Security Fundamentals

A network engineer is hardening an enterprise access layer switch using Cisco Layer 2 security features. Match each specific Layer 2 security feature configuration component on the left with its exact operational behavior or validation requirement on the right.

A network security administrator configures mutual certificate-based authentication (EAP-TLS) for remote access VPN endpoints. During initial validation testing, client endpoints successfully verify the identity of the VPN gateway. However, the VPN gateway fails to authenticate the client certificates. Detailed inspection reveals that the gateway is configured for mandatory certificate status checking using the Online Certificate Status Protocol (OCSP), but outbound HTTP requests sent to the Uniform Resource Identifier (URI) listed in the Authority Information Access (AIA) extension are being dropped by a perimeter security policy. Which statement correctly identifies the cause of the failure and the necessary resolution?

A network administrator needs to record and audit the specific CLI commands executed by engineers during their active management sessions on enterprise routers. Which component of the AAA framework provides this record-keeping functionality?

A network engineer configures an inbound IPv4 extended Access Control List (ACL) on GigabitEthernet0/1 to filter traffic entering a corporate network segment:

text
ip access-list extended FILTER_WEB
permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 80
permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.50 eq 443

A workstation at $172.16.10.15$ attempts to send ICMP echo request packets (ping) to the server at $192.168.1.50$. What happens to these ICMP packets when processed by the router interface?

In enterprise Cisco switch implementations, Layer 2 security controls govern frame processing, metadata insertion, and hardware lookup behaviors. Match each Layer 2 security operation or feature context to its exact functional mechanism.

A network administrator is configuring an extended IPv4 Access Control List (ACL) named `MGMT_FILTER` to implement sequential top-down filtering on a Cisco router interface. The policy requires four explicit criteria:
1. Permit SSH administrative access (TCP port 22) from source subnet `192.168.50.0/24` to target server `10.10.10.25`.
2. Permit SNMP monitoring queries (UDP port 161) from source subnet `192.168.50.0/24` to target server `10.10.10.25`.
3. Deny and log all other IP traffic from source subnet `192.168.50.0/24` destined to target server `10.10.10.25`.
4. Permit all remaining traffic originating from subnet `192.168.50.0/24` to any other destination, overriding the default implicit deny statement for this subnet.

In what top-down sequential order must these ACL statements be placed to satisfy all policy requirements without shadowing rules?

A network engineer configures an extended IPv4 Access Control List (ACL) on a Cisco IOS router interface with the following commands:

text
access-list 105 permit tcp 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255 eq 22
access-list 105 permit icmp 192.168.10.0 0.0.0.255 172.16.1.0 0.0.0.255 echo

This ACL is applied in the inbound direction on interface GigabitEthernet0/1 ($192.168.10.1/24$). Which two statements correctly describe how traffic entering interface GigabitEthernet0/1 is processed by this ACL?

A network administrator executes the commands `ip dhcp snooping` and `ip arp inspection vlan 10` on a Cisco Catalyst switch to mitigate Layer 2 ARP spoofing attacks. However, users on VLAN 10 immediately lose all network connectivity because Dynamic ARP Inspection (DAI) drops all incoming ARP requests from client ports. Executing `show ip dhcp snooping binding` displays an empty binding table. Which command was omitted from the switch configuration?

A network engineer is hardening access to a Cisco IOS router. The local user account is created using `username admin1 secret P@ssw0rd123`. However, when administrators attempt to log in remotely via SSH, the router requests only a password rather than asking for a username first. Which command must be configured under `line vty 0 4` to force the router to authenticate users against the local user database?

Which TWO operational characteristics accurately describe the RADIUS protocol implementation? (Select TWO)

A network administrator applies the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to regulate access from the Sales department ($192.168.30.0/24$) to the Finance server ($10.2.2.50$):

text
ip access-list extended FILTER_SALES
permit tcp host 192.168.30.15 host 10.2.2.50 eq 443
deny ip 192.168.30.0 0.0.0.255 host 10.2.2.50
permit ip 192.168.30.0 0.0.0.255 any

Which two statements correctly describe the operational evaluation and deployment best practices for this ACL configuration? (Select two.)

A network administrator is configuring initial administrative access security on a Cisco IOS XE router for remote management via SSH. Which TWO commands or configuration actions are required to enforce local database user authentication on the VTY lines and ensure local account passwords are saved using the scrypt (Type 9) hashing algorithm? (Select two.)

A network administrator is creating an IPv4 extended Access Control List (ACL 101) on a Cisco IOS router to enforce security policies for traffic sent to Web Server 192.168.10.50. The policy requires:

1. Host 10.1.1.5 must be permitted HTTP access (TCP port 80) to Web Server 192.168.10.50.
2. Host 10.1.1.5 must be denied all other IP traffic to Web Server 192.168.10.50.
3. All other hosts in the 10.1.1.0/24 subnet must be permitted full IP access to Web Server 192.168.10.50.
4. All remaining traffic to Web Server 192.168.10.50 must be explicitly denied.

Arrange the ACL statements in the correct sequential top-down order (from line 1 at the top to line 4 at the bottom) to satisfy all security requirements.

A network administrator configures an access port on a Cisco Catalyst switch using the commands `switchport port-security` and `switchport port-security mac-address sticky`. A host connects to the port, and its MAC address is dynamically learned and written to the running configuration. Shortly after, the switch experiences an unexpected reboot due to a brief power failure, before `copy running-config startup-config` or `write memory` was executed. What happens to the learned sticky MAC address on this interface after the switch completes its boot sequence?

Match each Layer 2 security feature or operational scenario on the left to its corresponding switch behavior or implementation detail on the right.

A network administrator applies the following standard IPv4 access control list (ACL) to a VTY line on a Cisco IOS switch to secure remote management access:

text
ip access-list standard VTY_ACCESS
permit host 192.168.10.25
permit 192.168.20.0 0.0.0.255

A monitoring server with IPv4 address $192.168.10.50$ attempts to initiate an SSH session to the switch. Based on this configuration, what action does the switch take on this traffic, and why?

Following an unexpected reboot of an enterprise access switch, users connected to interface GigabitEthernet1/0/12 report a complete loss of network connectivity. Upon investigation, the network administrator discovers that the dynamically learned MAC address added to the port security table prior to the switch reload is missing, causing the switch to reject traffic from the connected workstation. Which administrative action was omitted prior to the reboot that resulted in the loss of the sticky MAC address?

A network administrator is upgrading a wireless network from WPA2-Personal to WPA3-Personal to increase client authentication security. Which key exchange protocol does WPA3-Personal introduce to protect against offline dictionary attacks?

A network administrator is evaluating traffic filtering on a Cisco IOS router configured with the following extended IPv4 access control list:

access-list 110 permit tcp 10.2.0.0 0.0.255.255 host 192.168.50.25 eq 22
access-list 110 deny ip 10.2.0.0 0.0.255.255 host 192.168.50.25
access-list 110 permit ip any any

Which two operational outcomes will occur when this access control list is applied inbound on interface GigabitEthernet0/0? (Select TWO.)

An network administrator is updating an enterprise wireless network configuration to implement WPA3-Personal. Which two enhancements does WPA3 provide over WPA2 to improve wireless connection security? (Select two)