Security Fundamentals

298 soru

Tüm türler298 Çoktan seçmeli157 Çoklu seçim64 Eşleştirme56 Sıralama21

A network administrator applies the following standard IPv4 access control list (ACL) inbound on a router interface:

`access-list 10 permit 192.168.1.0 0.0.0.255`

A host with the IPv4 address `192.168.2.50` attempts to send traffic through this interface. What action will the router take on this packet?

The router drops the packet because it matches the implicit deny statement at the end of the ACL.

The router permits the packet because no explicit deny statement was configured in the ACL.

The router forwards the packet to the default gateway for further inspection.

The router prompts the sending host for authentication before making a forwarding decision.

Cevabı ve açıklamayı göster

Cevap: The router drops the packet because it matches the implicit deny statement at the end of the ACL.

Cevap

The router drops the packet because it matches the implicit deny statement at the end of the ACL.

Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any configured rule, it reaches the final unwritten entry: the implicit deny (deny ip any). Because the source IP 192.168.2.50 is not in the 192.168.1.0/24 subnet specified in the single permit line, it is silently dropped by this implicit deny feature.

Adım Adım Çözüm

Evaluate the packet source IPv4 address against the ACL entries.

The packet source address 192.168.2.50 does not match the permit rule for network 192.168.1.0/24.

Standard ACL 10 only matches host IP addresses falling within the 192.168.1.0 to 192.168.1.255 range.

Apply default ACL processing logic when no explicit entries match.

The packet reaches the bottom of the ACL and hits the implicit deny clause.

All Cisco IPv4 ACLs end with an unwritten 'deny ip any' rule that drops any traffic not explicitly permitted.

Anahtar Kavram

Access Control List (ACL) Implicit Deny Clause

Tahmini Süre:45s

Soru 62Soru →

During a security assessment of a financial institution, a network administrator reviews the measures implemented to protect network infrastructure. The measures include installing biometric door locks on the main data center, deploying TACACS+ for switch administration authentication, implementing Port Security on access switches, and conducting quarterly user security awareness campaigns. Which of these measures is classified specifically as a physical access control?

Installing biometric door locks on the main data center entry

Deploying TACACS+ for centralized switch management authentication

Implementing Port Security to restrict unauthorized switch port connections

Conducting quarterly security training campaigns on identifying phishing attacks

Cevabı ve açıklamayı göster

Cevap: Installing biometric door locks on the main data center entry

Cevap

Installing biometric door locks on the main data center entry

Installing biometric door locks directly controls physical access to the building and server room facilities housing network devices. Physical security controls include physical barriers, door locks, mantraps, security guards, and surveillance cameras that prevent unauthorized physical entry.

Adım Adım Çözüm

Categorize each listed security measure into physical, technical/logical, or administrative program elements.

Biometric door locks limit physical proximity to hardware. TACACS+ and Port Security manage network interface access electronically. Security awareness training educates personnel.

Security controls are broadly classified into physical controls, technical controls, and administrative/policy elements.

Identify which measure specifically restricts physical access to network equipment.

Biometric door locks prevent unauthorized individuals from physically entering the room containing servers and network devices.

Physical access controls prevent physical touch, intrusion, or theft of physical IT assets.

Anahtar Kavram

Classification of Security Controls (Physical Access Controls vs. Technical Access Controls and Security Program Elements)

Soru 63Soru →

A network technician configures port security on an access switch interface using the command `switchport port-security mac-address sticky`. Which TWO statements accurately describe how sticky MAC address learning operates on this interface?

Geçerli olan tümünü seçin

Dynamically learned MAC addresses are automatically added to the active running configuration file.

Dynamically learned sticky MAC addresses are automatically written to NVRAM startup configuration without requiring manual saving.

Learned sticky MAC addresses will be lost if the switch reboots before the running configuration is saved.

Sticky MAC learning allows untrusted frame traffic to bypass Layer 2 inspection on mismatched native VLAN trunks.

Cevabı ve açıklamayı göster

Cevap: Dynamically learned MAC addresses are automatically added to the active running configuration file.; Learned sticky MAC addresses will be lost if the switch reboots before the running configuration is saved.

Cevap

Dynamically learned MAC addresses are automatically added to the active running configuration file, and learned sticky MAC addresses will be lost if the switch reboots before the running configuration is saved.

Enabling sticky MAC learning allows switch interfaces to convert dynamically learned MAC addresses into sticky MAC addresses and append them directly to the active running configuration. Because these entries reside in volatile memory, saving the running configuration to the startup configuration is required to maintain the learned addresses after a reboot.

Adım Adım Çözüm

Analyze the function of sticky MAC address learning in Cisco IOS Port Security.

When 'mac-address sticky' is configured, the switch dynamically learns connected MAC addresses and automatically converts them into sticky entries in RAM.

Sticky MAC learning dynamically writes learned addresses into the running configuration so administrators do not have to enter them manually.

Determine the memory persistence of the running configuration.

The running configuration exists in volatile RAM and is erased upon device reboot unless explicitly saved to NVRAM.

To persist sticky MAC addresses across switch reboots, an administrator must execute 'copy running-config startup-config'.

Anahtar Kavram

Port Security Sticky MAC Address Dynamics and Configuration Persistence

Tahmini Süre:1m 0s

Soru 64Soru →

A network engineer must configure an IPv4 extended access control list (ACL 105) on a Cisco IOS router to enforce security policies for traffic originating from the internal subnet ( $10.1.1.0/24$ ) destined for an application server at $10.2.2.10$ :

1. Allow host $10.1.1.50$ administrative SSH access (TCP port 22) to server $10.2.2.10$ .
2. Prevent all other hosts in the $10.1.1.0/24$ subnet from accessing server $10.2.2.10$ via SSH.
3. Allow all hosts in the $10.1.1.0/24$ subnet web access (TCP port 80) to server $10.2.2.10$ .
4. Explicitly block all remaining IP traffic from $10.1.1.0/24$ to server $10.2.2.10$ .

