Tüm alıştırma soruları

1987 soru

Tüm türler1,987 Çoktan seçmeli1,020 Çoklu seçim452 Sayısal18 Eşleştirme229 Sıralama203 Boşluk doldurma22 Kısa cevap43

Soru 1901Soru →

A company is establishing operational guidelines to meet compliance mandates for its core data facility. The chief security officer highlights the necessity of administrative safeguards working in tandem with physical access mechanisms. Which initiative is properly classified as an administrative element of a security program?

Mandating quarterly security awareness training sessions and formal clean-desk policies for all staff

Deploying biometric fingerprint readers and mantrap vestibules at the entrance of the data hall

Configuring centralized AAA server authentication with TACACS+ to govern access to network switch consoles

Implementing dynamic port security on access switches to shut down ports upon unauthorized MAC detection

Cevabı ve açıklamayı göster

Cevap: Mandating quarterly security awareness training sessions and formal clean-desk policies for all staff

Cevap

Mandating quarterly security awareness training sessions and formal clean-desk policies for all staff is an administrative security program element.

The option specifying mandatory security awareness training and clean-desk policies represents an administrative security control. Administrative controls consist of policies, regulations, compliance guidelines, and security awareness programs designed to direct human behavior and govern organizational security operations.

Adım Adım Çözüm

Categorize the options into control categories: Administrative, Physical, and Technical (Logical).

Administrative controls include policies, procedures, and training programs. Physical controls include locks, biometrics, and physical barriers. Technical controls include ACLs, port security, and protocol authentication.

Security program elements are classified based on whether they regulate human behavior/policy (administrative), physical entry (physical), or software/hardware enforcement (technical).

Identify which choice represents administrative policy and human behavior governance.

Mandating security awareness training and enforcing clean-desk policies fall squarely under administrative management.

Administrative controls establish the rules of behavior, compliance monitoring, and organizational security awareness.

Anahtar Kavram

Classification of Security Program Elements (Administrative vs. Physical vs. Technical Controls)

Tahmini Süre:1m 0s

Soru 1902Soru →

Match each physical access control or security program element to its primary purpose within an enterprise network security framework.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Mantrap matches with preventing piggybacking/tailgating via interlocking doors. Security Awareness Training matches with educating personnel on social engineering and phishing. Biometric Access Control matches with verifying human biological features for physical entry. Incident Response Plan matches with formal administrative breach response procedures.

Each physical access control (mantrap, biometric scanner) directly mitigates physical entry threats through hardware mechanisms or biological authentication. Each security program element (awareness training, incident response plan) provides administrative structure, human education, and process governance.

Adım Adım Çözüm

Analyze each physical access control mechanism on the left.

Identify that a mantrap uses interlocking doors to combat tailgating, while biometrics validate biological features like fingerprints.

Physical controls manage direct bodily entry into hardware facilities.

Analyze each security program element on the left.

Identify that security awareness training targets human education against phishing, while an incident response plan is an administrative document outlining breach remediation steps.

Administrative elements establish policies, procedures, and human awareness program goals.

Pair each item on the left with its corresponding description on the right.

Establish the 4 correct pairings accurately.

Aligning controls with their functional definitions demonstrates mastery of physical and administrative program elements.

Anahtar Kavram

Classification and functional roles of physical access controls and administrative security program elements.

Soru 1903Soru →

Host devices connected to an access switch on VLAN 15 ( $172.16.15.0/24$ ) are failing to receive automatic IPv4 address assignments. Router R1 serves as the default gateway via its GigabitEthernet0/0.15 subinterface, while the enterprise DHCP server is located at $10.1.1.250$ across the WAN backbone. To enable successful DHCP relay operation for hosts on VLAN 15, on which interface must the `ip helper-address 10.1.1.250` command be configured on router R1?

On subinterface GigabitEthernet0/0.15, because the DHCP relay agent must intercept broadcast DISCOVER requests on the client-facing ingress gateway interface.

On the WAN interface connected towards the DHCP server, because helper commands direct egress traffic out of the router.

On the access switch ports connected to the hosts, because Layer 2 interfaces must rewrite DHCP broadcast frames into unicast frames before forwarding.

On the global configuration mode of router R1 without an interface context, because relay addresses apply router-wide across all active subnets.

Cevabı ve açıklamayı göster

Cevap: On subinterface GigabitEthernet0/0.15, because the DHCP relay agent must intercept broadcast DISCOVER requests on the client-facing ingress gateway interface.

Cevap

The helper address command must be configured on subinterface GigabitEthernet0/0.15, which is the client-facing ingress interface serving VLAN 15.

The correct answer specifies configuring the command on subinterface GigabitEthernet0/0.15. A Cisco IOS router acts as a DHCP relay agent by intercepting UDP broadcast traffic (ports 67 and 68) on the incoming client-facing interface, inserting its local interface address into the gateway IP address (giaddr) field of the DHCP packet header, and forwarding the request as a unicast packet to the designated DHCP server IP address.

Adım Adım Çözüm

Identify the ingress interface receiving client broadcasts

GigabitEthernet0/0.15 is the local default gateway interface receiving client DHCP DISCOVER broadcast frames on VLAN 15.

DHCP relay functions by listening for Layer 2 broadcasts on the client-facing gateway interface.

Apply the IP helper address configuration

Enter subinterface configuration mode (`interface GigabitEthernet0/0.15`) and execute `ip helper-address 10.1.1.250`.

This instructs the router to intercept UDP broadcasts on ports 67/68 on that interface, insert its own interface IP into the giaddr field, and unicast the request to

10.1.1.250

Anahtar Kavram

Cisco IOS DHCP Relay Agent Interface Placement

Soru 1904Soru →

A network security administrator is designing an IPsec site-to-site VPN to interconnect a main office and a remote branch office across the Internet. Which TWO statements correctly describe the operational functions and behavior of IPsec framework protocols in this deployment?

Geçerli olan tümünü seçin

ESP in Tunnel mode encrypts the entire original IP packet and adds a new outer IP header for routing across public networks.

ESP provides data confidentiality, data origin authentication, and connectionless integrity for IP packets.

AH provides data encryption for the packet payload while maintaining light protocol overhead.

AH allows seamless packet traversal through NAT devices because it ignores mutable outer IP header fields during integrity checks.

Transport mode encapsulates the original IP header inside a new outer IP header, making it ideal for site-to-site security gateways.

Cevabı ve açıklamayı göster

Cevap: ESP in Tunnel mode encrypts the entire original IP packet and adds a new outer IP header for routing across public networks.; ESP provides data confidentiality, data origin authentication, and connectionless integrity for IP packets.

Cevap

The two correct statements are that ESP in Tunnel mode encrypts the entire original IP packet with a new outer IP header added, and that ESP provides data confidentiality, origin authentication, and integrity.

ESP (Encapsulating Security Payload) is the core IPsec protocol used when encryption is required. In Tunnel mode, ESP encapsulates and encrypts the complete original IP packet (header and payload) with ESP headers/trailers and prepends a new outer IP header. This provides data confidentiality, authentication, and integrity across public networks.

Adım Adım Çözüm

Evaluate the capabilities and operation of ESP (Encapsulating Security Payload).

ESP delivers encryption (confidentiality), authentication, and integrity. When configured in Tunnel mode, it protects the entire original IP packet and places a new outer IP header in front of the ESP header.

Gateway-to-gateway VPN tunnels require full packet encapsulation (Tunnel mode) and confidentiality (ESP) to safely transit public networks.

Examine statements regarding AH (Authentication Header) features and NAT interaction.

AH provides integrity and authentication but lacks encryption capability. Because AH hashes immutable and mutable outer IP header fields, address modifications by NAT break AH validation.

Recognizing that AH lacks confidentiality and is incompatible with NAT eliminates incorrect protocol claims.

Differentiate between Transport mode and Tunnel mode encapsulation.

Transport mode leaves the original IP header unencapsulated (protecting only the payload), whereas Tunnel mode creates a new outer IP header around the entire original IP packet.

This confirms Tunnel mode is the required encapsulation method for site-to-site security gateways.

Anahtar Kavram

IPsec Framework Protocols (ESP vs. AH) and Encapsulation Modes (Tunnel vs. Transport)

Soru 1905Soru →

An administrator is configuring IPv4 static routes on a Cisco IOS router connected to adjacent networks via both point-to-point serial and multiaccess Ethernet interfaces. Which two statements correctly describe the behavior of these IPv4 static route configurations? (Select two.)

Geçerli olan tümünü seçin

Configuring a static route specifying only an Ethernet exit interface forces the router to resolve destination IP addresses using ARP, increasing ARP table size and processing overhead.

Configuring a static route specifying only a next-hop IP address requires the router to perform a recursive lookup in the routing table to identify the outgoing interface.

Configuring a static route with an administrative distance of 110 creates a primary route that overrides an existing OSPF route for the same network prefix.

Configuring a static route using an exit interface on a multiaccess network eliminates the need for recursive routing lookups while optimizing ARP table performance.

Cevabı ve açıklamayı göster

Cevap: Configuring a static route specifying only an Ethernet exit interface forces the router to resolve destination IP addresses using ARP, increasing ARP table size and processing overhead.; Configuring a static route specifying only a next-hop IP address requires the router to perform a recursive lookup in the routing table to identify the outgoing interface.

Cevap

The correct statements are that specifying only an Ethernet exit interface forces the router to resolve destination host IPs using ARP (increasing processing and memory load), and specifying only a next-hop IP address requires a recursive lookup in the routing table to determine the egress interface.

Specifying only an Ethernet exit interface causes the router to issue ARP requests for every destination IP address, inflating the ARP table. Specifying only a next-hop IP address forces the router to perform a recursive routing lookup to identify the appropriate outbound interface.

Adım Adım Çözüm

Analyze static route next-hop IP resolution behavior

Identified that next-hop static routes require a recursive lookup step

When a route specifies only a next-hop IP address, the router must search its routing table again to find the interface through which that next-hop address is reachable.

Analyze static route exit-interface behavior on multiaccess networks

Identified that specifying only an exit interface on Ethernet causes excessive ARP requests

On multiaccess segments, omitting the next-hop IP causes the router to treat every remote destination host IP as directly attached to the local link, triggering ARP resolution for each destination.

Evaluate administrative distance for route selection

Identified that an administrative distance of 110 does not take precedence over OSPF

OSPF uses a default administrative distance of 110. To override an OSPF route, a static route must have a lower administrative distance (e.g., default AD of 1).

Anahtar Kavram

IPv4 Static Routing Next-Hop Resolution and Exit Interface Selection

Soru 1906Soru →

A network administrator is migrating a VLAN gateway infrastructure from VRRP to HSRP version 2 on Cisco IOS routers. Under the previous VRRP setup, Router R1 had its physical interface IP address configured as $192.168.10.1/24$ and served as the VRRP IP address owner by using $192.168.10.1$ as the virtual IP address.

During the migration, the administrator enters the following commands on Router R1's GigabitEthernet0/0 interface:
text
RouterR1(config)# interface gigabitethernet 0/0
RouterR1(config-if)# ip address 192.168.10.1 255.255.255.0
RouterR1(config-if)# standby version 2
RouterR1(config-if)# standby 10 ip 192.168.10.1

What is the outcome of executing the `standby 10 ip 192.168.10.1` command on Router R1?

Cisco IOS rejects using the interface physical IP address as the HSRP virtual IP address, resulting in a configuration error.

Router R1 accepts the command and automatically becomes the Active router with an unalterable priority of

255

The router accepts the command and automatically enables HSRP preemption to ensure primary forwarding status.

The command is accepted only if HSRP version 1 is configured instead of HSRP version 2.

Cevabı ve açıklamayı göster

Cevap: Cisco IOS rejects using the interface physical IP address as the HSRP virtual IP address, resulting in a configuration error.

Cevap

Cisco IOS rejects using the interface physical IP address as the HSRP virtual IP address, resulting in a configuration error.

Unlike VRRP, which allows a router interface to be the IP address owner by assigning its physical IP address as the virtual IP address (which sets its priority automatically to

255

), Cisco HSRP (both v1 and v2) requires the virtual IP address to be an unused IP address on the IP subnet. Attempting to assign the local interface's physical IP address as the HSRP virtual IP address will be rejected by Cisco IOS.

Adım Adım Çözüm

Analyze VRRP versus HSRP virtual IP address assignment rules.

VRRP allows a router to act as the IP address owner where the virtual IP address is identical to the router's physical interface IP address (assigning priority

255

). In contrast, Cisco HSRP (both v1 and v2) strictly requires the virtual IP address to be a unique IP address on the subnet that is not assigned to any physical router interface.

Understanding protocol design differences prevents invalid configurations during network migrations.

Evaluate the CLI command result on Router R1.

Entering `standby 10 ip 192.168.10.1` while GigabitEthernet0/0 has the physical IP address

192.168.10.1

causes Cisco IOS to generate an error indicating the virtual IP address cannot match the local physical IP address.

HSRP relies on distinct virtual and physical IP addressing to maintain dual operational capability for ARP and ICMP handling.

Anahtar Kavram

HSRP Virtual IP Address Uniqueness Constraint vs. VRRP IP Address Ownership

Tahmini Süre:1m 15s

Soru 1907Soru →

A network engineer is comparing First Hop Redundancy Protocols (FHRP) for a multi-vendor enterprise network deployment. The evaluation focuses on the operational defaults and protocol parameters of Cisco HSRPv1 and industry-standard VRRPv2. Which two statements accurately describe the operational differences between HSRPv1 and VRRPv2? (Choose two.)

Geçerli olan tümünü seçin

VRRPv2 uses the multicast IP address 224.0.0.18 for control traffic, whereas HSRPv1 uses 224.0.0.2.

HSRPv1 allows the virtual IP address to be identical to an active router's physical interface IP address, whereas VRRPv2 strictly forbids matching physical interface IPs.

VRRPv2 enables preemption by default for the Master router role, whereas HSRPv1 disables preemption by default for the Active router role.

VRRPv2 uses virtual MAC addresses in the range 0000.0c07.acXX, whereas HSRPv1 uses virtual MAC addresses in the range 0000.5e00.01XX.

Cevabı ve açıklamayı göster

Cevap: VRRPv2 uses the multicast IP address 224.0.0.18 for control traffic, whereas HSRPv1 uses 224.0.0.2.; VRRPv2 enables preemption by default for the Master router role, whereas HSRPv1 disables preemption by default for the Active router role.

Cevap

The correct options state that VRRPv2 uses multicast IP 224.0.0.18 while HSRPv1 uses 224.0.0.2, and that VRRPv2 has preemption enabled by default while HSRPv1 has preemption disabled by default.

The correct statements correctly identify key operational differences: VRRPv2 sends control advertisements to multicast IP 224.0.0.18 whereas HSRPv1 uses 224.0.0.2, and VRRPv2 has preemption enabled by default whereas HSRPv1 requires preemption to be explicitly configured.

Adım Adım Çözüm

Analyze multicast destination IP address differences between HSRPv1 and VRRPv2.

HSRPv1 control traffic is destined to

224.0.0.2

(UDP port 1985). VRRPv2 control traffic is destined to

224.0.0.18

(IP protocol 112).

This confirms the statement regarding protocol multicast IP addressing is accurate.

Analyze default preemption behavior for both protocols.

VRRPv2 has preemption enabled by default. HSRPv1 has preemption disabled by default.

This confirms the statement regarding preemption defaults is accurate.

Evaluate distractor options concerning virtual IP assignment and virtual MAC address ranges.

VRRP allows virtual IP matching (IP address owner), while HSRP rejects it. HSRPv1 uses MAC prefix 0000.0c07.acXX, while VRRPv2 uses 0000.5e00.01XX.

Both incorrect choices swap the characteristic traits between HSRP and VRRP.

Anahtar Kavram

HSRPv1 vs VRRPv2 Protocol Characteristics and Defaults

Soru 1908Soru →

Match each VPN operational feature or protocol component on the left with its corresponding functional description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Dead Peer Detection matches with monitoring tunnel liveness via keepalives; Split Tunneling matches with selectively routing corporate traffic through the tunnel while internet traffic bypasses it; Authentication Header matches with providing integrity and authentication without data encryption; Dynamic Multipoint VPN matches with leveraging GRE, NHRP, and IPsec to dynamically establish spoke-to-spoke tunnels.

Each feature corresponds to its specific technical function in VPN architecture: Dead Peer Detection detects dead VPN peers via keepalives; Split Tunneling optimizes bandwidth by routing only targeted subnets over the VPN; Authentication Header provides integrity without encryption; Dynamic Multipoint VPN uses mGRE and NHRP for dynamic spoke-to-spoke WAN connectivity.

Adım Adım Çözüm

Analyze Dead Peer Detection (DPD)

Identify that DPD handles connection liveness monitoring using hello/keepalive messages between IPsec peers.

VPN gateways need a mechanism to reclaim security association resources when a peer unexpectedly crashes or loses power.

Analyze Split Tunneling

Identify that split tunneling separates corporate-bound traffic (sent inside the VPN) from general internet traffic (sent outside the VPN).

This conserves central corporate internet bandwidth while maintaining secure access to private enterprise resources.

Analyze Authentication Header (AH)

Identify that AH provides integrity and authentication for the whole packet, but does not provide encryption (confidentiality).

AH (IP protocol 51) computes a hashed MAC over packet headers and payload, whereas ESP (IP protocol 50) is required for encryption.

Analyze Dynamic Multipoint VPN (DMVPN)

Identify that DMVPN combines mGRE, NHRP, and IPsec to form on-demand site-to-site tunnels dynamically.

DMVPN scales enterprise WAN topologies by allowing spokes to communicate directly without hair-pinning traffic through the hub.

Anahtar Kavram

Remote Access and Site-to-Site VPN Components & Operation

Soru 1909Soru →

A network administrator applies the following IPv4 extended named access control list (ACL) inbound on the GigabitEthernet0/1 interface of a Cisco IOS router to restrict access to a server network:

text
ip access-list extended SERVER_POLICY
10 permit tcp 172.16.5.0 0.0.0.255 host 172.20.10.25 eq 22
20 permit tcp 172.16.5.128 0.0.0.127 172.20.10.0 0.0.0.255 eq 443
30 deny tcp host 172.16.5.150 172.20.10.0 0.0.0.255
40 permit ip 172.16.5.0 0.0.0.255 172.20.10.0 0.0.0.255

The router receives two distinct packets on interface GigabitEthernet0/1:
- Packet 1: Source IP 172.16.5.150, Destination IP 172.20.10.25, Protocol UDP (DNS, destination port 53)
- Packet 2: Source IP 172.16.5.150, Destination IP 172.20.10.30, Protocol TCP (HTTP, destination port 80)

Which statement accurately describes how the router processes these two packets?

Packet 1 is permitted by sequence line 40 because protocol IP encompasses UDP; Packet 2 is denied by sequence line 30 during sequential top-down evaluation.

Packet 1 is dropped by the implicit deny clause because no preceding entry explicitly specifies UDP; Packet 2 is permitted by sequence line 40.

Packet 1 is permitted by sequence line 40; Packet 2 bypasses sequence line 30 and is permitted by sequence line 40 because line 30 lacks a port operator.

Both Packet 1 and Packet 2 are dropped by the implicit deny clause because host 172.16.5.150 is restricted from reaching destination 172.20.10.0/24 across all protocols.

Cevabı ve açıklamayı göster

Cevap: Packet 1 is permitted by sequence line 40 because protocol IP encompasses UDP; Packet 2 is denied by sequence line 30 during sequential top-down evaluation.

Cevap

Packet 1 is permitted by sequence line 40 because protocol IP encompasses UDP; Packet 2 is denied by sequence line 30 during sequential top-down evaluation.

Cisco IPv4 extended ACLs are processed sequentially from top to bottom until the first match occurs. Packet 1 is a UDP packet. Lines 10, 20, and 30 explicitly match protocol TCP only, so Packet 1 skips them and reaches line 40. Line 40 uses protocol 'ip', which covers all Layer 4 protocols including UDP, so Packet 1 is permitted. Packet 2 is a TCP packet from host 172.16.5.150 to 172.20.10.30. It skips lines 10 and 20 due to non-matching destination parameters, but matches line 30, which explicitly denies all TCP traffic from host 172.16.5.150 to any address in the 172.20.10.0/24 subnet regardless of port number.

Adım Adım Çözüm

Evaluate Packet 1 (UDP, source 172.16.5.150, destination 172.20.10.25) against ACL entries top-down.

Lines 10, 20, and 30 explicitly match protocol 'tcp'. Because Packet 1 uses 'udp', it skips lines 10, 20, and 30.

Protocol matching in extended ACLs requires an exact protocol match (or broad match under protocol 'ip').

Evaluate Packet 1 against line 40.

Line 40 matches source subnet 172.16.5.0/24 (wildcard 0.0.0.255) and destination subnet 172.20.10.0/24 (wildcard 0.0.0.255) under protocol 'ip'.

The 'ip' protocol keyword in Cisco IPv4 extended ACLs acts as a wildcard protocol matching TCP, UDP, ICMP, and all other IP payload protocols. Packet 1 is PERMITTED.

Evaluate Packet 2 (TCP, source 172.16.5.150, destination 172.20.10.30, port 80) against ACL entries top-down.

Line 10 requires destination IP 172.20.10.25 and port 22 (no match). Line 20 requires source IP in range 172.16.5.128-172.16.5.255 and port 443 (no match). Line 30 matches TCP traffic from host 172.16.5.150 to destination subnet 172.20.10.0/24.

Line 30 specifies 'deny tcp host 172.16.5.150 172.20.10.0 0.0.0.255' without port restriction, meaning ALL TCP ports are matched and denied. Packet 2 is DENIED.

Anahtar Kavram

Top-down sequential evaluation of IPv4 Extended Access Control Lists, protocol suite coverage of the 'ip' keyword, and exact match criteria.

Tahmini Süre:2m 0s

Soru 1910Soru →

A network engineer applies the following local authentication and access configuration to a Cisco IOS XE router:

text
username opsuser privilege 7 secret OpsPass#2026
username auditor privilege 1 secret AuditPass#2026
enable secret EnablePass#2026
!
line vty 0 15
transport input ssh
login local

When `opsuser` successfully establishes an SSH session to the router using local database credentials, which initial operational state and privilege level behavior does the user experience?

The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.

The user is placed into user EXEC mode at privilege level 1 and must run 'enable 7' using the enable secret password to reach privilege level 7.

The user is automatically escalated to privilege level 15 because any non-default privilege level in the local database defaults to full administrative access.

The authentication attempt fails because VTY lines set to 'login local' reject user accounts that do not use scrypt password hashing.

Cevabı ve açıklamayı göster

Cevap: The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.

Cevap

The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.

When a local user account is created with an explicit privilege parameter (such as 'privilege 7'), Cisco IOS applies that privilege level immediately upon successful authentication via 'login local'. The user lands directly in EXEC mode at privilege level 7 with access to commands permitted at or below that level.

Adım Adım Çözüm

Analyze local database user configuration

The user 'opsuser' is defined with explicit privilege level 7 using 'username opsuser privilege 7 secret OpsPass#2026'.

Explicit privilege level keywords in local user creation define the initial privilege level assigned to the session upon authentication.

Analyze line VTY access control settings

The VTY lines use 'login local' to authenticate inbound SSH sessions against the local user database.

'login local' instructs Cisco IOS to validate credentials against the local running configuration user database and apply associated user attributes.

Determine post-authentication session environment

Upon successful login, Cisco IOS grants the session privilege level 7 immediately with the CLI prompt showing 'opsuser#'.

Users with custom privilege levels defined in the local database bypass default user EXEC (level 1) restriction and enter directly at their configured level without requiring the 'enable' command.

Anahtar Kavram

Cisco IOS Local Database User Privilege Level Assignment and VTY Access Behavior

Tahmini Süre:2m 0s

Soru 1911Soru →

A network administrator is designing a First Hop Redundancy Protocol (FHRP) deployment for a LAN segment. The design requirement dictates that the virtual default gateway IP address configured for host devices must be identical to the physical IP address assigned to the primary router's GigabitEthernet0/0 interface. Which protocol selection and operational characteristic accurately satisfies this design requirement?

VRRP, because it permits the virtual IP address to match a physical interface IP address, making that router the IP address owner with a default priority of 255.

HSRP version 1, because configuring an interface physical IP address as the standby IP address automatically elevates the router priority to 255.

HSRP version 2, because HSRPv2 updated its virtual MAC format to allow physical IP address mapping for backward compatibility.

Both HSRP and VRRP, because both protocols natively allow assigning an active router's physical IP address as the virtual gateway address.

Cevabı ve açıklamayı göster

Cevap: VRRP, because it permits the virtual IP address to match a physical interface IP address, making that router the IP address owner with a default priority of 255.

Cevap

VRRP allows the virtual IP address to match a router's physical interface IP address, designating that router as the IP address owner with an effective priority of 255.

In VRRP, a router can be configured to use its own physical interface IP address as the virtual IP address for the redundancy group. When this occurs, the router becomes the IP address owner and its priority is fixed at 255, ensuring it acts as the Master router whenever its interface is active.

Adım Adım Çözüm

Analyze the FHRP requirement for IP address ownership.

The scenario requires the virtual default gateway IP address to be identical to the primary router's physical interface IP address.

Different FHRP protocols have distinct rules regarding whether the virtual IP address can overlap with an interface's assigned physical IP.

Evaluate HSRP (v1 and v2) behavior regarding physical IP address assignment.

HSRP requires the virtual IP address to be a unique IP address on the subnet that is not assigned to any physical interface of the participating routers.

Attempting to assign a physical IP address as the HSRP virtual IP results in a CLI configuration error in Cisco IOS.

Evaluate VRRP (v2 and v3) behavior regarding physical IP address assignment.

VRRP explicitly supports assigning the physical interface IP address of a router as the VRRP virtual IP address.

When a router's physical IP matches the VRRP virtual IP, that router assumes the role of IP Address Owner and its operational priority is automatically set to 255 (the maximum possible priority).

Anahtar Kavram

VRRP IP Address Ownership vs HSRP Virtual IP Restrictions

Soru 1912Soru →

A network administrator is configuring a Cisco IOS router to act as a DHCP relay agent for host clients residing on VLAN 25 ( $10.25.0.0/24$ ). The centralized DHCP server is located at IP address $10.100.1.50/24$ in a different subnet connected off interface GigabitEthernet0/0/0. Which statements regarding the operation and Cisco IOS configuration of the DHCP relay agent are correct? (Select TWO.)

Geçerli olan tümünü seçin

The `ip helper-address 10.100.1.50` command must be configured under the client-facing subinterface (GigabitEthernet0/0.25).

The router inserts the client-facing interface IP address into the Gateway IP Address (`giaddr`) field of the DHCP header before unicasting the request to the server.

The `ip helper-address 10.100.1.50` command must be configured under the egress interface (GigabitEthernet0/0/0) facing the server.

The router retransmits the client broadcast DHCP Discover frame as a layer 2 broadcast frame out the egress server interface.

Cevabı ve açıklamayı göster

Cevap: The `ip helper-address 10.100.1.50` command must be configured under the client-facing subinterface (GigabitEthernet0/0.25).; The router inserts the client-facing interface IP address into the Gateway IP Address (`giaddr`) field of the DHCP header before unicasting the request to the server.

Cevap

The correct statements are that the `ip helper-address 10.100.1.50` command must be configured on the client-facing interface (GigabitEthernet0/0.25), and that the router populates the Gateway IP Address (`giaddr`) field with its client-facing interface IP address when unicasting the request to the server.

Configuring `ip helper-address 10.100.1.50` on the client-facing gateway interface enables the router to listen for incoming client DHCP broadcasts. When relaying the request to the DHCP server as a unicast IPv4 packet, the router populates the `giaddr` (Gateway IP Address) field in the DHCP payload with the IP address of that client-facing interface, allowing the DHCP server to identify which address pool to select from.

Adım Adım Çözüm

Identify the ingress interface for client DHCP broadcasts

Host clients send broadcast DHCP Discover requests on VLAN 25, which arrive at subinterface GigabitEthernet0/0.25.

DHCP relay interception must be enabled on the interface receiving the client broadcast traffic.

Verify proper command syntax and interface application

`ip helper-address 10.100.1.50` configured under interface GigabitEthernet0/0.25 converts UDP broadcasts (ports 67/68) into unicast packets destined for

10.100.1.50

Applying the command on the egress interface towards the server fails to intercept client broadcasts.

Analyze the Relay Agent packet payload modification

The router fills the `giaddr` field in the DHCP payload with the IP address assigned to GigabitEthernet0/0.25.

The centralized DHCP server uses `giaddr` to match the appropriate IP address pool (

10.25.0.0/24

) for lease allocation.

Anahtar Kavram

DHCP Relay Agent Operation and Interface Configuration

Soru 1913Soru →

A network administrator configures an IPv4 extended named Access Control List (ACL) on router R1 to control access to a server farm located on subnet 10.120.16.0/20, which connects locally to interface GigabitEthernet0/0. The policy requirements state that:
1. Management traffic (SSH and HTTPS) from 192.168.100.0/24 to the server farm must be allowed.
2. ICMP echo requests from host 192.168.200.5 to the server farm must be allowed.
3. All traffic originating inside the server farm (10.120.16.0/20) bound for its default gateway (10.120.16.1) must be allowed.
4. All other IPv4 traffic entering the server farm interface must be denied and logged.

The engineer applies the following configuration:

text
ip access-list extended SEC_SERVER_MGMT
permit tcp 192.168.100.0 0.0.0.255 10.120.16.0 0.0.15.255 eq 22
permit tcp 192.168.100.0 0.0.0.255 10.120.16.0 0.0.15.255 eq 443
permit icmp host 192.168.200.5 10.120.16.0 0.0.15.255 echo
permit ip 10.120.16.0 0.0.15.255 host 10.120.16.1
!
interface GigabitEthernet0/0
ip access-group SEC_SERVER_MGMT in

Which two statements correctly identify flaws or operational outcomes of this ACL deployment?

Geçerli olan tümünü seçin

Unlisted denied traffic will be dropped silently without generating log messages because no explicit deny statement with the log keyword was configured.

Traffic sent from the remote admin network (192.168.100.0/24) to the server farm will not match the ACL entries on GigabitEthernet0/0 because it enters R1 through a different interface.

Unlisted IPv4 traffic will automatically trigger Syslog logging upon being dropped by the default implicit ACL processing engine.

The wildcard mask 0.0.15.255 incorrectly matches hosts across the range 10.120.0.0 through 10.120.255.255 instead of the 10.120.16.0/20 subnet.

Cevabı ve açıklamayı göster

Cevap: Unlisted denied traffic will be dropped silently without generating log messages because no explicit deny statement with the log keyword was configured.; Traffic sent from the remote admin network (192.168.100.0/24) to the server farm will not match the ACL entries on GigabitEthernet0/0 because it enters R1 through a different interface.

Cevap

The configuration fails because unlisted denied packets are dropped silently by the default implicit deny clause rather than logged, and applying the ACL inbound on GigabitEthernet0/0 filters outbound server traffic rather than inbound traffic from remote subnets.

The deployment exhibits two distinct operational flaws. First, applying the ACL inbound on the server-facing interface filters traffic sent by the servers into the router rather than traffic destined to the servers from remote management networks. Second, Cisco IOS ACLs end with an unwritten implicit deny clause that drops unmatched traffic silently. To fulfill the requirement of logging denied traffic, an explicit 'deny ip any any log' entry must be added.

Adım Adım Çözüm

Analyze the direction of traffic flow and ACL placement.

GigabitEthernet0/0 connects locally to the 10.120.16.0/20 subnet. Traffic coming from remote networks (such as 192.168.100.0/24) toward the server farm travels out of GigabitEthernet0/0. Applying an inbound ACL ('ip access-group SEC_SERVER_MGMT in') on GigabitEthernet0/0 filters traffic originating from the server farm entering the router, not traffic heading to the server farm.

Extended ACLs must be placed as close to the source as possible or configured in the proper direction (outbound on GigabitEthernet0/0) to filter incoming traffic destined to servers.

Evaluate the implicit deny clause and logging requirements.

Every Cisco IOS IPv4 ACL ends with an invisible implicit 'deny ip any any' rule. Because this implicit statement drops packets silently, requirement 4 (deny and log all other IPv4 traffic) is not met unless an explicit line 'deny ip any any log' is configured at the end of the ACL.

Logging requires explicit configuration of the 'log' parameter on a matching statement; the implicit deny statement never produces log events.

Verify wildcard mask calculations.

For a /20 prefix (255.255.240.0), the wildcard mask is 255.255.255.255 - 255.255.240.0 = 0.0.15.255. Adding 15.255 to 10.120.16.0 yields 10.120.31.255, matching subnet 10.120.16.0/20 accurately.

Validating wildcard calculations ensures that the destination address scope in the permit lines is correct.

Anahtar Kavram

ACL Interface Direction and Implicit Deny Mechanics

Soru 1914Soru →

An enterprise requires remote employees using corporate laptops to establish a secure network-layer tunnel back to the headquarters firewall. The solution must support all IP-based applications and operate seamlessly across restrictive public networks by encapsulating traffic inside TLS or DTLS on port 443. Which VPN technology should the administrator deploy to satisfy these requirements?

SSL/TLS remote access VPN utilizing a dedicated software client

Clientless SSL VPN accessed exclusively through a web browser portal

IPsec site-to-site VPN operating in transport mode between endpoints

Generic Routing Encapsulation (GRE) tunnel configured directly on client operating systems

Cevabı ve açıklamayı göster

Cevap: SSL/TLS remote access VPN utilizing a dedicated software client

Cevap

SSL/TLS remote access VPN utilizing a dedicated software client

Client-based SSL/TLS remote access VPNs (such as Cisco Secure Client / AnyConnect) create a virtual network interface on the user's endpoint, encapsulating all network-layer IP traffic inside TLS (TCP 443) or DTLS (UDP 443). This satisfies both requirements: supporting arbitrary IP applications and seamlessly bypassing restrictive firewalls.

Adım Adım Çözüm

Analyze the access requirement

Individual remote users (teleworkers) need full network-level IP application access from their laptops to headquarters.

Remote access VPNs are designed for individual user-to-network connections, whereas site-to-site VPNs connect entire network segments.

Evaluate transport and protocol constraints

Traffic must be encapsulated over SSL/TLS or DTLS using port 443 to traverse restrictive firewalls.

SSL/TLS remote access VPNs use TCP/UDP port 443, which easily passes through NAT and strict firewall rules compared to native IPsec ESP (IP protocol 50).

Select the appropriate client deployment model

A dedicated client software (such as Cisco AnyConnect) is required for full network-layer IP encapsulation.

Clientless SSL VPN is limited to web browser access, whereas client-based SSL VPN creates a virtual network interface that tunnels all client IP traffic.

Anahtar Kavram

SSL/TLS Remote Access VPN Client-Based Architecture vs Clientless and Site-to-Site VPNs

Tahmini Süre:1m 15s

Soru 1915Soru →

A network engineer is configuring a static route on a Cisco router interface connected to a broadcast multiaccess Ethernet network. If the engineer configures the command using only the egress interface (e.g., `ip route 10.20.30.0 255.255.255.0 GigabitEthernet0/0`) without specifying a next-hop IPv4 address, which network behavior or operational issue will occur?

The router automatically assigns an administrative distance of 255 to the route, preventing it from being installed in the routing table.

The router treats the destination subnet as directly connected and generates an ARP request for every destination IP address, leading to high CPU load and ARP table bloat.

The router drops incoming packets destined for 10.20.30.0/24 because static routes on Ethernet interfaces strictly mandate a recursive lookup using a loopback IP address.

The static route functions identically to specifying a next-hop IPv4 address because Ethernet interfaces automatically resolve the next-hop MAC address using CDP.

Cevabı ve açıklamayı göster

Cevap: The router treats the destination subnet as directly connected and generates an ARP request for every destination IP address, leading to high CPU load and ARP table bloat.

Cevap

The router treats the destination prefix as a directly connected subnet on the Ethernet segment and attempts to perform an ARP lookup for every host IP address in that destination network.

When an IPv4 static route on a broadcast multiaccess Ethernet interface specifies only the exit interface, Cisco IOS considers the destination prefix directly connected. Consequently, the router attempts to resolve the MAC address for every individual destination IP address in that subnet via ARP requests. This leads to severe ARP table growth, high CPU usage, and dependence on Proxy ARP.

Adım Adım Çözüm

Analyze the static route syntax used on a multiaccess broadcast interface.

The command specifies an exit interface (`GigabitEthernet0/0`) instead of a next-hop IPv4 address.

On point-to-point links (like HDLC/PPP serial), an exit interface is sufficient because there is only one possible recipient. On multiaccess Ethernet networks, multiple devices share the segment.

Determine how the router processes packet forwarding for an exit-interface-only static route on Ethernet.

The router considers the target subnet directly connected to `GigabitEthernet0/0`.

To forward a packet, the router must encapsulate it into an Ethernet frame requiring a destination MAC address. Because no next-hop IP was defined, the router broadcasts an ARP request asking for the MAC address of the final destination IP address.

Identify the operational consequences of this configuration.

Excessive ARP traffic, enlarged ARP table size, and elevated CPU utilization occurs.

Every unique destination IPv4 address triggers a separate ARP request. Unless Proxy ARP is enabled on the downstream gateway, traffic will fail completely; if Proxy ARP is enabled, the router's ARP table fills with individual host entries.

Anahtar Kavram

Static Route Exit Interface vs. Next-Hop IP on Multiaccess Broadcast Networks

Soru 1916Soru →

A technician configures initial administrative security on a newly racked Cisco IOS XE switch using the following CLI commands:

text
username netadmin secret C1sco!Pass2026
line console 0
password C1sco!Pass2026
login

During validation, the technician observes that connecting via the serial console prompts only for a password, allowing login without entering the username `netadmin` stored in the local database.

Which command must be executed under `line console 0` to require authentication against the local user database?

service password-encryption

transport input ssh

enable secret C1sco!Pass2026

Cevabı ve açıklamayı göster

Cevap: login local

Cevap

The 'login local' command must be executed under line console 0 to force the switch to prompt for both a username and password defined in the local user database.

The 'login local' command configures line console 0 to authenticate access using credentials defined in the device's local database (created via 'username' commands). This causes the device to display both 'Username:' and 'Password:' prompts during login.

Adım Adım Çözüm

Analyze the current line console 0 configuration snippet

The current line configuration contains 'password C1sco!Pass2026' followed by 'login', which configures simple password-only line authentication.

The standard 'login' keyword under line configuration checks only against the line-specific password and ignores local username database entries.

Identify the CLI keyword required to consult the local user database

Replacing 'login' with 'login local' instructs Cisco IOS XE to prompt for both username and password credentials.

The 'local' parameter directs authentication requests to user accounts configured via global 'username' statements.

Anahtar Kavram

Cisco IOS Line Authentication Modes and Local Database Integration

Tahmini Süre:1m 0s

Soru 1917Soru →

A network engineer is transferring a 450 MB Cisco IOS XE system image across a high-latency WAN connection to a branch router. Initial transfer attempts using TFTP fail due to frequent timeouts and poor throughput over the lossy link. The engineer switches the process to use FTP, and the image file transfers completely without error. Which operational characteristic of FTP explains why it succeeds over high-latency, lossy connections where TFTP fails?

FTP operates over TCP, leveraging sliding windows and sliding sequence acknowledgments for reliable flow control and packet loss recovery.

TFTP uses UDP port 69 with built-in TCP-style sliding window flow control that drops sessions when round-trip delay exceeds 100 milliseconds.

FTP uses UDP for high-speed bulk data transport across WAN links, avoiding the overhead of connection establishment handshakes.

TFTP establishes dual TCP control and data channels that require persistent low-latency synchronization between endpoints.

Cevabı ve açıklamayı göster

Cevap: FTP operates over TCP, leveraging sliding windows and sliding sequence acknowledgments for reliable flow control and packet loss recovery.

Cevap

FTP operates over TCP, leveraging sliding windows and sliding sequence acknowledgments for reliable flow control and packet loss recovery.

The option identifying FTP's use of TCP sliding windows and acknowledgments is correct. FTP uses TCP as its transport protocol, which provides full reliability mechanisms including sequence numbering, windowing, and selective/cumulative retransmissions. This allows FTP to efficiently handle packet drops and latency over WAN links without timing out the overall session.

Adım Adım Çözüm

Analyze transport protocol mechanics for TFTP and FTP.

TFTP operates over UDP port 69 and uses lockstep acknowledgment (each block must be individually acknowledged before the next is sent). FTP operates over TCP (ports 20 and 21) and uses connection-oriented dynamics.

Transport layer mechanisms dictate file transfer behavior over lossy or delayed networks.

Evaluate impact of high latency and packet loss on lockstep vs windowed transfers.

On high-latency links with loss, TFTP lockstep acknowledgments experience severe throughput degradation and frequent timeouts. FTP's TCP windowing and dynamic retransmissions recover lost segments seamlessly.

TCP sliding windows allow multiple unacknowledged packets in transit, maximizing bandwidth utilization.

Anahtar Kavram

Operational characteristics and transport mechanics of TFTP vs FTP file transfers

Soru 1918Soru →

An administrator enables port security on a Cisco switch interface using default settings without specifying a violation mode. What default action will the switch take if an unauthorized device connects to this interface?

It drops traffic from the unauthorized MAC address, increments the security violation counter, and sends a Syslog alert while keeping the interface up.

It immediately shuts down the interface, places it into an err-disabled state, and turns off the port LED.

It silently drops packets from the unknown source MAC address without altering the port status or incrementing any counters.

It forwards the frame normally but restricts all subsequent broadcast traffic from passing through the interface.

Cevabı ve açıklamayı göster

Cevap: It immediately shuts down the interface, places it into an err-disabled state, and turns off the port LED.

Cevap

The switch immediately shuts down the interface, places it into an err-disabled state, and turns off the port LED.

When port security is enabled on a Cisco switch interface, the default violation mode is shutdown. When an unauthorized MAC address triggers a violation, the interface is immediately placed in an err-disabled state, disabling all traffic through the port until manually re-enabled or automatically recovered.

Adım Adım Çözüm

Identify the default violation mode for Cisco port security.

The default violation mode is shutdown.

When port-security is enabled without specifying a violation action using `switchport port-security violation`, the switch defaults to `shutdown`.

Determine the switch reaction when a violation occurs under shutdown mode.

The port transitions to the err-disabled state and stops forwarding all traffic.

Shutdown mode disables the interface entirely, turns off the link LED, increments the violation counter, and generates a syslog message.

Anahtar Kavram

Port Security Default Violation Mode

Soru 1919Soru →

A host connected to VLAN 100 ( $10.100.1.0/24$ ) broadcasts a DHCPDISCOVER packet to obtain network parameters. The client-facing gateway interface GigabitEthernet0/0/0.100 ( $10.100.1.1/24$ ) on router R1 is configured with the command `ip helper-address 192.168.50.10`. Which operation does router R1 perform upon receiving this broadcast?

R1 inserts its GigabitEthernet0/0/0.100 IP address (

10.100.1.1

) into the `giaddr` field and forwards the request as a unicast packet to

192.168.50.10

R1 inserts the IP address of its egress interface facing the DHCP server into the `giaddr` field and unicasts the packet to

192.168.50.10

R1 floods the original DHCPDISCOVER broadcast packet out all active interfaces except GigabitEthernet0/0/0.100.

R1 replaces the broadcast destination IP address (

255.255.255.255

) with

192.168.50.10

while preserving the broadcast MAC address.

Cevabı ve açıklamayı göster

Cevap: R1 inserts its GigabitEthernet0/0/0.100 IP address ( $10.100.1.1$ ) into the `giaddr` field and forwards the request as a unicast packet to $192.168.50.10$ .

Cevap

Router R1 inserts the IP address of its client-facing interface (

10.100.1.1

) into the `giaddr` field of the DHCP payload and forwards the request as a unicast packet to the configured relay destination

192.168.50.10

When a router configured with `ip helper-address` receives a broadcast DHCPDISCOVER packet on a client-facing interface, it acts as a DHCP relay agent. It populates the `giaddr` (gateway IP address) field in the DHCP header with the IP address assigned to the receiving ingress interface (

10.100.1.1

). This critical step enables the remote DHCP server to select an IP address from the matching IP pool subnet. The router then converts the broadcast frame into a unicast IP packet addressed directly to the helper address (

192.168.50.10

Adım Adım Çözüm

Analyze the incoming DHCPDISCOVER request on the client-facing gateway interface.

The host sends a layer 2 broadcast (

FF:FF:FF:FF:FF:FF

) and layer 3 broadcast (

255.255.255.255

) requesting an address assignment on VLAN 100.

DHCP clients initially have no IP address and must discover servers via broadcasting.

Evaluate the relay agent processing mechanism invoked by `ip helper-address`.

Router R1 intercepts the UDP broadcast port 67 packet, inserts

10.100.1.1

into the `giaddr` (Gateway IP Address) field of the DHCP message header, and sets the destination IP to

192.168.50.10

The `giaddr` field informs the remote DHCP server which subnet IP pool must be drawn from to serve the client.

Determine packet forwarding mechanics across the network core.

R1 routes the modified request as a standard unicast packet to

192.168.50.10

Unicast routing allows the DHCP request to cross multiple routed hops to reach a centralized server.

Anahtar Kavram

DHCP Relay Agent Operation and Gateway IP Address (`giaddr`) Insertion

Tahmini Süre:1m 15s

Soru 1920Soru →

An enterprise organization is updating security measures for its core telecommunications enclosure to protect critical network hardware. Which mechanism serves as a physical access control specifically designed to prevent unauthorized individuals from tailgating authorized personnel into the facility?

A mantrap portal equipped with interlocking doors and biometric identity verification

An extended IPv4 access control list filtering inbound traffic on the gateway router interface

A centralized TACACS+ server configured for administrative SSH command authorization

Port security configured with sticky MAC learning enabled on access switch interfaces

Cevabı ve açıklamayı göster

Cevap: A mantrap portal equipped with interlocking doors and biometric identity verification

Cevap

A mantrap portal equipped with interlocking doors and biometric identity verification

A mantrap portal consists of a small vestibule with two interlocking doors. Once an authorized user enters the outer door, it must close and lock before authentication unlocks the inner door. This structure physically limits entry to one validated person at a time, preventing tailgating.

Adım Adım Çözüm

Identify the primary threat vector and control category specified in the scenario.

The requirement specifies physical security controls to prevent tailgating into a telecommunications enclosure.

Tailgating occurs when an unauthorized person closely follows an authorized user through a physical entrance without independent authentication.

Evaluate the candidate security controls.

Mantrap portals enforce single-person physical access through interlocking doors. Logical controls like ACLs, TACACS+, and port security manage digital network access, not physical perimeter security.

Physical access controls directly restrict physical entry to physical hardware and secure spaces.

Anahtar Kavram

Physical Access Controls and Anti-Tailgating Mechanisms

ÖncekiSayfa 96 / 100Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram