Examkin

Tüm alıştırma soruları

1987 soru

Tüm türler1,987Çoktan seçmeli1,020Çoklu seçim452Sayısal18Eşleştirme229Sıralama203Boşluk doldurma22Kısa cevap43
Soru 1981Soru →

A network administrator configures a dual-mode WLAN on a Cisco Wireless LAN Controller (WLC) intended to support both modern WPA3-Personal devices and legacy WPA2-Personal client hardware during a corporate migration. WPA3-capable endpoints connect seamlessly; however, older WPA2-only devices consistently fail during the 802.11 association phase and cannot establish network connectivity. Frame captures reveal that the legacy stations receive association responses containing mandatory Protected Management Frames (PMF/802.11w) requirements. Which WLC configuration modification resolves this association failure for legacy endpoints while continuing to support WPA3-Personal clients?

Cevabı ve açıklamayı göster

Cevap: Set Management Frame Protection (MFP/PMF) to Optional (Capable) on the WLAN profile, allowing legacy stations without 802.11w support to associate.

Cevap

Setting Management Frame Protection (MFP/PMF) to Optional (Capable) on the WLAN profile allows legacy stations without 802.11w support to associate.
The choice stating to set Management Frame Protection (MFP/PMF) to Optional (Capable) is correct because IEEE 802.11w PMF is mandatory in WPA3. When configuring WPA3-Personal Transition Mode to accommodate legacy WPA2 devices, setting PMF to Required prevents legacy clients that lack PMF code or hardware support from completing the 802.11 association process. Changing PMF to Optional enables WPA3 endpoints to use PMF while permitting WPA2 endpoints to connect without it.

Adım Adım Çözüm

1
Analyze the WPA3-Personal vs WPA2-Personal migration requirements.
WPA3 mandates Protected Management Frames (PMF / IEEE 802.11w) and Simultaneous Authentication of Equals (SAE).
WPA3 security standards enforce PMF to prevent management frame spoofing attacks such as deauthentication attacks.
2
Evaluate the cause of the association failure for legacy WPA2 devices in transition mode.
Setting PMF to Required on the WLC forces all associating clients to support IEEE 802.11w. Legacy devices lacking 802.11w capabilities reject or are rejected during the association frame exchange.
Transition mode requires backward-compatible settings for optional feature negotiation.
3
Determine the correct WLC configuration adjustment.
Configuring PMF as Optional (Capable) on the WLAN allows WPA3 clients to negotiate PMF while permitting legacy WPA2 clients lacking 802.11w to complete association.
This configuration balances the strict security requirements of WPA3 with the physical hardware limitations of legacy WPA2 endpoints.

Anahtar Kavram

WPA3 Transition Mode and Protected Management Frames (PMF / IEEE 802.11w) compatibility requirements
Soru 1982Soru →

A network administrator configures port security on access interface GigabitEthernet0/1 of a Cisco Catalyst switch by executing `switchport port-security` and `switchport port-security mac-address sticky`. Hosts connect successfully and their MAC addresses are dynamically learned by the switch. However, after an unscheduled switch reboot, the administrator discovers that the dynamically learned MAC addresses were removed and hosts must re-trigger learning. Which operational step was omitted prior to the switch restart?

Cevabı ve açıklamayı göster

Cevap: Saving the running configuration to the startup configuration in NVRAM using the `copy running-config startup-config` command.

Cevap

The network administrator omitted saving the running configuration to the startup configuration using the `copy running-config startup-config` command.
When `switchport port-security mac-address sticky` is configured, the switch dynamically adds learned MAC addresses into the active `running-config` file. Because `running-config` resides in volatile RAM memory, any dynamically learned MAC addresses are lost upon a reboot unless the administrator explicitly copies the running configuration to the startup configuration using `copy running-config startup-config` (or `write memory`).

Adım Adım Çözüm

1
Analyze how sticky MAC addresses operate in Cisco Port Security.
When sticky MAC learning is enabled (`switchport port-security mac-address sticky`), the switch dynamically learns MAC addresses and writes them directly into the running configuration (`running-config`) as static-like entries.
Sticky MAC learning converts dynamically learned addresses into running configuration entries.
2
Evaluate the behavior of running-config during a switch reload.
RAM memory housing `running-config` is volatile. Unless `running-config` is saved to `startup-config` in NVRAM, all unsaved dynamic sticky MAC entries are erased when the switch reboots.
Volatile memory contents do not survive system reboots.
3
Identify the missing command required for persistence.
Executing `copy running-config startup-config` (or `write memory`) copies the learned sticky MAC entries into non-volatile memory so they load automatically upon boot.
Saving the configuration persists sticky MAC addresses across reboots.

