Examkin

Soru

Zorluk: ZorKey Security Concepts, Threats, Vulnerabilities, and Mitigations

During a security audit of an enterprise network infrastructure, an engineer reviews several identified security vulnerabilities and proposed mitigation steps across administrative access, ACL filtering, and switchport security. Which of the following correctly pairs an identified security threat or vulnerability with its proper mitigation strategy?

  1. To mitigate eavesdropping and tampering of administrative command authorization, deploy TACACS+ for AAA because TACACS+ encrypts the entire packet payload, unlike RADIUS which encrypts only the password.Cevap
  2. B
    To mitigate unauthorized administrative command execution, reconfigure RADIUS because RADIUS encrypts the complete packet payload and decouples authentication from individual command authorization.
  3. C
    To restrict administrative VTY line access to specific management subnets, apply an IPv4 access list containing permit statements for authorized subnets, relying on the implicit permit at the end of the ACL to allow all unlisted management protocols.
  4. D
    To prevent unauthorized hosts from connecting to access ports across switch reboots, configure port security with sticky MAC learning without executing the copy running-config startup-config command.

Cevap

Deploying TACACS+ for AAA correctly mitigates eavesdropping on administrative authorization because TACACS+ encrypts the complete body of every packet and separates authentication from authorization, whereas RADIUS encrypts only the password field.
Deploying TACACS+ is the correct mitigation for administrative eavesdropping because TACACS+ encrypts the complete body of every packet and separates authentication, authorization, and accounting functions, allowing granular command-level authorization in ciphertext over TCP.

Adım Adım Çözüm

1
Analyze protocol encryption characteristics for administrative access security.
TACACS+ uses TCP port 49 and encrypts the entire payload of every packet. RADIUS uses UDP ports 1812/1813 (or 1645/1646) and encrypts only the password attribute.
Cleartext command authorization payloads in RADIUS expose administrative operations to network sniffing.
2
Evaluate access control list behavior.
Cisco IPv4 ACLs feature an invisible implicit 'deny ip any any' at the end of every list.
Relying on an assumed implicit permit would lead to unexpected blocking of desired traffic or misunderstanding of ACL flow.
3
Evaluate port security persistent MAC address learning.
Sticky MAC learning writes dynamically discovered MAC addresses into the running-config file in RAM.
Failing to save running-config to startup-config causes all sticky MAC bindings to disappear when the switch restarts.

Anahtar Kavram

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

Bu konudan daha fazla soru