Security Fundamentals

A network security architect is hardening a newly initialized Cisco IOS XE enterprise router. Arrange the following CLI configuration commands in the mandatory order required to establish local database authentication for remote management, ensuring that local privileged credentials using scrypt hashing are created prior to entering the line context, local authentication is bound to the VTY lines, and unencrypted management sessions are blocked.

A network administrator configures a Cisco IOS router to restrict access to a financial database server ($192.168.50.100/32$) from the HR subnet ($192.168.10.0/24$). All other traffic between subnets must be permitted. The administrator applies the following access list in the inbound direction on interface GigabitEthernet0/0:

text
ip access-list extended FILTER_HR
deny ip 192.168.10.0 0.0.0.255 host 192.168.50.100

After applying this ACL, users report that all traffic targeting any server in the $192.168.50.0/24$ network is being dropped, including traffic from non-HR subnets. Which configuration change will resolve the issue and permit intended traffic?

An organization configures a remote access VPN solution using the Cisco AnyConnect Secure Mobility Client for mobile employees. To conserve corporate headquarter bandwidth, the network administrator must enable a feature that encrypts and routes traffic destined for internal corporate subnets through the VPN tunnel, while permitting general internet traffic to access the internet directly via the remote user's local network connection. Which VPN feature should the administrator configure to satisfy this requirement?

A network administrator configures a Cisco IOS switch for secure management access. The following excerpt is retrieved from the running configuration:

text
username secadmin privilege 15 secret 8 $8$ k9A$eP2xL1...
service password-encryption
!
line vty 0 4
transport input ssh
login

When a network engineer attempts to establish an SSH session using the `secadmin` account credentials, the authentication attempt is rejected. Which configuration change must be applied to line vty 0 4 to allow authentication using the local user database?

Match each VPN deployment characteristic or operational mode on the left with its corresponding VPN technology concept on the right.

An organization is designing the physical security and security program elements for a newly constructed enterprise facility housing core network hardware and server racks. Which two measures represent physical access controls or physical security program elements? (Select two.)

An enterprise organization is updating its infrastructure security baseline to comply with zero-trust architecture guidelines. The network security team is establishing policies governing administrative SSH access to core switches and 802.1X EAP-TLS client authentication across corporate wireless networks. Which TWO of the following implementation details correctly align with Cisco recommended standards for multi-factor authentication (MFA) factor classification and Public Key Infrastructure (PKI) digital certificate validation? (Choose two.)

A network security administrator must perform a local password recovery procedure on a Cisco IOS router after administrative credentials were lost. Arrange the procedural steps in the correct chronological order required to restore administrative access without losing the active device configuration.

A network engineer is configuring IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which of the following statements regarding the operation and behavior of IPv4 ACLs are correct? (Select TWO.)

A network engineer configures an extended IPv4 access control list named `CORP_SEC` on a Cisco IOS router to regulate access from the branch network ($10.40.0.0/16$) to an internal web server ($192.168.50.10/32$). The security requirement specifies that host $10.40.4.15$ in the IT subnet ($10.40.4.0/22$) must be allowed HTTPS access (TCP port 443) to the web server, while all other traffic from $10.40.0.0/16$ to the $192.168.50.0/24$ network must be denied. Additionally, non-matching traffic must reach external destinations freely.

The engineer enters the following configuration commands:

text
ip access-list extended CORP_SEC
10 deny ip 10.40.0.0 0.0.255.255 192.168.50.0 0.0.0.255
20 permit tcp host 10.40.4.15 host 192.168.50.10 eq 443
30 permit ip any any
!
interface GigabitEthernet0/0/1
ip access-group CORP_SEC in

During testing, HTTPS traffic from $10.40.4.15$ to $192.168.50.10$ is unexpectedly dropped. Which modification corrects the access control list logic to satisfy all requirements?

An administrator configures an IPv4 access control list on a router interface containing only the single entry `access-list 15 permit host 172.16.10.5`. What action will the router take when a packet originating from host 172.16.10.20 arrives on this interface?

A network administrator is evaluating AAA protocols to manage CLI access to enterprise routers. Which feature is a key characteristic of TACACS+ compared to RADIUS?

A network administrator enables Dynamic ARP Inspection (DAI) on a switch access VLAN to mitigate ARP spoofing attacks. Which database does DAI consult by default to validate ARP requests and responses received on untrusted ports?

A network administrator is configuring an IPv4 extended named access control list (ACL) on a Cisco router interface to implement security controls for the host subnet $10.50.1.0/24$. The ACL must satisfy the following traffic policies:

1. Allow ICMP echo requests from $10.50.1.0/24$ strictly to the default gateway at $10.50.1.1$.
2. Allow HTTPS access from $10.50.1.0/24$ to the internal application server at $192.168.20.45$.
3. Explicitly deny all other IPv4 traffic originating from $10.50.1.0/24$ destined to the internal server subnet $192.168.20.0/24$.
4. Permit all remaining outbound traffic from $10.50.1.0/24$ to any other network destination.

Which two ACL entries must be placed in the access list to achieve this exact behavior without blocking general Internet access? (Select two.)

A network manager is implementing physical security controls at a branch office data room following an incident where an unauthorized visitor entered by closely following an authorized employee through a single access door. Which physical control specifically mitigates tailgating by utilizing a dual-door vestibule where the second door opens only after the first door closes and authentication is validated?

A company needs to provide temporary access to internal web application portals for third-party contractors working from unmanaged personal computers. The security policy mandates that no client software or persistent VPN configuration profiles can be pre-installed on these contractor endpoints. Which VPN technology best satisfies this operational requirement?

A network security architect is enforcing local authentication policies on a Cisco IOS XE router. The organization requires local user accounts to utilize scrypt key derivation hashing algorithms and mandates that remote management lines authenticate users against the local device database. Which TWO actions or configuration commands meet these requirements?

An organization is upgrading the physical security posture of its main data center facility. The security team must implement controls that explicitly address tailgating mitigation at perimeter entryways and provide environmental surveillance inside server rooms. Which two physical security controls directly fulfill these specific requirements? (Select two.)

A network technician configures the following named IPv4 extended Access Control List (ACL) on a Cisco IOS router to restrict access from the Sales subnet ($192.168.20.0/24$) to an internal web server ($10.2.2.80$):

`ip access-list extended RESTRICT_SALES`
` deny tcp 192.168.20.0 0.0.0.255 host 10.2.2.80 eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 80`
` permit tcp 192.168.20.0 0.0.0.255 any eq 443`

The ACL is applied outbound on interface GigabitEthernet0/1 facing the internal network server segment. Following application, host $192.168.20.45$ can no longer resolve domain names using the internal DNS server at $10.2.2.53$ (UDP port 53) or receive DHCP lease updates. Which statement correctly explains why this non-HTTP traffic is blocked?

When DHCP snooping is enabled globally on a Cisco switch, what default trust state is assigned to all Layer 2 interfaces across the switch?