Anahtar Kavram

Port Security Sticky MAC Persistence across Switch Reboots
Soru 1983Soru →

A network security engineer is configuring digital certificate enrollment on a Cisco IOS router to establish secure IPsec VPN tunnels. Before submitting a Certificate Signing Request (CSR) to an enterprise Certificate Authority (CA), which item must be generated directly on the local router?

Cevabı ve açıklamayı göster

Cevap: An asymmetric public and private key pair

Cevap

An asymmetric public and private key pair must be generated on the local router prior to creating and submitting the Certificate Signing Request (CSR).
In Public Key Infrastructure (PKI) enrollment, an endpoint must generate its own asymmetric public/private key pair locally. The private key is securely stored in local memory/NVRAM and never transmitted, while the public key is packaged into the Certificate Signing Request (CSR) sent to the Certificate Authority (CA) for signing.

Adım Adım Çözüm

1
Identify the initial step in the Public Key Infrastructure (PKI) enrollment workflow on a Cisco device.
The router must generate an RSA or ECDSA asymmetric key pair locally.
The private key must never leave the local device to maintain security integrity.
2
Construct the Certificate Signing Request (CSR).
The router embeds its newly generated public key and identity information (Subject Name/SAN) into the CSR structure.
The CA requires the public key to embed it into the signed X.509 identity certificate.
3
Submit the CSR to the Certificate Authority (CA).
The CA validates identity details and issues the final signed identity certificate back to the router.
The CA signs the public key and identity data using its own private key to establish trust.

Anahtar Kavram

PKI Certificate Signing Request (CSR) and Local Key Pair Generation
Soru 1984Soru →

A security policy requires that all locally configured administrative accounts on Cisco network devices store passwords using strong one-way cryptographic hashing instead of reversible encryption. During an audit, an engineer inspects a switch configuration and discovers the command `username netadmin password 7 0822455D0A16`. Which action must the engineer take to bring this account configuration into compliance with the security policy?

Cevabı ve açıklamayı göster

Cevap: Reconfigure the account using the `username netadmin secret` command so the password is saved using a one-way hash algorithm.

Cevap

Reconfigure the account using the `username netadmin secret` command so the password is saved using a one-way hash algorithm.
Replacing the configuration with `username netadmin secret` ensures that Cisco IOS stores the password using a strong one-way hash (such as Type 5 MD5 or Type 8/9 SHA-256/scrypt). Because it is a one-way function, the original password cannot be decrypted from the configuration file, satisfying the security policy.

Adım Adım Çözüm

1
Analyze the existing password type in the device configuration.
The configuration entry uses `password 7`, which indicates Cisco Type 7 weak reversible encryption.
Type 7 encryption uses a simple Vigenère cipher that can be instantly decrypted using publicly available tools.
2
Identify the command required to store local account passwords securely as one-way hashes.
The `username <name> secret <password>` syntax creates a one-way cryptographic hash (Type 5 MD5, Type 8 PBKDF2 with SHA-256, or Type 9 scrypt).
One-way hashing prevents administrative passwords from being reversed or recovered if the configuration file is exposed.

Anahtar Kavram

Cisco IOS Password Storage (Type 7 reversible encryption vs. Type 5/8/9 one-way secret hashes)
Soru 1985Soru →

A network administrator configures an IPv4 standard access control list on a Cisco router and applies it inbound on interface GigabitEthernet0/1:

text
access-list 15 permit host 172.16.20.50
access-list 15 permit 172.16.30.0 0.0.0.255

A technician attempts to send traffic through interface GigabitEthernet0/1 from host 172.16.20.51 destined for a server on an internal network. The traffic is dropped by the router. Which statement accurately explains why traffic from host 172.16.20.51 is dropped?

Cevabı ve açıklamayı göster

Cevap: Traffic from host 172.16.20.51 does not match any explicit permit entry in ACL 15 and is dropped by the implicit deny statement at the end of the access list.

Cevap

Traffic from host 172.16.20.51 does not match any explicit permit entry in ACL 15 and is dropped by the implicit deny statement at the end of the access list.
In Cisco IOS IPv4 Access Control Lists, statements are processed sequentially from top to bottom. If incoming packet headers do not match any explicit permit or deny statement in the list, the traffic reaches the end of the ACL where an unwritten implicit deny clause ('deny any') drops the packet.

Adım Adım Çözüm

1
Evaluate host IP address 172.16.20.51 against the first ACL line: access-list 15 permit host 172.16.20.50
No match (172.16.20.51 does not equal 172.16.20.50). Proceed to line 2.
Sequential top-down ACL processing rules.
2
Evaluate 172.16.20.51 against the second ACL line: access-list 15 permit 172.16.30.0 0.0.0.255
No match (172.16.20.51 is in subnet 172.16.20.0/24, not 172.16.30.0/24). Proceed past the last explicit line.
Wildcard mask 0.0.0.255 requires exact matching on the first three octets (172.16.30).
3
Determine the action taken by the implicit default mechanism at the end of the ACL.
Traffic is dropped.
Every IPv4 ACL in Cisco IOS ends with an invisible, unwritten 'deny ip any any' (or 'deny any' for standard ACLs).

Anahtar Kavram

Implicit Deny Clause in Cisco IPv4 ACLs
Soru 1986Soru →

A network engineer is selecting a protocol to manage administrative CLI access to enterprise routers. The security policy mandates two key capabilities: full-packet payload encryption for all AAA transactions and the independent authorization of individual executive commands after initial login authentication. Which protocol fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: TACACS+, because it encrypts the entire packet payload and separates authentication and authorization functions.

Cevap

TACACS+, because it encrypts the entire packet payload and separates authentication and authorization functions.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49 and is optimized for device administration. It encrypts the entire payload of every packet (except the standard header) and separates AAA into three distinct, modular components. This modularity allows an administrator to authenticate a user once and then perform independent authorization checks for each CLI command entered.

Adım Adım Çözüm

1
Analyze encryption requirements specified in the security policy.
Full-packet encryption is required. TACACS+ encrypts the entire body of the packet, whereas RADIUS only encrypts the password attribute.
Protecting administrative sessions against payload inspection requires encrypting all transaction data.
2
Analyze authorization architecture requirements.
Per-command authorization requires independent authorization functionality separate from authentication. TACACS+ modularly separates Authentication, Authorization, and Accounting.
RADIUS binds authentication and authorization together in single exchange packets (Access-Request/Accept), making granular per-command CLI authorization impractical.
3
Synthesize protocol characteristics to select the compliant protocol.
TACACS+ is the correct choice because it fulfills both full-payload encryption and decoupled authorization capabilities.
TACACS+ is designed specifically for router and switch device administration (Cisco TACACS+ architecture).

Anahtar Kavram

AAA Architectural Differences between TACACS+ and RADIUS
Soru 1987Soru →

A network technician is inspecting authentication behavior on a newly deployed Wi-Fi network configured for personal use. The security policy mandates protection against passive eavesdropping and offline password-dictionary attacks by utilizing a Dragonfly Key Exchange during association. Which wireless security protocol mechanism provides this specific key exchange functionality?

Cevabı ve açıklamayı göster

Cevap: Simultaneous Authentication of Equals (SAE)

Cevap

Simultaneous Authentication of Equals (SAE)
Simultaneous Authentication of Equals (SAE) is the key exchange mechanism specified in WPA3-Personal. Built upon the Dragonfly Key Exchange protocol, SAE establishes a secure cryptographic key between the client and access point without revealing the passphrase, rendering captured authentication traffic immune to offline dictionary brute-force attempts.

Adım Adım Çözüm

1
Identify the primary requirement in the scenario
The scenario requires a wireless security mechanism that uses Dragonfly Key Exchange to prevent offline dictionary attacks in a personal Wi-Fi deployment.
WPA3-Personal replaces the vulnerable WPA2 Pre-Shared Key (PSK) handshake with a secure zero-knowledge proof exchange.
2
Evaluate the key exchange protocol associated with WPA3-Personal
Simultaneous Authentication of Equals (SAE) is the standard protocol defined in IEEE 802.11-2016 / WPA3 for secure peer-to-peer key agreement using Dragonfly algorithm cryptography.
SAE guarantees forward secrecy and prevents brute-force dictionary attacks even when weak passwords are used.

Anahtar Kavram

WPA3-Personal Key Exchange via SAE
ÖncekiSayfa 100 / 100
Tüm alıştırma soruları — Cisco CCNA | Examkin