Tüm alıştırma soruları

A network administrator applies an extended IPv4 Access Control List (ACL) containing only a single rule to an interface: `access-list 100 permit tcp host 192.168.1.10 host 10.0.0.5 eq 80`. What happens when a host with IP address 192.168.1.11 attempts to send HTTP traffic to 10.0.0.5?

A network administrator configures the following IPv4 extended named Access Control List (ACL) on a Cisco IOS router to control access to an internal application server at IP address 192.168.50.10:

text
ip access-list extended APP_FILTER
10 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 80
20 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 443
30 deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10
40 permit ip host 10.10.20.5 host 192.168.50.10

The ACL is applied outbound on GigabitEthernet0/1. An administrator attempts an SSH connection (TCP port 22) from management host 10.10.20.5 to the application server (192.168.50.10), while a user on host 10.10.20.100 attempts a web connection (TCP port 80) to the same server.

Which statement accurately describes how the router processes these two traffic flows?

A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?

A network security administrator is configuring digital certificate services and Multi-Factor Authentication (MFA) to secure management sessions on enterprise network infrastructure. Which of the following statements accurately describe digital certificate verification and MFA factor rules? (Select TWO.)

A network engineer configures the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to filter traffic between host $10.20.5.15$ and web server $192.168.100.50$:

text
ip access-list extended SECURE_VLAN
deny icmp host 10.20.5.15 host 192.168.100.50
permit tcp host 10.20.5.15 host 192.168.100.50 eq 80
permit tcp host 10.20.5.15 host 192.168.100.50 eq 443

Which two statements accurately describe the traffic filtering behavior enforced by this ACL? (Choose two.)

A network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to prevent ARP spoofing. DHCP snooping is enabled and functioning properly. However, several servers connected to untrusted access ports use statically assigned IP addresses, causing DAI to drop their legitimate ARP requests because they lack entries in the DHCP snooping binding database. Which configuration action should the administrator perform to permit ARP traffic from these static servers while maintaining DAI protection on VLAN 10?

A network administrator is creating an IPv4 extended Access Control List (ACL 105) to allow HTTPS access from host 192.168.10.5 to web server 10.0.0.5, block all other TCP traffic from the 192.168.10.0/24 subnet to the 10.0.0.0/8 network, and permit all remaining traffic. In what sequential order from top to bottom should these ACL statements be configured to enforce the intended policy correctly?

A host client on a remote subnetwork requires an IPv4 address assignment from a centralized server. Place the operational steps in the correct sequential order to illustrate how a Cisco router configured with `ip helper-address` processes and relays the initial discovery and offer messages.

A network administrator is configuring an extended IPv4 access control list (ACL) named `FILTER_INTERNAL` on GigabitEthernet0/0/0 (inbound) on a Cisco IOS router. The objective is to enforce the following security policy for internal users on network $10.50.10.0/24$:

1. Allow HTTPS traffic (TCP port 443) to the DMZ web server at $172.16.100.50$.
2. Allow DNS domain queries (UDP port 53) to the DMZ DNS server at $172.16.100.53$.
3. Explicitly drop and log all other traffic from $10.50.10.0/24$ directed to any host in the DMZ subnet ($172.16.100.0/24$).
4. Permit all remaining traffic originating from $10.50.10.0/24$ destined to other corporate subnets or the Internet.

Which two configuration statements or operational logic requirements must be included in the ACL design to satisfy these requirements without blocking non-DMZ traffic?

A network administrator wants to restrict access on a switch port to an authorized end device. If an unauthorized MAC address sends traffic to the port, the interface must drop the frames, avoid incrementing the security violation counter, and avoid disabling the port. Which port security violation mode meets this requirement?

An enterprise network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 using the command `ip arp inspection vlan 10`. Host devices dynamically receiving IPv4 configuration via DHCP operate without issue. However, a critical server connected to access switchport GigabitEthernet0/2 in VLAN 10 is configured with a static IPv4 address ($192.168.10.50/24$) and MAC address ($0011.2233.4455$). Network telemetry indicates that all network traffic from this server is dropped because DAI marks its ARP packets as invalid. Which configuration step correctly resolves the ARP packet drop for this static host while maintaining active DAI protection on VLAN 10?

Match each Layer 2 security mechanism or feature component on the left with its corresponding operational behavior on the right.

A network administrator needs to back up a Cisco IOS router's running configuration to a remote FTP server that requires user authentication. Arrange the Cisco IOS CLI operational and configuration steps in the correct chronological sequence to perform this transfer.

A network administrator is implementing administrative security controls for enterprise network switches and configuring Public Key Infrastructure (PKI) certificate validation for HTTPS management access. When evaluating multi-factor authentication (MFA) factor categories and PKI digital certificate validation mechanics, which two statements are correct?

An network administrator is troubleshooting traffic drops on switch port GigabitEthernet1/0/10. The interface is configured with Layer 2 security features including DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security in restrict mode. The output of `show ip dhcp snooping binding` displays a valid IP-to-MAC entry for the connected client on GigabitEthernet1/0/10. However, executing `show port-security interface g1/0/10` shows that the `SecurityViolation` counter is actively incrementing every time the host attempts to transmit data, while the port status remains operational (`secure-up`). Which scenario accounts for these symptoms?

A network administrator is deploying Layer 2 security controls on a Cisco Catalyst switch. Which two statements accurately describe the operational requirements and default behaviors of DHCP Snooping? (Select two.)

A network administrator configures switchport port security on a Cisco Catalyst switch access port using the command 'switchport port-security mac-address sticky'. An end device is connected to the port, and the switch dynamically learns its MAC address into the running configuration. The administrator verifies full network connectivity, but does not enter any additional CLI commands before the switch undergoes an unexpected reboot. Which outcome occurs regarding the port security bindings after the switch reboots?

A network technician is reviewing operational characteristics for standard IPv4 Access Control Lists (ACLs) on a Cisco router. Which of the following statements regarding standard IPv4 ACLs are correct? (Select TWO.)

A network engineer is configuring a Cisco IOS router to act as a local DHCP server for hosts in the $10.0.10.0/24$ subnet. The default gateway address $10.0.10.1$ and static server addresses $10.0.10.2$ through $10.0.10.10$ must be reserved and never assigned dynamically to DHCP clients. Which two configuration steps are required to properly exclude these addresses and define the default gateway parameter? (Select two.)

A network engineer completes the configuration of Layer 2 security features on a Cisco Catalyst switch connecting client workstations to an upstream router. After enabling DHCP snooping and Dynamic ARP Inspection (DAI) globally and on VLAN 20, client devices on untrusted access ports fail to obtain IPv4 addresses from the DHCP server, and ARP packets arriving from the default gateway on interface GigabitEthernet0/1 are discarded by DAI. Which two configuration steps are required on interface GigabitEthernet0/1 to resolve these issues? (Select two.)