Examkin

Security Fundamentals

298 questions

All types298Multiple choice157Multiple select64Matching56Ordering21
Question 141Question →

A network administrator is configuring Public Key Infrastructure (PKI) certificate services to secure administrative access and VPN connections on Cisco routers. Match each PKI component on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

Certificate Signing Request (CSR)
Certificate Revocation List (CRL)
Online Certificate Status Protocol (OCSP)
Certificate Authority (CA)

Matches

Show answer & explanation

Answer

Certificate Signing Request (CSR) matches the encoded request block with the public key; Certificate Revocation List (CRL) matches the signed file containing serial numbers of invalidated certificates; Online Certificate Status Protocol (OCSP) matches the real-time HTTP status checking protocol; Certificate Authority (CA) matches the trusted entity issuing signed certificates.
Each PKI component aligns with its specific role in the lifecycle of digital certificates: the CSR is the request payload created by an endpoint containing its public key; the CA is the trusted authority issuing certificates; the CRL is a published list of revoked serial numbers; and OCSP is an HTTP-based real-time certificate revocation protocol.

Step-by-Step Solution

1
Identify the creation and submission phase of PKI certificate enrollment.
The Certificate Signing Request (CSR) is the unsigned request file containing the public key and applicant identity details submitted to the CA.
Before a certificate can be issued, a key pair is generated locally and public details are placed in the CSR.
2
Identify the certificate issuing body.
The Certificate Authority (CA) is the trusted party that validates identity information and signs identity certificates using its private key.
The CA establishes trust by acting as the signing authority in the Public Key Infrastructure.
3
Distinguish between offline/periodic and online/real-time certificate revocation checks.
CRL refers to the periodically published file of revoked certificate serial numbers, while OCSP provides real-time revocation checking over HTTP.
CRLs require downloading full lists periodically, whereas OCSP queries the revocation status of individual certificates on demand.

Key Concept

Public Key Infrastructure (PKI) components and certificate validation mechanisms
Question 142Question →

A network administrator needs to construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy for internal users in the 192.168.1.0/24192.168.1.0/24 network:

1. Host 192.168.1.50192.168.1.50 must be permitted SSH access to the administrative server at 10.0.0.1010.0.0.10.
2. All other TCP traffic from the 192.168.1.0/24192.168.1.0/24 subnet destined to server 10.0.0.1010.0.0.10 must be blocked.
3. All hosts in the 192.168.1.0/24192.168.1.0/24 subnet must be permitted web access (HTTP) to any destination server.
4. General ICMP traffic must be allowed from any source to any destination.

Arrange the ACL statements from top to bottom (first line to last line) in the correct sequential order to achieve this policy without unintentionally blocking desired traffic.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The statements must be ordered sequentially from most specific host entry to broader subnet rules: first permit SSH from host 192.168.1.50 to 10.0.0.10, second deny all TCP from 192.168.1.0/24 to 10.0.0.10, third permit HTTP (port 80) from 192.168.1.0/24 to any, and fourth permit ICMP from any to any.
Cisco IOS ACLs process entries sequentially from top to bottom. The correct order places the most specific host-level permit rule for SSH at line 1, followed by the specific TCP deny rule to server 10.0.0.10 at line 2. Line 3 permits HTTP to any destination (which correctly permits HTTP except to 10.0.0.10, which was already matched and denied at line 2). Line 4 permits ICMP traffic before the implicit deny ip any any statement drops all remaining traffic.

Step-by-Step Solution

1
Identify the most specific exception rule.
Host 192.168.1.50 requires SSH access (TCP port 22) to host 10.0.0.10. Cisco ACLs evaluate top-down and stop at the first match. Therefore, 'permit tcp host 192.168.1.50 host 10.0.0.10 eq 22' must be the first line.
If a broader subnet deny statement were placed above this statement, host 192.168.1.50 would be blocked from establishing SSH sessions.
2
Identify the target subnet restriction rule.
All other TCP traffic from subnet 192.168.1.0/24 to host 10.0.0.10 must be blocked. The entry 'deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10' is placed second.
Placing this rule second ensures host 192.168.1.50 is permitted SSH access while all other TCP attempts to server 10.0.0.10 are dropped.
3
Place broader service permit rules after destination-specific deny rules.
The requirement states that all other HTTP traffic from 192.168.1.0/24 to any destination must be permitted, except HTTP to 10.0.0.10 which is covered under step 2. Placing 'permit tcp 192.168.1.0 0.0.0.255 any eq 80' third ensures HTTP to 10.0.0.10 is blocked while HTTP to all other hosts is permitted.
If the general HTTP permit rule were placed before the TCP deny rule for 10.0.0.10, HTTP traffic to 10.0.0.10 would match the permit rule and bypass security policy #2.
4
Place general IP protocol permit rules.
Place 'permit icmp any any' fourth. Unmatched traffic will hit the implicit 'deny ip any any' at the bottom of the ACL.
ICMP traffic needs explicit permission before the implicit deny clause drops all unreferenced packets.

Key Concept

Cisco IOS ACL Top-Down Sequential Evaluation Logic and Specific-to-General Ordering
Estimated Time:1m 30s
Question 143Question →

A network security administrator is configuring centralized security management for enterprise switches and routers. Match each AAA pillar or protocol characteristic on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

Authentication
Authorization
Accounting
TACACS+ Security Architecture

Matches

Show answer & explanation

Answer

Authentication matches with verifying user credentials. Authorization matches with defining allowed privileges and commands. Accounting matches with logging user activity and session details. TACACS+ Security Architecture matches with encrypting the full payload and separating AAA functions over TCP port 49.
Authentication verifies credentials (who you are), Authorization controls permitted actions/commands (what you can do), Accounting logs user session details (what you did), and TACACS+ architecture relies on TCP port 49 while providing full-packet payload encryption and modular separation of AAA functions.

Step-by-Step Solution

1
Identify the core definition of Authentication
Authentication answers 'Who are you?' by verifying credentials such as usernames and passwords.
Establishing identity is the primary first step in the AAA framework.
2
Identify the core definition of Authorization
Authorization answers 'What can you do?' by defining permitted command levels and access rights.
Once identity is proven, permissions must be enforced per user role.
3
Identify the core definition of Accounting
Accounting answers 'What did you do?' by tracking session start/stop times and commands executed.
Auditing requires keeping log records of user actions.
4
Identify the architectural mechanics of TACACS+
TACACS+ decouples AAA operations and uses TCP port 49 with full-packet payload encryption.
Unlike RADIUS which combines authentication/authorization and encrypts passwords only, TACACS+ provides total payload encryption and modular AAA separation.

Key Concept

AAA Framework Pillars and TACACS+ Protocol Architecture
Question 144Question →

A network administrator configures an IPv4 extended named Access Control List (ACL) on a Cisco router interface to restrict incoming traffic as follows:

text
ip access-list extended FILTER_MGMT
permit tcp 10.2.20.0 0.0.0.255 host 172.16.100.5 eq 443
permit tcp host 10.2.20.12 host 172.16.100.5 eq 22

A technician attempts to troubleshoot network connectivity by issuing a `ping` command from host 10.2.20.2510.2.20.25 to server 172.16.100.5172.16.100.5, but all ICMP echo request packets are dropped. Which statement correctly explains why the ping traffic fails?

Show answer & explanation

Answer: The ACL ends with an invisible implicit deny statement that drops any traffic that does not match an explicit permit entry.

Answer

The ping traffic fails because all IPv4 ACLs end with an implicit deny statement that drops any traffic not matching an explicit permit rule.
In Cisco IOS IPv4 Access Control Lists (both Standard and Extended), processing occurs sequentially from top to bottom. If a packet does not match any explicit permit statement, it hits the unwritten implicit deny clause (`deny ip any any`) at the end of the ACL. Since the ACL only contains explicit permits for TCP HTTPS and SSH traffic, ICMP echo requests from host 10.2.20.2510.2.20.25 fall through to the implicit deny and are dropped.

Step-by-Step Solution

1
Analyze the configured ACL entries sequentially.
Line 1 permits TCP port 443 traffic from subnet 10.2.20.0/24. Line 2 permits TCP port 22 traffic from host 10.2.20.12.
Sequential top-down matching occurs for incoming packets.
2
Evaluate ICMP traffic from host 10.2.20.25 against the ACL lines.
ICMP packets do not match TCP port 443 or TCP port 22.
ICMP is a Layer 3 protocol distinct from TCP.
3
Apply final ACL processing logic.
The packet falls through to the unwritten `deny ip any any` rule at the bottom of the list and is dropped.
Every Cisco IOS IPv4 access control list concludes with an implicit deny all clause.

Key Concept

ACL Sequential Processing and Implicit Deny Clause
Question 145Question →

An enterprise network policy mandates strict access controls for network engineers managing edge routers. The policy requires that user identity verification and command execution permission checks operate as completely decoupled processes, allowing individual CLI commands to be evaluated independently by a central server after a session is established. Which operational characteristic of TACACS+ satisfies this requirement?

Show answer & explanation

Answer: Complete separation of authentication, authorization, and accounting functions into distinct, modular transactions

Answer

TACACS+ architecture fully decouples authentication, authorization, and accounting, which enables per-command authorization checks during an established administrative session over reliable TCP port 49.
TACACS+ separates authentication, authorization, and accounting into distinct functional processes and uses TCP port 49 for reliable transport. This modular separation enables network devices to send independent authorization requests for individual CLI commands executed during an active administrative session.

Step-by-Step Solution

1
Analyze the policy requirements
The scenario requires decoupled authentication and authorization services to perform per-command authorization checks.
Administrative device access requires fine-grained control over which specific CLI commands a user can run.
2
Compare TACACS+ and RADIUS functional separation mechanics
TACACS+ separates AAA services into modular transactions over TCP port 49, whereas RADIUS combines authentication and authorization into unified transactions over UDP.
Modular functional separation allows a device to request authorization decisions for individual commands without re-authenticating.

Key Concept

TACACS+ vs. RADIUS Functional Architecture (Decoupled AAA vs. Combined Auth/Author)
Question 146Question →

An organization is updating its infrastructure access control policies and mandates Multi-Factor Authentication (MFA) for administrative SSH connections to all core routers. Which combination of credentials satisfies true Multi-Factor Authentication by employing two distinct authentication factor categories?

Show answer & explanation

Answer: A static user password combined with a time-based one-time password (TOTP) generated by a physical keyfob token

Answer

A static user password combined with a time-based one-time password (TOTP) generated by a physical keyfob token
Multi-Factor Authentication (MFA) requires using credentials from at least two distinct authentication categories: Knowledge (something you know, like a password), Possession (something you have, like a physical hardware token), and Inherence (something you are, like biometric scans). Pairing a standard password with a hardware-generated TOTP code combines a knowledge factor with a possession factor.

Step-by-Step Solution

1
Categorize the underlying factor types for authenticating users
Authentication factors are grouped into three primary categories: Knowledge (something you know), Possession (something you have), and Inherence (something you are).
True Multi-Factor Authentication requires combining at least two credentials from different categories.
2
Evaluate the credential pair containing a static password and a physical keyfob TOTP token
The static password is a knowledge factor and the physical token is a possession factor.
Combining knowledge and possession satisfies the requirement for multi-factor authentication.

Key Concept

Authentication Factor Categorization (Knowledge, Possession, Inherence)
Question 147Question →

A network manager is evaluating centralized AAA protocols to secure network infrastructure devices and access points. Which TWO operational characteristics distinguish TACACS+ from RADIUS? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: TACACS+ encrypts the entire packet payload, whereas RADIUS encrypts only the password field.; TACACS+ separates Authentication and Authorization into distinct processes, allowing per-command authorization.

Answer

TACACS+ encrypts the entire packet payload (rather than just the password field) and separates Authentication and Authorization into distinct processes to allow per-command authorization.
TACACS+ provides full-packet payload encryption (enhancing security for administrative traffic) and maintains modular separation of Authentication and Authorization (enabling per-command authorization policies).

Step-by-Step Solution

1
Identify payload encryption behavior for TACACS+ versus RADIUS.
TACACS+ encrypts the entire body of every packet, whereas RADIUS encrypts only the MD5-hashed password attribute.
Full-packet encryption in TACACS+ prevents unauthorized observers from reading usernames, authorization commands, and accounting logs.
2
Analyze functional decoupling of AAA pillars in TACACS+.
TACACS+ decouples authentication from authorization, enabling granular per-command control during administrative CLI sessions.
RADIUS binds authentication and authorization together in single packet exchanges, making per-command authorization impractical.

Key Concept

TACACS+ vs RADIUS Architectural and Security Differences
Question 148Question →

A network administrator needs to implement centralized AAA for managing CLI access to enterprise switches and routers. The organization security policy strictly mandates per-command authorization checks for every command an administrator executes, as well as full-packet encryption for all AAA network communications. Which protocol and operational characteristic fulfill these security requirements?

Show answer & explanation

Answer: TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.

Answer

TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.
TACACS+ uses TCP port 49 and completely decouples authentication, authorization, and accounting. This modularity enables per-command authorization, where every CLI command issued by an operator can be evaluated by the server before execution on the device. Furthermore, TACACS+ encrypts the entire payload of every packet, protecting sensitive configuration data and usernames.

Step-by-Step Solution

1
Analyze the requirement for per-command authorization.
TACACS+ separates Authentication and Authorization into distinct steps, allowing a device to query the AAA server for permission prior to executing each individual command. RADIUS combines Authentication and Authorization into a single response, making per-command authorization impractical.
Functional separation of AAA components determines the capability for granular command authorization.
2
Analyze the requirement for full-packet encryption.
TACACS+ encrypts the entire body of the packet following the header. RADIUS only encrypts the password field within the Access-Request packet, leaving username and authorization attributes in cleartext.
Protocol encryption specifications differ between TACACS+ and RADIUS.
3
Synthesize protocol characteristics to select the correct protocol.
TACACS+ provides both modular AAA separation (enabling per-command authorization) and full-packet encryption, satisfying both criteria.
Only TACACS+ satisfies both administrative access control requirements.

Key Concept

TACACS+ vs RADIUS Protocol Mechanics
Question 149Question →

A network engineer configures a Cisco IOS router with an extended IPv4 Access Control List (ACL) named `SECURE_TRAFFIC` to restrict traffic between internal segments:

text
ip access-list extended SECURE_TRAFFIC
10 permit tcp 172.16.10.0 0.0.0.255 host 172.16.20.10 eq 443
20 deny tcp 172.16.10.0 0.0.0.255 host 172.16.20.10 eq 80

After applying this ACL inbound on interface GigabitEthernet0/0, users in the 172.16.10.0/24172.16.10.0/24 subnet can access the HTTPS service at 172.16.20.10172.16.20.10, but all ICMP pings and traffic to other destinations are dropped. Which configuration change will allow non-HTTP traffic while preserving the configured rules?

Show answer & explanation

Answer: Add the statement `permit ip 172.16.10.0 0.0.0.255 any` at the end of the ACL.

Answer

Add an explicit `permit ip` statement to the end of the ACL to permit non-matching traffic.
Cisco IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the list. In this scenario, HTTPS traffic matches line 10 and is allowed, while HTTP traffic matches line 20 and is blocked. However, ICMP and other non-web traffic fall through to the implicit deny clause. Appending an explicit `permit ip 172.16.10.0 0.0.0.255 any` statement ensures that traffic not specifically matched by lines 10 or 20 is permitted through the interface.

Step-by-Step Solution

1
Analyze the existing ACL statements and implicit behaviors.
Line 10 permits HTTPS (TCP 443), and line 20 denies HTTP (TCP 80). At the end of every Cisco IPv4 ACL, an invisible implicit `deny ip any any` statement exists.
Traffic not explicitly permitted by preceding statements matches the implicit deny statement and is discarded.
2
Determine why ICMP and other protocols are failing.
ICMP and other non-TCP/non-web traffic fail to match lines 10 and 20, falling through to the implicit deny clause.
Without an explicit permit rule at the end, all unlisted protocols and destination IPs are blocked.
3
Identify the proper modification to allow legitimate remaining traffic.
Appending `permit ip 172.16.10.0 0.0.0.255 any` (or `permit ip any any`) allows remaining traffic to pass.
This explicitly permits all other IP traffic originating from the subnet after evaluating the specific HTTPS permit and HTTP deny rules.

Key Concept

Every IPv4 ACL ends with an invisible implicit deny any clause that drops all unmatched traffic unless explicitly permitted.
Question 150Question →

An enterprise network security policy mandates Multi-Factor Authentication for administrative access to core switches. An administrator logs in by entering a static PIN followed by a one-time passcode generated by a physical hardware token. Which statement correctly categorizes the authentication factors used in this scenario?

Show answer & explanation

Answer: It combines a knowledge factor (the static PIN) with a possession factor (the physical hardware token).

Answer

The authentication mechanism combines a knowledge factor (static PIN) with a possession factor (hardware token).
The static PIN is a knowledge factor (something you know), and the hardware token is a possession factor (something you have). Using credentials from two distinct categories forms valid Multi-Factor Authentication (MFA).

Step-by-Step Solution

1
Identify the first credential component used during authentication.
The static PIN is memorized information, which falls under the 'something you know' (knowledge) factor.
Knowledge factors consist of secrets stored in human memory, such as passwords, passphrases, or PINs.
2
Identify the second credential component used during authentication.
The hardware token generates a time-based passcode, proving physical ownership of the device, which falls under the 'something you have' (possession) factor.
Possession factors require holding a physical or digital artifact, such as a hardware dongle, smart card, or registered mobile device.
3
Evaluate whether true multi-factor authentication (MFA) is achieved.
Combining two different factor types (knowledge + possession) satisfies true multi-factor authentication standards.
MFA requires credentials from at least two distinct factor categories (knowledge, possession, inherence).

Key Concept

Multi-Factor Authentication (MFA) Factor Classification
Question 151Question →

In an enterprise network infrastructure, AAA services and security protocols provide identity verification, access control, and activity tracking for administrative sessions. Match each operational requirement or behavioral characteristic on the left with its corresponding AAA framework pillar or security protocol on the right.

Click a left item, then click its matching right item

Items

Determining whether an authenticated network engineer has permission to execute specific configuration commands on a switch.
Tracking and logging the start time, duration, and commands executed during an active CLI maintenance session.
Encrypting only the user password within the Access-Request packet payload while operating over UDP transport.
Encrypting the entire payload body of every communication packet exchanged over TCP port 49.

Matches

Show answer & explanation

Answer

The items correctly match as follows: Authorization corresponds to controlling command execution rights; Accounting corresponds to session duration and command execution logging; RADIUS protocol corresponds to password-only encryption over UDP; TACACS+ protocol corresponds to full packet payload encryption over TCP port 49.
Authorization handles user permissions and command execution rights, while Accounting handles session auditing and activity logs. From a protocol standpoint, RADIUS encrypts only the password using UDP, whereas TACACS+ encrypts the entire payload using TCP port 49.

Step-by-Step Solution

1
Analyze the access control requirement for command execution.
Matches Authorization.
Authorization defines what actions, services, or commands an authenticated entity is permitted to perform.
2
Analyze the logging and reporting requirement for CLI activity.
Matches Accounting.
Accounting records session usage data, timestamping, and user activities for audit trails.
3
Analyze protocol transport and encryption behavior for partial payload protection.
Matches RADIUS protocol.
RADIUS relies on UDP transport and limits its encryption to the user password field.
4
Analyze protocol transport and encryption behavior for full payload protection.
Matches TACACS+ protocol.
TACACS+ uses reliable TCP transport on port 49 and encrypts all packet payloads.

Key Concept

AAA Pillars and AAA Protocol Mechanics (TACACS+ vs RADIUS)
Question 152Question →

A network administrator must configure a Cisco IOS extended IPv4 Access Control List (ACL) to enforce the following security policy requirements:

1. Permit HTTP traffic (TCP port 80) from any host on the 10.1.1.0/2410.1.1.0/24 network to the web server at 192.168.10.50192.168.10.50.
2. Deny all other IP traffic originating specifically from host 10.1.1.2510.1.1.25 to the web server at 192.168.10.50192.168.10.50.
3. Permit all other TCP traffic from the 10.1.1.0/2410.1.1.0/24 network to the 192.168.10.0/24192.168.10.0/24 subnet.
4. Explicitly block all remaining IP traffic from the 10.1.1.0/2410.1.1.0/24 network to the 192.168.10.0/24192.168.10.0/24 subnet.

Arrange the following ACL statements in the correct top-down processing order (from line 1 at the top to line 4 at the bottom) so that the security policy is properly enforced.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The statements must be ordered sequentially from most specific exception to most general catch-all: 1) permit tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80, 2) deny ip host 10.1.1.25 host 192.168.10.50, 3) permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255, and 4) deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255.
Cisco IOS Access Control Lists evaluate entries sequentially from top to bottom. The correct order places the narrowest exception (HTTP permit to host 192.168.10.50) first so that host 10.1.1.25 can still send HTTP traffic. The host-specific deny rule follows immediately to block any non-HTTP traffic from host 10.1.1.25 to 192.168.10.50. Next, the broader subnet-level TCP permit rule allows legitimate TCP applications from the rest of 10.1.1.0/24. Finally, the explicit subnet IP deny statement blocks all other non-TCP IP traffic targeting 192.168.10.0/24.

Step-by-Step Solution

1
Identify the most specific permitted exception in the requirements.
HTTP traffic from 10.1.1.0/2410.1.1.0/24 to host 192.168.10.50192.168.10.50 must be permitted, even if host 10.1.1.2510.1.1.25 sends it.
Cisco ACLs process rules top-down and stop at the first matching statement. Placing HTTP permit statement first guarantees that host 10.1.1.2510.1.1.25 can access HTTP services on 192.168.10.50192.168.10.50.
2
Place the specific host restriction next.
Statement 'deny ip host 10.1.1.25 host 192.168.10.50' is placed in line 2.
Any non-HTTP IP traffic from 10.1.1.2510.1.1.25 to 192.168.10.50192.168.10.50 must be blocked before the general TCP permit rule line evaluates it.
3
Add the broader subnet-wide TCP permit rule.
Statement 'permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255' is placed in line 3.
This allows all remaining TCP connections across the 10.1.1.0/2410.1.1.0/24 and 192.168.10.0/24192.168.10.0/24 subnets for hosts that passed the previous filter checks.
4
Place the subnet-wide IP restriction statement.
Statement 'deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255' is placed in line 4.
This explicitly drops all non-TCP traffic (e.g., UDP or ICMP) targeting 192.168.10.0/24192.168.10.0/24 from 10.1.1.0/2410.1.1.0/24.

Key Concept

Top-down sequential evaluation in Cisco ACLs (specific rules before general rules)
Question 153Question →

During a security compliance audit of a network management architecture, an engineer observes that per-command authorization and granular command accounting cannot be enforced for CLI sessions authenticated via RADIUS. Which protocol characteristic explains this limitation of RADIUS compared to TACACS+?

Show answer & explanation

Answer: RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples them to allow independent per-command authorization requests.

Answer

RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples all three AAA services to allow granular, per-command authorization requests.
The correct answer highlights that RADIUS couples authentication and authorization together during initial access validation, making it impractical for per-command verification. TACACS+ maintains complete modularity between Authentication, Authorization, and Accounting, sending separate authorization packets for every command executed during an administrative session.

Step-by-Step Solution

1
Identify the AAA architectural requirement described in the audit scenario.
The requirement calls for per-command CLI authorization and granular command-level accounting.
Administrative network device management (device administration) often requires verifying each command entered by an engineer against a central policy.
2
Compare RADIUS and TACACS+ operational mechanics for Authorization.
RADIUS binds Authentication and Authorization into one operational exchange (Access-Request / Access-Accept), sending authorization attributes upon initial login. TACACS+ separates Authentication and Authorization into discrete transaction types.
Decoupling authorization allows TACACS+ to query the AAA server for explicit permission prior to executing individual CLI commands.
3
Select the option that accurately reflects protocol separation rules.
The option identifying that RADIUS combines authentication and authorization whereas TACACS+ decouples them explains the limitation.
This structural difference makes TACACS+ optimal for device administration and RADIUS optimal for network access control.

Key Concept

AAA Protocol Functional Separation (TACACS+ vs RADIUS)
Estimated Time:1m 30s
Question 154Question →

An engineer inspects a Cisco IOS router configured with the following extended IPv4 Access Control List (ACL) applied to an interface:

text
ip access-list extended DATA_SEC
10 permit tcp host 172.16.5.10 192.168.1.0 0.0.0.255 eq 22
20 deny ip 172.16.5.0 0.0.0.255 192.168.1.0 0.0.0.255
30 permit ip 172.16.0.0 0.0.255.255 192.168.1.0 0.0.0.255

A workstation with IPv4 address 172.16.5.20 attempts to establish an HTTP connection (TCP port 80) to a server at 192.168.1.50. What action does the router take when evaluating this packet?

Show answer & explanation

Answer: The router drops the packet because it matches sequence line 20.

Answer

The router drops the packet because it matches sequence line 20.
The option stating that the router drops the packet because it matches sequence line 20 is correct. Extended ACLs process rules sequentially from top to bottom. Line 10 does not match because the source address is 172.16.5.20 (not 172.16.5.10) and the port is 80 (not 22). Line 20 matches because its wildcard mask encompasses 172.16.5.20, its destination mask encompasses 192.168.1.50, and the protocol specification 'ip' matches all IPv4 protocols, including TCP. Upon matching line 20, the router executes the deny action and halts further ACL evaluation.

Step-by-Step Solution

1
Evaluate line 10
No match
Line 10 specifically matches source host 172.16.5.10 and destination port 22 (SSH). The incoming packet originates from 172.16.5.20 and targets port 80 (HTTP).
2
Evaluate line 20
Match found (Action: Deny)
Line 20 specifies 'deny ip 172.16.5.0 0.0.0.255 192.168.1.0 0.0.0.255'. The source IP 172.16.5.20 belongs to the 172.16.5.0/24 network, the destination 192.168.1.50 belongs to 192.168.1.0/24, and the 'ip' keyword covers TCP port 80.
3
Determine final disposition
Packet dropped immediately
Once a match occurs in a Cisco IOS IPv4 ACL, processing stops immediately. Line 30 and the implicit deny clause are not evaluated.

Key Concept

Extended IPv4 ACL Top-Down Sequential Evaluation and Protocol Scope
Estimated Time:1m 15s
Question 155Question →

An enterprise network operations team is evaluating centralized security protocols for authenticating and managing access across core infrastructure devices. Which TWO operational characteristics distinguish TACACS+ from RADIUS? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: TACACS+ operates over connection-oriented TCP port 49, whereas RADIUS utilizes connectionless UDP ports 1812 and 1813.; TACACS+ modularly decouples authentication from authorization, whereas RADIUS merges authentication and authorization into unified packet flows.

Answer

TACACS+ operates over TCP port 49 while RADIUS uses UDP ports 1812 and 1813, and TACACS+ modularly decouples authentication from authorization while RADIUS merges them into unified packet flows.
TACACS+ uses connection-oriented TCP port 49 and provides modular separation of authentication and authorization functions, allowing granular control over administrative commands. In contrast, RADIUS uses UDP ports 1812/1813 and combines authentication and authorization.

Step-by-Step Solution

1
Analyze transport protocol selection and default port assignments for TACACS+ and RADIUS.
TACACS+ uses TCP port 49 for reliable packet transport, while RADIUS operates over UDP using port 1812 for authentication/authorization and port 1813 for accounting.
TCP guarantees receipt notification and session establishment, which is suited for device management traffic.
2
Compare functional architecture and separation of AAA pillars across both protocols.
TACACS+ separates authentication, authorization, and accounting into distinct mechanisms, whereas RADIUS combines authentication and authorization into unified exchanges.
Decoupling authorization from authentication allows granular per-command permissions during active CLI administration sessions.

Key Concept

Protocol mechanics and functional differences between TACACS+ and RADIUS in enterprise AAA implementations.
Question 156Question →

A network administrator configures a Cisco IOS router with the following extended IPv4 access control list (ACL) applied in the outbound direction on interface GigabitEthernet0/1:

text
ip access-list extended OUTBOUND_FILTER
permit tcp 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22
deny ip host 172.16.20.5 192.168.1.0 0.0.0.255
permit ip 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255

Which two statements correctly describe how traffic sent through GigabitEthernet0/1 will be evaluated by this access list?

Select all that apply

Show answer & explanation

Answer: SSH traffic originating from host 172.16.20.5 and destined for 192.168.1.50 is permitted.; Traffic originating from host 172.16.20.10 and destined for an external address of 8.8.8.8 is dropped.

Answer

SSH traffic from host 172.16.20.5 to 192.168.1.50 is permitted because it matches the top rule first, and traffic from host 172.16.20.10 to 8.8.8.8 is dropped due to the implicit deny at the end of the ACL.
Cisco IPv4 ACLs evaluate statements sequentially in top-down order and stop processing as soon as a match is found. For SSH traffic from host 172.16.20.5, line 1 matches because SSH uses TCP port 22, so the packet is permitted immediately before line 2 can deny it. For traffic destined for 8.8.8.8, none of the explicit rules match the destination subnet, so the packet hits the implicit deny statement at the end of the list and is dropped.

Step-by-Step Solution

1
Evaluate top-down logic for SSH traffic from 172.16.20.5 to 192.168.1.50 (destination port 22)
The packet matches line 1 ('permit tcp 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22'). The router permits the packet immediately without checking further lines.
Cisco ACLs process rules sequentially from top to bottom and terminate evaluation upon the first successful match.
2
Evaluate non-matching traffic destined for an unlisted destination address (8.8.8.8)
The packet fails matching conditions for lines 1, 2, and 3 because the destination address 8.8.8.8 does not match 192.168.1.0 0.0.0.255.
All unlisted traffic falls through to the unwritten, mandatory 'deny ip any any' rule present at the end of every IPv4 ACL.

Key Concept

Sequential Top-Down ACL Evaluation and Implicit Deny Behavior
Question 157Question →

A network security technician is reviewing the AAA architecture for managing network switches. The design mandates that administrative command authorization must be handled independently from initial authentication, and all traffic between the network access server and the AAA server must encrypt the entire packet payload. Which protocol should be deployed to satisfy these security requirements?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct choice because it decouples authentication from authorization and encrypts the entire packet payload between the client device and the server.
TACACS+ meets both criteria specified in the scenario. It completely separates authentication, authorization, and accounting functions—enabling granular per-command authorization—and encrypts the entire packet payload sent across the network.

Step-by-Step Solution

1
Analyze requirement 1: Separation of authentication and command authorization.
TACACS+ modularly separates authentication, authorization, and accounting, allowing granular command authorization per user. RADIUS combines authentication and authorization into one process.
Administrative device access requires strict per-command authorization separate from logging in.
2
Analyze requirement 2: Full packet payload encryption.
TACACS+ encrypts the entire body of the packet. RADIUS encrypts only the password attribute in the access-request packet.
Encrypting the entire body ensures usernames, commands, and operational parameters are protected across the network.

Key Concept

TACACS+ vs RADIUS protocol capabilities and functional separation in the AAA framework
Estimated Time:1m 0s
Question 158Question →

Match each AAA framework component or protocol characteristic on the left with its correct functional description on the right.

Click a left item, then click its matching right item

Items

Authentication
Authorization
Accounting
TACACS+ Payload Security

Matches

Show answer & explanation

Answer

Authentication matches identity verification; Authorization matches permission control for commands and resources; Accounting matches activity logging and tracking; TACACS+ Payload Security matches encrypting the entire packet body.
Authentication verifies identity, Authorization controls access permissions and allowed CLI commands, Accounting logs user activity for security compliance, and TACACS+ encrypts the entire packet payload.

Step-by-Step Solution

1
Identify the primary function of Authentication within the AAA framework.
Authentication answers 'Who are you?' by verifying user credentials such as usernames and passwords.
It acts as the initial control point to validate user identity prior to granting system entry.
2
Identify the primary function of Authorization.
Authorization answers 'What can you do?' by determining privilege levels and permitted commands.
Once identity is established, privilege boundaries dictate accessible resources.
3
Identify the primary function of Accounting.
Accounting answers 'What did you do?' by collecting statistics, command history, and session durations.
Security compliance mandates keeping track of active sessions and administrative actions.
4
Analyze TACACS+ encryption behavior.
TACACS+ encrypts the entire payload body of each frame sent over TCP port 49.
This provides end-to-end payload confidentiality, contrasting with RADIUS which encrypts only the password field.

Key Concept

AAA Framework Pillars and TACACS+ vs RADIUS Security Mechanics
Question 159Question →

A network administrator must configure a Cisco IOS extended IPv4 Access Control List (ACL) numbered 105 to enforce the following security policy for outbound traffic from an internal subnet:

1. Permit HTTPS traffic originating from subnet 192.168.10.0/24 destined to the database server at 10.0.0.50.
2. Deny all other TCP traffic originating from subnet 192.168.10.0/24 destined to the database server at 10.0.0.50.
3. Permit all remaining IP traffic originating from subnet 192.168.10.0/24 to any destination.

Arrange the ACL statements in the correct top-down sequential order required to successfully enforce this security policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of statements from top to bottom is: 1) access-list 105 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 443, 2) access-list 105 deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50, 3) access-list 105 permit ip 192.168.10.0 0.0.0.255 any, 4) (Implicit deny ip any any).
Cisco IPv4 access control lists execute line-by-line starting from the top entry (lowest sequence number) and stop evaluating as soon as a match occurs. Therefore, rules must strictly proceed from most specific (permitting HTTPS port 443 to the single host 10.0.0.50) to moderately specific (denying all other TCP to host 10.0.0.50), followed by broader subnet access (permitting all IP from 192.168.10.0/24), and finally concluding with the built-in implicit deny rule.

Step-by-Step Solution

1
Identify the most specific requirement
HTTPS traffic (TCP port 443) from 192.168.10.0/24 to host 10.0.0.50 is the most narrow requirement.
Cisco ACLs process sequentially top-down; specific permit rules must precede broader deny rules to prevent legitimate traffic from being matched early and dropped.
2
Place the specific host/port restriction next
Denying general TCP traffic from 192.168.10.0/24 to host 10.0.0.50 follows the HTTPS permit rule.
This blocks all other TCP application ports destined for 10.0.0.50 without affecting HTTPS traffic matched in step 1.
3
Place the general subnet permit rule
Permitting all IP traffic from 192.168.10.0/24 to any destination is placed after host-specific TCP rules.
This guarantees other destinations and protocols (such as ICMP or traffic to other servers) from subnet 192.168.10.0/24 are permitted.
4
Account for implicit ACL behavior
The implicit deny ip any any statement automatically resides at the end of the access list.
Cisco IOS automatically appends an invisible implicit deny to the end of every ACL, dropping any traffic that fails to match any explicit permit entries above.

Key Concept

Top-Down Sequential Processing and Specific-to-General Rule Ordering in Cisco IPv4 Extended ACLs
Question 160Question →

A network engineer configures an extended IPv4 Access Control List (ACL) on a router to allow web access from an internal client subnet (172.16.20.0/24172.16.20.0/24) to a web server at 192.168.1.100192.168.1.100. The router has the following configuration lines applied:

text
access-list 105 permit tcp 172.16.20.0 0.0.0.255 host 192.168.1.100 eq 80
access-list 105 permit tcp 172.16.20.0 0.0.0.255 host 192.168.1.100 eq 443

When a host with IP address 172.16.20.15172.16.20.15 sends ICMP echo request (ping) packets to 192.168.1.100192.168.1.100, how does the router process this traffic?

Show answer & explanation

Answer: The router drops the ICMP packets because they do not match any explicit permit entry and are filtered by the implicit deny statement at the end of the ACL.

Answer

The router drops the ICMP packets because they do not match any explicit permit statement and are dropped by the implicit deny clause.
Cisco IPv4 ACLs evaluate traffic line-by-line in sequential order. Extended ACLs require exact protocol matching. Because the configuration only contains permit statements for TCP (ports 80 and 443), ICMP packets fail to match any entry. Traffic that does not match any explicit rule is dropped by the mandatory implicit deny clause at the end of the ACL.

Step-by-Step Solution

1
Examine the incoming packet characteristics against the configured extended ACL rules.
The packet protocol is ICMP, the source address is 172.16.20.15172.16.20.15, and the destination address is 192.168.1.100192.168.1.100.
Extended ACLs check the Layer 3 protocol type, source address, destination address, and Layer 4 port numbers.
2
Evaluate the packet sequentially against line 1 and line 2 of access-list 105.
Line 1 permits TCP port 80; line 2 permits TCP port 443. Neither line matches ICMP traffic.
ICMP is an IP protocol distinct from TCP. Protocol matching is strict in Cisco IOS extended ACLs.
3
Evaluate the packet against the end of the access list.
The packet hits the invisible implicit deny statement (implicit deny ip any any) and is discarded by the router.
Cisco IOS automatically appends an implicit deny clause to the end of every IPv4 access control list.

Key Concept

ACL Sequential Evaluation and the Implicit Deny Clause
PreviousPage 8 / 15Next
Security Fundamentals Practice Questions — Cisco CCNA — Page 8 | Examkin