Tüm alıştırma soruları

A network administrator configures a Cisco IOS router to restrict access to a financial database server ($192.168.50.100/32$) from the HR subnet ($192.168.10.0/24$). All other traffic between subnets must be permitted. The administrator applies the following access list in the inbound direction on interface GigabitEthernet0/0:

text
ip access-list extended FILTER_HR
deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100

After applying this ACL, users report that all traffic targeting any server in the $192.168.50.0/24$ network is being dropped, including traffic from non-HR subnets. Which configuration change will resolve the issue and permit intended traffic?

An organization configures a remote access VPN solution using the Cisco AnyConnect Secure Mobility Client for mobile employees. To conserve corporate headquarter bandwidth, the network administrator must enable a feature that encrypts and routes traffic destined for internal corporate subnets through the VPN tunnel, while permitting general internet traffic to access the internet directly via the remote user's local network connection. Which VPN feature should the administrator configure to satisfy this requirement?

A network administrator is evaluating First Hop Redundancy Protocols (FHRPs) for deployment across enterprise campus VLANs. The engineering team requires a precise comparison of HSRPv2 and VRRPv2 operational mechanics regarding multicast communication, virtual IP assignment, and role terminology. Which two statements accurately describe the differences and similarities between HSRPv2 and VRRPv2?

A network administrator is deploying SSHv2 on a newly installed Cisco IOS branch gateway router named BR-GW01. Place the required CLI configuration tasks in the correct logical execution sequence from initial global configuration mode to final line security binding.

A network administrator configures a Cisco IOS switch for secure management access. The following excerpt is retrieved from the running configuration:

text
username secadmin privilege 15 secret 8 $8$ k9A$eP2xL1...
service password-encryption
!
line vty 0 4
transport input ssh
login

When a network engineer attempts to establish an SSH session using the `secadmin` account credentials, the authentication attempt is rejected. Which configuration change must be applied to line vty 0 4 to allow authentication using the local user database?

Match each VPN deployment characteristic or operational mode on the left with its corresponding VPN technology concept on the right.

An enterprise network uses a centralized DHCP server located at IP address $172.16.10.100$ in VLAN 10. Clients in VLAN 20 ($172.16.20.0/24$) are connected to a router via subinterface `GigabitEthernet0/0.20` ($172.16.20.1/24$), while the DHCP server connects to subinterface `GigabitEthernet0/0.10` ($172.16.10.1/24$). Hosts in VLAN 20 are currently unable to acquire IP addresses dynamically. Which configuration command must be applied under the `GigabitEthernet0/0.20` interface to forward DHCP broadcasts from VLAN 20 hosts to the central DHCP server?

An administrator on a campus core switch named Core-SW1 is configuring SSH for secure management access. The administrator sets a hostname of Core-SW1 and attempts to run the command `crypto key generate rsa`, but receives the system message: `% Please define a domain-name first.` Which configuration command must be entered in global configuration mode to resolve this issue and allow key generation?

An organization is designing the physical security and security program elements for a newly constructed enterprise facility housing core network hardware and server racks. Which two measures represent physical access controls or physical security program elements? (Select two.)

An enterprise organization is updating its infrastructure security baseline to comply with zero-trust architecture guidelines. The network security team is establishing policies governing administrative SSH access to core switches and 802.1X EAP-TLS client authentication across corporate wireless networks. Which TWO of the following implementation details correctly align with Cisco recommended standards for multi-factor authentication (MFA) factor classification and Public Key Infrastructure (PKI) digital certificate validation? (Choose two.)

A network security administrator must perform a local password recovery procedure on a Cisco IOS router after administrative credentials were lost. Arrange the procedural steps in the correct chronological order required to restore administrative access without losing the active device configuration.

A network engineer is configuring IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which of the following statements regarding the operation and behavior of IPv4 ACLs are correct? (Select TWO.)

A network engineer enables preemption on router R1 (configured with HSRP priority $120$) while router R2 (configured with HSRP priority $100$) is currently acting as the Active gateway for HSRP Group 1. In what chronological sequence do the protocol events occur as router R1 takes over the Active role?

A network administrator is configuring secure management access on a newly deployed access switch named SW-ACCESS-03. The switch already has a non-default hostname and an active IP domain name configured. The organization requires that all remote administrative sessions use SSH version 2 and that legacy Telnet connections are explicitly blocked. Which two CLI configuration steps are required to complete this task? (Select TWO.)

A network engineer configures an extended IPv4 access control list named `CORP_SEC` on a Cisco IOS router to regulate access from the branch network ($10.40.0.0/16$) to an internal web server ($192.168.50.10/32$). The security requirement specifies that host $10.40.4.15$ in the IT subnet ($10.40.4.0/22$) must be allowed HTTPS access (TCP port 443) to the web server, while all other traffic from $10.40.0.0/16$ to the $192.168.50.0/24$ network must be denied. Additionally, non-matching traffic must reach external destinations freely.

The engineer enters the following configuration commands:

text
ip access-list extended CORP_SEC
10 deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255
20 permit tcp host 10.40.4.15 host 192.168.50.10 eq 443
30 permit ip any any
!
interface GigabitEthernet0/0/1
ip access-group CORP_SEC in

During testing, HTTPS traffic from $10.40.4.15$ to $192.168.50.10$ is unexpectedly dropped. Which modification corrects the access control list logic to satisfy all requirements?

An administrator configures an IPv4 access control list on a router interface containing only the single entry `access-list 15 permit host 172.16.10.5`. What action will the router take when a packet originating from host 172.16.10.20 arrives on this interface?

A network administrator is evaluating AAA protocols to manage CLI access to enterprise routers. Which feature is a key characteristic of TACACS+ compared to RADIUS?

A network administrator enables Dynamic ARP Inspection (DAI) on a switch access VLAN to mitigate ARP spoofing attacks. Which database does DAI consult by default to validate ARP requests and responses received on untrusted ports?

A network engineer is inspecting the CLI configuration of a Layer 3 switch named Site-Core-01 to ensure secure administrative access. The switch currently has a valid hostname, a configured IP domain name, and active local user accounts. The line vty configuration displays the following output:

text
Site-Core-01# show running-config | section line vty
line vty 0 15
transport input telnet
login local

Which command executed within line configuration mode will restrict remote management sessions exclusively to SSH while enforcing authentication against the local user database?

A network administrator is configuring an IPv4 extended named access control list (ACL) on a Cisco router interface to implement security controls for the host subnet $10.50.1.0/24$. The ACL must satisfy the following traffic policies:

1. Allow ICMP echo requests from $10.50.1.0/24$ strictly to the default gateway at $10.50.1.1$.
2. Allow HTTPS access from $10.50.1.0/24$ to the internal application server at $192.168.20.45$.
3. Explicitly deny all other IPv4 traffic originating from $10.50.1.0/24$ destined to the internal server subnet $192.168.20.0/24$.
4. Permit all remaining outbound traffic from $10.50.1.0/24$ to any other network destination.

Which two ACL entries must be placed in the access list to achieve this exact behavior without blocking general Internet access? (Select two.)