In what order should the network engineer place the ACL statements from top to bottom to ensure the policy is correctly enforced?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The ACL statements must be placed from top to bottom in the sequence: 1) access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22, 2) access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22, 3) access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80, and 4) access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10.

Cisco IOS Access Control Lists enforce policies based on top-down, first-match evaluation logic. Once a packet matches an ACL line's source, destination, protocol, and port criteria, the router executes the action (permit or deny) and ignores all subsequent entries. To properly allow host 10.1.1.50 to access SSH while denying SSH to the rest of the 10.1.1.0/24 subnet, the host permit rule must appear first. Next, the subnet SSH deny rule blocks all other SSH attempts. Following that, the HTTP permit rule allows web traffic for the subnet. Finally, the broad IP deny statement catches any remaining traffic types from the subnet.

Adım Adım Çözüm

Analyze top-down evaluation mechanics in Cisco IOS IPv4 ACLs.

Cisco IOS ACL entries are processed sequentially in top-down order until the first matching line is hit, at which point packet evaluation stops.

More specific exception rules must precede general or broader range rules to prevent premature match execution.

Place the specific host SSH permit statement first.

'access-list 105 permit tcp host 10.1.1.50 host 10.2.2.10 eq 22' is placed at position 1.

Host 10.1.1.50 is an IP within subnet 10.1.1.0/24. If the subnet SSH deny rule came first, 10.1.1.50 would match the subnet rule and be denied.

Place the subnet SSH deny statement second.

'access-list 105 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 22' is placed at position 2.

This guarantees that all other SSH packets originating from 10.1.1.0/24 (excluding 10.1.1.50) are dropped before subsequent permit lines are evaluated.

Place the subnet HTTP permit statement third.

'access-list 105 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 80' is placed at position 3.

This permits HTTP port 80 traffic for all hosts in the subnet after non-authorized SSH traffic has already been blocked.

Place the subnet broad IP deny statement fourth.

'access-list 105 deny ip 10.1.1.0 0.0.0.255 host 10.2.2.10' is placed at position 4.

This catches and drops any remaining IP protocols from subnet 10.1.1.0/24 to server 10.2.2.10.

Anahtar Kavram

Cisco IOS ACL Top-Down Sequential First-Match Processing

Soru 65Soru →

A network administrator is reviewing the fundamental operation of standard IPv4 Access Control Lists (ACLs) on a Cisco IOS router. Which two statements correctly describe the operational characteristics of standard IPv4 ACLs?

Geçerli olan tümünü seçin

Standard IPv4 ACLs filter network traffic based solely on the source IPv4 address.

Traffic that does not match any explicit permit or deny rule in the ACL is dropped by an implicit deny entry.

Unmatched packets are automatically permitted and forwarded out the interface by default.

Standard IPv4 ACLs inspect Layer 4 TCP and UDP port numbers to restrict specific application traffic.

Cevabı ve açıklamayı göster

Cevap: Standard IPv4 ACLs filter network traffic based solely on the source IPv4 address.; Traffic that does not match any explicit permit or deny rule in the ACL is dropped by an implicit deny entry.

Cevap

The correct statements are that standard IPv4 ACLs filter traffic based strictly on source IPv4 addresses, and that unmatched packets are dropped due to the implicit deny statement at the end of the list.

Standard IPv4 ACLs make forwarding or dropping decisions based exclusively on the packet's source IPv4 address. Additionally, any traffic that does not match an explicit rule in the list is dropped automatically by the default implicit deny clause at the end of the ACL.

Adım Adım Çözüm

Identify the filtering criteria capability of standard IPv4 ACLs.

Standard IPv4 ACLs examine only the source address field within the IPv4 packet header.

Standard ACL syntax and logic lack fields to evaluate destination IP addresses, transport protocols, or port numbers.

Analyze default ACL evaluation behavior for unmatched packets.

Every Cisco ACL concludes with an implicit 'deny ip any' rule.

If a packet is evaluated against all explicit ACL statements without a match, it hits the implicit deny statement at the end and is discarded.

Anahtar Kavram

Standard IPv4 ACL Filtering Scope and Implicit Deny Mechanism

Soru 66Soru →

An enterprise network operations center is aligning its infrastructure security framework with Cisco security baseline recommendations. Match each security program element or access control type on the left to its corresponding operational implementation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Physical Access Control pairs with biometric scanners and mantrap portals; Security Awareness Training pairs with user education on phishing and tailgating; Incident Response Plan pairs with structured escalation workflows and containment procedures; Administrative Policy Control pairs with corporate documentation establishing acceptable use policies.

Physical access control directly limits physical proximity to network infrastructure using devices like mantrap portals and biometrics. Security awareness training educates users on recognizing threats like tailgating and phishing. Incident response plans outline emergency response steps following a breach. Administrative controls establish corporate rules, governance, and written security guidelines.

Adım Adım Çözüm

Identify physical security measures.

Biometric readers, mantraps, locks, and badges directly restrict physical access to facilities.

Physical access control measures deal directly with spatial access to facilities and network hardware.

Differentiate human-focused educational controls from administrative rules.

Training sessions target user behavior (phishing, tailgating awareness), whereas administrative policies set the formal written rules (acceptable use).

User training is an operational program element, while governance rules represent administrative controls.

Categorize reactive security procedures.

Escalation workflows and containment procedures belong to incident management.

Incident response plans guide organizational actions during and after a security event.

Anahtar Kavram

Classification of Enterprise Security Program Elements and Controls

Soru 67Soru →

A network engineer is configuring digital certificate authentication for Cisco Identity Services Engine (ISE) and enterprise network infrastructure. To ensure proper certificate deployment and validation, the engineer must correctly identify the operational function of each Public Key Infrastructure (PKI) element. Match each PKI component on the left to its corresponding primary function on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Certificate Signing Request (CSR) matches the description of containing public key and identity details sent to an issuing authority; Root CA Certificate matches serving as the trusted anchor on client devices; Subject Alternative Name (SAN) matches allowing multiple domain names or IP addresses on a single certificate; Online Certificate Status Protocol (OCSP) matches enabling real-time verification of certificate revocation status.

Each PKI component plays a distinct role in digital certificate lifecycle management and authentication: CSRs initiate certificate issuance by bundling public keys and subject identity; Root CA certificates establish client-side trust anchors; SAN extensions allow single certificates to cover multiple FQDNs/IPs; and OCSP provides real-time revocation checks.

Adım Adım Çözüm

Analyze the role of a Certificate Signing Request (CSR).

Identify that a CSR is generated prior to certificate issuance and holds the public key and subject attributes submitted to a CA.

CSR generation is the initial step in obtaining an identity certificate from a public or private PKI.

Analyze the function of a Root CA Certificate.

Identify that the Root CA Certificate acts as the implicit root of trust configured in device trust stores.

Without a trusted Root CA certificate, network entities cannot complete TLS handshakes because certificate signature chains cannot be validated.

Evaluate the X.509 extension Subject Alternative Name (SAN).

Identify that SAN extends the certificate capability to cover multiple IP addresses or hostnames beyond the primary Common Name (CN).

Modern enterprise applications like Cisco ISE require SAN entries for dual-node deployment FQDNs and management IP addresses.

Evaluate certificate validation using Online Certificate Status Protocol (OCSP).

Identify that OCSP sends specific certificate status queries to an online responder rather than downloading complete Certificate Revocation Lists (CRLs).

OCSP avoids the bandwidth overhead associated with parsing large, periodically published CRL files.

Anahtar Kavram

Public Key Infrastructure (PKI) components and certificate validation mechanisms in network access control

Soru 68Soru →

A network administrator applies an extended IPv4 Access Control List (ACL) containing only a single rule to an interface: `access-list 100 permit tcp host 192.168.1.10 host 10.0.0.5 eq 80`. What happens when a host with IP address 192.168.1.11 attempts to send HTTP traffic to 10.0.0.5?

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

The traffic is permitted because there is no explicit deny statement configured in the ACL.

The traffic is forwarded by default because ACLs only inspect source IP address 192.168.1.10.

The traffic triggers a logging notification on the router before being allowed through the interface.

Cevabı ve açıklamayı göster

Cevap: The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

Cevap

The traffic is dropped because an implicit deny clause automatically denies all unmatched packets.

Every Cisco IPv4 Access Control List ends with an invisible implicit deny statement (implicit deny ip any any). Because the single configured line only permits traffic from 192.168.1.10, any packet coming from 192.168.1.11 fails to match rule 1 and is dropped by the implicit deny clause.

Adım Adım Çözüm

Evaluate the incoming packet details against the ACL rule.

Host 192.168.1.11 does not match source IP host 192.168.1.10 in line 1.

The configured line specifically permits traffic only from host 192.168.1.10.

Proceed to subsequent lines in the ACL.

The packet hits the unwritten implicit deny statement at the end of the list.

All Cisco IOS IPv4 ACLs end with an implicit 'deny ip any any' rule.

Determine the forwarding decision.

The router drops the packet from host 192.168.1.11.

Traffic that fails to match any explicit permit line is denied.

Anahtar Kavram

Implicit Deny in IPv4 Access Control Lists

Soru 69Soru →

A network administrator configures the following IPv4 extended named Access Control List (ACL) on a Cisco IOS router to control access to an internal application server at IP address 192.168.50.10:

text
ip access-list extended APP_FILTER
10 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 80
20 permit tcp 10.10.20.0 0.0.0.255 host 192.168.50.10 eq 443
30 deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10
40 permit ip host 10.10.20.5 host 192.168.50.10

The ACL is applied outbound on GigabitEthernet0/1. An administrator attempts an SSH connection (TCP port 22) from management host 10.10.20.5 to the application server (192.168.50.10), while a user on host 10.10.20.100 attempts a web connection (TCP port 80) to the same server.

Which statement accurately describes how the router processes these two traffic flows?

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

The SSH flow from 10.10.20.5 is permitted by sequence 40, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

The SSH flow from 10.10.20.5 is denied by the implicit deny clause, while the HTTP flow from 10.10.20.100 is denied by sequence 30.

Both the SSH flow from 10.10.20.5 and the HTTP flow from 10.10.20.100 are denied by sequence 30.

Cevabı ve açıklamayı göster

Cevap: The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

Cevap

The SSH flow from 10.10.20.5 is denied by sequence 30, while the HTTP flow from 10.10.20.100 is permitted by sequence 10.

Cisco IOS Access Control Lists process statements sequentially in top-down numerical order. For HTTP traffic (port 80) originating from 10.10.20.100, sequence 10 matches the subnet source 10.10.20.0/24, destination host 192.168.50.10, and TCP port 80, allowing the flow immediately. For SSH traffic (port 22) originating from 10.10.20.5, sequences 10 and 20 fail to match due to destination port mismatches (80 and 443). Sequence 30 specifies protocol 'ip', which encompasses all Layer 4 protocols (including TCP/22), matching host 10.10.20.5 within the 10.10.20.0/24 subnet and dropping the packet. Sequence 40 is never reached for host 10.10.20.5 because sequence 30 matches first.

Adım Adım Çözüm

Evaluate the HTTP flow (Source: 10.10.20.100, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 80) against sequence 10.

Sequence 10 permits TCP traffic from 10.10.20.0/24 to host 192.168.50.10 on port 80. Match found; processing stops and traffic is permitted.

Top-down evaluation stops immediately at the first matching entry.

Evaluate the SSH flow (Source: 10.10.20.5, Destination: 192.168.50.10, Protocol: TCP, Destination Port: 22) against sequence 10 and 20.

Port 22 does not match port 80 (sequence 10) or port 443 (sequence 20). Evaluation moves to sequence 30.

Extended ACLs require all specified criteria (protocol, source, destination, port) to match.

Evaluate the SSH flow against sequence 30 (deny ip 10.10.20.0 0.0.0.255 host 192.168.50.10).

Host 10.10.20.5 is within 10.10.20.0/24, destination is 192.168.50.10, and 'ip' matches all IP protocols including TCP. Match found; traffic is denied.

Sequence 30 catches all remaining IP traffic from the subnet before sequence 40 can ever be reached.

Anahtar Kavram

Top-Down Sequential Processing in Cisco IPv4 Extended ACLs

Soru 70Soru →

A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?

Local switch authentication fallback relies solely on the local database credentials (something you know), omitting the secondary possession factor managed by the offline central AAA server.

RADIUS encrypts only the password payload rather than the entire packet body, forcing the switch to strip the secondary token challenge during server unreachability.

The implicit deny clause at the end of the line vty Access Control List automatically overrides multi-factor requirements whenever server timeouts occur.

The switch failed to save its running configuration with sticky MAC parameters, causing the stored MFA session keys to reset upon AAA disconnect.

Cevabı ve açıklamayı göster

Cevap: Local switch authentication fallback relies solely on the local database credentials (something you know), omitting the secondary possession factor managed by the offline central AAA server.

Cevap

Local switch authentication fallback relies solely on local database credentials (something you know), which omits the secondary possession factor (dynamic token/OTP) handled by the central AAA infrastructure.

The correct answer highlights that local network device databases maintain static passwords (knowledge factors) but typically lack integration with time-based one-time password (TOTP) generators or push notifications (possession factors). When a central AAA server is unreachable and authentication falls back to the local database, the access control degrades from multi-factor to single-factor authentication.

Adım Adım Çözüm

Analyze the authentication factors in normal operation versus fallback mode.

Normal AAA operation combines a static password (knowledge factor) and a dynamic OTP token (possession factor).

MFA requires two or more distinct categories of authentication factors.

Evaluate local router/switch database capabilities.

Local switch user accounts store hash values of local passwords/secrets and cannot natively validate dynamic RADIUS/TACACS+ TOTP security tokens.

Local databases act as a emergency single-factor fallback unless specialized external key hardware is attached.

Identify the root cause of the MFA bypass.

Fallback to local authentication drops the possession factor, resulting in single-factor authentication.

Centralized RADIUS/TACACS+ failure isolates the secondary factor provider.

Anahtar Kavram

Multi-Factor Authentication (MFA) and Fallback Security Policies

Soru 71Soru →

A network security administrator is configuring digital certificate services and Multi-Factor Authentication (MFA) to secure management sessions on enterprise network infrastructure. Which of the following statements accurately describe digital certificate verification and MFA factor rules? (Select TWO.)

Geçerli olan tümünü seçin

The verifying client validates the Certificate Authority (CA) digital signature on a presented certificate by using the public key of the issuing CA.

A Certificate Signing Request (CSR) generated by an edge router embeds the root CA's private key to encrypt administrative TACACS+ authentication payloads.

Effective Multi-Factor Authentication requires combining credentials from at least two distinct factor categories, such as a passphrase and a hardware OTP token.

Enabling a local password complexity policy automatically commits all user credentials directly into the device startup-config without explicit administrator command execution.

Certificate Revocation Lists (CRLs) require an explicit deny statement in a local IPv4 ACL to block connections from revoked certificate serial numbers.

Cevabı ve açıklamayı göster

Cevap: The verifying client validates the Certificate Authority (CA) digital signature on a presented certificate by using the public key of the issuing CA.; Effective Multi-Factor Authentication requires combining credentials from at least two distinct factor categories, such as a passphrase and a hardware OTP token.

Cevap

The correct statements are that certificate verification requires validating the CA's digital signature using the CA's public key, and that MFA requires combining credentials from at least two distinct authentication factor categories (such as a passphrase and an OTP token).

Verifying a digital certificate involves checking the issuing CA's signature using that CA's public key. For MFA, authentication requires at least two independent factor types (such as something you know combined with something you have).

Adım Adım Çözüm

Analyze certificate validation mechanics.

Digital certificates are signed by a trusted Certificate Authority (CA). Receivers verify the validity of the signature using the CA's public key.

This establishes the chain of trust in Public Key Infrastructure (PKI).

Analyze Multi-Factor Authentication (MFA) requirements.

MFA requires combining factors from different categories (Knowledge, Possession, Inherence). Combining a passphrase (something you know) with a hardware token (something you have) fulfills MFA requirements.

Using two items from the same category (e.g., two passwords) is multi-step authentication, not multi-factor authentication.

Anahtar Kavram

PKI Certificate Verification and MFA Authentication Factor Requirements

Soru 72Soru →

A network engineer configures the following IPv4 extended named access control list (ACL) on a Cisco IOS router interface to filter traffic between host $10.20.5.15$ and web server $192.168.100.50$ :

text
ip access-list extended SECURE_VLAN
deny icmp host 10.20.5.15 host 192.168.100.50
permit tcp host 10.20.5.15 host 192.168.100.50 eq 80
permit tcp host 10.20.5.15 host 192.168.100.50 eq 443

Which two statements accurately describe the traffic filtering behavior enforced by this ACL? (Choose two.)

Geçerli olan tümünü seçin

ICMP packets sent from host

10.20.5.15

targeting server

192.168.100.50

are explicitly dropped by the first entry.

SSH traffic (TCP port

22

) sent from host

10.20.5.15

to server

192.168.100.50

is permitted because only ICMP traffic is explicitly denied.

UDP traffic originating from host

10.20.5.15

bound for server

192.168.100.50

is dropped due to the implicit deny clause at the end of the ACL.

Return HTTP traffic originating from server

192.168.100.50

back to host

10.20.5.15

matches and is permitted by the second ACL statement.

Cevabı ve açıklamayı göster

Cevap: ICMP packets sent from host $10.20.5.15$ targeting server $192.168.100.50$ are explicitly dropped by the first entry.; UDP traffic originating from host $10.20.5.15$ bound for server $192.168.100.50$ is dropped due to the implicit deny clause at the end of the ACL.

Cevap

The statement identifying that ICMP packets are explicitly dropped by the first entry and the statement noting that UDP traffic is dropped by the implicit deny clause are both correct.

The first entry in the ACL explicitly denies ICMP packets sent from host

10.20.5.15

to host

192.168.100.50

. Additionally, because Cisco IPv4 ACLs automatically append an unwritten implicit deny clause (`deny ip any any`) at the end of the evaluation list, any protocol not explicitly permitted—such as UDP—is automatically dropped.

Adım Adım Çözüm

Evaluate the first ACL statement against ICMP traffic

Statement 'deny icmp host 10.20.5.15 host 192.168.100.50' matches ICMP packets from host 10.20.5.15 to 192.168.100.50 and explicitly denies them.

Top-down ACL processing stops at the first matching rule.

Evaluate unlisted traffic types such as UDP or non-web TCP (e.g. port 22)

Unlisted traffic types do not match statements 1, 2, or 3 and hit the default 'deny ip any any' rule at the bottom.

All Cisco IOS ACLs end with an invisible implicit deny clause.

Evaluate directionality for return traffic originating from server 192.168.100.50

Return traffic has source 192.168.100.50 and destination 10.20.5.15, failing to match the source/destination fields of the permit rules.

Standard and Extended ACL statements evaluate traffic directional fields strictly as defined.

Anahtar Kavram

Top-down sequential processing and implicit deny clause evaluation in IPv4 Extended ACLs

Tahmini Süre:1m 30s

Soru 73Soru →

A network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to prevent ARP spoofing. DHCP snooping is enabled and functioning properly. However, several servers connected to untrusted access ports use statically assigned IP addresses, causing DAI to drop their legitimate ARP requests because they lack entries in the DHCP snooping binding database. Which configuration action should the administrator perform to permit ARP traffic from these static servers while maintaining DAI protection on VLAN 10?

Configure an ARP Access Control List (ARP ACL) with static IP-to-MAC bindings and apply it to VLAN 10 using the ip arp inspection filter command.

Enable sticky MAC addressing using switchport port-security mac-address sticky on the server access ports without saving the running configuration.

Change the trunk native VLAN configuration on opposing switch ends so that static ARP frames bypass the Layer 2 inspection process.

Add the ip helper-address command on the egress interface towards the DHCP server to automatically generate static ARP bindings.

Cevabı ve açıklamayı göster

Cevap: Configure an ARP Access Control List (ARP ACL) with static IP-to-MAC bindings and apply it to VLAN 10 using the ip arp inspection filter command.

Cevap

Configure an ARP Access Control List (ARP ACL) with the static IP-to-MAC address mappings of the servers and apply it to VLAN 10 using the 'ip arp inspection filter' command.

Dynamic ARP Inspection (DAI) validates ARP requests and responses against the DHCP snooping binding database on untrusted ports. Because statically configured hosts do not send DHCP requests, they lack entries in the binding database. To prevent DAI from dropping legitimate traffic from these static hosts, administrators must create an ARP Access Control List (ARP ACL) with static IP-to-MAC mappings and map it to the VLAN using the 'ip arp inspection filter' command.

Adım Adım Çözüm

Identify the cause of dropped ARP packets

DAI inspects ARP packets on untrusted ports by matching their IP and MAC addresses against the DHCP snooping binding database. Statically addressed hosts have no entries in this database, causing DAI to drop their packets.

DAI relies by default on the DHCP snooping binding table for validation.

Determine the correct mitigation mechanism for static IP hosts

Cisco IOS allows creating an ARP ACL (`arp access-list`) containing explicit `permit ip host <IP> mac host <MAC>` statements for static hosts.

ARP ACLs act as a static reference database alongside DHCP snooping for DAI validation.

Apply the ARP ACL to Dynamic ARP Inspection

Execute `ip arp inspection filter <arp-acl-name> vlan 10` in global configuration mode.

This command instructs DAI to check the ARP ACL before or instead of the DHCP snooping database for traffic on VLAN 10.

Anahtar Kavram

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs

Soru 74Soru →

A network administrator is creating an IPv4 extended Access Control List (ACL 105) to allow HTTPS access from host 192.168.10.5 to web server 10.0.0.5, block all other TCP traffic from the 192.168.10.0/24 subnet to the 10.0.0.0/8 network, and permit all remaining traffic. In what sequential order from top to bottom should these ACL statements be configured to enforce the intended policy correctly?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence places the specific host permit rule first, followed by the broader subnet TCP deny rule, and ends with the general permit ip any any rule.

Cisco IOS ACL entries are evaluated sequentially from top to bottom. Specific permit statements (such as host-to-host HTTPS traffic) must always precede broader deny statements (such as an entire /24 subnet destination block). Finally, an explicit permit ip any any statement must be placed at the end to prevent unrelated traffic from being dropped by the hidden implicit deny rule.

Adım Adım Çözüm

Place the specific host-to-host HTTPS permit statement at the top of the ACL.

HTTPS traffic from host 192.168.10.5 to host 10.0.0.5 is matched immediately and allowed.

Cisco IOS ACLs evaluate rules top-down sequentially and stop processing once a match is found. Specific exception rules must precede broader restrictive rules.

Place the subnet-wide TCP deny statement second.

All other TCP traffic originating from 192.168.10.0/24 to 10.0.0.0/8 is denied.

Placing this rule after the specific host exception ensures that only non-exempt TCP traffic from the subnet gets blocked.

Place the permit ip any any statement at the bottom of the ACL.

All remaining IP traffic that does not match the first two rules is explicitly allowed.

Without an explicit permit statement at the end of the ACL, unmatched traffic would be dropped by the implicit deny any rule at the end of ACL processing.

Anahtar Kavram

Access Control List sequential top-down processing and rule specificity

Soru 75Soru →

A network administrator is configuring an extended IPv4 access control list (ACL) named `FILTER_INTERNAL` on GigabitEthernet0/0/0 (inbound) on a Cisco IOS router. The objective is to enforce the following security policy for internal users on network $10.50.10.0/24$ :

1. Allow HTTPS traffic (TCP port 443) to the DMZ web server at $172.16.100.50$ .
2. Allow DNS domain queries (UDP port 53) to the DMZ DNS server at $172.16.100.53$ .
3. Explicitly drop and log all other traffic from $10.50.10.0/24$ directed to any host in the DMZ subnet ( $172.16.100.0/24$ ).
4. Permit all remaining traffic originating from $10.50.10.0/24$ destined to other corporate subnets or the Internet.

Which two configuration statements or operational logic requirements must be included in the ACL design to satisfy these requirements without blocking non-DMZ traffic?

Geçerli olan tümünü seçin

An explicit statement `permit ip 10.50.10.0 0.0.0.255 any` must be placed at the end of the ACL to override the implicit deny any clause.

The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be sequenced immediately after the specific HTTPS and DNS permit rules.

The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be placed at line 10 (top of the ACL) to ensure security policy enforcement before processing permits.

The explicit permit statement for remaining traffic can be omitted because IPv4 ACLs automatically permit non-matching packets if at least one deny line exists.

Cevabı ve açıklamayı göster

Cevap: An explicit statement `permit ip 10.50.10.0 0.0.0.255 any` must be placed at the end of the ACL to override the implicit deny any clause.; The rule `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` must be sequenced immediately after the specific HTTPS and DNS permit rules.

Cevap

The correct configuration requires placing the subnet deny statement (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`) after the specific HTTPS and DNS permit entries, as well as appending an explicit `permit ip 10.50.10.0 0.0.0.255 any` at the end of the ACL.

Cisco IOS IPv4 Access Control Lists evaluate entries sequentially from top to bottom. Specific permit rules for host-level services (HTTPS and DNS) must be evaluated before broader subnet restrictions (`deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log`). Furthermore, because every ACL terminates with an implicit `deny ip any any` rule, an explicit `permit ip 10.50.10.0 0.0.0.255 any` statement must be placed at the end of the ACL structure to allow non-DMZ traffic to pass.

Adım Adım Çözüm

Analyze top-down sequential processing of Cisco IOS ACLs.

Specific permit lines for HTTPS (TCP 443 to

172.16.100.50

) and DNS (UDP 53 to

172.16.100.53

) must precede broad deny statements for the

172.16.100.0/24

subnet.

If a broad subnet deny rule appears higher in the ACL sequence, matching packets are dropped before reaching lower permit statements.

Evaluate subnet isolation and logging requirement.

Adding `deny ip 10.50.10.0 0.0.0.255 172.16.100.0 0.0.0.255 log` directly after the permit rules catches and logs any other attempt to access the DMZ network.

This explicitly satisfies requirement 3 without interfering with legitimate HTTPS/DNS flows.

Account for the default implicit deny behavior.

Adding `permit ip 10.50.10.0 0.0.0.255 any` at the end prevents non-DMZ traffic from being dropped.

All IPv4 Cisco ACLs end with an unwritten `deny ip any any` entry. Without an explicit permit rule at the end, all traffic to external networks or other subnets would be discarded.

Anahtar Kavram

Top-down ACL rule evaluation sequence and handling of the implicit deny any clause

Soru 76Soru →

A network administrator wants to restrict access on a switch port to an authorized end device. If an unauthorized MAC address sends traffic to the port, the interface must drop the frames, avoid incrementing the security violation counter, and avoid disabling the port. Which port security violation mode meets this requirement?

protect

restrict

shutdown

disabled

Cevabı ve açıklamayı göster

Cevap: protect

Cevap

The protect violation mode silently drops packets from unknown MAC addresses without incrementing the security violation counter or placing the interface into an err-disabled state.

The protect violation mode silently drops packets with unauthorized source MAC addresses. It does not increment the interface's security violation counter, nor does it send SNMP traps or Syslog notifications.

Adım Adım Çözüm

Analyze the operational requirements

The requirement specifies dropping unauthorized frames silently without raising violation counters or bringing down the link.

Port security violation modes differ in how they react to unauthorized MAC addresses.

Evaluate Port Security violation mode options

Protect mode drops frames silently without counter increments. Restrict mode drops frames but logs violations and increments counters. Shutdown mode err-disables the interface.

Matching the behavior to the protect keyword fulfills all prompt criteria.

Anahtar Kavram

Port Security Violation Modes (Protect, Restrict, Shutdown)

Soru 77Soru →

An enterprise network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 using the command `ip arp inspection vlan 10`. Host devices dynamically receiving IPv4 configuration via DHCP operate without issue. However, a critical server connected to access switchport GigabitEthernet0/2 in VLAN 10 is configured with a static IPv4 address ( $192.168.10.50/24$ ) and MAC address ( $0011.2233.4455$ ). Network telemetry indicates that all network traffic from this server is dropped because DAI marks its ARP packets as invalid. Which configuration step correctly resolves the ARP packet drop for this static host while maintaining active DAI protection on VLAN 10?

Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.

Configure `switchport port-security mac-address sticky 0011.2233.4455` on interface GigabitEthernet0/2 without saving the running-config to startup-config.

Reassign interface GigabitEthernet0/2 to an unused native VLAN so untagged ARP frames bypass the switch DAI inspection engine.

Configure the `ip helper-address` command on interface GigabitEthernet0/2 pointing to the enterprise DHCP server address.

Cevabı ve açıklamayı göster

Cevap: Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.

Cevap

Define an ARP access list matching the server's IP and MAC address, then apply it to VLAN 10 using the `ip arp inspection filter` command.

Dynamic ARP Inspection (DAI) intercepts and validates all ARP packets on untrusted switch interfaces against the DHCP snooping binding database. Statically addressed hosts do not use DHCP and therefore lack entries in this database, causing DAI to discard their ARP traffic. To resolve this issue without disabling DAI, an administrator must create an ARP access list (`arp access-list`) defining the static IP and MAC address pairing, and associate it with the VLAN using `ip arp inspection filter <acl-name> vlan <vlan-id>`.

Adım Adım Çözüm

Diagnose the root cause of packet drops under Dynamic ARP Inspection (DAI)

DAI intercepts ARP requests and responses on untrusted ports and validates the sender's IP-to-MAC mapping against the DHCP snooping binding database. Because the server uses a static IP address, no DHCP transaction occurred, resulting in no database entry and subsequent ARP packet drops.

Static IP devices naturally lack dynamic entries in the switch DHCP snooping binding database.

Identify the Cisco IOS mechanism for authorizing non-DHCP static hosts under DAI

Define an ARP Access Control List (`arp access-list <name>`) and add a permit entry binding the host's static IP (

192.168.10.50

) to its MAC address (

0011.2233.4455

ARP ACLs provide a static verification table for DAI validation.

Apply the static ARP ACL to the VLAN inspection filter

Execute `ip arp inspection filter <acl-name> vlan 10` in global configuration mode.

This permits the static host's ARP packets to pass inspection while preserving DAI security enforcement for all other hosts in VLAN 10.

Anahtar Kavram

Dynamic ARP Inspection (DAI) Static ARP Access List Filtering

Soru 78Soru →

Match each Layer 2 security mechanism or feature component on the left with its corresponding operational behavior on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

DHCP Snooping Binding Database maps to tracking client MAC, IP, lease, VLAN, and interface details. Dynamic ARP Inspection matches intercepting and validating IP-to-MAC bindings in ARP packets on untrusted ports. Port Security Sticky MAC Learning matches dynamically converting learned MAC addresses into running configuration entries. DAI Interface Rate Limiting matches enforcing a maximum threshold of incoming ARP packets per second.

Each feature component directly performs its specified security role: DHCP Snooping creates the authoritative binding database; DAI utilizes that database to validate ARP packets on untrusted interfaces; Sticky MAC learning writes dynamically learned MACs into the running configuration; and DAI rate limiting protects switch hardware by capping incoming ARP frames per second.

Adım Adım Çözüm

Analyze the operational function of DHCP Snooping.

DHCP snooping acts as a firewall between untrusted hosts and DHCP servers, building a binding database containing IP address, MAC address, lease time, bind type, VLAN number, and interface information.

This database serves as the authoritative mapping reference for other Layer 2 features such as DAI and IP Source Guard.

Analyze the operational function of Dynamic ARP Inspection (DAI).

DAI inspects ARP packets on untrusted interfaces to prevent ARP poisoning and man-in-the-middle attacks.

DAI discards invalid ARP packets where the Sender IP and Sender MAC do not match an entry in the DHCP snooping binding database.

Analyze the function of sticky MAC learning in Port Security.

Sticky MAC learning dynamically converts learned MAC addresses into sticky addresses that are automatically added to the running-config file.

This eliminates the need to manually enter static MAC addresses on switchports while maintaining MAC persistence across reboots if saved.

Analyze DAI interface rate limiting.

Enforcing an ARP rate limit drops excess ARP packets when incoming packet rates exceed the configured threshold per second.

Rate limiting protects the switch CPU from control plane starvation caused by ARP flooding attacks.

Anahtar Kavram

Layer 2 Security Feature Operation and Interdependencies

Soru 79Soru →

A network administrator is implementing administrative security controls for enterprise network switches and configuring Public Key Infrastructure (PKI) certificate validation for HTTPS management access. When evaluating multi-factor authentication (MFA) factor categories and PKI digital certificate validation mechanics, which two statements are correct?

Geçerli olan tümünü seçin

An RSA hardware key fob generating a time-based passcode combined with a user password satisfies MFA by combining a possession factor with a knowledge factor.

During TLS certificate verification, the client uses the issuer Certificate Authority's public key to validate the digital signature on the switch certificate.

A software certificate stored on a user workstation and a domain user account password both belong to the knowledge factor authentication category.

During certificate validation, the client uses the switch private key to decrypt the digital signature applied by the Certificate Authority.

Enforcing password complexity and aging policies on local switch databases automatically encrypts the underlying SSH session payloads.

Cevabı ve açıklamayı göster

Cevap: An RSA hardware key fob generating a time-based passcode combined with a user password satisfies MFA by combining a possession factor with a knowledge factor.; During TLS certificate verification, the client uses the issuer Certificate Authority's public key to validate the digital signature on the switch certificate.

Cevap

The correct statements are that combining an RSA hardware key fob passcode with a password satisfies MFA by using possession and knowledge factors, and that during TLS certificate verification, the client relies on the issuing Certificate Authority's public key to validate the switch certificate's digital signature.

Combining a hardware token generator (something you have) with a user password (something you know) uses two distinct authentication factor categories, satisfying true MFA requirements. Additionally, in PKI validation, clients verify the CA's signature on a switch's X.509 certificate using the CA's public key contained in their local trust store.

Adım Adım Çözüm

Analyze the authentication factors in the proposed MFA scenario.

A hardware token generating a one-time passcode is a physical possession factor ('something you have'), while a standard password is a knowledge factor ('something you know'). Combining two distinct categories fulfills multi-factor authentication requirements.

MFA requires authentication elements from at least two different categories among knowledge, possession, and inherence.

Evaluate the PKI digital certificate signature verification mechanism.

When a Certificate Authority (CA) issues an X.509 certificate to a switch, the CA signs the certificate hash using the CA's private key. The connecting client verifies this signature using the CA's public key contained in its trusted root store.

Asymmetric cryptography dictates that data signed by a private key can only be verified using the corresponding public key.

Identify misclassifications and incorrect cryptographic roles in the remaining choices.

Digital certificates function as possession factors (not knowledge factors), signature verification utilizes the CA public key (never the switch private key), and password policies regulate password properties rather than session transport encryption.

Distinguishing between factor types, public/private key roles in PKI, and authentication versus transport encryption avoids operational security misconceptions.

Anahtar Kavram

Multi-Factor Authentication (MFA) Factor Classification and PKI Digital Certificate Verification

Soru 80Soru →

An network administrator is troubleshooting traffic drops on switch port GigabitEthernet1/0/10. The interface is configured with Layer 2 security features including DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security in restrict mode. The output of `show ip dhcp snooping binding` displays a valid IP-to-MAC entry for the connected client on GigabitEthernet1/0/10. However, executing `show port-security interface g1/0/10` shows that the `SecurityViolation` counter is actively incrementing every time the host attempts to transmit data, while the port status remains operational (`secure-up`). Which scenario accounts for these symptoms?

The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.

The switch was rebooted after host MAC addresses were learned via sticky configuration, but the running configuration was never saved to startup-config.

Dynamic ARP Inspection is dropping frames because GigabitEthernet1/0/10 was incorrectly configured as a trusted interface for DHCP Snooping.

Native VLAN mismatch on the access link is causing DHCP Snooping to discard incoming frame headers prior to port security processing.

Cevabı ve açıklamayı göster

Cevap: The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.

Cevap

The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.

The correct answer accounts for both symptoms: a valid DHCP Snooping entry and an incrementing Port Security violation counter. When a host NIC is replaced, the new MAC address successfully requests a DHCP lease (creating a valid DHCP Snooping database entry and allowing DAI validation to pass). However, because Port Security was configured with sticky MAC learning or a explicit MAC limit, the newly introduced MAC address violates port security parameters. In restrict mode, Port Security drops non-matching frames and increments the SecurityViolation counter without disabling the port.

Adım Adım Çözüm

Analyze the reported operational symptoms

Port status is secure-up, SecurityViolation counter is incrementing, and DHCP Snooping binding table contains a valid entry.

Identify which security feature is actively dropping traffic.

Evaluate Port Security violation mode behavior

Restrict mode drops frames from unauthorized source MAC addresses, increments the violation counter, and logs a Syslog message while keeping the interface up.

The incrementing violation counter indicates Port Security is triggering, not DAI or DHCP Snooping.

Correlate DHCP Snooping binding presence with Port Security failure

The host successfully completed a DHCP exchange (populating the binding table), but its source MAC address does not match the statically or dynamically learned sticky MAC address on the port security database.

A replaced network interface card generates a new MAC address. DHCP Snooping will grant an IP and record the new MAC, but Port Security will block the frame if the maximum MAC address limit or specific sticky MAC entry is exceeded.

Anahtar Kavram

Port Security violation modes and multi-feature Layer 2 security interaction

Tahmini Süre:2m 0s

ÖncekiSayfa 4 / 15Sonraki

Security Fundamentals

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram