Tüm alıştırma soruları

1987 soru

Tüm türler1,987 Çoktan seçmeli1,020 Çoklu seçim452 Sayısal18 Eşleştirme229 Sıralama203 Boşluk doldurma22 Kısa cevap43

Match each operational feature or interface component to its correct classification when comparing traditional network architectures with controller-based software-defined networks (SDN).

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Independent protocol path computation matches Traditional Network Distributed Control Plane; RESTful APIs for application-to-controller policy intent match Controller-Based Northbound Interface (NBI); NETCONF/OpenFlow for controller-to-device programming matches Controller-Based Southbound Interface (SBI); Node-by-node CLI configuration matches Traditional Network Decentralized Management Plane.

In traditional networking, control plane processing and management operations are decentralized across every network node. Conversely, controller-based SDN centralizes the control plane into a single logical controller, using Northbound APIs (REST) to expose network services to applications and Southbound APIs (NETCONF, RESTCONF, OpenFlow) to program policy onto hardware devices.

Adım Adım Çözüm

Analyze how control plane decisions are processed in traditional networks.

Identify that traditional networks distribute control plane processing across every individual device.

Each switch and router maintains its own control plane intelligence and routing protocols.

Identify the API direction connecting applications to the central controller.

Recognize that interfaces facing upward toward applications are Northbound Interfaces (NBIs).

Northbound APIs allow software applications to programmatically convey network requirements to the SDN controller.

Identify the API direction connecting the central controller to forwarding hardware.

Recognize that interfaces facing downward toward network nodes are Southbound Interfaces (SBIs).

Southbound protocols like NETCONF, RESTCONF, and OpenFlow carry instructions from the controller to network switches and routers.

Evaluate traditional device management practices.

Identify manual box-by-box CLI access as a characteristic of traditional management planes.

Unlike controller-driven centralized policy pushing, traditional management relies on individual device CLI interaction.

Anahtar Kavram

Architectural plane separation and interface distinction between traditional and controller-based networks

Tahmini Süre:1m 0s

Soru 722Soru →

An enterprise organization is updating its Cisco Wireless LAN Controller (WLC) security baseline to align with WPA3 specification standards across all branch locations. Which TWO architectural and security protocol enhancements are introduced when transitioning infrastructure from WPA2 to WPA3? (Select TWO.)

Geçerli olan tümünü seçin

WPA3-Personal replaces the PSK 4-way handshake with Simultaneous Authentication of Equals (SAE) to provide forward secrecy and mitigate offline dictionary attacks.

WPA3 mandates the implementation of Protected Management Frames (PMF / IEEE 802.11w) for all client connections to protect unicast and multicast management actions against spoofing.

WPA3-Enterprise deprecates AES-CCMP encryption and mandates Temporal Key Integrity Protocol (TKIP) with re-keying to reduce CPU overhead on lightweight APs.

WPA3-Enterprise eliminates the need for 802.1X/EAP authentication servers by implementing pre-shared static master keys across the WLAN controller infrastructure.

Cevabı ve açıklamayı göster

Cevap: WPA3-Personal replaces the PSK 4-way handshake with Simultaneous Authentication of Equals (SAE) to provide forward secrecy and mitigate offline dictionary attacks.; WPA3 mandates the implementation of Protected Management Frames (PMF / IEEE 802.11w) for all client connections to protect unicast and multicast management actions against spoofing.

Cevap

WPA3 introduces key cryptographic enhancements: WPA3-Personal replaces standard PSK handshakes with Simultaneous Authentication of Equals (SAE) to guard against offline brute-force attacks, and WPA3 mandates Protected Management Frames (PMF/802.11w) to stop management frame spoofing.

WPA3 enhances wireless network security by introducing Simultaneous Authentication of Equals (SAE) for Personal modes to defend against offline dictionary attacks and enforcing Protected Management Frames (PMF / IEEE 802.11w) to stop deauthentication attacks.

Adım Adım Çözüm

Analyze WPA3-Personal authentication improvements over WPA2-PSK.

Identified that WPA3-Personal replaces the 4-way PSK handshake with Simultaneous Authentication of Equals (SAE), preventing offline dictionary attacks even with weak passwords.

SAE uses Dragonfly key exchange providing forward secrecy.

Evaluate Management Frame Protection requirements in WPA3.

Identified that IEEE 802.11w (PMF) is mandatory for WPA3 connections.

PMF prevents attackers from forging deauthentication or disassociation frames to cause denial of service.

Evaluate cipher suite and enterprise authentication claims.

Disqualified TKIP as legacy/insecure and verified that 802.1X authentication remains a requirement for enterprise mode.

WPA3 mandates strong ciphers (CCMP/GCMP) and standard RADIUS/802.1X for WPA3-Enterprise.

Anahtar Kavram

WPA3 Wireless Security Enhancements (SAE and PMF)

Tahmini Süre:1m 30s

Soru 723Soru →

A network administrator is upgrading a wireless deployment to implement the WPA3-Personal security standard. Which key exchange mechanism does WPA3-Personal introduce to protect against offline dictionary attacks?

Simultaneous Authentication of Equals (SAE)

Temporal Key Integrity Protocol (TKIP)

Pre-Shared Key (PSK) 4-Way Handshake

Extensible Authentication Protocol (EAP-TLS)

Cevabı ve açıklamayı göster

Cevap: Simultaneous Authentication of Equals (SAE)

Cevap

Simultaneous Authentication of Equals (SAE)

Simultaneous Authentication of Equals (SAE) is the mandatory replacement for Pre-Shared Key (PSK) authentication in WPA3-Personal. SAE utilizes the Dragonfly handshake protocol, which prevents attackers from performing offline dictionary attacks against captured wireless handshakes.

Adım Adım Çözüm

Identify the key security enhancement introduced specifically in WPA3-Personal over WPA2-Personal.

WPA3-Personal replaces the standard PSK 4-way handshake with a key exchange protocol resistant to password guessing attacks.

WPA2-Personal relied on a pre-shared key (PSK) 4-way handshake that was susceptible to offline dictionary attacks if an attacker captured the initial handshake frames.

Match the protocol mechanism name with its function in WPA3.

Simultaneous Authentication of Equals (SAE) is the Dragonfly-based key exchange mechanism that fulfills this requirement.

SAE provides forward secrecy and prevents brute-force passive offline dictionary cracking attempts even when weak passphrases are used.

Anahtar Kavram

WPA3-Personal SAE Key Exchange Mechanism

Soru 724Soru →

Place the operational events in chronological order from first to last during an HSRP interface tracking failover scenario, assuming preemption is enabled on the standby router.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological order for HSRP interface tracking failover is: (1) The monitored uplink interface on the Active router fails; (2) The Active router decrements its HSRP priority; (3) The Active router broadcasts an HSRP Hello packet with the reduced priority; (4) The Standby router detects its higher priority and sends a Coup message; (5) The newly promoted Active router broadcasts a Gratuitous ARP to update Layer 2 MAC address tables.

HSRP interface tracking failover follows a precise operational order: First, the tracked uplink interface fails on the Active router. Second, the Active router decrements its configured HSRP priority locally. Third, it advertises this reduced priority in an HSRP Hello packet. Fourth, the Standby router (with preemption enabled) receives the Hello, recognizes its priority advantage, and sends a Coup message to claim the Active role. Finally, the newly active router sends a Gratuitous ARP (GARP) to refresh Layer 2 switch forwarding tables for the virtual MAC address.

Adım Adım Çözüm

Identify the initial trigger for tracking failover.

The monitored uplink interface fails, activating the tracking object on the Active router.

Interface tracking relies on physical or logical link state changes to initiate priority modification.

Determine the immediate local router response to the trigger.

The Active router reduces its operational priority by the configured decrement value.

HSRP tracking dynamically adjusts priority values to allow healthier backup routers to take over.

Determine how the priority change is communicated to the network.

The Active router advertises the lowered priority in its next HSRP Hello packet.

Peers must receive an updated Hello packet to learn about priority changes on neighboring devices.

Analyze the reaction of the Standby router.

The Standby router notices its priority is superior and sends a Coup message to assume the Active role.

Preemption permits a router with higher priority to claim the Active role immediately upon detecting lower priority Hellos.

Identify how Layer 2 network topology adjusts to the new Active router.

The newly active router broadcasts a Gratuitous ARP to force switches to update their MAC tables for the Virtual MAC.

Layer 2 switch ports must point to the new physical port holding the Virtual MAC to prevent traffic blackholing.

Anahtar Kavram

HSRP Interface Tracking and Preemption Failover

Soru 725Soru →

A network administrator configures an extended IPv4 access control list (ACL 102) on a Cisco IOS router to restrict traffic from the internal LAN subnet $172.16.10.0/24$ to an external server at IP address $192.168.50.10$ . The administrator enters the following CLI commands:

`access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 80`
`access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 192.168.50.10 eq 443`

After applying ACL 102 inbound on interface GigabitEthernet0/0, users report that HTTP and HTTPS access to $192.168.50.10$ works properly, but all DNS resolution queries to an internal server at $172.16.10.2$ and internet browsing to other hosts are failing. Which statement correctly explains why all other traffic originating from the internal subnet is being blocked?

The router processes traffic sequentially and drops all unlisted traffic due to the implicit deny clause located at the end of the access control list.

Unlisted traffic is dropped because an extended ACL requires an explicit 'deny ip any any' line to be configured before any non-matching packets can be evaluated.

The wildcard mask 0.0.0.255 restricts access strictly to host 172.16.10.0, causing packets from all other hosts in the subnet to be dropped by the permit statements.

Applying an extended ACL inbound on a LAN interface automatically blocks local intra-subnet communications between hosts on the same physical switch.

Cevabı ve açıklamayı göster

Cevap: The router processes traffic sequentially and drops all unlisted traffic due to the implicit deny clause located at the end of the access control list.

Cevap

The router evaluates traffic against ACL 102 sequentially from top to bottom and drops all unlisted packets because of the invisible implicit deny clause ('deny ip any any') appended at the end of every IPv4 ACL.

In Cisco IOS networking, all standard and extended IPv4 Access Control Lists end with an invisible 'implicit deny' statement (conceptually `deny ip any any`). Packets entering an interface with an applied ACL are compared against statements top-down. Because ACL 102 only explicitly permits TCP ports 80 and 443 to host

192.168.50.10

, all other traffic—including DNS (UDP port 53) and traffic destined for other IP addresses—reaches the end of the ACL and is dropped by the implicit deny rule.

Adım Adım Çözüm

Analyze the configured access list statements

ACL 102 explicitly permits only TCP destination port 80 (HTTP) and TCP destination port 443 (HTTPS) traffic from source

172.16.10.0/24

to destination

192.168.50.10

Top-down ACL evaluation checks each incoming packet against these two rules first.

