Security Fundamentals

A network administrator is deploying Layer 2 security controls on a Cisco Catalyst switch. Which two statements accurately describe the operational requirements and default behaviors of DHCP Snooping? (Select two.)

A network administrator configures switchport port security on a Cisco Catalyst switch access port using the command 'switchport port-security mac-address sticky'. An end device is connected to the port, and the switch dynamically learns its MAC address into the running configuration. The administrator verifies full network connectivity, but does not enter any additional CLI commands before the switch undergoes an unexpected reboot. Which outcome occurs regarding the port security bindings after the switch reboots?

A network technician is reviewing operational characteristics for standard IPv4 Access Control Lists (ACLs) on a Cisco router. Which of the following statements regarding standard IPv4 ACLs are correct? (Select TWO.)

A network engineer completes the configuration of Layer 2 security features on a Cisco Catalyst switch connecting client workstations to an upstream router. After enabling DHCP snooping and Dynamic ARP Inspection (DAI) globally and on VLAN 20, client devices on untrusted access ports fail to obtain IPv4 addresses from the DHCP server, and ARP packets arriving from the default gateway on interface GigabitEthernet0/1 are discarded by DAI. Which two configuration steps are required on interface GigabitEthernet0/1 to resolve these issues? (Select two.)

A network engineer hardens an enterprise access switch by enabling DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security. Host A acquires an IPv4 address dynamically via DHCP on interface GigabitEthernet1/0/5, where Port Security is configured with the `switchport port-security mac-address sticky` command. The engineer executes `write memory` to save the running configuration. Later, the switch experiences a power outage and reboots. DHCP Snooping database persistence was not configured with `ip dhcp snooping database`. Upon bootup, Host A attempts to communicate using its active DHCP lease without re-initiating a DHCP DORA sequence. However, all ARP traffic from Host A is dropped by the switch. What is the root cause of these frame drops?

A network administrator configures an inbound IPv4 extended Access Control List (ACL) on interface GigabitEthernet0/0 to control traffic originating from the engineering subnet $10.50.10.0/24$. The objective is to allow HTTP and HTTPS access to an internal web server at $172.16.1.100$, while continuing to allow normal network traffic to all other destinations.

The administrator applies the following configuration:

text
ip access-list extended FILTER_ENGINEERING
permit tcp 10.50.10.0 0.0.0.255 host 172.16.1.100 eq 80
permit tcp 10.50.10.0 0.0.0.255 host 172.16.1.100 eq 443

After applying this ACL to GigabitEthernet0/0 inbound, users in the $10.50.10.0/24$ subnet report that while they can access the web server, all access to internet services, DNS, and local file servers is completely blocked. What is the primary cause of this issue?

A network engineer is analyzing connectivity failures on a Cisco Catalyst switch serving VLAN 20. DHCP Snooping and Dynamic ARP Inspection (DAI) are globally enabled and configured on VLAN 20. Users connected to access ports report that they fail to receive DHCP IP addresses, valid ARP requests from hosts are dropped by the switch engine, and port-security sticky MAC addresses learned on access port GigabitEthernet0/2 were lost following a switch reboot.

Which TWO administrative actions are required to resolve the DHCP/DAI packet drops and permanently persist the learned sticky MAC addresses across switch reboots? (Select TWO.)

A network administrator is implementing Layer 2 security controls on a Cisco Catalyst access switch to defend against rogue DHCP servers, ARP poisoning, and unauthorized MAC address access. Match each Layer 2 security configuration command or feature component on the left to its corresponding operational behavior on the right.

A network administrator needs to restrict which specific CLI commands an engineer can execute on a router after logging in. Which AAA component is responsible for controlling the specific actions and commands a user is allowed to perform?

A network administrator inspects a Cisco IOS XE switch and finds the following running configuration snippet:

text
username secadmin privilege 15 password 0 C1sc0123!
!
line vty 0 4
transport input ssh
login local

The organization's security hardening baseline requires all local database user accounts to store credentials using PBKDF2 (Type 8) password hashing rather than unencrypted plaintext (Type 0). Which global configuration command correctly updates the local user credential to meet this security standard?

A network engineer is configuring Layer 2 security controls on access switches to protect against man-in-the-middle attacks and rogue server deployments. Which two statements accurately describe the operational behaviors of DHCP Snooping and Dynamic ARP Inspection (DAI)? (Select two.)

Match each AAA framework operational characteristic or protocol mechanism on the left to its corresponding protocol or architectural implementation on the right.

A network technician needs to harden local console line access on a Cisco IOS XE switch using the local user database. Arrange the following Cisco IOS CLI commands in the correct sequential order required to perform this configuration, starting from Privileged EXEC mode (`Switch#`).

A network administrator is implementing the AAA framework on an enterprise switch to manage access. Match each administrative operational task on the left to its corresponding AAA framework pillar on the right.

An enterprise network security team is designing an access control architecture for two distinct use cases: granular CLI command authorization with full packet encryption for network engineers managing infrastructure devices via SSH, and port-based 802.1X authentication for wireless clients where authentication and authorization must be evaluated together in a single protocol transaction. Which protocol deployment strategy correctly fulfills both technical requirements based on their underlying operational characteristics?

A network engineer enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch where DHCP Snooping is also active. All access interfaces on VLAN 20 are left in the default untrusted state. A critical host connected to interface GigabitEthernet1/0/12 is configured with a static IP address ($192.168.20.50/24$) and MAC address ($0050.56a1.23bc$). Consequently, DAI drops all ARP requests sent by this host because no entry exists for it in the DHCP snooping binding database. The engineer must allow this host to communicate while keeping GigabitEthernet1/0/12 untrusted and maintaining DAI protection on VLAN 20. Which command sequence must be configured on the switch to resolve this issue?

A network administrator reviews a Cisco IOS XE router configuration and notices the following line in the running configuration:

`username netadmin privilege 15 password 7 08221509421E05150C`

This entry was created after a technician executed `username netadmin privilege 15 password 0 SecretPass123` followed by `service password-encryption`.

Which statement accurately describes the primary security risk of using this password storage method compared to configuring `username netadmin secret SecretPass123`?

A network administrator is implementing Layer 2 security controls on Cisco Catalyst access switches. Match each Layer 2 security feature mechanism on the left to its corresponding operational behavior on the right.

A network security engineer analyzes packet traces captured during remote access sessions to network infrastructure and 802.1X wireless client authentications. Which TWO statements correctly describe the architectural and packet-level differences between TACACS+ and RADIUS operations?

An inbound IPv4 extended Access Control List (ACL) named SECURE_IN is applied to interface GigabitEthernet0/1 on a Cisco router with the following configuration:

ip access-list extended SECURE_IN
10 permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.100 eq 80
20 permit tcp host 172.16.10.15 192.168.1.0 0.0.0.255 eq 22
30 permit ip host 172.16.10.20 192.168.1.0 0.0.0.255

A host with IPv4 address $172.16.10.15$ sends a packet destined for $192.168.1.100$ targeting TCP port 443 (HTTPS). What action will the router take when processing this packet?