on GigabitEthernet0/0/0 (inbound) on a Cisco IOS router. The objective is to enforce the following security policy for internal users on network 10.50.10.0/2410.50.10.0/24:

1. Allow HTTPS traffic (TCP port 443) to the DMZ web server at 172.16.100.50172.16.100.50.
2. Allow DNS domain queries (UDP port 53) to the DMZ DNS server at 172.16.100.53172.16.100.53.
3. Explicitly drop and log all other traffic from 10.50.10.0/2410.50.10.0/24 directed to any host in the DMZ subnet (172.16.100.0/24172.16.100.0/24).
4. Permit all remaining traffic originating from 10.50.10.0/2410.50.10.0/24 destined to other corporate subnets or the Internet.

Which two configuration statements or operational logic requirements must be included in the ACL design to satisfy these requirements without blocking non-DMZ traffic?

Select all that apply

Show answer & explanation

Answer: An explicit statement `permit ip 10.50.10.0 0.0.0.255 any` must be placed at the end of the ACL to override the implicit deny any clause.; The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be sequenced immediately after the specific HTTPS and DNS permit rules.

Answer

The correct configuration requires placing the subnet deny statement (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`) after the specific HTTPS and DNS permit entries, as well as appending an explicit `permit ip 10.50.10.0 0.0.0.255 any` at the end of the ACL.
Cisco IOS IPv4 Access Control Lists evaluate entries sequentially from top to bottom. Specific permit rules for host-level services (HTTPS and DNS) must be evaluated before broader subnet restrictions (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`). Furthermore, because every ACL terminates with an implicit `deny ip any any` rule, an explicit `permit ip 10.50.10.0 0.0.0.255 any` statement must be placed at the end of the ACL structure to allow non-DMZ traffic to pass.

Step-by-Step Solution

1
Analyze top-down sequential processing of Cisco IOS ACLs.
Specific permit lines for HTTPS (TCP 443 to 172.16.100.50172.16.100.50) and DNS (UDP 53 to 172.16.100.53172.16.100.53) must precede broad deny statements for the 172.16.100.0/24172.16.100.0/24 subnet.
If a broad subnet deny rule appears higher in the ACL sequence, matching packets are dropped before reaching lower permit statements.
2
Evaluate subnet isolation and logging requirement.
Adding `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` directly after the permit rules catches and logs any other attempt to access the DMZ network.
This explicitly satisfies requirement 3 without interfering with legitimate HTTPS/DNS flows.
3
Account for the default implicit deny behavior.
Adding `permit ip 10.50.10.0 0.0.0.255 any` at the end prevents non-DMZ traffic from being dropped.
All IPv4 Cisco ACLs end with an unwritten `deny ip any any` entry. Without an explicit permit rule at the end, all traffic to external networks or other subnets would be discarded.

Key Concept

Top-down ACL rule evaluation sequence and handling of the implicit deny any clause
Question 76Question →

A network administrator wants to restrict access on a switch port to an authorized end device. If an unauthorized MAC address sends traffic to the port, the interface must drop the frames, avoid incrementing the security violation counter, and avoid disabling the port. Which port security violation mode meets this requirement?

Show answer & explanation

Answer: protect

Answer

The protect violation mode silently drops packets from unknown MAC addresses without incrementing the security violation counter or placing the interface into an err-disabled state.
The protect violation mode silently drops packets with unauthorized source MAC addresses. It does not increment the interface's security violation counter, nor does it send SNMP traps or Syslog notifications.

Step-by-Step Solution

1
Analyze the operational requirements
The requirement specifies dropping unauthorized frames silently without raising violation counters or bringing down the link.
Port security violation modes differ in how they react to unauthorized MAC addresses.
2
Evaluate Port Security violation mode options
Protect mode drops frames silently without counter increments. Restrict mode drops frames but logs violations and increments counters. Shutdown mode err-disables the interface.
Matching the behavior to the protect keyword fulfills all prompt criteria.

Key Concept

Port Security Violation Modes (Protect, Restrict, Shutdown)
Question 77Question →

An enterprise network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 using the command `ip arp inspection vlan 10`. Host devices dynamically receiving IPv4 configuration via DHCP operate without issue. However, a critical server connected to access switchport GigabitEthernet0/2 in VLAN 10 is configured with a static IPv4 address (192.168.10.50/24192.168.10.50/24) and MAC address (0011.2233.44550011.2233.4455). Network telemetry indicates that all network traffic from this server is dropped because DAI marks its ARP packets as invalid. Which configuration step correctly resolves the ARP packet drop for this static host while maintaining active DAI protection on VLAN 10?

Show answer & explanation

Answer: Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.

Answer

Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.
Dynamic ARP Inspection (DAI) intercepts and validates all ARP packets on untrusted switch interfaces against the DHCP snooping binding database. Statically addressed hosts do not use DHCP and therefore lack entries in this database, causing DAI to discard their ARP traffic. To resolve this issue without disabling DAI, an administrator must create an ARP access list (`arp access-list`) defining the static IP and MAC address pairing, and associate it with the VLAN using `ip arp inspection filter <acl-name> vlan <vlan-id>`.

Step-by-Step Solution

1
Diagnose the root cause of packet drops under Dynamic ARP Inspection (DAI)
DAI intercepts ARP requests and responses on untrusted ports and validates the sender's IP-to-MAC mapping against the DHCP snooping binding database. Because the server uses a static IP address, no DHCP transaction occurred, resulting in no database entry and subsequent ARP packet drops.
Static IP devices naturally lack dynamic entries in the switch DHCP snooping binding database.
2
Identify the Cisco IOS mechanism for authorizing non-DHCP static hosts under DAI
Define an ARP Access Control List (`arp access-list <name>`) and add a permit entry binding the host's static IP (192.168.10.50192.168.10.50) to its MAC address (0011.2233.44550011.2233.4455).
ARP ACLs provide a static verification table for DAI validation.
3
Apply the static ARP ACL to the VLAN inspection filter
Execute `ip arp inspection filter <acl-name> vlan 10` in global configuration mode.
This permits the static host's ARP packets to pass inspection while preserving DAI security enforcement for all other hosts in VLAN 10.

Key Concept

Dynamic ARP Inspection (DAI) Static ARP Access List Filtering
Question 78Question →

Match each Layer 2 security mechanism or feature component on the left with its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

DHCP Snooping Binding Database
Dynamic ARP Inspection (DAI)
Port Security Sticky MAC Learning
DAI Interface Rate Limiting

Matches

Show answer & explanation

Answer

DHCP Snooping Binding Database maps to tracking client MAC, IP, lease, VLAN, and interface details. Dynamic ARP Inspection matches intercepting and validating IP-to-MAC bindings in ARP packets on untrusted ports. Port Security Sticky MAC Learning matches dynamically converting learned MAC addresses into running configuration entries. DAI Interface Rate Limiting matches enforcing a maximum threshold of incoming ARP packets per second.
Each feature component directly performs its specified security role: DHCP Snooping creates the authoritative binding database; DAI utilizes that database to validate ARP packets on untrusted interfaces; Sticky MAC learning writes dynamically learned MACs into the running configuration; and DAI rate limiting protects switch hardware by capping incoming ARP frames per second.

Step-by-Step Solution

1
Analyze the operational function of DHCP Snooping.
DHCP snooping acts as a firewall between untrusted hosts and DHCP servers, building a binding database containing IP address, MAC address, lease time, bind type, VLAN number, and interface information.
This database serves as the authoritative mapping reference for other Layer 2 features such as DAI and IP Source Guard.
2
Analyze the operational function of Dynamic ARP Inspection (DAI).
DAI inspects ARP packets on untrusted interfaces to prevent ARP poisoning and man-in-the-middle attacks.
DAI discards invalid ARP packets where the Sender IP and Sender MAC do not match an entry in the DHCP snooping binding database.
3
Analyze the function of sticky MAC learning in Port Security.
Sticky MAC learning dynamically converts learned MAC addresses into sticky addresses that are automatically added to the running-config file.
This eliminates the need to manually enter static MAC addresses on switchports while maintaining MAC persistence across reboots if saved.
4
Analyze DAI interface rate limiting.
Enforcing an ARP rate limit drops excess ARP packets when incoming packet rates exceed the configured threshold per second.
Rate limiting protects the switch CPU from control plane starvation caused by ARP flooding attacks.

Key Concept

Layer 2 Security Feature Operation and Interdependencies
Question 79Question →

A network administrator is implementing administrative security controls for enterprise network switches and configuring Public Key Infrastructure (PKI) certificate validation for HTTPS management access. When evaluating multi-factor authentication (MFA) factor categories and PKI digital certificate validation mechanics, which two statements are correct?

Select all that apply

Show answer & explanation

Answer: An RSA hardware key fob generating a time-based passcode combined with a user password satisfies MFA by combining a possession factor with a knowledge factor.; During TLS certificate verification, the client uses the issuer Certificate Authority's public key to validate the digital signature on the switch certificate.

Answer

The correct statements are that combining an RSA hardware key fob passcode with a password satisfies MFA by using possession and knowledge factors, and that during TLS certificate verification, the client relies on the issuing Certificate Authority's public key to validate the switch certificate's digital signature.
Combining a hardware token generator (something you have) with a user password (something you know) uses two distinct authentication factor categories, satisfying true MFA requirements. Additionally, in PKI validation, clients verify the CA's signature on a switch's X.509 certificate using the CA's public key contained in their local trust store.

Step-by-Step Solution

1
Analyze the authentication factors in the proposed MFA scenario.
A hardware token generating a one-time passcode is a physical possession factor ('something you have'), while a standard password is a knowledge factor ('something you know'). Combining two distinct categories fulfills multi-factor authentication requirements.
MFA requires authentication elements from at least two different categories among knowledge, possession, and inherence.
2
Evaluate the PKI digital certificate signature verification mechanism.
When a Certificate Authority (CA) issues an X.509 certificate to a switch, the CA signs the certificate hash using the CA's private key. The connecting client verifies this signature using the CA's public key contained in its trusted root store.
Asymmetric cryptography dictates that data signed by a private key can only be verified using the corresponding public key.
3
Identify misclassifications and incorrect cryptographic roles in the remaining choices.
Digital certificates function as possession factors (not knowledge factors), signature verification utilizes the CA public key (never the switch private key), and password policies regulate password properties rather than session transport encryption.
Distinguishing between factor types, public/private key roles in PKI, and authentication versus transport encryption avoids operational security misconceptions.

Key Concept

Multi-Factor Authentication (MFA) Factor Classification and PKI Digital Certificate Verification
Question 80Question →

An network administrator is troubleshooting traffic drops on switch port GigabitEthernet1/0/10. The interface is configured with Layer 2 security features including DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security in restrict mode. The output of `show ip dhcp snooping binding` displays a valid IP-to-MAC entry for the connected client on GigabitEthernet1/0/10. However, executing `show port-security interface g1/0/10` shows that the `SecurityViolation` counter is actively incrementing every time the host attempts to transmit data, while the port status remains operational (`secure-up`). Which scenario accounts for these symptoms?

Show answer & explanation

Answer: The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.

Answer

The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.
The correct answer accounts for both symptoms: a valid DHCP Snooping entry and an incrementing Port Security violation counter. When a host NIC is replaced, the new MAC address successfully requests a DHCP lease (creating a valid DHCP Snooping database entry and allowing DAI validation to pass). However, because Port Security was configured with sticky MAC learning or a explicit MAC limit, the newly introduced MAC address violates port security parameters. In restrict mode, Port Security drops non-matching frames and increments the SecurityViolation counter without disabling the port.

Step-by-Step Solution

1
Analyze the reported operational symptoms
Port status is secure-up, SecurityViolation counter is incrementing, and DHCP Snooping binding table contains a valid entry.
Identify which security feature is actively dropping traffic.
2
Evaluate Port Security violation mode behavior
Restrict mode drops frames from unauthorized source MAC addresses, increments the violation counter, and logs a Syslog message while keeping the interface up.
The incrementing violation counter indicates Port Security is triggering, not DAI or DHCP Snooping.
3
Correlate DHCP Snooping binding presence with Port Security failure
The host successfully completed a DHCP exchange (populating the binding table), but its source MAC address does not match the statically or dynamically learned sticky MAC address on the port security database.
A replaced network interface card generates a new MAC address. DHCP Snooping will grant an IP and record the new MAC, but Port Security will block the frame if the maximum MAC address limit or specific sticky MAC entry is exceeded.

Key Concept

Port Security violation modes and multi-feature Layer 2 security interaction
Estimated Time:2m 0s
PreviousPage 4 / 15Next
Security Fundamentals Practice Questions — Cisco CCNA — Page 4 | Examkin