Evaluate how non-HTTP/HTTPS traffic is handled

DNS queries (UDP/TCP port 53) and general IP traffic destined for other IP addresses do not match either of the explicit permit statements.

When no explicit permit statement matches a packet, processing reaches the end of the access list.

Apply Cisco IOS default ACL behavior

All non-matching traffic is dropped by the unwritten implicit deny clause ('deny ip any any').

To allow other traffic, explicit permit statements (such as 'permit ip any any' or specific service permits) must be configured.

Anahtar Kavram

Implicit Deny Clause in IPv4 ACLs

Tahmini Süre:1m 30s

Soru 726Soru →

A network engineering team requires strict per-command authorization and per-command audit logging for administrative CLI access on core Cisco switches. Every individual command entered by a logged-in administrator must be evaluated against central security policies before execution. Which protocol selection and architectural behavior correctly satisfies these operational requirements?

TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.

RADIUS, because its transport architecture uses UDP for rapid transmission and encrypts the entire packet payload during per-command authorization checks.

RADIUS, because it separates authentication and authorization into distinct UDP sessions while providing full-packet encryption for command authorization strings.

TACACS+, because it combines authentication and authorization into a single UDP exchange while encrypting only the user authentication password field.

Cevabı ve açıklamayı göster

Cevap: TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.

Cevap

TACACS+, because its modular AAA architecture separates authentication and authorization, sending distinct TCP-based authorization requests for each individual command entered.

The correct selection identifies TACACS+ as the protocol that decouples authentication and authorization over TCP port 49 with full-packet payload encryption. This modular separation enables network devices to send an authorization request for every CLI command entered by an administrator.

Adım Adım Çözüm

Analyze the functional access control requirement.

The requirement calls for per-command administrative authorization and CLI logging on network infrastructure devices.

Device administration requires fine-grained control over CLI commands, which is supported natively by TACACS+.

Compare protocol separation mechanics between TACACS+ and RADIUS.

TACACS+ completely decouples Authentication, Authorization, and Accounting (AAA), whereas RADIUS combines Authentication and Authorization into single protocol exchanges.

Decoupling authorization allows a NAS (network access server) to request explicit permission for individual CLI commands after a user has already authenticated.

Evaluate transport and security mechanisms for TACACS+ vs RADIUS.

TACACS+ uses TCP port 49 and encrypts the entire packet payload (body). RADIUS uses UDP ports 1812/1813 and encrypts only the password attribute.

TCP guarantees reliable delivery for per-command authorization packets, and full-payload encryption protects command strings and output sent across the network.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Architecture and AAA Function Separation

Soru 727Soru →

An administrator applies the following IPv4 extended named access control list (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco IOS router:

ip access-list extended FILTER_WEB
permit tcp 10.10.1.0 0.0.0.255 host 172.16.10.50 eq 80
permit tcp 10.10.1.0 0.0.0.255 host 172.16.10.50 eq 443

Which two statements accurately describe how traffic arriving on interface GigabitEthernet0/0/1 is evaluated by this ACL?

Geçerli olan tümünü seçin

HTTP traffic originating from host 10.10.1.25 and destined for server 172.16.10.50 on port 80 is permitted.

ICMP echo requests sent from host 10.10.1.25 to destination server 172.16.10.50 are dropped by the router.

ICMP traffic from host 10.10.1.25 to server 172.16.10.50 is permitted because no explicit deny rule is defined in the configuration.

UDP DNS traffic from host 10.10.1.25 to 172.16.10.50 is forwarded because the list only restricts TCP traffic.

Cevabı ve açıklamayı göster

Cevap: HTTP traffic originating from host 10.10.1.25 and destined for server 172.16.10.50 on port 80 is permitted.; ICMP echo requests sent from host 10.10.1.25 to destination server 172.16.10.50 are dropped by the router.

Cevap

HTTP traffic on port 80 from subnet 10.10.1.0/24 to 172.16.10.50 is permitted by the first ACL entry, while ICMP traffic is dropped due to the implicit deny at the end of the access list.

The extended ACL explicitly allows TCP traffic on port 80 from the 10.10.1.0/24 network to destination host 172.16.10.50. Any protocol or traffic type not explicitly permitted—such as ICMP or UDP traffic—matches the implicit deny clause at the end of the ACL and is dropped by the router.

Adım Adım Çözüm

Evaluate the explicit permit statements in the ACL configuration sequentially from top to bottom.

Rule 1 permits TCP traffic from 10.10.1.0/24 to host 172.16.10.50 on port 80. Rule 2 permits TCP traffic from 10.10.1.0/24 to host 172.16.10.50 on port 443.

Top-down sequential matching permits HTTP and HTTPS traffic matching the specified source subnet and destination host IP.

Evaluate non-matching traffic types (such as ICMP and UDP) against the ACL end condition.

Traffic types not matched by explicit permit statements fall through to the default implicit deny clause (deny ip any any).

All Cisco IOS ACLs end with an implicit deny all statement that drops any packet not explicitly permitted.

Anahtar Kavram

Extended IPv4 Access Control List Sequential Processing and Implicit Deny Behavior

Soru 728Soru →

A network administrator configures HSRP group 10 on two Cisco IOS routers to provide high availability for the $192.168.10.0/24$ network.

