Tüm alıştırma soruları

1987 soru

Tüm türler1,987 Çoktan seçmeli1,020 Çoklu seçim452 Sayısal18 Eşleştirme229 Sıralama203 Boşluk doldurma22 Kısa cevap43

A network administrator is conducting a security baseline review for an enterprise network to distinguish key security concepts and apply suitable mitigation strategies. Which two statements accurately describe key security principles or valid mitigation practices? (Select two.)

Geçerli olan tümünü seçin

A vulnerability represents a weakness or flaw in system design, implementation, or configuration that could be exploited by a threat actor.

Implementing 802.1X Port-Based Network Access Control mitigates unauthorized network connectivity by authenticating endpoints before granting switch port access.

TACACS+ encrypts only the user password field within the packet payload, leaving authorization details unencrypted during AAA communication.

Enabling switch port security with sticky MAC address learning dynamically saves learned addresses directly into the startup configuration file.

Cevabı ve açıklamayı göster

Cevap: A vulnerability represents a weakness or flaw in system design, implementation, or configuration that could be exploited by a threat actor.; Implementing 802.1X Port-Based Network Access Control mitigates unauthorized network connectivity by authenticating endpoints before granting switch port access.

Cevap

The correct statements define a vulnerability as a system flaw or weakness that can be exploited by a threat, and describe 802.1X Port-Based Network Access Control as a valid mitigation that authenticates devices before granting network switch port access.

A vulnerability is defined as an internal weakness or flaw in system design, software, or configuration that can be exploited by a threat actor. 802.1X Network Access Control serves as a robust mitigation mechanism by forcing endpoints to authenticate before granting access to the LAN switch port.

Adım Adım Çözüm

Differentiate security baseline concepts such as threats, vulnerabilities, and mitigations.

Identify that a vulnerability is a weakness in code, design, or implementation that creates potential exposure.

Accurate conceptual taxonomy is necessary for risk assessment and system hardening.

Evaluate identity and access control mitigations for local network access.

Confirm that 802.1X enforces port-level security by restricting traffic until authentication succeeds.

Network access controls prevent unauthorized devices from attaching to switch ports.

Analyze distractors related to AAA protocols and switch security operations.

Recognize that TACACS+ encrypts the complete packet payload (unlike RADIUS) and that sticky MAC addresses reside in running-config until saved to NVRAM.

Misinterpreting protocol mechanics or configuration state persistence leads to invalid security assumptions.

Anahtar Kavram

Key Security Terminology and Network Access Mitigations

Soru 1762Soru →

Match each network security threat on the left with its corresponding primary mitigation strategy on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Ransomware infection matches maintaining immutable offsite backups and deploying endpoint protection software. IP address spoofing matches configuring anti-spoofing Access Control Lists and Unicast Reverse Path Forwarding. Password brute-force attack matches enforcing multi-factor authentication and account lockout threshold policies. Unescorted server room access matches installing biometric scanners, smart card locks, and physical security logs.

Each threat item is correctly paired with the corresponding operational defense: Ransomware requires immutable backups and endpoint detection; IP spoofing requires packet header validation via anti-spoofing ACLs or uRPF; Brute-force attacks require authentication controls like lockout thresholds and multi-factor authentication; and unauthorized facility access requires physical security controls such as biometric devices and locks.

Adım Adım Çözüm

Analyze each security threat to determine its attack vector.

Identified four distinct threat vectors: file encryption (Ransomware), packet header manipulation (IP spoofing), credential guessing (Brute-force), and physical intrusion (Server room access).

Selecting the correct mitigation requires identifying whether the threat is physical, network-layer, identity-based, or software-based.

Match each threat vector with the technical or physical security control engineered to mitigate it.

Ransomware maps to backups/endpoint defense; IP spoofing maps to ACLs/uRPF; Brute-force maps to MFA/Lockout policies; Physical intrusion maps to biometrics/badge controls.

Effective defense-in-depth requires applying targeted controls aligned with specific vulnerability types and threat vectors.

Anahtar Kavram

Security Threats and Mitigation Controls

Soru 1763Soru →

A network administrator is performing an initial configuration of SSH version 2 on a new branch router (Branch-R1). Place the required configuration steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for configuring SSH v2 on a Cisco IOS device is: first, set a non-default hostname; second, configure an IP domain name; third, generate the RSA key pair (minimum 768 bits for SSH v2); and fourth, configure line VTY settings to accept SSH input and require local login authentication.

SSH configuration in Cisco IOS follows a strict dependency sequence. First, a non-default hostname and an IP domain name must be defined so that the system has a valid Fully Qualified Domain Name (FQDN). Second, generating an RSA key pair using the FQDN automatically activates the SSH service. Finally, line VTY settings must be configured to bind incoming management traffic to SSH and enforce local login credentials.

Adım Adım Çözüm

Set a non-default hostname (e.g., hostname Branch-R1).

Establishes the host portion of the router's FQDN.

The default router hostname 'Router' is invalid for RSA key pair creation.

Define an IP domain name (e.g., ip domain-name cisco.com).

Completes the router's FQDN (Branch-R1.cisco.com).

Cisco IOS uses the FQDN as the name label when generating RSA keys.

Generate RSA keys with at least 768 bits (e.g., crypto key generate rsa modulus 1024).

Activates the SSH server subsystem on the device.

SSH v2 requires an RSA key pair; key sizes below 768 bits force the router to default to SSH v1.5.

Configure VTY lines (line vty 0 4) with transport input ssh and login local.

Disables unencrypted management (Telnet) and forces authentication against local device credentials.

Ensures remote sessions use secure SSH transport and authenticate via local database users.

Anahtar Kavram

Cisco IOS SSH Configuration Prerequisites and Sequence

Soru 1764Soru →

A network engineer observes that periodic bandwidth statistics collected from a 10-GigabitEthernet interface on a Cisco router display inaccurate, negative, or wrapping byte counts during peak traffic hours. The Network Management System (NMS) currently uses SNMPv1 to poll standard 32-bit interface counters (`ifInOctets` and `ifOutOctets`). Which SNMP version capability and MIB object group should be deployed to resolve this counter rollover issue?

Migrate to SNMPv2c or SNMPv3 to poll 64-bit High Capacity (HC) counters (`ifHCInOctets` and `ifHCOutOctets`).

Retain SNMPv1 but increase the NMS polling frequency to poll 32-bit counters every 2 seconds.

Configure SNMP Traps on the router to automatically push 32-bit counter values whenever threshold limits are exceeded.

Enable SNMPv3 authPriv security level to automatically encrypt and expand 32-bit counter fields into 64-bit values.

Cevabı ve açıklamayı göster

Cevap: Migrate to SNMPv2c or SNMPv3 to poll 64-bit High Capacity (HC) counters (`ifHCInOctets` and `ifHCOutOctets`).

Cevap

Migrate to SNMPv2c or SNMPv3 to poll 64-bit High Capacity (HC) counters (`ifHCInOctets` and `ifHCOutOctets`).

High-speed interfaces (such as GigabitEthernet and 10-GigabitEthernet) rapidly roll over standard 32-bit MIB counters (`ifInOctets`/`ifOutOctets`) supported by SNMPv1. SNMPv2c and SNMPv3 introduce IF-MIB 64-bit High Capacity (HC) counters (`ifHCInOctets`/`ifHCOutOctets`), which allow accurate traffic monitoring without counter wrapping.

Adım Adım Çözüm

Analyze interface speed and counter limits

A 10 Gbps interface transmits up to

1.25 \times 10^9

bytes per second. A 32-bit counter caps at

2^{32} - 1 \approx 4.29 \times 10^9

bytes.

At maximum capacity, a 32-bit counter rolls over approximately every 3.4 seconds (

4.29 \times 10^9 / 1.25 \times 10^9

Evaluate SNMP version features regarding MIB counter capacity

SNMPv1 is restricted to 32-bit counter objects. SNMPv2c and SNMPv3 introduced 64-bit High Capacity (HC) MIB objects in IF-MIB.

64-bit counters (

2^{64} - 1 \approx 1.84 \times 10^{19}

) take hundreds of years to roll over even on 10 Gbps interfaces.

Select the correct SNMP configuration update

Upgrading to SNMPv2c or SNMPv3 and requesting `ifHCInOctets` / `ifHCOutOctets` provides accurate bandwidth metrics.

This directly resolves high-speed link counter rollover issues.

Anahtar Kavram

64-bit MIB High Capacity (HC) counters introduced in SNMPv2c/SNMPv3 for high-speed interface monitoring

Soru 1765Soru →

An enterprise network administrator needs to securely connect a fixed branch office network to the corporate headquarters over the public Internet. The connection must operate transparently to end users and encrypt all traffic between the two network gateways without requiring software installation on individual host computers. Which VPN deployment model and technology best satisfies this requirement?

Site-to-Site IPsec VPN

Remote Access SSL VPN

Remote Access IPsec VPN using Cisco AnyConnect

Clientless SSL VPN via web browser portal

Cevabı ve açıklamayı göster

Cevap: Site-to-Site IPsec VPN

Cevap

Site-to-Site IPsec VPN

A Site-to-Site IPsec VPN is specifically engineered to securely connect two static locations across an untrusted public network. Gateway devices (such as Cisco ISR routers or ASA/FTD firewalls) handle all encryption and decryption at the network boundary, allowing end hosts on both subnets to communicate seamlessly without requiring local client software.

Adım Adım Çözüm

Identify the topology requirement from the scenario

The requirement calls for interconnecting two fixed site locations (branch office and corporate headquarters) using infrastructure devices.

Differentiating between site-to-site connectivity and individual user connectivity determines whether a Site-to-Site or Remote Access VPN model is needed.

Evaluate host software dependencies and transparency requirements

A Site-to-Site IPsec VPN uses routers or firewalls as dedicated tunnel endpoints to encrypt and decrypt network traffic transparently, requiring zero configuration or software on end-user hosts.

Remote Access solutions (both SSL and IPsec host-based models) rely on individual endpoint software or user sessions.

Anahtar Kavram

Site-to-Site vs Remote Access VPN Topology Characteristics

Soru 1766Soru →

A company requires a VPN solution for mobile employees working from personal laptops. The organization wants to grant secure remote access to internal web-based applications without requiring users to install dedicated VPN client software on their endpoints. Which VPN deployment model best satisfies this requirement?

Clientless SSL VPN

Site-to-Site IPsec VPN

Client-based IPsec VPN

GRE tunnel with IPsec protection

Cevabı ve açıklamayı göster

Cevap: Clientless SSL VPN

Cevap

Clientless SSL VPN is the appropriate solution because it provides web browser-based access to internal web applications without requiring client software installation.

Clientless SSL VPN uses standard web browsers on the user device to establish a secure SSL/TLS connection back to the corporate ASA/Secure Firewall device, permitting access to web-based internal services without requiring local administrative privileges or software installation.

Adım Adım Çözüm

Analyze the business requirements from the scenario.

Identified key requirements: individual mobile user access (Remote Access VPN) and no pre-installed client software required on endpoints.

VPN solutions differ by topology (Site-to-Site vs Remote Access) and endpoint client requirements.

Evaluate candidate VPN technologies based on endpoint software requirements.

Clientless SSL VPN relies on Web browser TLS/SSL sessions, whereas IPsec and client-based SSL VPNs require dedicated software applications to be installed on the client device.

Browsers natively support TLS/SSL, eliminating client installation overhead.

Select the option that matches both Remote Access topology and zero-client installation requirements.

Clientless SSL VPN is chosen as the correct deployment model.

It fulfills access needs specifically for web resources without endpoint software deployment.

Anahtar Kavram

Remote Access VPN Technologies: Clientless SSL VPN vs Client-based VPN

Soru 1767Soru →

A network administrator is troubleshooting IP address allocation for clients on subnet $10.20.30.0/24$ . Clients connected to router interface GigabitEthernet0/0 ( $10.20.30.1/24$ ) fail to acquire dynamic IP addresses from a centralized DHCP server at $172.16.50.10$ . An audit of the router configuration shows that `ip helper-address 172.16.50.10` was configured on interface GigabitEthernet0/1 (the egress interface facing the DHCP server), while GigabitEthernet0/0 has no helper address configured. Which statement correctly explains why the clients on GigabitEthernet0/0 fail to receive IP leases?

The broadcast DHCP DISCOVER messages received on GigabitEthernet0/0 are dropped by default because the `ip helper-address` command must be applied on the client-facing ingress interface to convert local broadcasts into targeted unicast packets.

The router relays the DHCP DISCOVER message but populates the gateway IP address (giaddr) field with GigabitEthernet0/1's IP address, causing the DHCP server to select an incorrect address pool.

Routers automatically flood Layer 2 DHCP broadcasts across all operational interfaces by default, but the egress interface GigabitEthernet0/1 drops the frame because Option 82 metadata is missing.

The client DHCP DISCOVER broadcast reaches the server via default routing, but the server drops the request because the source IP address of the broadcast packet is unroutable.

Cevabı ve açıklamayı göster

Cevap: The broadcast DHCP DISCOVER messages received on GigabitEthernet0/0 are dropped by default because the `ip helper-address` command must be applied on the client-facing ingress interface to convert local broadcasts into targeted unicast packets.

Cevap

DHCP clients issue local broadcast messages to discover servers. Because routers do not forward broadcasts, the `ip helper-address` command must be applied directly to the client-facing interface (GigabitEthernet0/0). This instructs the router to intercept client broadcasts, set the gateway IP address (giaddr) field to GigabitEthernet0/0's IP address, and unicast the DHCP requests to the remote DHCP server.

Adım Adım Çözüm

Analyze client packet behavior at the gateway interface

Clients broadcast DHCP DISCOVER packets with source 0.0.0.0 and destination 255.255.255.255 on GigabitEthernet0/0.

DHCP clients do not yet have an IP address and must use local subnetwork broadcasts to find a server.

Evaluate router default broadcast handling

Router interface GigabitEthernet0/0 drops the 255.255.255.255 broadcast packet because no relay mechanism is active on that interface.

Cisco IOS routers break broadcast domains and drop limited broadcast frames by default.

Verify correct placement of the `ip helper-address` command

Applying `ip helper-address 172.16.50.10` under `interface GigabitEthernet0/0` enables the DHCP relay agent process on incoming client broadcasts.

The relay agent must intercept broadcasts on the ingress interface, insert its own interface IP into the giaddr field, and unicast the request to the DHCP server.

Anahtar Kavram

DHCP Relay Agent Interface Placement and Broadcast Handling

Soru 1768Soru →

Two Cisco routers are attempting to establish an OSPFv2 adjacency over a point-to-point link. During the neighbor formation process, the routers exchange empty Database Description (DBD) packets to negotiate the Master/Slave relationship and select the initial sequence number. In which specific OSPF neighbor state does this negotiation take place?

Cevabı ve açıklamayı göster

Cevap: ExStart; EXSTART; ExStart state; exstart

Cevap

ExStart

In the ExStart state, neighbor routers use empty Database Description (DBD) packets to determine which router acts as the Master and which acts as the Slave, as well as set the initial DBD sequence number. The router with the higher Router ID wins the Master role.

Adım Adım Çözüm

Identify the OSPF neighbor state where Master/Slave election occurs

The ExStart (Exchange Start) state is designated for establishing the Master/Slave relationship.

Before exchanging Link State Advertisements (LSAs), routers must determine which device controls the sequence numbering of DBD packets.

Verify the role of DBD packets in this state

In ExStart, empty DBD packets containing the MS (Master/Slave), Init, and More bits are exchanged along with Router IDs.

The router with the higher Router ID becomes the Master.

Anahtar Kavram

OSPF Neighbor States (ExStart)

Tahmini Süre:1m 0s

Soru 1769Soru →

Match each VPN technology or deployment concept to its corresponding operational characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Site-to-Site IPsec VPN matches fixed network gateway interconnection; Remote Access SSL VPN matches individual remote user connections; Split Tunneling matches selective corporate destination routing; IPsec ESP matches payload confidentiality and integrity.

Each concept correctly aligns with its core CCNA VPN definition: Site-to-Site links gateways, Remote Access links individual endpoints, Split Tunneling routes selectively to conserve bandwidth, and ESP encrypts payload data.

Adım Adım Çözüm

Identify the deployment topology of Site-to-Site IPsec VPNs.

Match Site-to-Site VPNs to the description of connecting fixed location gateways without host software.

Site-to-Site VPNs join static remote subnets seamlessly across an untrusted network.

Identify the primary use case of Remote Access SSL VPNs.

Match Remote Access VPNs to secure client connections for mobile and remote workers.

Remote access VPN solutions cater to individual user endpoints dynamically establishing secure sessions.

Analyze the operational traffic behavior of Split Tunneling.

Match Split Tunneling to routing corporate traffic into the tunnel while internet traffic bypasses it.

Split tunneling isolates targeted internal subnets for tunnel routing while preserving local internet connectivity.

Identify the core security service offered by IPsec ESP.

Match IPsec ESP to data confidentiality via payload encryption.

ESP encapsulates and encrypts payload data to maintain privacy across IP networks.

Anahtar Kavram

Remote Access and Site-to-Site VPN Concepts

Soru 1770Soru →

A network administrator must transfer multi-gigabyte Cisco IOS XE system software images across an enterprise WAN link to remote routers. The administrator is evaluating file transfer protocols for reliability, session management, and access control. Which two characteristics or operational behaviors distinguish FTP from TFTP, making FTP more appropriate for this large image transfer scenario? (Select TWO.)

Geçerli olan tümünü seçin

FTP utilizes TCP as its transport protocol, establishing connection-oriented sessions with sequence acknowledgment and windowing to ensure reliable delivery of large files.

FTP supports authentication using credentials and operates separate control (TCP port 21) and data (TCP port 20) channels for session management.

FTP operates using UDP port 69, which minimizes transport protocol overhead to achieve faster transmission speeds over lossy WAN links.

FTP leverages connectionless data streams to automatically recover from dropped packets without requiring TCP connection state tracking.

Cevabı ve açıklamayı göster

Cevap: FTP utilizes TCP as its transport protocol, establishing connection-oriented sessions with sequence acknowledgment and windowing to ensure reliable delivery of large files.; FTP supports authentication using credentials and operates separate control (TCP port 21) and data (TCP port 20) channels for session management.

Cevap

FTP is distinguished by its use of TCP for reliable, connection-oriented transfers with windowing and sequence tracking, as well as its support for user authentication and dual-channel operation over TCP ports 20 and 21.

FTP uses TCP as its underlying transport protocol, providing reliable end-to-end flow control, sequencing, and error recovery vital for large file transfers over WANs. Additionally, FTP supports user authentication and separates control management (TCP port 21) from data transmission (TCP port 20).

Adım Adım Çözüm

Analyze transport protocol characteristics for TFTP and FTP.

TFTP uses UDP (port 69) which is connectionless and unauthenticated, while FTP uses TCP (ports 20 and 21) which is connection-oriented, reliable, and authenticated.

Large Cisco IOS image transfers over WAN links require connection reliability, flow control, and access control.

Evaluate features that support multi-gigabyte WAN file transfers.

TCP windowing, sequencing, and error recovery in FTP prevent corruption or transfer aborts upon minor packet drops, unlike basic lock-step TFTP mechanisms.

FTP's separate control (port 21) and data (port 20) channels combined with credential checking enable controlled, robust file transfers.

Anahtar Kavram

FTP vs TFTP protocol mechanics, transport ports, and reliability features for system image transfers

Soru 1771Soru →

An enterprise router receives a primary path for the prefix $192.168.50.0/24$ via OSPF. An engineer attempts to configure a floating static backup route using the command `ip route 192.168.50.0 255.255.255.0 10.0.0.2 105`. However, after entering the command, the routing table immediately replaces the OSPF path with the static route. What is the cause of this behavior?

The static route was assigned an administrative distance of 105, which is lower than the default OSPF administrative distance of 110.

The static route was assigned an administrative distance of 105, which is higher than the default OSPF administrative distance of 90.

The numerical value 105 at the end of the static route command sets the routing metric cost rather than the administrative distance.

The router requires an administrative distance of 255 to designate a static route as a floating backup route.

Cevabı ve açıklamayı göster

Cevap: The static route was assigned an administrative distance of 105, which is lower than the default OSPF administrative distance of 110.

Cevap

The static route was assigned an administrative distance of 105, which is lower than the default OSPF administrative distance of 110.

Cisco IOS selects routes based on Administrative Distance (AD), where lower AD values indicate higher trustworthiness. Default OSPF has an AD of 110. Because the engineer configured the static route with an AD of 105, it is lower than OSPF's AD of 110. Consequently, the router prefers the static route and installs it into the routing table immediately, preventing it from functioning as a backup route. A proper floating static route for OSPF must be configured with an AD greater than 110 (such as 120).

Adım Adım Çözüm

Identify the default Administrative Distance (AD) for the primary routing protocol (OSPF).

OSPF has a default AD of 110.

Cisco IOS uses AD values to determine route trustworthiness when multiple routing sources offer paths to the exact same destination.

Evaluate the AD assigned to the static route in the command `ip route 192.168.50.0 255.255.255.0 10.0.0.2 105`.

The trailing value 105 configures the static route AD to 105.

The optional numeric argument at the end of a static route statement specifies its administrative distance.

Compare the static route AD against the primary OSPF route AD.

Because

105 < 110

, the static route has a lower (more preferred) AD than OSPF.

Lower AD values take precedence in routing table installation. To act as a floating static backup, the static route AD must be configured with a value strictly greater than the primary protocol AD (e.g., AD > 110).

Anahtar Kavram

Floating Static Route Administrative Distance Requirements

Soru 1772Soru →

A network administrator configures a Cisco IOS router with the following syslog parameters:

text
logging buffered 16000 informational
logging host 192.168.10.50
logging trap notifications
logging console errors

Which two statements correctly describe the behavior of syslog logging on this router? (Select two.)

Geçerli olan tümünü seçin

The remote syslog host at 192.168.10.50 receives log messages with severity levels 0 through 5, excluding informational and debugging messages.

The internal logging buffer stores a broader range of severity levels than what is displayed on the router's local console interface.

The remote syslog host receives level 6 (Informational) and level 7 (Debugging) logs because higher severity numbers take priority during trap transmission.

The console interface outputs warning messages (severity level 4) because console logging automatically inherits the severity threshold configured for syslog trap messages.

Cevabı ve açıklamayı göster

Cevap: The remote syslog host at 192.168.10.50 receives log messages with severity levels 0 through 5, excluding informational and debugging messages.; The internal logging buffer stores a broader range of severity levels than what is displayed on the router's local console interface.

Cevap

The remote syslog host receives messages from severity level 0 up through severity level 5 (Notifications), and the internal buffer records a wider variety of severity levels (levels 0-6) than the local console interface (levels 0-3).

The command 'logging trap notifications' sets the syslog server threshold to severity level 5. Cisco IOS syslog destinations process messages at or below the configured numeric level, so levels 0 through 5 are sent to the syslog server. Additionally, 'logging buffered informational' sets the buffer threshold to level 6 (levels 0-6), while 'logging console errors' limits console output to level 3 (levels 0-3), making the buffer capture a wider range of logs than the console.

Adım Adım Çözüm

Map the configured keywords to their corresponding Cisco IOS Syslog numeric severity levels.

Console = level 3 (Errors), Trap = level 5 (Notifications), Buffered = level 6 (Informational).

Cisco IOS syslog severity levels range from 0 (Emergency, most severe) to 7 (Debugging, least severe).

Evaluate the destination threshold for remote syslog trap forwarding.

Messages with severity levels 0, 1, 2, 3, 4, and 5 are sent to 192.168.10.50.

Configuring 'logging trap notifications' forwards messages at the specified severity level (5) and all lower numeric values.

Compare the destination thresholds between the logging buffer and console output.

Buffered logging captures levels 0-6, whereas console logging captures levels 0-3.

Level 6 includes more message types than level 3, making the buffer's scope broader than the console's.

Anahtar Kavram

Cisco IOS Syslog Severity Thresholds and Log Destination Operation

Soru 1773Soru →

A network engineer is troubleshooting an issue where only the first internal user from subnet $192.168.10.0/24$ can access external destinations at any given time. The Cisco IOS router configuration and verification command output are shown below:

text
ip nat pool OUTSIDE_POOL 203.0.113.50 203.0.113.50 netmask 255.255.255.248
ip nat inside source list 10 pool OUTSIDE_POOL
!
access-list 10 permit 192.168.10.0 0.0.0.255

text
Router# show ip nat statistics
Total active translations: 1 (0 static, 1 dynamic, 0 extended)
Hits: 412 Misses: 15
Expired translations: 12
Dynamic mappings:
-- Inside Source
access-list 10 pool OUTSIDE_POOL refCount 1

Which configuration change is required to allow multiple internal hosts to share the single pool IP address simultaneously?

Append the overload keyword to the statement ip nat inside source list 10 pool OUTSIDE_POOL.

Change access-list 10 to permit traffic from the public range 172.32.10.0 0.0.0.255 instead of the current subnet.

Configure ip helper-address 203.0.113.50 on the internal gateway interface to forward NAT translation requests.

Set an administrative distance of 210 on the dynamic NAT pool to ensure translated packets take priority.

Cevabı ve açıklamayı göster

Cevap: Append the overload keyword to the statement ip nat inside source list 10 pool OUTSIDE_POOL.

Cevap

Append the overload keyword to the statement ip nat inside source list 10 pool OUTSIDE_POOL.

Without the 'overload' keyword, Cisco IOS implements basic dynamic NAT, mapping inside local IP addresses to inside global IP addresses on a strict one-to-one basis. Because the defined NAT pool has only one IP address (203.0.113.50), only one internal device can translate its IP address at any given time, as confirmed by 'Total active translations: 1 (0 static, 1 dynamic, 0 extended)' in the output. Appending 'overload' converts dynamic NAT into Port Address Translation (PAT), allowing multiple inside hosts to share the single public IP address concurrently using unique source L4 port numbers.

Adım Adım Çözüm

Analyze the existing router configuration and command output

The current command 'ip nat inside source list 10 pool OUTSIDE_POOL' without the 'overload' keyword performs standard 1-to-1 dynamic NAT mapping.

Because the pool OUTSIDE_POOL contains only a single IP address (203.0.113.50), standard dynamic NAT exhausts all available addresses after assigning it to the first host.

Identify the missing Port Address Translation (PAT) parameter

Adding 'overload' enables port-level multiplexing (PAT), creating extended translation entries that track source port numbers.

PAT allows thousands of concurrent internal hosts to share a single public IPv4 address simultaneously.

Anahtar Kavram

Port Address Translation (PAT) Overload Keyword Configuration

Soru 1774Soru →

A network security engineer is categorizing security threats and mapping them to appropriate defense controls. Match each security incident description on the left with the corresponding primary defense control on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Deceptive targeted communications match security awareness training; Rogue AP deployment matches Wireless Intrusion Prevention Systems (WIPS); Password spraying across multiple accounts matches Multi-Factor Authentication (MFA); Eavesdropping on cleartext management traffic matches SSH enforcement.

Each threat scenario maps directly to its optimal mitigation strategy: social engineering requires user awareness training; rogue wireless access points require rogue detection and WIPS; multi-account password spraying requires MFA enforcement; cleartext session eavesdropping requires encrypted communication via SSH.

Adım Adım Çözüm

Analyze each threat scenario to identify the primary attack vector.

Identified attack vectors: social engineering (human element), rogue wireless hardware, password spraying (credential guessing), and unencrypted session interception.

Accurate threat classification is required to match appropriate mitigation controls.

Map each attack vector to its corresponding security control mechanism.

Social engineering maps to user training; Rogue AP hardware maps to WIPS; Password spraying maps to MFA; Unencrypted traffic interception maps to SSH encryption.

Each defense mechanism directly addresses the specific vulnerability exploited by the attack vector.

Anahtar Kavram

Threat Vectors and Primary Security Mitigation Controls

Soru 1775Soru →

An organization is deploying a Cisco AnyConnect Remote Access VPN solution for remote employees. The security policy mandates that all corporate traffic destined for internal enterprise subnets must be encrypted and forwarded through the VPN tunnel, while standard internet traffic should bypass the tunnel and route directly out the user's local network interface to preserve corporate WAN bandwidth. Additionally, remote clients must dynamically acquire private IP addresses and internal DNS server settings upon successful authentication. Which combination of VPN features and tunneling configurations meets these requirements?

Configure a site-to-site IPsec tunnel using GRE encapsulation with full-tunneling enabled on the headend router.

Configure an SSL/TLS or IPsec Remote Access VPN using split-tunneling with an access list specifying internal corporate destination networks.

Configure an IPsec Remote Access VPN using Authentication Header (AH) in transport mode with split-tunneling disabled.

Configure a site-to-site IPsec tunnel utilizing Encapsulating Security Payload (ESP) in transport mode with dynamic NAT overload applied on the client end.

Cevabı ve açıklamayı göster

Cevap: Configure an SSL/TLS or IPsec Remote Access VPN using split-tunneling with an access list specifying internal corporate destination networks.

Cevap

The correct architecture requires a Remote Access VPN deployment utilizing split-tunneling controlled by an access list that defines internal corporate network destinations.

Remote Access VPNs are designed for individual client endpoints connecting to a central site, pushing configurations dynamically. Enabling split-tunneling with a targeted destination ACL ensures that only traffic destined for internal corporate networks is encrypted and routed through the tunnel, while local internet access remains unencumbered.

Adım Adım Çözüm

Identify the VPN operational topology requirement (Remote Access vs. Site-to-Site).

Because individual mobile users require client software (Cisco AnyConnect) to connect dynamically to the headend firewall/router, a Remote Access VPN model must be selected rather than a fixed Site-to-Site topology.

Remote Access VPNs support dynamic client authentication, IP address assignment (DHCP/Local Pool), and parameter pushing to roaming hosts.

Analyze the traffic routing security policy requirement (Split-tunneling vs. Full-tunneling).

Split-tunneling must be implemented using an access control list (ACL) that permits corporate subnet ranges.

Split-tunneling directs traffic bound for specified internal enterprise subnets through the encrypted VPN tunnel while allowing local internet traffic to exit directly via the client's local network gateway, preserving WAN bandwidth.

Evaluate protocol payload and encapsulation requirements.

Encapsulating Security Payload (ESP) in tunnel mode (or SSL/TLS VPN) is required to ensure data confidentiality via encryption and header encapsulation.

AH provides authentication and integrity without encryption, and transport mode does not hide or encapsulate private RFC 1918 IP headers required for traversing the public internet.

Anahtar Kavram

Remote Access VPN Architecture and Split-Tunneling Operation

Soru 1776Soru →

A network administrator is connecting multiple routers to a shared multiaccess Ethernet segment running OSPFv2. Place the parameter criteria used to determine the Designated Router (DR) election winner in order of evaluation precedence, starting with the parameter evaluated first down to the final fallback tie-breaker.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of precedence for OSPFv2 DR election is: (1) Highest OSPF interface priority value, (2) Manually configured OSPF Router ID, (3) Highest IPv4 address on an active loopback interface, and (4) Highest IPv4 address on an active physical interface.

The DR/BDR election process evaluates interface priority first, where the highest non-zero priority wins. If priorities are tied, OSPF breaks the tie using the Router ID. The Router ID selection itself follows a strict hierarchy: explicit configuration first, followed by the highest active loopback IP address, and finally the highest active physical interface IP address.

Adım Adım Çözüm

Evaluate OSPF interface priority

Highest priority (1-255) wins. A priority of 0 excludes the router from becoming DR/BDR.

Interface priority is the primary metric defined by OSPF for DR/BDR election.

Evaluate explicit Router ID if priorities tie

Router with the highest router-id command value wins.

If interface priorities are equal, OSPF uses the Router ID as a tie-breaker, preferring manually defined IDs.

Evaluate loopback interfaces if no explicit Router ID exists

Router with the highest IP address on an active loopback interface wins.

Loopback interfaces provide stability and automatically take precedence over physical interfaces for Router ID selection.

Evaluate physical interfaces if no loopback or explicit Router ID exists

Router with the highest IP address on an active physical interface wins.

Physical interface IP addresses serve as the absolute fallback for Router ID determination.

Anahtar Kavram

OSPFv2 DR/BDR Election Precedence Criteria

Soru 1777Soru →

A Cisco router receives an IPv4 packet destined for host 192.168.4.66. The routing table contains the following entries:

text
Gateway of last resort is not set

192.168.4.0/24 is variably subnetted, 4 subnets, 4 masks
S 192.168.4.0/24 [1/0] via 172.16.4.4
B 192.168.4.64/26 [20/0] via 172.16.3.3, 01:45:10, GigabitEthernet0/2
D 192.168.4.64/27 [90/307200] via 172.16.2.2, 00:15:30, GigabitEthernet0/1
O 192.168.4.64/28 [110/20] via 172.16.1.1, 00:08:12, GigabitEthernet0/0

Which route will the router select to forward the packet?

The static route 192.168.4.0/24 via 172.16.4.4 because static routes have the lowest administrative distance of 1.

The BGP route 192.168.4.64/26 via 172.16.3.3 because exterior gateway protocols override interior gateway routing tables.

The OSPF route 192.168.4.64/28 via 172.16.1.1 because it provides the longest matching prefix for the destination IP address.

The EIGRP route 192.168.4.64/27 via 172.16.2.2 because EIGRP has a lower administrative distance than OSPF while matching the subnet.

Cevabı ve açıklamayı göster

Cevap: The OSPF route 192.168.4.64/28 via 172.16.1.1 because it provides the longest matching prefix for the destination IP address.

Cevap

The router selects the OSPF route `192.168.4.64/28` via 172.16.1.1 because it provides the longest prefix match (/28) for the destination IP address 192.168.4.66.

When a router receives a packet, it compares the destination IP address against all routes in its routing table. When multiple routes match the destination IP address, the router selects the route with the longest prefix length (most network bits / longest subnet mask). In this case, 192.168.4.66 matches all four prefixes, but the /28 route is the most specific match (28 bits vs 27, 26, or 24 bits). Administrative distance plays no role here because the prefixes are of different lengths.

Adım Adım Çözüm

Identify the destination IP address of the incoming packet

Destination IP is 192.168.4.66

Routing lookup is driven by matching the packet's destination IP against routing table entries.

Determine which routing table prefixes encompass the destination IP address

192.168.4.0/24 (range .0-.255), 192.168.4.64/26 (range .64-.127), 192.168.4.64/27 (range .64-.95), and 192.168.4.64/28 (range .64-.79) all match the destination address 192.168.4.66.

All four configured subnets contain the IP address 192.168.4.66.

Apply the Longest Prefix Match (LPM) rule

The /28 prefix length (28 subnet bits) is the longest and most specific match compared to /27, /26, and /24.

Cisco routers always prioritize the most specific route (longest subnet mask) when forwarding traffic.

Anahtar Kavram

Longest Prefix Match (LPM) in IPv4 Route Determination

Tahmini Süre:1m 0s

Soru 1778Soru →

An analyst monitoring a campus switch network detects an active Man-in-the-Middle (MitM) attack where an unauthorized host broadcasts gratuitous ARP replies containing its own MAC address mapped to the IP address of the default gateway. Which Layer 2 security control should be implemented to prevent this specific threat by validating incoming ARP requests and responses against a trusted binding database?

Dynamic ARP Inspection (DAI)

TACACS+ full-payload traffic encryption

PortFast enabled across interswitch trunk links

Sticky Port Security saved to the startup configuration

Cevabı ve açıklamayı göster

Cevap: Dynamic ARP Inspection (DAI)

Cevap

Dynamic ARP Inspection (DAI) is the specific security control designed to validate ARP packets on untrusted switch ports against a trusted binding table to stop ARP spoofing.

Dynamic ARP Inspection (DAI) is a Layer 2 security feature designed explicitly to mitigate ARP poisoning and spoofing attacks. It intercepts all ARP requests and responses on untrusted switch ports and verifies that the IP-to-MAC mapping matches a valid entry in the DHCP snooping binding table before forwarding the packet.

Adım Adım Çözüm

Analyze the threat scenario described in the stem.

The attack involves transmitting forged ARP responses to map the gateway IP to an attacker's MAC address (ARP spoofing / MitM).

Identifying the threat type narrows down the specific mitigation mechanism.

Evaluate mitigation controls capable of inspecting Layer 2 ARP payloads.

Dynamic ARP Inspection (DAI) intercepts ARP requests and responses on untrusted ports and verifies the MAC-to-IP binding against the DHCP snooping database.

DAI drops invalid ARP packets, neutralizing the ARP poisoning threat.

Anahtar Kavram

Mitigating ARP Spoofing and Man-in-the-Middle Attacks with Dynamic ARP Inspection

Soru 1779Soru →

A network administrator needs to direct traffic destined specifically for a single log server at $192.168.10.45$ through next-hop IPv4 address $10.1.1.2$ , while allowing all other traffic intended for the $192.168.10.0/24$ subnet to follow the existing default path. Which Cisco IOS command must be configured on the router to accomplish this requirement?

ip route 192.168.10.45 255.255.255.255 10.1.1.2

ip route 192.168.10.45 255.255.255.0 10.1.1.2

ip route 192.168.10.45 0.0.0.0 10.1.1.2

ip route 192.168.10.0 255.255.255.255 10.1.1.2

Cevabı ve açıklamayı göster

Cevap: ip route 192.168.10.45 255.255.255.255 10.1.1.2

Cevap

The command 'ip route 192.168.10.45 255.255.255.255 10.1.1.2' creates a host static route targeting the specific destination IP address.

The correct command uses a subnet mask of 255.255.255.255 (/32) combined with the exact host IP address 192.168.10.45. When the router performs forwarding lookup, the longest prefix match rule ensures that packets addressed to 192.168.10.45 match this 32-bit route rather than broader subnet routes.

Adım Adım Çözüm

Identify the routing requirement

Only traffic to the single IP host 192.168.10.45 must take the specific next-hop path 10.1.1.2.

Traffic to other hosts within the 192.168.10.0/24 subnet must follow another path, requiring a route that applies only to a single IP address.

Determine the subnet mask required for a host route

A 32-bit mask (

255.255.255.255

) specifies exactly one IPv4 host address.

In IPv4 routing, a /32 prefix mask indicates that all 32 bits of the destination IPv4 address must match.

Construct the Cisco IOS static route command

ip route 192.168.10.45 255.255.255.255 10.1.1.2

The standard syntax is 'ip route <destination-prefix> <subnet-mask> <next-hop-ip>'.

Anahtar Kavram

IPv4 Host Static Routing and Longest Prefix Match

Tahmini Süre:1m 0s

Soru 1780Soru →

An enterprise risk assessment identifies that an unpatched buffer overflow flaw exists in a legacy database server daemon. An unauthorized external entity creates custom code to capitalize on this flaw, exposing sensitive customer records to unauthorized modification and creating an estimated financial risk of $250,000. Which element of this scenario specifically constitutes the vulnerability?

The unpatched buffer overflow flaw in the legacy database server daemon

The unauthorized external entity attempting to disrupt operations

The custom code created to leverage the software flaw

The potential financial impact of $250,000 resulting from data modification

Cevabı ve açıklamayı göster

Cevap: The unpatched buffer overflow flaw in the legacy database server daemon

Cevap

The unpatched buffer overflow flaw in the legacy database server daemon

In security fundamentals, a vulnerability is defined as an inherent weakness, flaw, or bug in system software, hardware, configuration, or control processes. The unpatched buffer overflow flaw in the daemon represents the internal weakness that can be targeted.

Adım Adım Çözüm

Analyze the core terminology definitions in cybersecurity risk management.

Vulnerability = system weakness; Threat = potential danger or actor; Exploit = method/code used to trigger weakness; Risk = potential loss or impact.

Clear separation of security concepts is required to evaluate security posture.

Map the specific details of the scenario to their respective security terms.

Buffer overflow flaw = Vulnerability; External entity = Threat actor; Custom code = Exploit; $250,000 potential financial loss = Risk/Impact.

The question explicitly asks to identify which component represents the vulnerability.

Select the option that matches the definition of a vulnerability.

The unpatched software flaw is identified as the vulnerability.

A software weakness prior to remediation is the precise definition of a vulnerability.

Anahtar Kavram

Key Security Concepts: Distinguishing Risk, Threat, Vulnerability, and Exploit

Tahmini Süre:1m 30s

ÖncekiSayfa 89 / 100Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram