Tüm alıştırma soruları

1987 soru

Tüm türler1,987 Çoktan seçmeli1,020 Çoklu seçim452 Sayısal18 Eşleştirme229 Sıralama203 Boşluk doldurma22 Kısa cevap43

An organization is updating its infrastructure access control policies and mandates Multi-Factor Authentication (MFA) for administrative SSH connections to all core routers. Which combination of credentials satisfies true Multi-Factor Authentication by employing two distinct authentication factor categories?

A static user password combined with a time-based one-time password (TOTP) generated by a physical keyfob token

A domain user account password combined with an enable secret passphrase and a security PIN

A fingerprint scan combined with a high-resolution retina scan

A mobile app push notification approval combined with an SMS verification code sent to the same smartphone

Cevabı ve açıklamayı göster

Cevap: A static user password combined with a time-based one-time password (TOTP) generated by a physical keyfob token

Cevap

A static user password combined with a time-based one-time password (TOTP) generated by a physical keyfob token

Multi-Factor Authentication (MFA) requires using credentials from at least two distinct authentication categories: Knowledge (something you know, like a password), Possession (something you have, like a physical hardware token), and Inherence (something you are, like biometric scans). Pairing a standard password with a hardware-generated TOTP code combines a knowledge factor with a possession factor.

Adım Adım Çözüm

Categorize the underlying factor types for authenticating users

Authentication factors are grouped into three primary categories: Knowledge (something you know), Possession (something you have), and Inherence (something you are).

True Multi-Factor Authentication requires combining at least two credentials from different categories.

Evaluate the credential pair containing a static password and a physical keyfob TOTP token

The static password is a knowledge factor and the physical token is a possession factor.

Combining knowledge and possession satisfies the requirement for multi-factor authentication.

Anahtar Kavram

Authentication Factor Categorization (Knowledge, Possession, Inherence)

Soru 782Soru →

A network manager is evaluating centralized AAA protocols to secure network infrastructure devices and access points. Which TWO operational characteristics distinguish TACACS+ from RADIUS? (Select TWO.)

Geçerli olan tümünü seçin

TACACS+ encrypts the entire packet payload, whereas RADIUS encrypts only the password field.

TACACS+ separates Authentication and Authorization into distinct processes, allowing per-command authorization.

TACACS+ operates over transport protocol UDP port 49 to reduce transmission overhead.

TACACS+ combines Authentication and Authorization within single request/response packet pairs.

Cevabı ve açıklamayı göster

Cevap: TACACS+ encrypts the entire packet payload, whereas RADIUS encrypts only the password field.; TACACS+ separates Authentication and Authorization into distinct processes, allowing per-command authorization.

Cevap

TACACS+ encrypts the entire packet payload (rather than just the password field) and separates Authentication and Authorization into distinct processes to allow per-command authorization.

TACACS+ provides full-packet payload encryption (enhancing security for administrative traffic) and maintains modular separation of Authentication and Authorization (enabling per-command authorization policies).

Adım Adım Çözüm

Identify payload encryption behavior for TACACS+ versus RADIUS.

TACACS+ encrypts the entire body of every packet, whereas RADIUS encrypts only the MD5-hashed password attribute.

Full-packet encryption in TACACS+ prevents unauthorized observers from reading usernames, authorization commands, and accounting logs.

Analyze functional decoupling of AAA pillars in TACACS+.

TACACS+ decouples authentication from authorization, enabling granular per-command control during administrative CLI sessions.

RADIUS binds authentication and authorization together in single packet exchanges, making per-command authorization impractical.

Anahtar Kavram

TACACS+ vs RADIUS Architectural and Security Differences

Soru 783Soru →

A network administrator needs to implement centralized AAA for managing CLI access to enterprise switches and routers. The organization security policy strictly mandates per-command authorization checks for every command an administrator executes, as well as full-packet encryption for all AAA network communications. Which protocol and operational characteristic fulfill these security requirements?

TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.

RADIUS, because it separates authentication and authorization to allow command filtering and encrypts the entire packet payload.

RADIUS, because it combines authentication and authorization for lower overhead while providing full-packet payload encryption over UDP.

TACACS+, because it combines authentication and authorization into a single process while encrypting only the password string over TCP.

Cevabı ve açıklamayı göster

Cevap: TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.

Cevap

TACACS+, because it separates AAA functions to support granular per-command authorization and encrypts the complete packet payload.

TACACS+ uses TCP port 49 and completely decouples authentication, authorization, and accounting. This modularity enables per-command authorization, where every CLI command issued by an operator can be evaluated by the server before execution on the device. Furthermore, TACACS+ encrypts the entire payload of every packet, protecting sensitive configuration data and usernames.

Adım Adım Çözüm

Analyze the requirement for per-command authorization.

TACACS+ separates Authentication and Authorization into distinct steps, allowing a device to query the AAA server for permission prior to executing each individual command. RADIUS combines Authentication and Authorization into a single response, making per-command authorization impractical.

Functional separation of AAA components determines the capability for granular command authorization.

Analyze the requirement for full-packet encryption.

TACACS+ encrypts the entire body of the packet following the header. RADIUS only encrypts the password field within the Access-Request packet, leaving username and authorization attributes in cleartext.

Protocol encryption specifications differ between TACACS+ and RADIUS.

Synthesize protocol characteristics to select the correct protocol.

TACACS+ provides both modular AAA separation (enabling per-command authorization) and full-packet encryption, satisfying both criteria.

Only TACACS+ satisfies both administrative access control requirements.

Anahtar Kavram

TACACS+ vs RADIUS Protocol Mechanics

Soru 784Soru →

A network engineer configures a Cisco IOS router with an extended IPv4 Access Control List (ACL) named `SECURE_TRAFFIC` to restrict traffic between internal segments:

text
ip access-list extended SECURE_TRAFFIC
10 permit tcp 172.16.10.0 0.0.0.255 host 172.16.20.10 eq 443
20 deny tcp 172.16.10.0 0.0.0.255 host 172.16.20.10 eq 80

After applying this ACL inbound on interface GigabitEthernet0/0, users in the $172.16.10.0/24$ subnet can access the HTTPS service at $172.16.20.10$ , but all ICMP pings and traffic to other destinations are dropped. Which configuration change will allow non-HTTP traffic while preserving the configured rules?

Add the statement `permit ip 172.16.10.0 0.0.0.255 any` at the end of the ACL.

Remove sequence line 20, as unpermitted TCP traffic is allowed by default.

Replace the wildcard mask `0.0.0.255` with `255.255.255.0` in the existing ACL entries.

Reconfigure `SECURE_TRAFFIC` as a standard ACL using statement sequence numbers 10 and 20.

Cevabı ve açıklamayı göster

Cevap: Add the statement `permit ip 172.16.10.0 0.0.0.255 any` at the end of the ACL.

Cevap

Add an explicit `permit ip` statement to the end of the ACL to permit non-matching traffic.

Cisco IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the list. In this scenario, HTTPS traffic matches line 10 and is allowed, while HTTP traffic matches line 20 and is blocked. However, ICMP and other non-web traffic fall through to the implicit deny clause. Appending an explicit `permit ip 172.16.10.0 0.0.0.255 any` statement ensures that traffic not specifically matched by lines 10 or 20 is permitted through the interface.

Adım Adım Çözüm

Analyze the existing ACL statements and implicit behaviors.

Line 10 permits HTTPS (TCP 443), and line 20 denies HTTP (TCP 80). At the end of every Cisco IPv4 ACL, an invisible implicit `deny ip any any` statement exists.

Traffic not explicitly permitted by preceding statements matches the implicit deny statement and is discarded.

Determine why ICMP and other protocols are failing.

ICMP and other non-TCP/non-web traffic fail to match lines 10 and 20, falling through to the implicit deny clause.

Without an explicit permit rule at the end, all unlisted protocols and destination IPs are blocked.

Identify the proper modification to allow legitimate remaining traffic.

Appending `permit ip 172.16.10.0 0.0.0.255 any` (or `permit ip any any`) allows remaining traffic to pass.

This explicitly permits all other IP traffic originating from the subnet after evaluating the specific HTTPS permit and HTTP deny rules.

Anahtar Kavram

Every IPv4 ACL ends with an invisible implicit deny any clause that drops all unmatched traffic unless explicitly permitted.

Soru 785Soru →

An enterprise network security policy mandates Multi-Factor Authentication for administrative access to core switches. An administrator logs in by entering a static PIN followed by a one-time passcode generated by a physical hardware token. Which statement correctly categorizes the authentication factors used in this scenario?

It combines a knowledge factor (the static PIN) with a possession factor (the physical hardware token).

It relies entirely on two knowledge factors because both the static PIN and the generated passcode are numeric strings entered by the user.

It combines an inherent factor (biometric trait) with a possession factor (the hardware token).

It provides single-factor authentication because RADIUS and TACACS+ servers automatically consolidate PINs and passcodes into one credential payload.

Cevabı ve açıklamayı göster

Cevap: It combines a knowledge factor (the static PIN) with a possession factor (the physical hardware token).

Cevap

The authentication mechanism combines a knowledge factor (static PIN) with a possession factor (hardware token).

The static PIN is a knowledge factor (something you know), and the hardware token is a possession factor (something you have). Using credentials from two distinct categories forms valid Multi-Factor Authentication (MFA).

Adım Adım Çözüm

Identify the first credential component used during authentication.

The static PIN is memorized information, which falls under the 'something you know' (knowledge) factor.

Knowledge factors consist of secrets stored in human memory, such as passwords, passphrases, or PINs.

Identify the second credential component used during authentication.

The hardware token generates a time-based passcode, proving physical ownership of the device, which falls under the 'something you have' (possession) factor.

Possession factors require holding a physical or digital artifact, such as a hardware dongle, smart card, or registered mobile device.

Evaluate whether true multi-factor authentication (MFA) is achieved.

Combining two different factor types (knowledge + possession) satisfies true multi-factor authentication standards.

MFA requires credentials from at least two distinct factor categories (knowledge, possession, inherence).

Anahtar Kavram

Multi-Factor Authentication (MFA) Factor Classification

Soru 786Soru →

In an enterprise network infrastructure, AAA services and security protocols provide identity verification, access control, and activity tracking for administrative sessions. Match each operational requirement or behavioral characteristic on the left with its corresponding AAA framework pillar or security protocol on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The items correctly match as follows: Authorization corresponds to controlling command execution rights; Accounting corresponds to session duration and command execution logging; RADIUS protocol corresponds to password-only encryption over UDP; TACACS+ protocol corresponds to full packet payload encryption over TCP port 49.

Authorization handles user permissions and command execution rights, while Accounting handles session auditing and activity logs. From a protocol standpoint, RADIUS encrypts only the password using UDP, whereas TACACS+ encrypts the entire payload using TCP port 49.

Adım Adım Çözüm

Analyze the access control requirement for command execution.

Matches Authorization.

Authorization defines what actions, services, or commands an authenticated entity is permitted to perform.

Analyze the logging and reporting requirement for CLI activity.

Matches Accounting.

Accounting records session usage data, timestamping, and user activities for audit trails.

Analyze protocol transport and encryption behavior for partial payload protection.

Matches RADIUS protocol.

RADIUS relies on UDP transport and limits its encryption to the user password field.

Analyze protocol transport and encryption behavior for full payload protection.

Matches TACACS+ protocol.

TACACS+ uses reliable TCP transport on port 49 and encrypts all packet payloads.

Anahtar Kavram

AAA Pillars and AAA Protocol Mechanics (TACACS+ vs RADIUS)

Soru 787Soru →

A network administrator must configure a Cisco IOS extended IPv4 Access Control List (ACL) to enforce the following security policy requirements:

1. Permit HTTP traffic (TCP port 80) from any host on the $10.1.1.0/24$ network to the web server at $192.168.10.50$ .
2. Deny all other IP traffic originating specifically from host $10.1.1.25$ to the web server at $192.168.10.50$ .
3. Permit all other TCP traffic from the $10.1.1.0/24$ network to the $192.168.10.0/24$ subnet.
4. Explicitly block all remaining IP traffic from the $10.1.1.0/24$ network to the $192.168.10.0/24$ subnet.

Arrange the following ACL statements in the correct top-down processing order (from line 1 at the top to line 4 at the bottom) so that the security policy is properly enforced.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The statements must be ordered sequentially from most specific exception to most general catch-all: 1) permit tcp 10.1.1.0 0.0.0.255 host 192.168.10.50 eq 80, 2) deny ip host 10.1.1.25 host 192.168.10.50, 3) permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255, and 4) deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255.

Cisco IOS Access Control Lists evaluate entries sequentially from top to bottom. The correct order places the narrowest exception (HTTP permit to host 192.168.10.50) first so that host 10.1.1.25 can still send HTTP traffic. The host-specific deny rule follows immediately to block any non-HTTP traffic from host 10.1.1.25 to 192.168.10.50. Next, the broader subnet-level TCP permit rule allows legitimate TCP applications from the rest of 10.1.1.0/24. Finally, the explicit subnet IP deny statement blocks all other non-TCP IP traffic targeting 192.168.10.0/24.

Adım Adım Çözüm

Identify the most specific permitted exception in the requirements.

HTTP traffic from

10.1.1.0/24

to host

192.168.10.50

must be permitted, even if host

10.1.1.25

sends it.

Cisco ACLs process rules top-down and stop at the first matching statement. Placing HTTP permit statement first guarantees that host

10.1.1.25

can access HTTP services on

192.168.10.50

Place the specific host restriction next.

Statement 'deny ip host 10.1.1.25 host 192.168.10.50' is placed in line 2.

Any non-HTTP IP traffic from

10.1.1.25

192.168.10.50

must be blocked before the general TCP permit rule line evaluates it.

Add the broader subnet-wide TCP permit rule.

Statement 'permit tcp 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255' is placed in line 3.

This allows all remaining TCP connections across the

10.1.1.0/24

and

192.168.10.0/24

subnets for hosts that passed the previous filter checks.

Place the subnet-wide IP restriction statement.

Statement 'deny ip 10.1.1.0 0.0.0.255 192.168.10.0 0.0.0.255' is placed in line 4.

This explicitly drops all non-TCP traffic (e.g., UDP or ICMP) targeting

192.168.10.0/24

from

10.1.1.0/24

Anahtar Kavram

Top-down sequential evaluation in Cisco ACLs (specific rules before general rules)

Soru 788Soru →

During a security compliance audit of a network management architecture, an engineer observes that per-command authorization and granular command accounting cannot be enforced for CLI sessions authenticated via RADIUS. Which protocol characteristic explains this limitation of RADIUS compared to TACACS+?

RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples them to allow independent per-command authorization requests.

RADIUS encrypts the entire packet body using UDP, which prevents the network device from parsing individual privilege-level parameters.

RADIUS uses TCP port 49 for authorization traffic, which does not support multiplexed command execution sessions.

RADIUS relies on local Cisco IOS privilege levels for accounting rather than server-side attribute-value pairs.

Cevabı ve açıklamayı göster

Cevap: RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples them to allow independent per-command authorization requests.

Cevap

RADIUS combines authentication and authorization into unified packet exchanges, whereas TACACS+ decouples all three AAA services to allow granular, per-command authorization requests.

The correct answer highlights that RADIUS couples authentication and authorization together during initial access validation, making it impractical for per-command verification. TACACS+ maintains complete modularity between Authentication, Authorization, and Accounting, sending separate authorization packets for every command executed during an administrative session.

Adım Adım Çözüm

Identify the AAA architectural requirement described in the audit scenario.

The requirement calls for per-command CLI authorization and granular command-level accounting.

Administrative network device management (device administration) often requires verifying each command entered by an engineer against a central policy.

Compare RADIUS and TACACS+ operational mechanics for Authorization.

RADIUS binds Authentication and Authorization into one operational exchange (Access-Request / Access-Accept), sending authorization attributes upon initial login. TACACS+ separates Authentication and Authorization into discrete transaction types.

Decoupling authorization allows TACACS+ to query the AAA server for explicit permission prior to executing individual CLI commands.

Select the option that accurately reflects protocol separation rules.

The option identifying that RADIUS combines authentication and authorization whereas TACACS+ decouples them explains the limitation.

This structural difference makes TACACS+ optimal for device administration and RADIUS optimal for network access control.

Anahtar Kavram

AAA Protocol Functional Separation (TACACS+ vs RADIUS)

Tahmini Süre:1m 30s

Soru 789Soru →

An engineer inspects a Cisco IOS router configured with the following extended IPv4 Access Control List (ACL) applied to an interface:

text
ip access-list extended DATA_SEC
10 permit tcp host 172.16.5.10 192.168.1.0 0.0.0.255 eq 22
20 deny ip 172.16.5.0 0.0.0.255 192.168.1.0 0.0.0.255
30 permit ip 172.16.0.0 0.0.255.255 192.168.1.0 0.0.0.255

A workstation with IPv4 address 172.16.5.20 attempts to establish an HTTP connection (TCP port 80) to a server at 192.168.1.50. What action does the router take when evaluating this packet?

The router drops the packet because it matches sequence line 20.

The router permits the packet because line 30 permits traffic from the broader 172.16.0.0/16 network.

The router permits the packet because line 20 only restricts non-TCP traffic.

The router drops the packet due to the implicit deny statement after skipping line 20.

Cevabı ve açıklamayı göster

Cevap: The router drops the packet because it matches sequence line 20.

Cevap

The router drops the packet because it matches sequence line 20.

The option stating that the router drops the packet because it matches sequence line 20 is correct. Extended ACLs process rules sequentially from top to bottom. Line 10 does not match because the source address is 172.16.5.20 (not 172.16.5.10) and the port is 80 (not 22). Line 20 matches because its wildcard mask encompasses 172.16.5.20, its destination mask encompasses 192.168.1.50, and the protocol specification 'ip' matches all IPv4 protocols, including TCP. Upon matching line 20, the router executes the deny action and halts further ACL evaluation.

Adım Adım Çözüm

Evaluate line 10

No match

Line 10 specifically matches source host 172.16.5.10 and destination port 22 (SSH). The incoming packet originates from 172.16.5.20 and targets port 80 (HTTP).

Evaluate line 20

Match found (Action: Deny)

Line 20 specifies 'deny ip 172.16.5.0 0.0.0.255 192.168.1.0 0.0.0.255'. The source IP 172.16.5.20 belongs to the 172.16.5.0/24 network, the destination 192.168.1.50 belongs to 192.168.1.0/24, and the 'ip' keyword covers TCP port 80.

Determine final disposition

Packet dropped immediately

Once a match occurs in a Cisco IOS IPv4 ACL, processing stops immediately. Line 30 and the implicit deny clause are not evaluated.

Anahtar Kavram

Extended IPv4 ACL Top-Down Sequential Evaluation and Protocol Scope

Tahmini Süre:1m 15s

Soru 790Soru →

An enterprise network operations team is evaluating centralized security protocols for authenticating and managing access across core infrastructure devices. Which TWO operational characteristics distinguish TACACS+ from RADIUS? (Select TWO.)

Geçerli olan tümünü seçin

TACACS+ operates over connection-oriented TCP port 49, whereas RADIUS utilizes connectionless UDP ports 1812 and 1813.

TACACS+ restricts encryption to only the password field in access request frames, whereas RADIUS encrypts the entire body of the packet.

TACACS+ modularly decouples authentication from authorization, whereas RADIUS merges authentication and authorization into unified packet flows.

TACACS+ is the standard protocol for 802.1X port-based network authentication, whereas RADIUS is designed exclusively for network device CLI session control.

Cevabı ve açıklamayı göster

Cevap: TACACS+ operates over connection-oriented TCP port 49, whereas RADIUS utilizes connectionless UDP ports 1812 and 1813.; TACACS+ modularly decouples authentication from authorization, whereas RADIUS merges authentication and authorization into unified packet flows.

Cevap

TACACS+ operates over TCP port 49 while RADIUS uses UDP ports 1812 and 1813, and TACACS+ modularly decouples authentication from authorization while RADIUS merges them into unified packet flows.

TACACS+ uses connection-oriented TCP port 49 and provides modular separation of authentication and authorization functions, allowing granular control over administrative commands. In contrast, RADIUS uses UDP ports 1812/1813 and combines authentication and authorization.

Adım Adım Çözüm

Analyze transport protocol selection and default port assignments for TACACS+ and RADIUS.

TACACS+ uses TCP port 49 for reliable packet transport, while RADIUS operates over UDP using port 1812 for authentication/authorization and port 1813 for accounting.

TCP guarantees receipt notification and session establishment, which is suited for device management traffic.

Compare functional architecture and separation of AAA pillars across both protocols.

TACACS+ separates authentication, authorization, and accounting into distinct mechanisms, whereas RADIUS combines authentication and authorization into unified exchanges.

Decoupling authorization from authentication allows granular per-command permissions during active CLI administration sessions.

Anahtar Kavram

Protocol mechanics and functional differences between TACACS+ and RADIUS in enterprise AAA implementations.

Soru 791Soru →

A network administrator configures a Cisco IOS router with the following extended IPv4 access control list (ACL) applied in the outbound direction on interface GigabitEthernet0/1:

text
ip access-list extended OUTBOUND_FILTER
permit tcp 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22
deny ip host 172.16.20.5 192.168.1.0 0.0.0.255
permit ip 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255

Which two statements correctly describe how traffic sent through GigabitEthernet0/1 will be evaluated by this access list?

Geçerli olan tümünü seçin

SSH traffic originating from host 172.16.20.5 and destined for 192.168.1.50 is permitted.

Traffic originating from host 172.16.20.10 and destined for an external address of 8.8.8.8 is dropped.

ICMP traffic originating from host 172.16.20.5 and destined for 192.168.1.50 is permitted.

Traffic originating from host 172.16.20.10 and destined for an external address of 8.8.8.8 is permitted.

Cevabı ve açıklamayı göster

Cevap: SSH traffic originating from host 172.16.20.5 and destined for 192.168.1.50 is permitted.; Traffic originating from host 172.16.20.10 and destined for an external address of 8.8.8.8 is dropped.

Cevap

SSH traffic from host 172.16.20.5 to 192.168.1.50 is permitted because it matches the top rule first, and traffic from host 172.16.20.10 to 8.8.8.8 is dropped due to the implicit deny at the end of the ACL.

Cisco IPv4 ACLs evaluate statements sequentially in top-down order and stop processing as soon as a match is found. For SSH traffic from host 172.16.20.5, line 1 matches because SSH uses TCP port 22, so the packet is permitted immediately before line 2 can deny it. For traffic destined for 8.8.8.8, none of the explicit rules match the destination subnet, so the packet hits the implicit deny statement at the end of the list and is dropped.

Adım Adım Çözüm

Evaluate top-down logic for SSH traffic from 172.16.20.5 to 192.168.1.50 (destination port 22)

The packet matches line 1 ('permit tcp 172.16.20.0 0.0.0.255 192.168.1.0 0.0.0.255 eq 22'). The router permits the packet immediately without checking further lines.

Cisco ACLs process rules sequentially from top to bottom and terminate evaluation upon the first successful match.

Evaluate non-matching traffic destined for an unlisted destination address (8.8.8.8)

The packet fails matching conditions for lines 1, 2, and 3 because the destination address 8.8.8.8 does not match 192.168.1.0 0.0.0.255.

All unlisted traffic falls through to the unwritten, mandatory 'deny ip any any' rule present at the end of every IPv4 ACL.

Anahtar Kavram

Sequential Top-Down ACL Evaluation and Implicit Deny Behavior

Soru 792Soru →

A network security technician is reviewing the AAA architecture for managing network switches. The design mandates that administrative command authorization must be handled independently from initial authentication, and all traffic between the network access server and the AAA server must encrypt the entire packet payload. Which protocol should be deployed to satisfy these security requirements?

TACACS+

RADIUS

802.1X

SNMPv3

Cevabı ve açıklamayı göster

Cevap: TACACS+

Cevap

TACACS+ is the correct choice because it decouples authentication from authorization and encrypts the entire packet payload between the client device and the server.

TACACS+ meets both criteria specified in the scenario. It completely separates authentication, authorization, and accounting functions—enabling granular per-command authorization—and encrypts the entire packet payload sent across the network.

Adım Adım Çözüm

Analyze requirement 1: Separation of authentication and command authorization.

TACACS+ modularly separates authentication, authorization, and accounting, allowing granular command authorization per user. RADIUS combines authentication and authorization into one process.

Administrative device access requires strict per-command authorization separate from logging in.

Analyze requirement 2: Full packet payload encryption.

TACACS+ encrypts the entire body of the packet. RADIUS encrypts only the password attribute in the access-request packet.

Encrypting the entire body ensures usernames, commands, and operational parameters are protected across the network.

Anahtar Kavram

TACACS+ vs RADIUS protocol capabilities and functional separation in the AAA framework

Tahmini Süre:1m 0s

Soru 793Soru →

Match each AAA framework component or protocol characteristic on the left with its correct functional description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Authentication matches identity verification; Authorization matches permission control for commands and resources; Accounting matches activity logging and tracking; TACACS+ Payload Security matches encrypting the entire packet body.

Authentication verifies identity, Authorization controls access permissions and allowed CLI commands, Accounting logs user activity for security compliance, and TACACS+ encrypts the entire packet payload.

Adım Adım Çözüm

Identify the primary function of Authentication within the AAA framework.

Authentication answers 'Who are you?' by verifying user credentials such as usernames and passwords.

It acts as the initial control point to validate user identity prior to granting system entry.

Identify the primary function of Authorization.

Authorization answers 'What can you do?' by determining privilege levels and permitted commands.

Once identity is established, privilege boundaries dictate accessible resources.

Identify the primary function of Accounting.

Accounting answers 'What did you do?' by collecting statistics, command history, and session durations.

Security compliance mandates keeping track of active sessions and administrative actions.

Analyze TACACS+ encryption behavior.

TACACS+ encrypts the entire payload body of each frame sent over TCP port 49.

This provides end-to-end payload confidentiality, contrasting with RADIUS which encrypts only the password field.

Anahtar Kavram

AAA Framework Pillars and TACACS+ vs RADIUS Security Mechanics

Soru 794Soru →

A network administrator must configure a Cisco IOS extended IPv4 Access Control List (ACL) numbered 105 to enforce the following security policy for outbound traffic from an internal subnet:

1. Permit HTTPS traffic originating from subnet 192.168.10.0/24 destined to the database server at 10.0.0.50.
2. Deny all other TCP traffic originating from subnet 192.168.10.0/24 destined to the database server at 10.0.0.50.
3. Permit all remaining IP traffic originating from subnet 192.168.10.0/24 to any destination.

Arrange the ACL statements in the correct top-down sequential order required to successfully enforce this security policy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order of statements from top to bottom is: 1) access-list 105 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.50 eq 443, 2) access-list 105 deny tcp 192.168.10.0 0.0.0.255 host 10.0.0.50, 3) access-list 105 permit ip 192.168.10.0 0.0.0.255 any, 4) (Implicit deny ip any any).

Cisco IPv4 access control lists execute line-by-line starting from the top entry (lowest sequence number) and stop evaluating as soon as a match occurs. Therefore, rules must strictly proceed from most specific (permitting HTTPS port 443 to the single host 10.0.0.50) to moderately specific (denying all other TCP to host 10.0.0.50), followed by broader subnet access (permitting all IP from 192.168.10.0/24), and finally concluding with the built-in implicit deny rule.

Adım Adım Çözüm

Identify the most specific requirement

HTTPS traffic (TCP port 443) from 192.168.10.0/24 to host 10.0.0.50 is the most narrow requirement.

Cisco ACLs process sequentially top-down; specific permit rules must precede broader deny rules to prevent legitimate traffic from being matched early and dropped.

Place the specific host/port restriction next

Denying general TCP traffic from 192.168.10.0/24 to host 10.0.0.50 follows the HTTPS permit rule.

This blocks all other TCP application ports destined for 10.0.0.50 without affecting HTTPS traffic matched in step 1.

Place the general subnet permit rule

Permitting all IP traffic from 192.168.10.0/24 to any destination is placed after host-specific TCP rules.

This guarantees other destinations and protocols (such as ICMP or traffic to other servers) from subnet 192.168.10.0/24 are permitted.

Account for implicit ACL behavior

The implicit deny ip any any statement automatically resides at the end of the access list.

Cisco IOS automatically appends an invisible implicit deny to the end of every ACL, dropping any traffic that fails to match any explicit permit entries above.

Anahtar Kavram

Top-Down Sequential Processing and Specific-to-General Rule Ordering in Cisco IPv4 Extended ACLs

Soru 795Soru →

A network engineer configures an extended IPv4 Access Control List (ACL) on a router to allow web access from an internal client subnet ( $172.16.20.0/24$ ) to a web server at $192.168.1.100$ . The router has the following configuration lines applied:

text
access-list 105 permit tcp 172.16.20.0 0.0.0.255 host 192.168.1.100 eq 80
access-list 105 permit tcp 172.16.20.0 0.0.0.255 host 192.168.1.100 eq 443

When a host with IP address $172.16.20.15$ sends ICMP echo request (ping) packets to $192.168.1.100$ , how does the router process this traffic?

The router drops the ICMP packets because they do not match any explicit permit entry and are filtered by the implicit deny statement at the end of the ACL.

The router permits the ICMP packets because network control protocols bypass transport-layer ACL filtering by default.

The router forwards the ICMP packets because the wildcard mask 0.0.0.255 permits all IP traffic originating from the 172.16.20.0/24 subnet.

The router drops the ICMP packets only if an explicit access-list 105 deny icmp any any statement is manually added to the end of the list.

Cevabı ve açıklamayı göster

Cevap: The router drops the ICMP packets because they do not match any explicit permit entry and are filtered by the implicit deny statement at the end of the ACL.

Cevap

The router drops the ICMP packets because they do not match any explicit permit statement and are dropped by the implicit deny clause.

Cisco IPv4 ACLs evaluate traffic line-by-line in sequential order. Extended ACLs require exact protocol matching. Because the configuration only contains permit statements for TCP (ports 80 and 443), ICMP packets fail to match any entry. Traffic that does not match any explicit rule is dropped by the mandatory implicit deny clause at the end of the ACL.

Adım Adım Çözüm

Examine the incoming packet characteristics against the configured extended ACL rules.

The packet protocol is ICMP, the source address is

172.16.20.15

, and the destination address is

192.168.1.100

Extended ACLs check the Layer 3 protocol type, source address, destination address, and Layer 4 port numbers.

Evaluate the packet sequentially against line 1 and line 2 of access-list 105.

Line 1 permits TCP port 80; line 2 permits TCP port 443. Neither line matches ICMP traffic.

ICMP is an IP protocol distinct from TCP. Protocol matching is strict in Cisco IOS extended ACLs.

Evaluate the packet against the end of the access list.

The packet hits the invisible implicit deny statement (implicit deny ip any any) and is discarded by the router.

Cisco IOS automatically appends an implicit deny clause to the end of every IPv4 access control list.

Anahtar Kavram

ACL Sequential Evaluation and the Implicit Deny Clause

Soru 796Soru →

A network administrator needs to deploy a centralized AAA solution specifically for managing router and switch command-line interface (CLI) administration. The security team mandates that every individual command entered by an administrator must be evaluated and authorized independently, and all data within the protocol packet body must be encrypted during transport. Which protocol satisfies these operational requirements?

TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

RADIUS, because it encrypts the entire packet payload and combines authentication with authorization.

RADIUS, because it utilizes TCP port 49 to provide granular per-command authorization.

TACACS+, because it operates over UDP ports 1812 and 1813 to deliver encrypted per-command authorization.

Cevabı ve açıklamayı göster

Cevap: TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

Cevap

TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for administrative network device management. It uses TCP port 49 for reliable transport, encrypts the entire payload of every packet, and decouples authentication, authorization, and accounting. This separation permits individual command authorization checks for administrative sessions.

Adım Adım Çözüm

Analyze the requirements for command authorization and encryption.

The requirement specifies per-command authorization and full packet body payload encryption.

Device management requires granular authorization per CLI command, whereas network access control (802.1X) typically uses user/port-level authorization.

Evaluate TACACS+ capabilities against the requirements.

TACACS+ uses TCP port 49, separates Authentication and Authorization into modular components (allowing per-command check), and encrypts the complete packet payload.

Separating authentication from authorization allows a network device to query the AAA server for authorization rights on every CLI command executed.

Contrast TACACS+ capabilities with RADIUS capabilities.

RADIUS operates over UDP (ports 1812/1813), combines authentication and authorization into a unified response, and encrypts only the user password field within packets.

Because RADIUS combines authentication and authorization, it cannot perform per-command authorization checks efficiently.

Anahtar Kavram

TACACS+ vs RADIUS Architectural and Functional Differences

Tahmini Süre:1m 15s

Soru 797Soru →

An enterprise network engineering team is deploying AAA services across core routers and wireless LAN controllers. The design requires differentiating protocols used for CLI administrative access versus port-based network access control. Which TWO of the following statements correctly compare the operational characteristics of TACACS+ and RADIUS in this environment?

Geçerli olan tümünü seçin

RADIUS combines authentication and authorization into unified transaction packets, whereas TACACS+ decouples authentication, authorization, and accounting into distinct and independent processes.

TACACS+ relies on UDP port 49 for lightweight message transmission, whereas RADIUS relies on TCP port 1812 to guarantee connection-oriented transport.

TACACS+ encrypts the entire body of the packet following the header, whereas RADIUS encrypts only the password field within the packet payload.

RADIUS is optimized for administrative CLI per-command authorization, whereas TACACS+ is primarily used for 802.1X port-based network client access control.

Cevabı ve açıklamayı göster

Cevap: RADIUS combines authentication and authorization into unified transaction packets, whereas TACACS+ decouples authentication, authorization, and accounting into distinct and independent processes.; TACACS+ encrypts the entire body of the packet following the header, whereas RADIUS encrypts only the password field within the packet payload.

Cevap

The correct statements are that RADIUS combines authentication and authorization into unified transaction packets while TACACS+ decouples them into distinct processes, and TACACS+ encrypts the entire body of the packet following the header while RADIUS encrypts only the password field.

RADIUS integrates authentication and authorization into single transactions (Access-Request/Access-Accept), while TACACS+ decouples all three AAA elements. Additionally, TACACS+ encrypts the entire body of every packet following the header, whereas RADIUS leaves packet headers and non-password attributes unencrypted in transit.

Adım Adım Çözüm

Analyze protocol architecture and functional separation

Identify that RADIUS combines authentication and authorization, while TACACS+ separates AAA functions.

RADIUS sends authorization attributes inside authentication response packets (Access-Accept), whereas TACACS+ allows granular, separate authorization requests.

Evaluate transport layer protocols and port assignments

Verify transport protocols: TACACS+ uses TCP port 49; RADIUS uses UDP ports 1812 and 1813.

TACACS+ requires connection-oriented TCP reliability, whereas RADIUS uses connectionless UDP.

Examine packet payload encryption mechanisms

Determine packet encryption scope for both protocols.

TACACS+ encrypts the entire packet body following the header, protecting all AAA data, whereas RADIUS encrypts only the password attribute.

Anahtar Kavram

Operational differences between TACACS+ and RADIUS protocols within the AAA framework.

Soru 798Soru →

A network security policy requires allowing database traffic to a server while restricting other communications. An engineer applies the following named extended IPv4 Access Control List (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco router:

text
ip access-list extended RESTRICT_DB
permit tcp 10.20.10.0 0.0.0.255 host 10.20.30.50 eq 1433
deny ip 10.20.10.0 0.0.0.255 host 10.20.30.50

Users on subnet $10.20.10.0/24$ report that they cannot reach a web server located at $10.20.30.80$ over HTTP (TCP port 80). Which statement explains why the router drops the HTTP traffic destined for $10.20.30.80$ ?

The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

The second rule contains a wildcard mask of 0.0.0.255 that blocks access to the entire 10.20.30.0/24 destination subnet.

The router processes the deny statement before evaluating the permit statement due to named ACL priority rules.

Extended ACLs applied inbound on an interface are only capable of filtering traffic destined for hosts on that local interface.

Cevabı ve açıklamayı göster

Cevap: The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

Cevap

The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement in the list, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the ACL and is dropped. Since HTTP traffic to

10.20.30.80

matches neither line 1 (which targets

10.20.30.50:1433

) nor line 2 (which targets host

10.20.30.50

), it is dropped by the implicit deny.

Adım Adım Çözüm

Analyze the sequential processing of the ACL for traffic destined to 10.20.30.80 on TCP port 80.

Line 1 matches destination 10.20.30.50 on port 1433 (No match). Line 2 matches destination 10.20.30.50 (No match).

Traffic to host 10.20.30.80 port 80 does not satisfy the criteria of either explicit rule.

Determine the default behavior when a packet reaches the end of an ACL without matching any explicit entry.

The packet encounters the implicit 'deny ip any any' rule.

All Cisco IOS IPv4 ACLs have an invisible final statement that drops any packet not explicitly permitted.

Anahtar Kavram

ACL Sequential Evaluation and Implicit Deny Any

Soru 799Soru →

A network administrator is upgrading a remote office wireless LAN from WPA2-Personal to WPA3-Personal. The main objective of this upgrade is to protect user traffic against offline dictionary attacks if an attacker captures the initial wireless association exchange. Which key exchange mechanism implemented in WPA3-Personal mitigates this vulnerability?

Simultaneous Authentication of Equals (SAE)

Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)

Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)

Temporal Key Integrity Protocol (TKIP)

Cevabı ve açıklamayı göster

Cevap: Simultaneous Authentication of Equals (SAE)

Cevap

Simultaneous Authentication of Equals (SAE) is the key exchange mechanism in WPA3-Personal that prevents offline dictionary attacks.

Simultaneous Authentication of Equals (SAE) is the fundamental key exchange protocol defined in WPA3-Personal. Based on the Dragonfly key exchange algorithm, SAE provides zero-knowledge proof during authentication, making captured handshakes immune to offline dictionary attacks.

Adım Adım Çözüm

Identify the deployment mode and vulnerability mentioned in the scenario

The scenario highlights upgrading WPA2-Personal to WPA3-Personal specifically to protect against offline dictionary password-guessing attacks resulting from captured handshakes.

WPA2-Personal relies on the 4-way handshake using a Pre-Shared Key (PSK), which is vulnerable to offline dictionary/brute-force attacks if captured.

Determine the WPA3-Personal authentication enhancement mechanism

WPA3-Personal replaces the 4-way PSK handshake with Simultaneous Authentication of Equals (SAE), based on the Dragonfly handshake.

SAE provides forward secrecy and renders captured handshake data useless for offline password cracking attempt tools.

Anahtar Kavram

WPA3-Personal Key Exchange (SAE vs WPA2 PSK)

Soru 800Soru →

A network security administrator is configuring centralized access control services across enterprise switches and routers. Match each operational capability or requirement on the left with the correct AAA framework element or protocol specification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Per-command CLI authorization matches TACACS+ architecture leveraging TCP port 49 and decoupled AAA functions. Full payload body encryption matches TACACS+ transport security mechanism providing full-body packet protection. Coupled authentication and authorization matches RADIUS protocol operation leveraging UDP ports 1812 and 1813. Session tracking and audit logging matches the Accounting component of the AAA framework.

TACACS+ uses TCP port 49 and decouples AAA functions to permit per-command authorization and full packet payload encryption. RADIUS operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), combining authentication and authorization in a single transaction while only encrypting passwords. Accounting tracks user session metrics and activity logs.

Adım Adım Çözüm

Analyze protocol modularity for per-command authorization.

Identified TACACS+ as the protocol that decouples AAA services, allowing individual command authorization over TCP port 49.

RADIUS binds authentication and authorization together, making fine-grained CLI command authorization impossible.

Evaluate packet encryption methods between AAA protocols.

Matched full body encryption to TACACS+, which encrypts the entire payload after the 12-byte header.

RADIUS only encrypts the password field in Access-Request packets, leaving the rest of the packet body in cleartext.

Identify protocol binding for combined authentication/authorization.

Matched combined authentication and authorization to RADIUS over UDP ports 1812/1813.

RADIUS returns authorization attributes directly inside the Access-Accept response during authentication.

Determine the functional role of audit logging in AAA.

Matched session duration and command execution tracking to the Accounting framework pillar.

Accounting logs user activities and resource usage after authentication and authorization occur.

Anahtar Kavram

AAA Protocol Mechanics & Functional Separation (TACACS+ vs RADIUS)

Tahmini Süre:1m 30s

ÖncekiSayfa 40 / 100Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram