Examkin

Tüm alıştırma soruları

203 soru

Tüm türler1,987Çoktan seçmeli1,020Çoklu seçim452Sayısal18Eşleştirme229Sıralama203Boşluk doldurma22Kısa cevap43
Soru 201Soru →

A Cisco router receives an IPv4 packet destined for 172.16.10.45172.16.10.45. Place the routing table lookup and packet forwarding steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct forwarding sequence begins with parsing the packet header to extract the destination IP, searching the routing table using longest prefix match logic, selecting the most specific matching prefix, identifying the next-hop IP or exit interface, and finally encapsulating the packet into a Layer 2 frame for egress transmission.
The correct order follows standard Cisco IOS router packet forwarding logic: extracting the destination IPv4 address, evaluating routing table prefixes, applying the longest prefix match (LPM) rule to select the best route, resolving the next-hop IP address or exit interface, and performing Layer 2 frame encapsulation prior to egress.

Adım Adım Çözüm

1
Parse packet header
Destination IPv4 address extracted
The router requires the destination address to perform a routing lookup.
2
Perform routing table lookup
Candidate matching routes identified
The routing table contains network prefixes that must be checked against the destination IP.
3
Apply Longest Prefix Match (LPM)
Select most specific route entry
When multiple routes match the destination, the prefix with the most matching leading bits (longest subnet mask) is selected.
4
Resolve forwarding details
Determine next-hop IP address or egress interface
The selected route specifies the exact forwarding path towards the destination.
5
Layer 2 Encapsulation and Egress
Frame transmitted out the outbound interface
Layer 2 headers (such as Ethernet MAC headers) are constructed based on next-hop ARP table resolution before physical transmission.

Anahtar Kavram

IPv4 Routing Table Lookup and Longest Prefix Match Forwarding Logic
Soru 202Soru →

A network engineer needs to configure secure SSH remote management on a Cisco IOS XE router using local database authentication. Place the CLI configuration steps in the correct logical and CLI dependency order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps is: 1) Configure the IP domain name (`ip domain name enterprise.lab`), 2) Generate the RSA key pair (`crypto key generate rsa general-keys modulus 2048`), 3) Create a local user account with secret encryption (`username netadmin secret S3cur3!Pass2026`), 4) Enter VTY line configuration submode (`line vty 0 4`), and 5) Enforce local login and SSH protocol access (`login local` and `transport input ssh`).
To successfully enable SSH remote access authenticated by the local user database, CLI commands must follow specific mode hierarchy and operational dependencies. First, `ip domain name` must be configured in global configuration mode to form the system FQDN. Next, `crypto key generate rsa` creates the encryption keys required to initialize SSH server functionality. Third, a local user account is configured with `username secret`. Fourth, line configuration mode is entered via `line vty 0 4`. Finally, `login local` and `transport input ssh` are applied to enforce local database authentication and disallow unencrypted transport.

Adım Adım Çözüm

1
Set the domain name in global configuration mode.
Defines the domain context required for cryptographic key creation.
Cisco IOS XE constructs the default RSA key pair name using host.domain syntax; without a domain name, SSH key generation fails or requests manual domain assignment.
2
Generate RSA keys for SSH encryption.
Activates the SSH server subsystem on the router.
SSH requires asymmetric key pairs to establish secure encrypted tunnels for remote sessions.
3
Define local database user credentials.
Adds an administrative username with a Type 5 or Type 8/9 secret hash to the local running configuration.
Local password authentication relies on pre-created accounts in the local device database.
4
Enter line VTY configuration submode (`line vty 0 4`).
Changes prompt context to line configuration mode.
Line-specific access controls must be executed within the target line context.
5
Apply `login local` and `transport input ssh` commands.
Enforces local database credential checking and blocks unencrypted protocols like Telnet.
`login local` instructs VTY lines to authenticate inbound connections against the local user database, while `transport input ssh` secures transport security.

Anahtar Kavram

Cisco IOS XE SSH configuration sequence and local database authentication dependencies
Tahmini Süre:1m 30s
Soru 203Soru →

A network administrator is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco router to regulate traffic sent from the internal LAN (192.168.1.0/24) to an application server (10.0.0.10).

The access policy requires:
1. Host 192.168.1.50 must be allowed full IP access to the application server (including HTTP).
2. All other hosts on the 192.168.1.0/24 subnet must be blocked from accessing HTTP (TCP port 80) on the application server.
3. All other IP traffic originating from the 192.168.1.0/24 subnet to the application server must be permitted.

Arrange the ACL statements in the correct top-down execution order to achieve this security policy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from top to bottom is: 1) permit ip host 192.168.1.50 host 10.0.0.10, 2) deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80, 3) permit ip 192.168.1.0 0.0.0.255 host 10.0.0.10, and 4) implicit deny ip any any.
Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a match occurs, stopping further evaluation. To satisfy all requirements: 1) The host-specific permit statement for 192.168.1.50 must be placed first so its HTTP traffic is allowed before subnet rules apply. 2) The HTTP deny rule for subnet 192.168.1.0/24 must be placed second so HTTP packets from all other hosts in the subnet are caught and dropped. 3) The broader subnet IP permit statement must be placed third to permit non-HTTP traffic. 4) The implicit deny statement operates at the bottom, dropping any other un-matched traffic.

Adım Adım Çözüm

1
Place specific host exception rules at the top of the ACL.
Host 192.168.1.50 is permitted full IP access before any subnet-level restrictions are evaluated.
Cisco IOS ACLs evaluate top-down and stop processing on the first match. Host 192.168.1.50 must be matched first so its HTTP traffic is not dropped by the subnet HTTP block.
2
Place specific service block rules for the subnet after host exceptions.
HTTP traffic (TCP port 80) from subnet 192.168.1.0/24 to 10.0.0.10 is denied.
This rule must appear before the general permit rule for the subnet, ensuring HTTP traffic is filtered out first.
3
Place general subnet permit rules after specific service deny rules.
All remaining IP traffic from subnet 192.168.1.0/24 to 10.0.0.10 is permitted.
Placing this rule after the HTTP deny rule ensures non-HTTP traffic from the subnet passes successfully.
4
Rely on the implicit deny at the end of the ACL.
All other traffic not matching the explicit rules is dropped.
Cisco ACLs automatically append an unwritten implicit deny statement at the end of every list.

Anahtar Kavram

Top-down sequential processing of IPv4 ACLs and ordering from most specific to least specific statements.
ÖncekiSayfa 11 / 11
Tüm alıştırma soruları — Cisco CCNA | Examkin