Security Fundamentals

Match each VPN implementation type or protocol combination on the left with its corresponding operational characteristic on the right.

Match each Virtual Private Network (VPN) technology or protocol component on the left with its corresponding operational characteristic or security capability on the right.

Match each Cisco Layer 2 security feature to its primary function in mitigating network attacks.

An enterprise network security team is evaluating its defense-in-depth posture across a multi-tenant facility hosting critical infrastructure. How should each specific security measure be matched to its primary security program element or physical control category?

A network engineer deploys Dynamic ARP Inspection (DAI) and DHCP Snooping on VLAN 30 of a Cisco Catalyst switch. A workstation connected to an untrusted access port is configured with a static IPv4 address rather than obtaining one via DHCP. When the workstation attempts to communicate with the default gateway, all of its traffic is dropped at the switch port. Which command sequence should be configured on the switch to permit ARP traffic from this statically configured host while maintaining DAI protection?

A network administrator wants to encrypt all cleartext passwords stored in a Cisco IOS router's running configuration file, including console line passwords and legacy user passwords. Which global configuration command accomplishes this task?

An administrator configures port security on an enterprise access switch interface using the switchport port-security mac-address sticky command to restrict network access to authorized devices. Endpoints connect successfully and their hardware addresses are added to the active configuration as sticky entries. Following an unexpected power maintenance event, the switch reboots. When the authorized endpoints attempt to reconnect, port security violation alerts are triggered and traffic is blocked. Which administrative oversight caused this issue after the switch rebooted?

A network administrator inspects a Cisco IOS router configuration and observes the following line:

`username admin privilege 15 secret 9 $9$ eG8H$kQzP8xY...`

Which encryption algorithm or password type is used to secure the password for this local account?

A network technician is tasked with securing direct physical access to a Cisco switch console. Which two configuration steps are required to ensure that users connecting through the console port are authenticated against user accounts stored in the local device database? (Select two.)

An enterprise network security team is establishing formal terminology for a security awareness program. Match each fundamental security concept on the left to its corresponding description on the right.

A network administrator runs the `show running-config` command on a Cisco switch and observes the following user configuration entry:

`username netadmin secret 5 $1$ mER7$19f.aB3z7QkL9p0`

Which statement accurately describes the security mechanism used to store this password?

Match each Public Key Infrastructure (PKI) component on the left with its primary function on the right.

A network engineering team is updating management access policies to reduce vulnerabilities associated with credential sniffing, brute-force access attempts, and unauthenticated administrative sessions across enterprise devices. Which two security controls directly mitigate these specific vulnerabilities and threats? (Select two.)

An administrator hardens interface GigabitEthernet1/0/5 on a Cisco Catalyst switch by executing `switchport port-security`, `switchport port-security maximum 2`, and `switchport port-security mac-address sticky`. During business hours, two authorized workstations connect to the switch port and successfully transmit data. However, following a scheduled power outage that causes an ungraceful switch reload, users report that connecting the exact same workstations to GigabitEthernet1/0/5 triggers a security violation, placing the port into an err-disabled state. Inspection via `show port-security interface gigabitEthernet1/0/5` shows a Total MAC Addresses count of 0. Which administrative oversight directly caused this loss of MAC address bindings?

An network administrator is implementing Multi-Factor Authentication (MFA) to secure access to network infrastructure devices. Which two of the following options represent a possession factor ('something you have')? (Select two.)

An enterprise security analyst is categorizing security audit findings and incident events into core cybersecurity governance definitions. Match each operational scenario on the left with its corresponding fundamental security concept on the right.

A network administrator is establishing password security policies on network devices to protect administrative logins from brute-force attacks. Which security policy control directly ensures that users choose strong passwords that resist dictionary attacks?

An organization is deploying 802.1X authentication using EAP-TLS to secure network access. During testing, a user laptop fails the TLS handshake when attempting to authenticate against the Cisco Identity Services Engine (ISE) RADIUS server. Inspection of the server logs reveals that the client presented a valid user certificate issued by an Intermediate Certificate Authority (CA), and the root CA certificate is present in the server's trusted store. However, the handshake fails because ISE cannot verify whether the client certificate has been revoked due to an unreachable Revocation Check endpoint. Which mechanism or component must be accessible to resolve this authentication failure?

A network technician configures a standard IPv4 access control list on a Cisco router using the command `access-list 5 permit host 172.16.10.15` and applies it inbound on an interface. What happens when host 172.16.10.20 sends traffic into that interface?

A network security engineer is reviewing the defense-in-depth posture for a sensitive financial processing facility. The engineer needs to implement controls that belong specifically to the physical security domain or administrative security program elements, distinguishing them from technical and logical network mechanisms. Which two options represent physical access controls or security program elements? (Select two.)