Router R1 configuration:
text interface GigabitEthernet0/1 ip address 192.168.10.2 255.255.255.0 standby 10 ip 192.168.10.1 standby 10 priority 115 standby 10 preempt standby 10 track GigabitEthernet0/0 30

Router R2 configuration:
text interface GigabitEthernet0/1 ip address 192.168.10.3 255.255.255.0 standby 10 ip 192.168.10.1 standby 10 priority 100 standby 10 preempt

Initially, both routers and interfaces are fully operational, and R1 is the Active router. If interface GigabitEthernet0/0 on R1 experiences a link failure, which router will become the Active router for HSRP group 10, and what is R1's effective priority?

R2 becomes the Active router because R1's priority decrements to 85, which is lower than R2's priority of 100.

R1 remains the Active router because R1's priority decrements to 100, resulting in a tie where the current Active router retains its role.

R1 remains the Active router because R2 lacks interface tracking and cannot preempt an active router during an uplink failure.

R2 becomes the Active router because HSRP tracking immediately disables the standby group on R1 upon uplink failure.

Cevabı ve açıklamayı göster

Cevap: R2 becomes the Active router because R1's priority decrements to 85, which is lower than R2's priority of 100.

Cevap

R2 becomes the Active router because R1's priority decrements to 85, which is lower than R2's priority of 100.

When the tracked uplink GigabitEthernet0/0 on R1 fails, HSRP interface tracking decrements R1's priority from 115 by 30, bringing its effective priority down to 85. Since R2 has preemption enabled and its priority of 100 is higher than R1's new priority of 85, R2 preempts R1 and becomes the Active router for HSRP group 10.

Adım Adım Çözüm

Calculate the initial priorities and state of both HSRP routers.

R1 initial priority is 115 (Active). R2 priority is 100 (Standby). Both have preemption enabled.

Higher priority wins the Active role when preemption is enabled.

Evaluate the impact of GigabitEthernet0/0 failure on R1.

R1's tracked interface drops, reducing R1's priority by 30:

115 - 30 = 85

The command 'standby 10 track GigabitEthernet0/0 30' decrements the priority by 30 upon link down.

Determine the outcome of HSRP preemption.

R2's priority (100) is now higher than R1's effective priority (85). R2 sends coup messages and becomes Active.

R2 has 'standby 10 preempt' configured, allowing it to assume the Active role whenever its priority exceeds the current Active router's priority.

Anahtar Kavram

HSRP Priority Tracking and Preemption

Soru 729Soru →

Match each Quality of Service (QoS) field or traffic conditioning mechanism on the left to its correct header specification or operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

IP Precedence matches the 3-bit Layer 3 ToS field; DSCP matches the 6-bit Layer 3 field in ToS/Traffic Class; ECN matches the 2-bit IP congestion notification field; Traffic Shaping matches the egress buffering mechanism.

Each item accurately maps to its defined QoS header specification or operational mechanics. IP Precedence uses 3 bits in the ToS byte; DSCP uses 6 bits in the ToS/Traffic Class byte; ECN uses 2 bits to signal congestion without packet drops; Traffic Shaping buffers excess packets on egress interfaces.

Adım Adım Çözüm

Analyze header field bit lengths and layer classifications

Identify IP Precedence as the legacy 3-bit Layer 3 field (8 values) and DSCP as the modern 6-bit Layer 3 field (64 values).

Classification standards define specific bit positions within the 8-bit Type of Service byte.

Identify signaling and traffic conditioning functions

Map ECN to its 2-bit congestion notification role and Traffic Shaping to egress buffering.

ECN signals congestion proactively to TCP endpoints without packet loss, while traffic shaping buffers bursty packets to conform to a configured rate.

Anahtar Kavram

QoS Header Markings and Traffic Conditioning Functions

Tahmini Süre:1m 30s

Soru 730Soru →

A network security administrator needs to configure a local database user account named 'opsman' on a Cisco IOS XE router. The requirement specifies using PBKDF2 with SHA-256 hashing (Type 8 encryption) to securely store the plaintext password 'Secur3#Pass2026'. Which Cisco IOS global configuration command correctly satisfies this requirement?

username opsman secret algorithm-type pbkdf2 Secur3#Pass2026

username opsman password algorithm-type pbkdf2 Secur3#Pass2026

username opsman secret 8 Secur3#Pass2026

service password-encryption algorithm pbkdf2

Cevabı ve açıklamayı göster

Cevap: username opsman secret algorithm-type pbkdf2 Secur3#Pass2026

Cevap

The command 'username opsman secret algorithm-type pbkdf2 Secur3#Pass2026' correctly configures the local account with PBKDF2 (Type 8) password hashing.

In Cisco IOS XE, creating a local database user account with PBKDF2 hashing (Type 8) from a cleartext string requires the syntax 'username <name> secret algorithm-type pbkdf2 <plaintext_password>'. The router automatically computes the SHA-256 PBKDF2 hash and stores it in the running configuration as a Type 8 secret.

Adım Adım Çözüm

Identify the target requirement

The goal is to configure a local user secret using PBKDF2 (Type 8 encryption) from a cleartext input password on Cisco IOS XE.

Cisco IOS XE supports enhanced password hashing algorithms via the 'secret' command branch.

Evaluate Cisco IOS XE syntax rules for local user database creation

The 'username <name> secret algorithm-type <type> <password>' syntax is used to define cleartext passwords hashed with specific algorithms such as pbkdf2 or scrypt.

Using 'secret algorithm-type pbkdf2' specifies Type 8 SHA-256 PBKDF2 hashing.

Differentiate from incorrect options

The 'password' keyword cannot take hashing algorithms, the literal number '8' expects an already computed hash string, and 'service password-encryption' is a global command for legacy Type 7 encryption.

Syntax elements must match the command state and input format expected by IOS XE.

Anahtar Kavram

Local database user authentication and password hashing algorithms (Type 5 MD5, Type 8 PBKDF2, Type 9 scrypt, Type 7 service password-encryption).

Soru 731Soru →

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding operational behavior on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Port Security (Restrict Mode) matches with dropping unauthorized frames, incrementing the violation counter, and logging without shutting the interface down. DHCP Snooping Untrusted Interface matches with blocking incoming DHCP server responses and building the binding table from client traffic. Dynamic ARP Inspection (DAI) matches with intercepting and validating ARP packets against the binding database. Port Security (Sticky MAC) matches with dynamically adding learned MAC addresses as secure entries in the running configuration.

Each feature maps to its exact Cisco IOS operational behavior: Restrict mode logs and drops without disabling the port; DHCP Snooping untrusted ports drop server responses; DAI validates ARP frames against the DHCP binding table; and Sticky MAC converts dynamically learned addresses into running-config entries.

Adım Adım Çözüm

Analyze Port Security violation modes

Identify that 'restrict' drops traffic, logs a message, and increments counters without disabling the port (unlike 'shutdown' mode which err-disables the interface).

Differentiating between protect, restrict, and shutdown modes is essential for Layer 2 access control.

Analyze DHCP Snooping interface roles

Recognize that untrusted ports drop DHCP server response packets (DHCPOFFER, DHCPACK) to prevent rogue DHCP server attacks.

DHCP Snooping enforces trust boundaries between user access ports (untrusted) and legitimate DHCP server ports (trusted).

Analyze Dynamic ARP Inspection mechanics

Confirm DAI checks incoming ARP packets on untrusted interfaces against the DHCP Snooping IP-to-MAC binding database.

DAI depends on the integrity of the DHCP Snooping binding table to mitigate man-in-the-middle ARP spoofing.

Analyze Sticky MAC address persistence

Verify that sticky MAC learning places dynamically discovered MAC addresses directly into the active running configuration.

Sticky MAC addresses persist in memory until saved to startup-config via copy running-config startup-config.

Anahtar Kavram

Layer 2 security mitigations (Port Security violation modes, DHCP Snooping trust roles, and Dynamic ARP Inspection validation mechanics).

Soru 732Soru →

An engineer is deploying a software-defined fabric architecture across an enterprise network. Which two operational functions are handled exclusively by the overlay network rather than the underlying physical network? (Choose two.)

Geçerli olan tümünü seçin

Encapsulating virtual tenant traffic inside VXLAN packets at the fabric edge

Establishing physical IP reachability between fabric nodes using an IGP like OSPF or IS-IS

Maintaining the mapping database that resolves Endpoint Identifiers (EIDs) to Routing Locators (RLOCs)

Forwarding packets across core fabric switches based on the outer destination IP header

Configuring maximum transmission unit (MTU) sizes to accommodate encapsulation overhead on physical interfaces

Cevabı ve açıklamayı göster

Cevap: Encapsulating virtual tenant traffic inside VXLAN packets at the fabric edge; Maintaining the mapping database that resolves Endpoint Identifiers (EIDs) to Routing Locators (RLOCs)

Cevap

Encapsulating virtual tenant traffic inside VXLAN packets at the fabric edge and maintaining the mapping database that resolves Endpoint Identifiers (EIDs) to Routing Locators (RLOCs) are the two functions operating exclusively within the overlay network.

In software-defined network fabrics, the overlay network is responsible for creating virtual networks on top of physical infrastructure. Encapsulating traffic using VXLAN at fabric edge nodes forms the overlay data plane, while maintaining the LISP mapping database (EID to RLOC) forms the overlay control plane.

Adım Adım Çözüm

Identify the primary role of the overlay network.

The overlay network provides virtualized layer 2 and layer 3 connectivity on top of the underlay using encapsulation and mapping protocols.

Overlay architectures decouple endpoint identity and virtual topology from the physical network infrastructure.

Evaluate data plane mechanisms.

VXLAN encapsulates original tenant frames with outer headers at Virtual Tunnel Endpoints (VTEPs).

This packet encapsulation allows virtual networks to span across physical IP boundaries.

Evaluate control plane mechanisms.

LISP maintains mapping tables between EIDs (endpoint addresses) and RLOCs (underlay IP addresses).

LISP serves as the control plane for locating endpoints within the fabric overlay.

Anahtar Kavram

Overlay vs. Underlay Roles in Software-Defined Networking

Soru 733Soru →

A network operations team is auditing access control protocols used across enterprise routers and switches. When comparing TACACS+ and RADIUS protocol implementations, which TWO functional characteristics belong specifically to TACACS+? (Select TWO.)

Geçerli olan tümünü seçin

It utilizes TCP port 49 and encrypts the entire payload of the packet.

It completely separates authentication and authorization into independent operational processes.

It utilizes UDP transport and encrypts only the user password field within the packet.

It combines authentication and authorization into a single unified protocol exchange.

Cevabı ve açıklamayı göster

Cevap: It utilizes TCP port 49 and encrypts the entire payload of the packet.; It completely separates authentication and authorization into independent operational processes.

Cevap

The two correct functional characteristics of TACACS+ are that it utilizes TCP port 49 while encrypting the entire packet payload, and it completely separates authentication and authorization into independent operational processes.

TACACS+ is primarily engineered for administrative device access control. It uses TCP port 49 and provides full-packet payload encryption. Furthermore, TACACS+ strictly separates the authentication, authorization, and accounting functions, which permits network administrators to implement granular command-level authorization policies independently of user authentication.

Adım Adım Çözüm

Analyze transport layer behavior and security mechanics for TACACS+.

TACACS+ uses TCP port 49 and encrypts the entire payload.

TACACS+ relies on connection-oriented TCP for reliable communication and encrypts all packet payload data beyond the header.

Evaluate functional separation within the AAA architecture for TACACS+.

TACACS+ decouples authentication, authorization, and accounting.

Separating authorization from authentication enables precise, per-command CLI access control during device administration sessions.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Architecture and Operational Mechanics

Tahmini Süre:2m 0s

Soru 734Soru →

A network administrator is evaluating default gateway redundancy protocol behavior on Cisco IOS switches for VLAN 10 ( $192.168.10.0/24$ ). Which two statements accurately contrast the default operational features of HSRPv1 and VRRPv2? (Choose two.)

Geçerli olan tümünü seçin

VRRPv2 enables preemption by default, whereas HSRPv1 disables preemption by default.

HSRPv1 uses virtual MAC addresses formatted as 0000.0c07.acXX, whereas VRRPv2 uses virtual MAC addresses formatted as 0000.5e00.01XX.

HSRPv1 allows assigning an active physical interface IP address as the virtual IP address, whereas VRRPv2 forbids matching the virtual IP to any physical interface IP.

VRRPv2 designates the active forwarding router as the Active router, whereas HSRPv1 designates it as the Master router.

Cevabı ve açıklamayı göster

Cevap: VRRPv2 enables preemption by default, whereas HSRPv1 disables preemption by default.; HSRPv1 uses virtual MAC addresses formatted as 0000.0c07.acXX, whereas VRRPv2 uses virtual MAC addresses formatted as 0000.5e00.01XX.

Cevap

VRRPv2 enables preemption by default while HSRPv1 disables it by default, and HSRPv1 uses virtual MAC addresses in the format 0000.0c07.acXX while VRRPv2 uses 0000.5e00.01XX.

The correct statements accurately identify key default operational differences between Cisco proprietary HSRPv1 and open standard VRRPv2: VRRPv2 preemption is enabled by default while HSRPv1 preemption is disabled by default, and HSRPv1 uses the virtual MAC structure 0000.0c07.acXX compared to VRRPv2's 0000.5e00.01XX.

Adım Adım Çözüm

Analyze preemption defaults for HSRPv1 and VRRPv2.

HSRPv1 requires explicit configuration of preemption to allow a higher priority router to claim the Active role. VRRPv2 has preemption enabled natively out of the box.

Understanding protocol default behaviors is essential for predicting failover and failback behavior during topology changes.

Analyze Virtual MAC address structures.

HSRPv1 uses vendor MAC prefix 0000.0c07.acXX, while VRRPv2 uses standard MAC prefix 0000.5e00.01XX.

Virtual MAC formatting allows Layer 2 switch forwarding tables to map the default gateway IP to the virtual router.

Evaluate role terminology and physical IP assignment constraints.

HSRP uses Active/Standby terminology and forbids virtual IP overlap with interface IPs. VRRP uses Master/Backup terminology and allows IP address ownership (priority 255).

This rules out distractors that swap role terminology or misstate virtual IP assignment capabilities.

Anahtar Kavram

First Hop Redundancy Protocols Default Features and Architectural Comparison

Tahmini Süre:1m 30s

Soru 735Soru →

A network administrator configures a numbered standard IPv4 access control list on a Cisco IOS router to permit management access from the Network Operations Center (NOC) subnet $192.168.10.0/24$ while blocking all other hosts. The administrator enters the following commands:

text
Router(config)# access-list 15 permit 192.168.10.0 0.0.0.255
Router(config)# line vty 0 4
Router(config-line)# access-class 15 in

After applying this configuration, which traffic outcome occurs when an administrator at IP address $192.168.10.45$ attempts an SSH connection to the router's VTY interface, and why?

The SSH session is permitted because the source IP address matches the permit entry in ACL 15.

The SSH session is denied because standard access control lists cannot filter traffic applied to VTY lines.

The SSH session is denied because an explicit permit ip any statement is missing at the end of ACL 15.

The SSH session is permitted only if an explicit deny entry is added to block other subnets.

Cevabı ve açıklamayı göster

Cevap: The SSH session is permitted because the source IP address matches the permit entry in ACL 15.

Cevap

The SSH connection attempt from IP address 192.168.10.45 is permitted because it matches the permit statement for network 192.168.10.0 with wildcard mask 0.0.0.255 in access-list 15.

The incoming SSH connection attempt originates from 192.168.10.45, which falls inside the 192.168.10.0/24 IP network range matched by wildcard mask 0.0.0.255. When the packet is checked against access-list 15 applied inbound on the VTY lines via the access-class command, it hits the first rule, matches, and is permitted.

Adım Adım Çözüm

Analyze the ACL entry network range and wildcard mask

Network 192.168.10.0 with wildcard mask 0.0.0.255 matches source IP addresses in the range 192.168.10.0 to 192.168.10.255.

Wildcard mask bits of 0 require exact matching of octet values, while 255 allows any value in the fourth octet.

Evaluate the incoming SSH source IP address against ACL 15 sequentially

IP address 192.168.10.45 matches the first statement: access-list 15 permit 192.168.10.0 0.0.0.255.

ACL processing evaluates statements top-down until a match is found.

Determine line VTY access policy application

Traffic matching a permit line in an access-class in ACL applied to line vty is allowed through to establish the administrative management connection.

Once a permit match occurs, ACL evaluation terminates and the action specified in the matched statement (permit) is executed.

Anahtar Kavram

Standard IPv4 ACL Evaluation and VTY Line Application

Soru 736Soru →

A network administrator needs to harden administrative access on a Cisco IOS XE router. The requirement specifies that users connecting via SSH must authenticate against the local device user database, and privileged EXEC mode access must be protected using Type 9 (scrypt) password hashing. Which two CLI configuration tasks must be performed to meet these security requirements? (Select two.)

Geçerli olan tümünü seçin

Configure enable secret algorithm-type scrypt <password> in global configuration mode.

Execute the login local command under line vty configuration mode.

Enable service password-encryption in global configuration mode to convert existing enable secret passwords into Type 9 hashes.

Configure the login command without additional parameters under line vty configuration mode to trigger local database lookup.

Cevabı ve açıklamayı göster

Cevap: Configure enable secret algorithm-type scrypt <password> in global configuration mode.; Execute the login local command under line vty configuration mode.

Cevap

The two required CLI configuration tasks are configuring enable secret algorithm-type scrypt <password> in global configuration mode and executing login local under line vty configuration mode.

Configuring enable secret with the algorithm-type scrypt option enforces strong Type 9 hashing for privileged EXEC access, and issuing login local under line vty mode forces VTY remote access to validate credentials against local user database accounts.

Adım Adım Çözüm

Identify the command required to enforce strong Type 9 privileged EXEC password protection.

Executing enable secret algorithm-type scrypt <password> creates a Type 9 password hash using the scrypt key derivation function for privileged EXEC mode.

Cisco IOS XE supports Type 9 scrypt encryption, which provides significantly stronger protection than standard Type 5 MD5 or Type 7 obfuscation.

Identify the line configuration command required for local user database authentication on VTY lines.

Navigating to line vty configuration mode and executing login local configures VTY sessions to authenticate incoming connections against accounts created in the local database.

Using the standalone login command checks only a line-level password, whereas login local directs authentication to the local username database.

Anahtar Kavram

Cisco IOS Local User Authentication and Password Hashing Types

Soru 737Soru →

A network administrator is designing a QoS marking policy to classify enterprise application traffic across both Layer 2 switch trunks and Layer 3 routed WAN links. Which statement accurately compares Class of Service (CoS) and Differentiated Services Code Point (DSCP) markings?

CoS relies on a 3-bit field located inside the 802.1Q VLAN tag, whereas DSCP uses a 6-bit field inside the IP header.

CoS uses a 6-bit field in the IP header, whereas DSCP uses a 3-bit Priority Code Point field in the Ethernet frame header.

CoS automatically buffers non-conforming bursty traffic in queues, whereas DSCP drops out-of-profile traffic at ingress.

CoS markings persist end-to-end across Layer 3 router hops, whereas DSCP markings are stripped when packets cross ethernet switches.

Cevabı ve açıklamayı göster

Cevap: CoS relies on a 3-bit field located inside the 802.1Q VLAN tag, whereas DSCP uses a 6-bit field inside the IP header.

Cevap

Class of Service (CoS) relies on a 3-bit Priority Code Point (PCP) field within the Layer 2 802.1Q VLAN header, whereas Differentiated Services Code Point (DSCP) uses a 6-bit field within the Layer 3 IP header.

The statement identifying CoS as a 3-bit field inside the 802.1Q VLAN header and DSCP as a 6-bit field in the IP header is correct. CoS provides 8 priority levels (0 to 7) for Layer 2 tagged frames, while DSCP provides 64 values (0 to 63) in the Differentiated Services field of Layer 3 IP headers.

Adım Adım Çözüm

Identify Layer 2 QoS classification mechanisms.

CoS (Class of Service / 802.1p) is defined in the 3-bit Priority Code Point field of an 802.1Q VLAN frame header, giving 8 possible priority levels (0-7).

Layer 2 headers are encapsulated per link and only exist on tagged Ethernet frames.

Identify Layer 3 QoS classification mechanisms.

DSCP (Differentiated Services Code Point) is defined in the 6-bit DiffServ field of the IPv4/IPv6 packet header, giving 64 possible code points (0-63).

Layer 3 headers persist across router hops end-to-end from source to destination.

Compare header locations and persistence capabilities.

CoS is restricted to tagged Layer 2 Ethernet trunks and is stripped by routers, while DSCP travels inside the IP packet across routed boundaries.

Routers decapsulate Layer 2 frames when forwarding IP packets, removing the 802.1Q tag containing CoS.

Anahtar Kavram

QoS Marking Fields (CoS 3-bit L2 vs DSCP 6-bit L3)

Soru 738Soru →

In a software-defined fabric architecture, which protocol operates specifically at the overlay layer to encapsulate end-host Ethernet frames inside IP/UDP packets across the physical transport infrastructure?

VXLAN

IS-IS

SNMP

LACP

Cevabı ve açıklamayı göster

Cevap: VXLAN

Cevap

VXLAN is the correct protocol operating at the overlay layer for encapsulation.

VXLAN (Virtual Extensible LAN) is the data plane encapsulation technology used in SDN overlays (such as Cisco SD-Access and VXLAN EVPN) to encapsulate original Layer 2 frames within IP/UDP headers to transport traffic over the physical underlay infrastructure.

Adım Adım Çözüm

Identify the primary role of the overlay layer in software-defined network architectures.

The overlay layer creates virtual tunnels (tunnels end-user frames across the physical network) using data plane encapsulation.

Overlay networks decouple logical tenant services from physical topology.

Match the protocols to their architectural layers (Underlay vs. Overlay vs. Management).

VXLAN provides MAC-in-UDP encapsulation for overlay transport, whereas IS-IS provides underlay IP routing, SNMP manages devices, and LACP bundles physical ports.

VXLAN is designed specifically to encapsulate Layer 2/3 user payloads inside standard UDP packets.

Anahtar Kavram

Overlay Data Plane Encapsulation with VXLAN

Soru 739Soru →

A network engineer must enforce a security policy requiring real-time validation of individual CLI commands executed during administrator sessions on enterprise switches. Additionally, the policy dictates that the entire communication payload between the switch and the AAA server must be encrypted. Which protocol and operational mechanism fulfill these security requirements?

TACACS+, because it operates over TCP and decouples authorization from authentication, allowing per-command validation while encrypting the entire packet payload.

RADIUS, because it operates over UDP and provides per-command authorization by combining authentication and authorization headers into a single encrypted packet payload.

TACACS+, because it operates over UDP and encrypts only the password field while transmitting command authorization parameters in cleartext for lower latency.

RADIUS, because it operates over TCP and encrypts the entire packet body while decoupling accounting from authentication to permit per-command checks.

Cevabı ve açıklamayı göster

Cevap: TACACS+, because it operates over TCP and decouples authorization from authentication, allowing per-command validation while encrypting the entire packet payload.

Cevap

TACACS+ is the correct choice because it uses TCP transport, decouples AAA functions to enable individual command authorization, and encrypts the entire packet payload.

TACACS+ separates the AAA pillars into discrete operations, allowing an administrator to configure per-command authorization on network devices. Furthermore, TACACS+ runs over TCP port 49 and encrypts the entire packet body beyond the 12-byte header, satisfying all requirements specified in the scenario.

Adım Adım Çözüm

Evaluate transport protocol and encryption characteristics

TACACS+ uses TCP port 49 and encrypts the entire packet payload (everything after the standard TACACS+ header). RADIUS uses UDP ports 1812/1813 and encrypts only the password field within Access-Request packets.

Security requirements call for full packet payload encryption.

Evaluate AAA functional separation for command-level authorization

TACACS+ fully separates Authentication, Authorization, and Accounting into distinct modular services, enabling per-command authorization checks before execution. RADIUS combines authentication and authorization in unified exchange messages.

Administrative command validation requires standalone authorization requests per CLI command.

Select the protocol that satisfies both requirements

Only TACACS+ satisfies both full packet payload encryption and decoupled per-command authorization.

Matching all technical and policy constraints leads directly to TACACS+.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Capabilities and AAA Functional Separation

Soru 740Soru →

A network administrator is configuring QoS mechanisms on a branch router edge interface to manage traffic bursts that periodically exceed the committed contract rate. Which two statements accurately describe the operational characteristics of traffic shaping?

Geçerli olan tümünü seçin

Buffers excess packets in a queue and delays their transmission to smooth the outbound traffic flow.

Can only be implemented in the egress direction on a network interface.

Immediately drops out-of-profile packets as soon as the traffic rate exceeds the burst threshold.

Remarks out-of-profile traffic to a lower precedence value instead of delaying packet egress.

Cevabı ve açıklamayı göster

Cevap: Buffers excess packets in a queue and delays their transmission to smooth the outbound traffic flow.; Can only be implemented in the egress direction on a network interface.

Cevap

Traffic shaping buffers excess packets in a queue to release them smoothly over time, and it can only be configured in the egress direction on an interface.

Traffic shaping is designed to smooth egress traffic rates by holding non-conforming packets in software queues and transmitting them as bandwidth becomes available. Because this queueing and scheduling process takes place before sending packets out of an interface, shaping is strictly an egress-only feature.

Adım Adım Çözüm

Analyze the core operational mechanism of traffic shaping.

Traffic shaping retains packets in a queue when the traffic rate exceeds the configured rate (CIR) and transmits them gradually to achieve a regulated flow.

Understanding the role of internal buffers differentiates shaping from policing.

Determine the interface direction constraints for traffic shaping.

Since packets must enter an egress queue before being delayed and scheduled for transmission, shaping can only be applied in the egress direction.

Ingress interfaces cannot hold packets in an egress scheduling buffer.

Differentiate policing functions from shaping functions to rule out incorrect choices.

Actions such as dropping excess packets immediately or remarking packet header fields are characteristic of policing, which does not buffer traffic.

Policers handle traffic bursts by dropping or remarking rather than queueing.

Anahtar Kavram

Traffic Shaping vs. Traffic Policing Mechanisms

Tahmini Süre:1m 0s

ÖncekiSayfa 37 / 100Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram