Examkin

Tüm alıştırma soruları

1987 soru

Tüm türler1,987Çoktan seçmeli1,020Çoklu seçim452Sayısal18Eşleştirme229Sıralama203Boşluk doldurma22Kısa cevap43
Soru 1961Soru →

A network administrator is configuring IPv4 static routes on router R1 to reach destination network 10.88.0.0/1610.88.0.0/16. The primary path must forward traffic to the next-hop IP address 192.168.50.2192.168.50.2. A secondary path must act as a floating static backup route using the point-to-point interface Serial0/1/0, forwarding traffic only if the primary path becomes unavailable. Which TWO commands must be configured on router R1 to achieve this objective?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: ip route 10.88.0.0 255.255.0.0 192.168.50.2; ip route 10.88.0.0 255.255.0.0 Serial0/1/0 130

Cevap

The correct configurations are the command defining the primary static route using next-hop IP address 192.168.50.2 with the default administrative distance of 1, and the command defining the floating static backup route via interface Serial0/1/0 with an administrative distance elevated to 130.
The primary path to 10.88.0.0/1610.88.0.0/16 is defined using the next-hop IPv4 address 192.168.50.2, which inherits the default static route Administrative Distance (AD) of 1. To configure a floating static backup route, an explicit AD value strictly greater than the primary route's AD (such as 130) must be appended at the end of the command string. Additionally, point-to-point interfaces like Serial0/1/0 are valid exit interface choices for static routing.

Adım Adım Çözüm

1
Determine the primary route configuration.
Syntax: 'ip route 10.88.0.0 255.255.0.0 192.168.50.2'.
Standard IPv4 static routes default to an Administrative Distance (AD) of 1 when no distance parameter is specified at the end of the command.
2
Determine the backup floating static route configuration.
Syntax: 'ip route 10.88.0.0 255.255.0.0 Serial0/1/0 130'.
A floating static route requires an administrative distance higher than the primary route's AD (which is 1). Specifying an AD of 130 ensures it remains out of the routing table until the primary path goes down.

Anahtar Kavram

IPv4 Static Route Syntax and Floating Static Administrative Distance
Soru 1962Soru →

A network administrator is evaluating traffic filtering on a Cisco IOS router configured with the following extended IPv4 access control list:

access-list 110 permit tcp 10.2.0.0 0.0.255.255 host 192.168.50.25 eq 22
access-list 110 deny ip 10.2.0.0 0.0.255.255 host 192.168.50.25
access-list 110 permit ip any any

Which two operational outcomes will occur when this access control list is applied inbound on interface GigabitEthernet0/0? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: SSH traffic originating from host 10.2.15.5 and destined to host 192.168.50.25 is permitted by the router.; HTTP traffic (TCP port 80) originating from host 10.2.15.5 and destined to host 192.168.50.25 is denied by the router.

Cevap

SSH traffic from host 10.2.15.5 to 192.168.50.25 is permitted, and HTTP traffic (TCP port 80) from host 10.2.15.5 to 192.168.50.25 is denied.
Access control lists evaluate packets sequentially from top to bottom until a match is found. For SSH traffic from host 10.2.15.5 to 192.168.50.25, line 1 matches because 10.2.15.5 falls within subnet 10.2.0.0/16 (wildcard 0.0.255.255) and SSH operates on TCP port 22; therefore, SSH traffic is permitted. For HTTP traffic (TCP port 80) from host 10.2.15.5 to 192.168.50.25, it bypasses line 1 because of the port mismatch, but matches line 2 because the 'ip' keyword encompasses all IPv4 payloads including TCP; therefore, HTTP traffic is denied.

Adım Adım Çözüm

1
Evaluate the first ACL entry against incoming SSH traffic from 10.2.15.5 to 192.168.50.25.
Host 10.2.15.5 matches wildcard mask 0.0.255.255 (subnet 10.2.0.0/16), destination is host 192.168.50.25, and SSH uses TCP port 22. Line 1 permits this traffic.
ACLs are evaluated sequentially top-down; once a match occurs, no further entries are evaluated.
2
Evaluate HTTP traffic (TCP port 80) from 10.2.15.5 to 192.168.50.25 against the ACL statements.
Line 1 specifies port 22, so port 80 does not match line 1. Processing moves to line 2, which denies all IP traffic from 10.2.0.0/16 to 192.168.50.25. Line 2 denies HTTP traffic.
The 'ip' protocol keyword in extended ACLs includes all higher-layer protocols such as TCP, UDP, and ICMP.
3
Evaluate traffic from host 10.3.1.1 to 192.168.50.25.
Host 10.3.1.1 does not match 10.2.0.0/16 on line 1 or line 2. Processing reaches line 3 'permit ip any any', which explicitly permits the packet.
An explicit 'permit ip any any' statement overrides the default implicit deny for any traffic reaching line 3.

Anahtar Kavram

Extended IPv4 Access Control List sequential top-down evaluation, protocol matching, and implicit/explicit statement processing.
Soru 1963Soru →

Two Layer 3 switches, Core-1 and Core-2, provide default gateway redundancy for hosts in VLAN 30 (10.30.0.0/2410.30.0.0/24). Core-1 is configured with physical interface IP address 10.30.0.2/2410.30.0.2/24 and Core-2 with 10.30.0.3/2410.30.0.3/24. A network administrator enters the configuration command `standby 30 ip 10.30.0.2` on Core-1's VLAN 30 interface. Which outcome occurs when this command is executed?

Cevabı ve açıklamayı göster

Cevap: The router rejects the command because HSRP does not allow the virtual IP address to match an IP address assigned to a physical interface.

Cevap

The command is rejected because HSRP virtual IP addresses cannot match any physical interface IP address configured on the router.
Cisco IOS/IOS-XE enforces a fundamental operational rule in HSRP: the virtual IP address must be unique within the subnet and cannot match the physical IP address of any router interface in the HSRP group. Attempting to assign an interface's physical IP address as the HSRP virtual IP results in an immediate CLI error rejecting the command.

Adım Adım Çözüm

1
Analyze the HSRP virtual IP address configuration rule.
In Hot Standby Router Protocol (HSRP v1 and v2), the virtual IP address must be an unused IP address within the subnet assigned to the interface.
Assigning an existing physical interface IP address as the virtual IP would cause internal IP routing conflicts and ARP table ambiguities on the local router.
2
Compare HSRP behavior with VRRP.
While Virtual Router Redundancy Protocol (VRRP) allows a router to act as the IP address owner by assigning its physical IP address as the virtual IP (setting priority to 255), HSRP explicitly forbids this.
Understanding protocol implementation differences is essential for gateway redundancy administration.
3
Determine the CLI execution result.
Entering `standby 30 ip 10.30.0.2` on an interface already configured with physical IP 10.30.0.210.30.0.2 causes Cisco IOS to return a command syntax/validation error and reject the entry.
The CLI parser validates the virtual IP against existing interface address configurations immediately upon entry.

Anahtar Kavram

HSRP Virtual IP Address Assignment Restrictions
Soru 1964Soru →

An network administrator is updating an enterprise wireless network configuration to implement WPA3-Personal. Which two enhancements does WPA3 provide over WPA2 to improve wireless connection security? (Select two)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Simultaneous Authentication of Equals (SAE) to defend against offline dictionary attacks; Mandatory Protected Management Frames (PMF) to protect management traffic against eavesdropping and forging

Cevap

WPA3 improves security over WPA2 by introducing Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks and mandating Protected Management Frames (PMF) to secure management frame exchanges.
WPA3 introduces Simultaneous Authentication of Equals (SAE) to replace the standard WPA2 pre-shared key 4-way handshake, offering protection against offline dictionary brute-force attempts. Additionally, WPA3 requires mandatory implementation of Protected Management Frames (PMF) to prevent malicious disassociation and deauthentication spoofing.

Adım Adım Çözüm

1
Identify key authentication upgrades in WPA3-Personal
WPA3 replaces PSK with SAE (Simultaneous Authentication of Equals), rendering offline dictionary attacks ineffective even with weak passphrases.
SAE performs a resistant peer-to-peer key exchange (Dragonfly key exchange protocol).
2
Identify key management frame protections in WPA3
PMF (Protected Management Frames / IEEE 802.11w) is mandatory in WPA3 deployments.
PMF prevents attackers from forging management frames such as deauthentication attacks.

Anahtar Kavram

Wireless Security Protocols (WPA3 Features & Enhancements)
Soru 1965Soru →

An enterprise network administrator is deploying Layer 2 security controls across an access switch. The administrator configures DHCP Snooping and Dynamic ARP Inspection (DAI) on VLAN 15 to safeguard clients against rogue DHCP servers and ARP spoofing attacks. Which TWO statements accurately describe the operational requirements and behaviors of Dynamic ARP Inspection (DAI) in this environment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: DAI intercepts and validates incoming ARP requests and responses on untrusted interfaces against the DHCP snooping binding database.; Uplink interfaces connected to core switches or default gateway routers must be designated as DAI trusted ports to allow legitimate ARP traffic without inspection.

Cevap

The correct operational behaviors are that Dynamic ARP Inspection (DAI) intercepts and validates ARP packets on untrusted ports against the DHCP snooping binding table, and that switch uplink/gateway interfaces must be configured as trusted ports to allow valid infrastructure ARP traffic to bypass inspection.
Dynamic ARP Inspection (DAI) protects networks against Man-in-the-Middle ARP spoofing by intercepting all ARP requests and responses on untrusted interfaces and verifying their sender IP and MAC address pairs against the DHCP snooping binding database. Additionally, ports connected to trusted network infrastructure (such as default gateways and switch uplinks) must be configured as DAI trusted interfaces so legitimate network traffic is passed without being dropped.

Adım Adım Çözüm

1
Analyze DAI untrusted port behavior
DAI intercepts incoming ARP packets on untrusted interfaces and compares the IP-and-MAC sender fields against the DHCP snooping binding database (or static ARP ACLs). Unmatched packets are dropped.
Untrusted ports are host-facing access ports where malicious ARP poisoning attacks might originate.
2
Analyze DAI trusted port role
Ports connected to authorized switches, routers, or servers bypass DAI validation checks.
Infrastructure ports carry traffic for multiple hosts or network devices that may not have dynamic DHCP bindings on the local switch, so inspecting them would result in false-positive packet drops.
3
Evaluate distractor mechanisms
DAI does not query Port Security NVRAM configurations nor does it require native VLAN alignment to inspect VLAN-specific ARP frames.
DAI relies specifically on Layer 2/3 IP-to-MAC mapping databases generated via DHCP Snooping.

Anahtar Kavram

Dynamic ARP Inspection (DAI) database binding dependencies and interface trust state roles.
Tahmini Süre:2m 0s
Soru 1966Soru →

An auditor examines the device management settings on a Cisco IOS XE switch and observes the following running configuration snippet:

text
service password-encryption
!
username auditor privilege 3 algorithm-type scrypt secret Security2026!
username operator privilege 1 password 0 C1sc0123!
!
line vty 0 4
login local
transport input ssh

Which TWO statements correctly describe the security posture and operational behavior of this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The auditor account credential uses Type 9 hash storage, which provides strong protection against password cracking via key stretching.; The operator account credential will be rendered as weak Type 7 reversible ciphertext in the running configuration.

Cevap

The auditor account uses strong Type 9 scrypt password hashing, and the operator account cleartext password is obfuscated as Type 7 ciphertext due to service password-encryption.
The configuration correctly demonstrates two password security characteristics: the 'scrypt' algorithm type generates a secure Type 9 hash for the auditor user, while global 'service password-encryption' converts cleartext 'password 0' statements into Type 7 weak reversible obfuscation for display purposes.

Adım Adım Çözüm

1
Analyze the 'auditor' username configuration line.
The command 'username auditor privilege 3 algorithm-type scrypt secret ...' generates a Type 9 encrypted password using the scrypt algorithm.
Type 9 scrypt hashes provide robust protection against offline password cracking due to key stretching.
2
Analyze the global 'service password-encryption' command and 'operator' account configuration.
Cleartext passwords specified with 'password 0' are encoded into Type 7 obfuscated strings in the configuration file.
'service password-encryption' applies weak reversible Type 7 encryption to prevent shoulder surfing.

Anahtar Kavram

Local User Database Password Storage and Encryption Types
Soru 1967Soru →

Which encryption cipher suite does the WPA2 wireless security standard use by default to ensure data confidentiality and integrity for wireless network traffic?

Cevabı ve açıklamayı göster

Cevap: AES-CCMP

Cevap

AES-CCMP is the default encryption cipher suite used by WPA2.
WPA2 requires the use of Advanced Encryption Standard (AES) operating in Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). This combination guarantees strong data confidentiality and frame authenticity.

Adım Adım Çözüm

1
Identify the primary encryption mechanism required by the WPA2 standard.
WPA2 implements the full IEEE 802.11i standard, which specifies AES with CCMP as the mandatory cipher suite.
AES-CCMP provides strong 128-bit encryption along with Message Integrity Check (MIC) to ensure data privacy and authenticity.

Anahtar Kavram

WPA2 Default Encryption (AES-CCMP)
Soru 1968Soru →

A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to mitigate ARP spoofing attacks across the corporate subnet. Although DHCP clients operate without interruption, several critical servers using statically configured IP addresses immediately lose network access. Switch logs indicate that DAI is actively dropping all ARP packets generated by these static servers because their IP-to-MAC bindings do not exist in the DHCP snooping binding database. Which configuration step must be performed to restore network connectivity for the static servers while maintaining DAI protection on VLAN 10?

Cevabı ve açıklamayı göster

Cevap: Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.

Cevap

Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.
Dynamic ARP Inspection relies by default on the DHCP snooping binding database to verify IP-to-MAC address relationships in ARP packets on untrusted ports. Because static servers never request an IP address via DHCP, their bindings are absent from the database. Defining an ARP ACL with static IP-to-MAC entries and binding it to DAI using the `ip arp inspection filter` command allows the switch to validate and permit legitimate ARP traffic from static hosts.

Adım Adım Çözüm

1
Identify the cause of packet drops under Dynamic ARP Inspection (DAI).
DAI intercepts all ARP requests and responses on untrusted ports and validates them against the DHCP snooping binding database. Statically addressed hosts do not use DHCP, so they lack entries in the database, causing DAI to drop their ARP packets.
Understanding why static hosts fail under DAI is essential for selecting the correct non-disruptive bypass mechanism.
2
Define an ARP ACL for static IP-to-MAC mappings.
Configuring an ARP ACL (`arp access-list <name>`) allows explicit static mapping of IP addresses to MAC addresses (e.g., `permit ip host <IP> mac host <MAC>`).
ARP ACLs provide a manual binding table that DAI checks when validating ARP packets.
3
Apply the ARP ACL to the affected VLAN.
Executing `ip arp inspection filter <acl-name> vlan 10 [static]` instructs DAI to consult the ARP ACL for validation on VLAN 10.
Linking the ARP ACL to DAI ensures static server ARP traffic is validated and permitted without disabling DAI security.

Anahtar Kavram

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Soru 1969Soru →

A network engineer creates a local user account on a Cisco IOS XE router using the command `username admin privilege 15 secret C1sc0#Pass`. However, when attempting to establish a session through the console port, the router displays only a `Password:` prompt rather than asking for a username.

Which command must be executed under `line con 0` configuration mode to require local database user authentication?

Cevabı ve açıklamayı göster

Cevap: login local

Cevap

The correct action is to execute the `login local` command under `line con 0` configuration mode.
Executing `login local` under line configuration mode explicitly binds line authentication to the local IOS user database created with global `username` commands. This forces the device to prompt for both a username and password during connection establishment.

Adım Adım Çözüm

1
Analyze line authentication behavior
By default or when configured with the simple `login` command, a Cisco line interface expects a line password defined by the `password` line subcommand.
Without instructing the line to check the local database, the router ignores defined `username` accounts for line access.
2
Identify the command that references the local user database
The `login local` command tells Cisco IOS to check credentials against accounts created via `username` global configuration commands.
This causes the line to present a `Username:` prompt followed by a `Password:` prompt.

Anahtar Kavram

Cisco IOS Line Local Database Authentication
Soru 1970Soru →

A junior network technician is reviewing device configuration procedures for a new campus deployment. Which key architectural difference characterizes a controller-based network when compared to a traditional network architecture?

Cevabı ve açıklamayı göster

Cevap: Control plane intelligence is centralized on a dedicated network controller rather than running independently on each node.

Cevap

Control plane intelligence is centralized on a dedicated network controller rather than running independently on each node.
Controller-based networking separates the control plane from the data plane, moving control intelligence into a centralized controller that programmatically manages network devices.

Adım Adım Çözüm

1
Identify how control plane functions operate in traditional networks.
In traditional networking, every router and switch runs its own control plane protocol stack independently (distributed control plane).
Traditional devices build routing and forwarding tables locally.
2
Compare traditional behavior with controller-based network architecture.
In controller-based networking (SDN), control plane functions are abstracted and centralized into a central software controller.
Centralization allows policy-based automated management, while physical devices handle data plane forwarding.

Anahtar Kavram

Centralized Control Plane vs Distributed Control Plane
Soru 1971Soru →

A network engineer is troubleshooting host connectivity issues on a Cisco Catalyst switch after enabling Dynamic ARP Inspection (DAI) on VLAN 50. Most clients receive their network settings dynamically via DHCP, but a legacy server connected to interface GigabitEthernet1/0/10 uses a static IP address. Because the server's IP-to-MAC mapping is absent from the DHCP snooping binding database, the switch drops all ARP packets originating from GigabitEthernet1/0/10. Which configuration sequence allows ARP traffic from this static server while maintaining active DAI inspection for all other hosts on VLAN 50?

Cevabı ve açıklamayı göster

Cevap: Define an ARP access control list matching the server's IP and MAC addresses, then apply it globally to VLAN 50 using the ip arp inspection filter command with the static keyword.

Cevap

The correct action is to define an ARP access control list specifying the static host's IP and MAC address mapping, and bind it to VLAN 50 using the command `ip arp inspection filter <acl-name> vlan 50 static`.
Dynamic ARP Inspection relies on the DHCP snooping binding database to validate ARP packets on untrusted interfaces. When network endpoints use static IP addressing, their entries do not exist in the DHCP binding database. To resolve this, administrators must configure an ARP ACL (`arp access-list`) containing the static host's MAC and IP address, and apply it to the VLAN via `ip arp inspection filter <acl_name> vlan <vlan-id> [static]`. The optional `static` keyword ensures that for IPs specified in the ACL, DAI only permits packets matching the configured MAC address and drops all others.

Adım Adım Çözüm

1
Identify why Dynamic ARP Inspection (DAI) is dropping packets on interface GigabitEthernet1/0/10.
DAI inspects incoming ARP packets on untrusted ports against the DHCP snooping binding database. Statically configured hosts do not perform DHCP transactions, so their IP-to-MAC mappings are missing from the binding table.
Without a valid binding table entry, DAI flags incoming ARP requests/replies as invalid and drops them.
2
Determine the Cisco IOS mechanism to manually define static IP-to-MAC bindings for DAI.
Configuring an ARP Access Control List (ARP ACL) using `arp access-list <name>` allows explicit mapping of IP addresses to MAC addresses.
ARP ACLs supply static verification entries to DAI for hosts that do not utilize DHCP.
3
Apply the ARP ACL to the VLAN using the correct DAI command option.
Executing `ip arp inspection filter <acl-name> vlan 50 static` forces the switch to check the ARP ACL first.
Including the `static` keyword specifies an implicit deny for IP addresses defined in the ACL if their MAC addresses do not match, ensuring static hosts are authenticated without relying on DHCP snooping.

Anahtar Kavram

Dynamic ARP Inspection (DAI) ARP ACL Integration
Soru 1972Soru →

A network engineer needs to configure secure SSH remote management on a Cisco IOS XE router using local database authentication. Place the CLI configuration steps in the correct logical and CLI dependency order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps is: 1) Configure the IP domain name (`ip domain name enterprise.lab`), 2) Generate the RSA key pair (`crypto key generate rsa general-keys modulus 2048`), 3) Create a local user account with secret encryption (`username netadmin secret S3cur3!Pass2026`), 4) Enter VTY line configuration submode (`line vty 0 4`), and 5) Enforce local login and SSH protocol access (`login local` and `transport input ssh`).
To successfully enable SSH remote access authenticated by the local user database, CLI commands must follow specific mode hierarchy and operational dependencies. First, `ip domain name` must be configured in global configuration mode to form the system FQDN. Next, `crypto key generate rsa` creates the encryption keys required to initialize SSH server functionality. Third, a local user account is configured with `username secret`. Fourth, line configuration mode is entered via `line vty 0 4`. Finally, `login local` and `transport input ssh` are applied to enforce local database authentication and disallow unencrypted transport.

Adım Adım Çözüm

1
Set the domain name in global configuration mode.
Defines the domain context required for cryptographic key creation.
Cisco IOS XE constructs the default RSA key pair name using host.domain syntax; without a domain name, SSH key generation fails or requests manual domain assignment.
2
Generate RSA keys for SSH encryption.
Activates the SSH server subsystem on the router.
SSH requires asymmetric key pairs to establish secure encrypted tunnels for remote sessions.
3
Define local database user credentials.
Adds an administrative username with a Type 5 or Type 8/9 secret hash to the local running configuration.
Local password authentication relies on pre-created accounts in the local device database.
4
Enter line VTY configuration submode (`line vty 0 4`).
Changes prompt context to line configuration mode.
Line-specific access controls must be executed within the target line context.
5
Apply `login local` and `transport input ssh` commands.
Enforces local database credential checking and blocks unencrypted protocols like Telnet.
`login local` instructs VTY lines to authenticate inbound connections against the local user database, while `transport input ssh` secures transport security.

Anahtar Kavram

Cisco IOS XE SSH configuration sequence and local database authentication dependencies
Tahmini Süre:1m 30s
Soru 1973Soru →

During a network security audit, an enterprise engineering team is reviewing AAA operations across campus switches and routers. Match each specific administrative operation or security scenario on the left with its corresponding AAA component or protocol mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Evaluating whether an authenticated administrator possesses the privilege level to execute specific CLI commands such as reload or configure terminal.
Authenticating 802.1X wireless or wired client network access requests while encrypting only the user password in transit over UDP port 1812.
Tracking administrative activity by logging session start/stop timestamps, executed CLI commands, and total bytes transferred for compliance auditing.
Authenticating router console logins using a locally defined database user account when centralized TACACS+ servers become unreachable.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Evaluating command execution privileges maps to Command-Level Authorization (TACACS+); authenticating 802.1X client access over UDP port 1812 with password-only encryption maps to Network Access Authentication (RADIUS); tracking session activity and logged commands maps to AAA Accounting; and authenticating against a local database during server outages maps to Local AAA Authentication Fallback.
Evaluating CLI command privileges requires per-command authorization, which is a native capability of TACACS+ (Command-Level Authorization). Authenticating 802.1X clients over UDP port 1812 with password-only encryption describes standard RADIUS operation for network access control. Collecting log metrics such as command usage, duration, and session timestamps is the core responsibility of AAA Accounting. Falling back to an on-box database when central AAA servers fail represents Local AAA Authentication Fallback.

Adım Adım Çözüm

1
Analyze the first scenario regarding CLI command permissions.
Restricting or permitting specific commands like 'configure terminal' per user relies on Authorization, specifically leveraging TACACS+ due to its support for granular per-command authorization.
RADIUS combines Authentication and Authorization and cannot authorize individual CLI commands dynamically per session.
2
Analyze the second scenario involving 802.1X and password-only encryption over UDP.
802.1X access control relies on RADIUS (UDP 1812), which encrypts only the password field rather than the entire packet payload.
TACACS+ uses TCP port 49 and encrypts the entire packet body, making UDP 1812 and password-only encryption distinct indicators of RADIUS.
3
Analyze the third scenario focused on logging session activity and command history.
Logging timestamps, executed commands, and byte counts falls directly under the Accounting pillar of the AAA framework.
Accounting records 'what the user did' during a session, distinguishing it from Authentication ('who you are') and Authorization ('what you can do').
4
Analyze the fourth scenario addressing administrator login when central servers fail.
Using a local router username/password database as a backup mechanism when AAA server groups do not respond is Local AAA Authentication Fallback.
Configuring 'aaa authentication login default group tacacs+ local' instructs the device to query local credentials only if server group unreachable errors occur.

Anahtar Kavram

AAA Framework Pillars and Operational Protocol Mechanisms (TACACS+ vs RADIUS)
Tahmini Süre:2m 0s
Soru 1974Soru →

In a software-defined fabric deployment, an engineer is preparing the physical network switches prior to building virtual tunnels. Which essential service must the underlay network provide to enable overlay operational functionality?

Cevabı ve açıklamayı göster

Cevap: Reliable Layer 3 IP reachability between all physical fabric devices

Cevap

Reliable Layer 3 IP reachability between all physical fabric devices
The physical underlay network acts as the foundational transport layer in software-defined architectures. Its mandatory function is to establish end-to-end Layer 3 IP reachability between physical fabric nodes (such as switches and VTEPs) using traditional routing protocols like OSPF, IS-IS, or BGP. Overlay tunnels rely entirely on this underlying IP reachability to transmit encapsulated packets.

Adım Adım Çözüm

1
Identify the role of the physical underlay in software-defined network architectures.
The underlay consists of physical switches, routers, links, and Interior Gateway Protocols (such as OSPF or IS-IS).
The main purpose of the underlay is providing standard Layer 3 IP packet transport across physical devices.
2
Determine the dependency of the overlay on the underlay.
Overlay virtual tunnels (e.g., VXLAN tunnels between VTEPs) transport virtualized traffic over the physical network.
Overlay tunnels cannot be established or forward traffic unless the underlay provides IP reachability between the physical IP addresses of the tunnel endpoints.

Anahtar Kavram

Underlay Layer 3 IP Reachability Requirement
Soru 1975Soru →

A network administrator is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco router to regulate traffic sent from the internal LAN (192.168.1.0/24) to an application server (10.0.0.10).

The access policy requires:
1. Host 192.168.1.50 must be allowed full IP access to the application server (including HTTP).
2. All other hosts on the 192.168.1.0/24 subnet must be blocked from accessing HTTP (TCP port 80) on the application server.
3. All other IP traffic originating from the 192.168.1.0/24 subnet to the application server must be permitted.

Arrange the ACL statements in the correct top-down execution order to achieve this security policy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from top to bottom is: 1) permit ip host 192.168.1.50 host 10.0.0.10, 2) deny tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq 80, 3) permit ip 192.168.1.0 0.0.0.255 host 10.0.0.10, and 4) implicit deny ip any any.
Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a match occurs, stopping further evaluation. To satisfy all requirements: 1) The host-specific permit statement for 192.168.1.50 must be placed first so its HTTP traffic is allowed before subnet rules apply. 2) The HTTP deny rule for subnet 192.168.1.0/24 must be placed second so HTTP packets from all other hosts in the subnet are caught and dropped. 3) The broader subnet IP permit statement must be placed third to permit non-HTTP traffic. 4) The implicit deny statement operates at the bottom, dropping any other un-matched traffic.

Adım Adım Çözüm

1
Place specific host exception rules at the top of the ACL.
Host 192.168.1.50 is permitted full IP access before any subnet-level restrictions are evaluated.
Cisco IOS ACLs evaluate top-down and stop processing on the first match. Host 192.168.1.50 must be matched first so its HTTP traffic is not dropped by the subnet HTTP block.
2
Place specific service block rules for the subnet after host exceptions.
HTTP traffic (TCP port 80) from subnet 192.168.1.0/24 to 10.0.0.10 is denied.
This rule must appear before the general permit rule for the subnet, ensuring HTTP traffic is filtered out first.
3
Place general subnet permit rules after specific service deny rules.
All remaining IP traffic from subnet 192.168.1.0/24 to 10.0.0.10 is permitted.
Placing this rule after the HTTP deny rule ensures non-HTTP traffic from the subnet passes successfully.
4
Rely on the implicit deny at the end of the ACL.
All other traffic not matching the explicit rules is dropped.
Cisco ACLs automatically append an unwritten implicit deny statement at the end of every list.

Anahtar Kavram

Top-down sequential processing of IPv4 ACLs and ordering from most specific to least specific statements.
Soru 1976Soru →

A network engineer is evaluating QoS traffic conditioning strategies for a branch connection using a sub-rate Ethernet service where the committed information rate is lower than the physical interface speed. Which two characteristics accurately distinguish traffic policing from traffic shaping in this scenario? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Traffic shaping buffers out-of-profile packets in memory queues to smooth egress traffic spikes.; Traffic policing immediately drops or remarks packets that exceed the configured bandwidth threshold without buffering.

Cevap

Traffic shaping buffers out-of-profile packets in memory queues to smooth egress traffic spikes, and traffic policing immediately drops or remarks packets that exceed the configured bandwidth threshold without buffering.
Traffic shaping regulates output rates by queuing non-conforming packets and transmitting them smoothly over time. In contrast, traffic policing enforces rate limits without buffering, immediately dropping or remarking packets that exceed specified burst limits.

Adım Adım Çözüm

1
Analyze operational behavior of traffic shaping
Shaping buffers excess bursts in queues and smooths the egress flow to match the configured rate, introducing queuing delay rather than immediate drops.
Shapers use queue buffers to manage micro-bursts and smooth out-of-profile traffic.
2
Analyze operational behavior of traffic policing
Policing checks traffic against rate limits and immediately drops or remarks non-conforming packets without using memory buffers.
Policers operate on a bucket mechanism with no queue storage capability.

Anahtar Kavram

Traffic Policing vs. Traffic Shaping Mechanics
Tahmini Süre:1m 30s
Soru 1977Soru →

A network administrator is implementing Layer 2 security controls across corporate access switches. Which TWO operational characteristics correctly describe how DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security function on untrusted interfaces? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: DHCP Snooping drops incoming DHCP server messages, such as DHCPOFFER and DHCPACK, when received on untrusted ports.; Dynamic ARP Inspection intercept and validate ARP packets on untrusted ports by comparing source IP and MAC addresses against the DHCP snooping binding database.

Cevap

The correct operational behaviors are that DHCP Snooping drops DHCP server messages on untrusted ports and Dynamic ARP Inspection uses the DHCP snooping binding database to validate ARP packets on untrusted ports.
DHCP Snooping designates user-facing access ports as untrusted by default, causing any DHCP server responses (DHCPOFFER, DHCPACK) to be discarded to prevent rogue server deployment. Furthermore, Dynamic ARP Inspection (DAI) checks incoming ARP packets on untrusted ports against the IP-to-MAC bindings in the DHCP snooping table to stop ARP spoofing attacks.

Adım Adım Çözüm

1
Analyze the operational rules of DHCP Snooping on untrusted interfaces.
Untrusted interfaces are designated for end-user devices. Server responses such as DHCPOFFER, DHCPACK, and DHCPLEASEQUERY are dropped to block unauthorized DHCP servers.
Ensures rogue DHCP servers cannot distribute incorrect IP addresses or gateway information.
2
Analyze how Dynamic ARP Inspection (DAI) operates on untrusted interfaces.
DAI intercepts incoming ARP requests and replies on untrusted interfaces and validates their source MAC and IP against the DHCP snooping database.
Prevents ARP poisoning and man-in-the-middle attacks.
3
Evaluate sticky MAC address storage behavior in Port Security.
Sticky MACs are placed into the running configuration in volatile memory and will be lost upon reboot if not saved.
Port security does not automatically update NVRAM.

Anahtar Kavram

Layer 2 Security Integration (DHCP Snooping, DAI, Port Security)
Tahmini Süre:1m 30s
Soru 1978Soru →

A network administrator is deploying Cisco IP Phones across an enterprise network where desktop PCs are daisy-chained to the secondary switch port on each IP Phone. Which configuration location represents the recommended placement of the QoS trust boundary to prevent PC traffic from spoofing high-priority Layer 2 CoS values while ensuring voice packets are appropriately prioritized?

Cevabı ve açıklamayı göster

Cevap: At the Cisco IP Phone, trusting CoS markings generated by the phone while untrusting and remarking traffic from the connected PC to CoS 0.

Cevap

The QoS trust boundary should be enforced at the Cisco IP Phone, trusting voice traffic tagged by the phone while untrusting and rewriting CoS markings from the attached PC to 0.
Extending the trust boundary to the Cisco IP Phone ensures that voice traffic generated by the phone is trusted, while traffic originating from the daisy-chained PC is untrusted and rewritten to a default best-effort value (CoS 0) before entering the switch access port.

Adım Adım Çözüm

1
Identify the risk of untrusted endpoints at the network edge.
Desktop PCs connected to the IP phone can potentially send frames with altered Class of Service (CoS) bits to gain unauthorized priority.
If untrusted PC traffic is prioritized, critical voice traffic may experience jitter, latency, or packet loss.
2
Determine the optimal trust boundary enforcement point.
The trust boundary is extended to the Cisco IP Phone using switch commands (e.g., `mls qos trust cos` combined with `switchport priority extend trust` or `switchport priority extend cos 0`).
The Cisco IP Phone acts as a micro-switch, marking its own voice payload appropriately while stripping or remarking incoming traffic from the attached PC port down to CoS 0.

Anahtar Kavram

QoS Trust Boundary Placement and CoS Marking Enforcement
Soru 1979Soru →

A network technician enables DHCP Snooping globally and on VLAN 10 using the commands `ip dhcp snooping` and `ip dhcp snooping vlan 10`. However, clients connected to access ports on VLAN 10 are failing to acquire IP addresses from the central DHCP server reachable via trunk interface GigabitEthernet0/1. Which condition accounts for the DHCP packet drops on the switch?

Cevabı ve açıklamayı göster

Cevap: Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.

Cevap

Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.
When DHCP Snooping is globally activated on a Cisco switch, every interface is set to an untrusted state by default. Untrusted interfaces only allow DHCP client broadcast requests to enter the switch, while dropping any incoming DHCP server response messages (DHCPOFFER, DHCPACK). Because GigabitEthernet0/1 connects to the central DHCP server, it must be explicitly configured with `ip dhcp snooping trust` to permit server responses to reach clients on VLAN 10.

Adım Adım Çözüm

1
Analyze default DHCP Snooping port trust states upon enabling the feature.
By default, all switch interfaces are categorized as untrusted.
DHCP Snooping enforces security by filtering unauthorized DHCP server traffic on untrusted ports.
2
Evaluate packet handling rules on untrusted ports.
Untrusted ports permit client requests (DHCPDISCOVER, DHCPREQUEST) but drop server replies (DHCPOFFER, DHCPACK, DHCPNAK).
Prevents rogue DHCP servers from offering unauthorized IP configurations to clients.
3
Determine the required resolution to restore DHCP functionality.
Configure `ip dhcp snooping trust` on interface GigabitEthernet0/1.
Designating the server-facing uplink as trusted allows legitimate server offer and acknowledgment packets to pass.

Anahtar Kavram

DHCP Snooping Trusted vs Untrusted Port Operational Behavior
Soru 1980Soru →

In a Cisco Software-Defined Access (SD-Access) architecture, which function is strictly the responsibility of the physical underlay network?

Cevabı ve açıklamayı göster

Cevap: Providing underlying IP connectivity to ensure reachability between fabric nodes.

Cevap

Providing underlying IP connectivity to ensure reachability between fabric nodes.
The underlay network provides basic, robust Layer 3 unicast IP reachability between all fabric nodes (such as fabric edge switches and control plane nodes) using traditional routing protocols.

Adım Adım Çözüm

1
Identify the primary definition of the underlay in software-defined network architectures.
The underlay is the physical infrastructure (switches, routers, links) and IGP routing protocols.
The underlay exists to establish basic Layer 3 IP reachability across all physical network devices.
2
Differentiate underlay transport from overlay fabric services.
Encapsulation (VXLAN), control plane mapping (LISP), and policy enforcement (Cisco TrustSec/SGTs) operate in the overlay built on top of the underlay.
Keeping transport functions in the underlay decouples physical topology from virtual fabric services.

Anahtar Kavram

SDN Underlay vs. Overlay Functionality
Tahmini Süre:45s
ÖncekiSayfa 99 / 100Sonraki
Tüm alıştırma soruları — Cisco CCNA | Examkin