Security Fundamentals

Match each Public Key Infrastructure (PKI) component or Multi-Factor Authentication (MFA) element on the left to its corresponding function or definition on the right.

A network administrator enables DHCP Snooping globally and on VLAN 20. To protect against DHCP denial-of-service (DoS) starvation attacks, the administrator configures `ip dhcp snooping limit rate 15` on all untrusted access interfaces. Shortly after, a user workstation interface transitions into the `err-disabled` state. Which operational behavior explains why this interface was placed into the `err-disabled` state?

An organization is updating its administrative access policy for Cisco enterprise network devices. To enforce multi-factor authentication (MFA) for secure SSH management access, network administrators configure AAA authentication to require both a static account password and a one-time passcode (OTP) generated by a physical hardware token fob. Which statement correctly classifies these two authentication controls under standard MFA factor categories?

A network administrator is designing an IPv4 security policy and placing Access Control Lists (ACLs) across a corporate router topology. Which two statements accurately describe the operational characteristics and default behaviors of Cisco IPv4 ACLs? (Select two.)

An enterprise security team is evaluating AAA protocol deployments across network devices. The security policy mandates that administrative CLI sessions on core routers must enforce per-command authorization and per-command accounting logs. During testing, the team observes that while RADIUS successfully authenticates incoming user sessions, it fails to perform real-time, per-command authorization checks during an active CLI session. Which architectural characteristic of RADIUS accounts for this limitation?

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding system action or behavior on the right.

A network administrator is implementing certificate-based client authentication (EAP-TLS) for 802.1X enterprise wireless access. When an authentication server receives a digital certificate presented by a client device, which two methods or attributes are used by the server to check whether the certificate has been explicitly revoked before its natural expiration date? (Select TWO.)

An administrator configures the following IPv4 extended named access control list on a Cisco IOS router:

text
ip access-list extended BLOCK_WEB_SERVICES
deny tcp 10.20.30.0 0.0.0.255 host 192.168.100.10 eq 80
deny tcp 10.20.30.0 0.0.0.255 host 192.168.100.10 eq 443

This ACL is applied inbound on interface GigabitEthernet0/0. A host with IP address 10.20.30.15 attempts to send ICMP echo request packets to 192.168.100.10. What occurs when this ICMP traffic reaches the router interface?

A network administrator configures port security on access interface GigabitEthernet0/10 of a Cisco Catalyst switch using the command `switchport port-security mac-address sticky`. Over the next week, several workstations connect to the port, and their MAC addresses are dynamically added to the running configuration. Following an unscheduled power outage and switch reboot, the administrator discovers that the connected workstations are unable to gain access and port security sticky entries are missing from the configuration. What was the root cause of this issue?

A network administrator is creating an IPv4 extended Access Control List (ACL) on a Cisco IOS router to regulate traffic flowing from internal hosts to the DMZ subnet ($172.16.1.0/24$). The ACL must enforce the following policy requirements in order of precedence:

1. Allow HTTP traffic from any host in the internal subnet ($192.168.10.0/24$) to the web server at $172.16.1.50$.
2. Block all other IP traffic from host $192.168.10.15$ to the DMZ subnet ($172.16.1.0/24$).
3. Allow all remaining IP traffic from the internal subnet ($192.168.10.0/24$) to the DMZ subnet ($172.16.1.0/24$).
4. Explicitly deny all other traffic.

Arrange the given ACL statements in the correct top-down execution order to achieve this security policy without unintended traffic drops.

A network administrator is implementing Layer 2 security controls on an access switch, configuring Port Security with sticky MAC address learning alongside DHCP Snooping on edge switch ports. Which two statements correctly describe the operational behavior of these features? (Select two.)

An organization is updating its enterprise security standards for administrative access and infrastructure security. Match each security control or PKI concept on the left to its corresponding operational function on the right.

Match each wireless security deployment mode or protocol with its primary cryptographic cipher suite or key exchange mechanism.

A network engineer applies the following extended IPv4 access control list inbound on router interface GigabitEthernet0/0/0 to allow web administration access from an operations subnet ($172.16.50.0/24$) to a database server ($10.0.1.50/32$):

text
ip access-list extended ADMIN_TO_DB
permit tcp 172.16.50.0 0.0.0.255 host 10.0.1.50 eq 443

Immediately after applying the ACL, administrators report that HTTPS connections to $10.0.1.50$ work as expected, but SSH connections and ICMP echo requests (ping) from the operations subnet to $10.0.1.50$ fail. What is the root cause of this behavior?

An administrator configures the following IPv4 extended named access control list on a Cisco IOS router and applies it inbound on interface GigabitEthernet0/0/1:

text
ip access-list extended CORP_SEC
permit tcp 10.1.10.0 0.0.0.255 host 192.168.1.50 eq 22
permit tcp 10.1.10.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit tcp 10.1.10.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 443

Which two statements accurately describe how network traffic arriving on GigabitEthernet0/0/1 will be filtered by this access control list? (Select two options.)

A system administrator is configuring an authentication server to support 802.1X wireless client access across campus switch stacks. Which operational characteristic of RADIUS makes it the primary protocol choice for this network access scenario compared to TACACS+?

A network administrator installs a new identity certificate on a Cisco IOS router to secure HTTPS management access. However, when administrative workstations attempt to connect to the router via HTTPS, their web browsers display a security warning stating that the certificate issuer is untrusted. The router's system clock is synchronized via NTP, and the certificate is within its valid date range. What is the root cause of this trust failure?

A network infrastructure team is selecting a centralized AAA protocol to secure administrative CLI access to enterprise switches. The security policy dictates that all communication between the network devices and the AAA server must have its entire packet payload encrypted, and the solution must support granular authorization for individual CLI commands. Which protocol satisfies these security requirements?

An administrator needs to restrict access on a Cisco IOS router so that only traffic from host $192.168.10.15$ can reach the internal web server at $10.1.1.50$ via HTTPS (TCP port $443$). All other traffic originating from the $192.168.10.0/24$ network destined to any location must be allowed. Which set of IPv4 access control list statements correctly satisfies these requirements?

An enterprise network policy mandates Multi-Factor Authentication (MFA) for network administrators establishing SSH sessions to core infrastructure devices. The policy specifically requires combining a 'something you know' factor with a 'something you have' factor. Which authentication combination satisfies this policy requirement?