Security Fundamentals

298 soru

Tüm türler298 Çoktan seçmeli157 Çoklu seçim64 Eşleştirme56 Sıralama21

A network administrator needs to deploy a centralized AAA solution specifically for managing router and switch command-line interface (CLI) administration. The security team mandates that every individual command entered by an administrator must be evaluated and authorized independently, and all data within the protocol packet body must be encrypted during transport. Which protocol satisfies these operational requirements?

TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

RADIUS, because it encrypts the entire packet payload and combines authentication with authorization.

RADIUS, because it utilizes TCP port 49 to provide granular per-command authorization.

TACACS+, because it operates over UDP ports 1812 and 1813 to deliver encrypted per-command authorization.

Cevabı ve açıklamayı göster

Cevap: TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

Cevap

TACACS+, because it encrypts the entire packet payload and decouples authentication from authorization.

TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for administrative network device management. It uses TCP port 49 for reliable transport, encrypts the entire payload of every packet, and decouples authentication, authorization, and accounting. This separation permits individual command authorization checks for administrative sessions.

Adım Adım Çözüm

Analyze the requirements for command authorization and encryption.

The requirement specifies per-command authorization and full packet body payload encryption.

Device management requires granular authorization per CLI command, whereas network access control (802.1X) typically uses user/port-level authorization.

Evaluate TACACS+ capabilities against the requirements.

TACACS+ uses TCP port 49, separates Authentication and Authorization into modular components (allowing per-command check), and encrypts the complete packet payload.

Separating authentication from authorization allows a network device to query the AAA server for authorization rights on every CLI command executed.

Contrast TACACS+ capabilities with RADIUS capabilities.

RADIUS operates over UDP (ports 1812/1813), combines authentication and authorization into a unified response, and encrypts only the user password field within packets.

Because RADIUS combines authentication and authorization, it cannot perform per-command authorization checks efficiently.

Anahtar Kavram

TACACS+ vs RADIUS Architectural and Functional Differences

Tahmini Süre:1m 15s

Soru 162Soru →

An enterprise network engineering team is deploying AAA services across core routers and wireless LAN controllers. The design requires differentiating protocols used for CLI administrative access versus port-based network access control. Which TWO of the following statements correctly compare the operational characteristics of TACACS+ and RADIUS in this environment?

Geçerli olan tümünü seçin

RADIUS combines authentication and authorization into unified transaction packets, whereas TACACS+ decouples authentication, authorization, and accounting into distinct and independent processes.

TACACS+ relies on UDP port 49 for lightweight message transmission, whereas RADIUS relies on TCP port 1812 to guarantee connection-oriented transport.

TACACS+ encrypts the entire body of the packet following the header, whereas RADIUS encrypts only the password field within the packet payload.

RADIUS is optimized for administrative CLI per-command authorization, whereas TACACS+ is primarily used for 802.1X port-based network client access control.

Cevabı ve açıklamayı göster

Cevap: RADIUS combines authentication and authorization into unified transaction packets, whereas TACACS+ decouples authentication, authorization, and accounting into distinct and independent processes.; TACACS+ encrypts the entire body of the packet following the header, whereas RADIUS encrypts only the password field within the packet payload.

Cevap

The correct statements are that RADIUS combines authentication and authorization into unified transaction packets while TACACS+ decouples them into distinct processes, and TACACS+ encrypts the entire body of the packet following the header while RADIUS encrypts only the password field.

RADIUS integrates authentication and authorization into single transactions (Access-Request/Access-Accept), while TACACS+ decouples all three AAA elements. Additionally, TACACS+ encrypts the entire body of every packet following the header, whereas RADIUS leaves packet headers and non-password attributes unencrypted in transit.

Adım Adım Çözüm

Analyze protocol architecture and functional separation

Identify that RADIUS combines authentication and authorization, while TACACS+ separates AAA functions.

RADIUS sends authorization attributes inside authentication response packets (Access-Accept), whereas TACACS+ allows granular, separate authorization requests.

Evaluate transport layer protocols and port assignments

Verify transport protocols: TACACS+ uses TCP port 49; RADIUS uses UDP ports 1812 and 1813.

TACACS+ requires connection-oriented TCP reliability, whereas RADIUS uses connectionless UDP.

Examine packet payload encryption mechanisms

Determine packet encryption scope for both protocols.

TACACS+ encrypts the entire packet body following the header, protecting all AAA data, whereas RADIUS encrypts only the password attribute.

Anahtar Kavram

Operational differences between TACACS+ and RADIUS protocols within the AAA framework.

Soru 163Soru →

A network security policy requires allowing database traffic to a server while restricting other communications. An engineer applies the following named extended IPv4 Access Control List (ACL) inbound on interface GigabitEthernet0/0/1 of a Cisco router:

text
ip access-list extended RESTRICT_DB
permit tcp 10.20.10.0 0.0.0.255 host 10.20.30.50 eq 1433
deny ip 10.20.10.0 0.0.0.255 host 10.20.30.50

Users on subnet $10.20.10.0/24$ report that they cannot reach a web server located at $10.20.30.80$ over HTTP (TCP port 80). Which statement explains why the router drops the HTTP traffic destined for $10.20.30.80$ ?

The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

The second rule contains a wildcard mask of 0.0.0.255 that blocks access to the entire 10.20.30.0/24 destination subnet.

The router processes the deny statement before evaluating the permit statement due to named ACL priority rules.

Extended ACLs applied inbound on an interface are only capable of filtering traffic destined for hosts on that local interface.

Cevabı ve açıklamayı göster

Cevap: The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

Cevap

The unwritten implicit deny any statement at the end of the ACL drops all unpermitted IPv4 traffic.

Cisco IOS IPv4 Access Control Lists evaluate rules sequentially from top to bottom. If a packet does not match any explicit permit or deny statement in the list, it hits the invisible implicit deny statement (`deny ip any any`) at the end of the ACL and is dropped. Since HTTP traffic to

10.20.30.80

matches neither line 1 (which targets

10.20.30.50:1433

) nor line 2 (which targets host

10.20.30.50

), it is dropped by the implicit deny.

Adım Adım Çözüm

Analyze the sequential processing of the ACL for traffic destined to 10.20.30.80 on TCP port 80.

Line 1 matches destination 10.20.30.50 on port 1433 (No match). Line 2 matches destination 10.20.30.50 (No match).

Traffic to host 10.20.30.80 port 80 does not satisfy the criteria of either explicit rule.

Determine the default behavior when a packet reaches the end of an ACL without matching any explicit entry.

The packet encounters the implicit 'deny ip any any' rule.

All Cisco IOS IPv4 ACLs have an invisible final statement that drops any packet not explicitly permitted.

Anahtar Kavram

ACL Sequential Evaluation and Implicit Deny Any

Soru 164Soru →

A network administrator is upgrading a remote office wireless LAN from WPA2-Personal to WPA3-Personal. The main objective of this upgrade is to protect user traffic against offline dictionary attacks if an attacker captures the initial wireless association exchange. Which key exchange mechanism implemented in WPA3-Personal mitigates this vulnerability?

Simultaneous Authentication of Equals (SAE)

Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)

Extensible Authentication Protocol-Transport Layer Security (EAP-TLS)

Temporal Key Integrity Protocol (TKIP)

Cevabı ve açıklamayı göster

Cevap: Simultaneous Authentication of Equals (SAE)

Cevap

Simultaneous Authentication of Equals (SAE) is the key exchange mechanism in WPA3-Personal that prevents offline dictionary attacks.

Simultaneous Authentication of Equals (SAE) is the fundamental key exchange protocol defined in WPA3-Personal. Based on the Dragonfly key exchange algorithm, SAE provides zero-knowledge proof during authentication, making captured handshakes immune to offline dictionary attacks.

Adım Adım Çözüm

Identify the deployment mode and vulnerability mentioned in the scenario

The scenario highlights upgrading WPA2-Personal to WPA3-Personal specifically to protect against offline dictionary password-guessing attacks resulting from captured handshakes.

WPA2-Personal relies on the 4-way handshake using a Pre-Shared Key (PSK), which is vulnerable to offline dictionary/brute-force attacks if captured.

Determine the WPA3-Personal authentication enhancement mechanism

WPA3-Personal replaces the 4-way PSK handshake with Simultaneous Authentication of Equals (SAE), based on the Dragonfly handshake.

SAE provides forward secrecy and renders captured handshake data useless for offline password cracking attempt tools.

Anahtar Kavram

WPA3-Personal Key Exchange (SAE vs WPA2 PSK)

Soru 165Soru →

A network security administrator is configuring centralized access control services across enterprise switches and routers. Match each operational capability or requirement on the left with the correct AAA framework element or protocol specification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Per-command CLI authorization matches TACACS+ architecture leveraging TCP port 49 and decoupled AAA functions. Full payload body encryption matches TACACS+ transport security mechanism providing full-body packet protection. Coupled authentication and authorization matches RADIUS protocol operation leveraging UDP ports 1812 and 1813. Session tracking and audit logging matches the Accounting component of the AAA framework.

TACACS+ uses TCP port 49 and decouples AAA functions to permit per-command authorization and full packet payload encryption. RADIUS operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), combining authentication and authorization in a single transaction while only encrypting passwords. Accounting tracks user session metrics and activity logs.

Adım Adım Çözüm

Analyze protocol modularity for per-command authorization.

Identified TACACS+ as the protocol that decouples AAA services, allowing individual command authorization over TCP port 49.

RADIUS binds authentication and authorization together, making fine-grained CLI command authorization impossible.

Evaluate packet encryption methods between AAA protocols.

Matched full body encryption to TACACS+, which encrypts the entire payload after the 12-byte header.

RADIUS only encrypts the password field in Access-Request packets, leaving the rest of the packet body in cleartext.

Identify protocol binding for combined authentication/authorization.

Matched combined authentication and authorization to RADIUS over UDP ports 1812/1813.

RADIUS returns authorization attributes directly inside the Access-Accept response during authentication.

Determine the functional role of audit logging in AAA.

Matched session duration and command execution tracking to the Accounting framework pillar.

Accounting logs user activities and resource usage after authentication and authorization occur.

Anahtar Kavram

AAA Protocol Mechanics & Functional Separation (TACACS+ vs RADIUS)

Tahmini Süre:1m 30s

Soru 166Soru →

A network engineer is reviewing security standards to upgrade an organization's wireless network infrastructure to WPA3. Which TWO statements accurately describe the security enhancements and requirements introduced in WPA3 compared to WPA2? (Select two.)

Geçerli olan tümünü seçin

WPA3-Personal replaces the legacy pre-shared key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks.

WPA3 mandates the use of Protected Management Frames (PMF) across all connections to defend against wireless management frame spoofing.

WPA3-Personal requires a centralized RADIUS server for IEEE 802.1X user authentication during client association.

WPA3 relies on Temporal Key Integrity Protocol (TKIP) to deliver 256-bit encryption for high-density client deployments.

Cevabı ve açıklamayı göster

Cevap: WPA3-Personal replaces the legacy pre-shared key (PSK) four-way handshake with Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks.; WPA3 mandates the use of Protected Management Frames (PMF) across all connections to defend against wireless management frame spoofing.

Cevap

WPA3 introduces Simultaneous Authentication of Equals (SAE) in Personal mode to protect against dictionary attacks, and mandates Protected Management Frames (PMF) on all connections.

WPA3 introduces key cryptographic enhancements over WPA2. First, WPA3-Personal replaces the legacy WPA2 PSK four-way handshake with Simultaneous Authentication of Equals (SAE), which protects against offline dictionary attacks and provides forward secrecy. Second, WPA3 mandates Protected Management Frames (PMF / IEEE 802.11w) across all client connections to protect against management frame injection and deauthentication attacks.

Adım Adım Çözüm

Analyze WPA3-Personal authentication improvements over WPA2-Personal.

Identified that WPA3-Personal replaces the PSK four-way handshake with Simultaneous Authentication of Equals (SAE), preventing offline password guessing.

SAE uses Dragonfly key exchange so that an attacker capturing the handshake cannot perform offline dictionary attacks.

Evaluate management frame protection requirements in WPA3.

Confirmed that Protected Management Frames (PMF / IEEE 802.11w) are mandatory in WPA3.

PMF prevents deauthentication and disassociation spoofing attacks by encrypting/authenticating management frames.

Examine distractor statements regarding RADIUS deployment and TKIP ciphers.

Disqualified statements claiming WPA3-Personal requires RADIUS or that WPA3 uses TKIP.

RADIUS is required for 802.1X Enterprise mode, not Personal mode. TKIP is an insecure legacy cipher prohibited in WPA3.

Anahtar Kavram

WPA3 Security Improvements: SAE Key Exchange and Mandatory PMF

Tahmini Süre:1m 30s

Soru 167Soru →

A network administrator is deploying a high-security wireless LAN on a Cisco Wireless LAN Controller (WLC) configured for WPA3-Enterprise authentication. Which operational feature is mandatory for all client devices connecting to this WLAN?

Support and active enforcement of Protected Management Frames (PMF)

Direct TACACS+ authentication negotiation between the client and the access point

Configuration of access points in FlexConnect local switching mode to authenticate EAP requests independently

An explicit Layer 2 MAC Access Control List (ACL) configured on the WLC to bypass EAP-TLS exchange

Cevabı ve açıklamayı göster

Cevap: Support and active enforcement of Protected Management Frames (PMF)

Cevap

Support and active enforcement of Protected Management Frames (PMF)

The WPA3 security specification makes Protected Management Frames (PMF, IEEE 802.11w) mandatory for all device connections in both WPA3-Personal and WPA3-Enterprise deployments. PMF protects unicast and multicast management frames—such as deauthentication and disassociation frames—against eavesdropping and spoofing.

Adım Adım Çözüm

Identify the key cryptographic and structural enhancements introduced by the WPA3 standard.

Recognize that Protected Management Frames (PMF / IEEE 802.11w) are mandatory across all WPA3 modes (Personal and Enterprise).

PMF prevents attackers from forging management frames, such as deauthentication or disassociation packets, mitigating Wireless DoS attacks.

Evaluate client-side compatibility requirements for joining WPA3 WLANs.

Determine that connected clients must explicitly support PMF negotiation during association.

Unlike WPA2 where PMF was optional, WPA3 enforces PMF as a non-negotiable security baseline.

Anahtar Kavram

WPA3 Mandatory Protected Management Frames (PMF)

Soru 168Soru →

Match each wireless security protocol or mode with its primary key exchange mechanism or encryption characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

WPA2-Personal pairs with CCMP (AES-128) and PSK 4-way handshake; WPA3-Personal pairs with Simultaneous Authentication of Equals (SAE); WPA3-Enterprise (192-bit mode) pairs with GCMP-256, EAP-TLS, and PMF; OWE pairs with unauthenticated encryption on open networks using Diffie-Hellman key exchange.

Each wireless security protocol uses distinct key exchange mechanisms and encryption ciphers: WPA2-Personal relies on PSK with CCMP (AES-128); WPA3-Personal introduces SAE to mitigate dictionary attacks; WPA3-Enterprise 192-bit mode mandates GCMP-256 and EAP-TLS; OWE delivers unauthenticated encryption over open networks using Diffie-Hellman key exchanges.

Adım Adım Çözüm

Identify the authentication and encryption suite for legacy WPA2-Personal.

WPA2-Personal uses PSK authentication with a 4-way handshake and CCMP (AES-128) encryption.

This is the baseline IEEE 802.11i implementation for pre-shared key deployments.

Identify the key exchange enhancement in WPA3-Personal.

WPA3-Personal mandates Simultaneous Authentication of Equals (SAE).

SAE prevents password guessing attacks by validating authentication without exposing pre-shared secrets.

Identify the high-security requirements of WPA3-Enterprise 192-bit mode.

It specifies GCMP-256 cipher suite along with EAP-TLS and mandatory PMF.

Enterprise 192-bit mode enforces top-tier cryptographic standards for sensitive deployments.

Identify the role of Opportunistic Wireless Encryption (OWE).

OWE encrypts traffic over open wireless networks using Diffie-Hellman key negotiation.

OWE allows open hotspots to encrypt wireless transmission without requiring user passphrases.

Anahtar Kavram

Wireless Security Protocols (WPA, WPA2, WPA3, OWE)

Tahmini Süre:1m 30s

Soru 169Soru →

A wireless network engineer is reviewing protocol requirements to transition an enterprise Wi-Fi infrastructure from WPA2 to WPA3 across corporate and guest SSIDs. Which TWO statements correctly describe key structural and operational differences between WPA3 and legacy WPA2 standards?

Geçerli olan tümünü seçin

WPA3-Personal mandates the use of Simultaneous Authentication of Equals (SAE) for initial key exchange to mitigate offline password guessing and dictionary attacks.

WPA3-Enterprise deprecates 802.1X/EAP authentication frameworks, replacing them with centralized RADIUS pre-shared key management.

Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory for all native WPA3 connections.

WPA3 uses Temporal Key Integrity Protocol (TKIP) as its primary encryption cipher to maintain backward compatibility with legacy 802.11a/b/g devices.

Cevabı ve açıklamayı göster

Cevap: WPA3-Personal mandates the use of Simultaneous Authentication of Equals (SAE) for initial key exchange to mitigate offline password guessing and dictionary attacks.; Protected Management Frames (PMF / IEEE 802.11w) are strictly mandatory for all native WPA3 connections.

Cevap

The correct statements are that WPA3-Personal mandates Simultaneous Authentication of Equals (SAE) to protect against offline dictionary attacks, and Protected Management Frames (PMF) are mandatory across all native WPA3 network connections.

WPA3 introduces key improvements over WPA2: Simultaneous Authentication of Equals (SAE) replaces WPA2-Personal's Pre-Shared Key (PSK) 4-way handshake to protect against offline dictionary attacks and provide forward secrecy. Additionally, Protected Management Frames (PMF / IEEE 802.11w) are mandatory across all native WPA3 network connections to secure control and management traffic against spoofing.

Adım Adım Çözüm

Analyze WPA3-Personal key exchange mechanisms

Identified that WPA3-Personal uses Dragonfly/SAE (Simultaneous Authentication of Equals) instead of the WPA2 PSK 4-way handshake, preventing offline dictionary attacks.

SAE provides forward secrecy and protects authentication exchanges even when weak passwords are chosen.

Evaluate WPA3 Management Frame Protection requirements

Confirmed that IEEE 802.11w Protected Management Frames (PMF) are negotiated as required (mandatory) in WPA3 mode.

PMF shields unicast and multicast management frames against deauthentication and disassociation spoofing.

Verify legacy cipher and enterprise framework compatibility

Disproved claims that WPA3 uses TKIP or removes 802.1X.

TKIP is explicitly forbidden in WPA3 due to security vulnerabilities, and WPA3-Enterprise retains 802.1X/EAP.

Anahtar Kavram

WPA3 Security Enhancements (SAE and Mandatory PMF)

Soru 170Soru →

A small business seeks to secure its employee Wi-Fi network against offline brute-force and dictionary attacks if wireless traffic captures occur. The company does not deploy a centralized AAA or RADIUS server. Which wireless security protocol and key exchange mechanism should be configured on the Wireless LAN Controller (WLC) to satisfy these requirements?

WPA3-Personal using Simultaneous Authentication of Equals (SAE)

WPA2-Personal using Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)

WPA3-Enterprise using 192-bit security suite mode with EAP-TLS

WPA2-Enterprise using Temporal Key Integrity Protocol (TKIP) with 802.1X

Cevabı ve açıklamayı göster

Cevap: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Cevap

WPA3-Personal using Simultaneous Authentication of Equals (SAE)

WPA3-Personal replaces the traditional WPA2 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm. SAE provides forward secrecy and effectively mitigates offline dictionary and brute-force attacks even if passwords are simple, all without requiring an 802.1X RADIUS authentication server.

Adım Adım Çözüm

Analyze authentication infrastructure constraints

Since the organization has no AAA/RADIUS server, Enterprise modes (802.1X/EAP) cannot be implemented. The solution must use a Personal (Preshared Key) deployment model.

Enterprise security modes rely on 802.1X RADIUS communication to authenticate users against a centralized backend directory.

Evaluate key exchange mechanisms for PSK protection

WPA2-Personal uses a 4-way handshake vulnerable to offline dictionary/brute-force attacks if captured. WPA3-Personal replaces this mechanism with Simultaneous Authentication of Equals (SAE).

SAE is based on the Dragonfly handshake algorithm, which provides zero-knowledge proof key establishment, preventing passive offline key-cracking attempts.

Select the matching configuration option

WPA3-Personal utilizing SAE delivers pre-shared key simplicity without requiring RADIUS while guaranteeing protection against offline dictionary attacks.

Meets both operational constraints: no RADIUS server required and resistant to handshake capture attacks.

Anahtar Kavram

Wireless Security Protocols: WPA3-Personal SAE vs WPA2-Personal PSK

Soru 171Soru →

A network administrator is upgrading a corporate Wireless LAN Controller (WLC) to meet stringent government cryptographic requirements. The administrator configures a new SSID operating in WPA3-Enterprise 192-bit mode. Which encryption cipher suite is mandated by WPA3-Enterprise 192-bit mode to protect data payload frames?

GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)

CCMP-128 (Counter Mode Cipher Block Chaining Message Authentication Code Protocol with 128-bit encryption)

TKIP (Temporal Key Integrity Protocol with 128-bit encryption)

RC4 (Rivest Cipher 4 with 128-bit static keying)

Cevabı ve açıklamayı göster

Cevap: GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)

Cevap

GCMP-256 (Galois/Counter Mode Protocol with 256-bit encryption)

Galois/Counter Mode Protocol with 256-bit encryption (GCMP-256) is mandated by the IEEE 802.11i / WPA3 specifications for WPA3-Enterprise 192-bit mode. This mode provides higher-grade cryptographic protection aligned with Commercial National Security Algorithm (CNSA) suite standards.

Adım Adım Çözüm

Identify the specific wireless security framework and operational mode requested

The scenario specifies WPA3-Enterprise in 192-bit security mode (CNSA suite compliant).

Different WPA3 operating modes specify distinct cryptographic algorithms and key sizes.

Evaluate the cipher suite requirements for WPA3-Enterprise 192-bit mode

WPA3-Enterprise 192-bit mode requires GCMP-256 for authenticated data encryption, BIP-GMAC-256 for management frame protection, and EAP-TLS with SHA-384 for authentication.

Standard WPA2/WPA3 Enterprise 128-bit modes use CCMP-128, whereas 192-bit mode upgrades the cipher suite to 256-bit GCMP.

Anahtar Kavram

WPA3-Enterprise 192-bit Security Mode Requirements

Soru 172Soru →

Match each wireless security protocol or feature to its defining operational characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Protected Management Frames (PMF) matches securing unicast/multicast management frames; TKIP matches legacy RC4 encapsulation with key mixing; OWE matches unauthenticated encryption on open networks; SAE matches prevention of offline dictionary attacks via Dragonfly key exchange.

Each protocol or mechanism serves a distinct function within wireless security architectures: PMF protects management action frames from forgery, TKIP relies on RC4 for legacy WPA security, OWE provides unauthenticated encryption for open access, and SAE uses Dragonfly key exchange to secure pre-shared key establishment in WPA3-Personal.

Adım Adım Çözüm

Identify the primary role of Protected Management Frames (PMF)

PMF (IEEE 802.11w) protects management frames (such as deauth packets) against spoofing and eavesdropping; it is mandatory in WPA3.

Security standards mandate PMF to prevent common Wireless Denial of Service (DoS) attacks.

Identify the encryption characteristics of Temporal Key Integrity Protocol (TKIP)

TKIP uses RC4 stream cipher with dynamic temporal key mixing as an upgrade path from WEP.

TKIP was designed to run on legacy WEP hardware while fixing key reuse flaws.

Identify the operation of Opportunistic Wireless Encryption (OWE)

OWE uses Diffie-Hellman key exchange to encrypt open Wi-Fi networks without requiring client authentication.

Enhanced Open (OWE) provides opportunistic privacy for guest networks without passphrase configuration.

Identify the authentication protocol used in Simultaneous Authentication of Equals (SAE)

SAE utilizes the Dragonfly handshake algorithm to negotiate shared keys securely and neutralize offline dictionary attacks.

SAE replaces the traditional 4-way handshake PSK model in WPA3-Personal.

Anahtar Kavram

Wireless Security Protocols and Cipher Mechanics

Soru 173Soru →

A network administrator is transitioning a retail store Wi-Fi network from WPA2-Personal to WPA3-Personal. During testing, the administrator confirms that pre-shared key (PSK) authentication has been replaced by Simultaneous Authentication of Equals (SAE) based on the Dragonfly key exchange algorithm. Which security enhancement does SAE deliver when compared to the traditional WPA2 4-way handshake?

It provides forward secrecy and built-in resistance to offline dictionary attacks even when password complexity is low.

It encrypts the entire packet payload using RADIUS authentication credentials rather than individual pre-shared keys.

It enables access points operating in Local mode to continuously authenticate clients offline when controller connectivity is lost.

It buffers unauthenticated client frames at the access point interface rather than dropping out-of-profile handshake packets.

Cevabı ve açıklamayı göster

Cevap: It provides forward secrecy and built-in resistance to offline dictionary attacks even when password complexity is low.

Cevap

SAE provides forward secrecy and prevents offline dictionary attacks by eliminating the predictable 4-way handshake password exchange used in WPA2-Personal.

WPA3-Personal mandates Simultaneous Authentication of Equals (SAE), replacing the vulnerable 4-way WPA2 PSK exchange. SAE leverages the Dragonfly key exchange protocol, which prevents passive eavesdroppers from capturing traffic and cracking passwords via offline dictionary attacks, while also guaranteeing forward secrecy.

Adım Adım Çözüm

Analyze WPA2-Personal vulnerability

WPA2-Personal uses a 4-way handshake based on a static PSK. An attacker capturing the handshake can perform offline brute-force or dictionary attacks to reveal the PSK.

The WPA2 pairwise master key (PMK) derivation allows passive offline analysis.

Evaluate WPA3-Personal SAE operation

WPA3-Personal replaces the standard PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Diffie-Hellman Dragonfly key exchange.

SAE executes a peer-to-peer authentication exchange before key establishment.

Identify key cryptographic advantages

SAE ensures forward secrecy (session keys cannot be compromised even if the password is discovered later) and renders offline dictionary attacks useless because each attempt requires an active network exchange.

Invalid authentication attempts require live interactions with the AP, frustrating passive capture analysis.

Anahtar Kavram

WPA3-Personal Simultaneous Authentication of Equals (SAE)

Soru 174Soru →

Match each wireless security framework or protocol with its primary key exchange or encryption mechanism.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

WPA3-Personal matches with SAE key exchange. WPA2-Enterprise matches with 802.1X/RADIUS authentication. Enhanced Open (OWE) matches with unauthenticated Diffie-Hellman encryption. WPA-Personal matches with deprecated TKIP/RC4 encryption.

Each wireless protocol maps to its distinct standard implementation: WPA3-Personal uses SAE for Dragonfly key exchange, WPA2-Enterprise mandates 802.1X/EAP with RADIUS, Enhanced Open provides OWE encryption for unauthenticated networks, and legacy WPA uses TKIP.

Adım Adım Çözüm

Identify key characteristics of WPA3-Personal.

WPA3-Personal introduces SAE (Simultaneous Authentication of Equals) to eliminate offline brute-force attacks.

SAE is the hallmark replacement for PSK in WPA3.

Identify key characteristics of WPA2-Enterprise.

Enterprise modes specifically demand 802.1X with EAP and RADIUS servers.

Personal modes use pre-shared keys, whereas Enterprise modes use centralized AAA architecture.

Identify key characteristics of Enhanced Open (OWE).

Enhanced Open uses OWE (Diffie-Hellman key exchange) to encrypt traffic on open networks without password entry.

OWE protects public Wi-Fi eavesdropping without authentication.

Identify key characteristics of WPA-Personal (Legacy).

Legacy WPA relied on TKIP/RC4 prior to the introduction of CCMP/AES in WPA2.

TKIP was designed as an interim migration path from WEP.

Anahtar Kavram

Wireless Security Protocols and Authentication/Encryption Mechanisms

Soru 175Soru →

A network engineer is configuring a new Wireless LAN Controller (WLC) deployment to support WPA3-Enterprise across an enterprise infrastructure. Which two operational characteristics or requirements strictly apply to WPA3-Enterprise deployments? (Select two.)

Geçerli olan tümünü seçin

Protected Management Frames (PMF) must be set to required and enforced on the WLAN.

Client authentication relies on IEEE 802.1X and EAP protocols rather than Simultaneous Authentication of Equals (SAE).

RADIUS authentication traffic between the WLC and the AAA server encrypts the entire IP packet payload by default.

Access points operating in Local mode handle 802.1X client authentication locally without forwarding EAP messages to the WLC.

Cevabı ve açıklamayı göster

Cevap: Protected Management Frames (PMF) must be set to required and enforced on the WLAN.; Client authentication relies on IEEE 802.1X and EAP protocols rather than Simultaneous Authentication of Equals (SAE).

Cevap

WPA3-Enterprise requires Protected Management Frames (PMF) to be enforced and uses IEEE 802.1X/EAP frameworks for client authentication.

WPA3 mandates the use of Protected Management Frames (PMF / IEEE 802.11w) across all implementations to guard against eavesdropping and frame forging. Additionally, WPA3-Enterprise relies on IEEE 802.1X authentication with EAP methods for centralized user access control, contrasting with WPA3-Personal which employs SAE.

Adım Adım Çözüm

Analyze key security requirements for the WPA3 standard.

PMF (IEEE 802.11w) is mandatory across all WPA3 modes (Personal and Enterprise) to protect against management frame attacks.

WPA3 eliminates optional PMF negotiated states found in WPA2 and makes management protection compulsory.

Differentiate between Personal and Enterprise operational modes in WPA3.

WPA3-Personal replaces PSK with SAE (Simultaneous Authentication of Equals), whereas WPA3-Enterprise mandates IEEE 802.1X and EAP authentication.

Enterprise wireless networks require individual user identity verification backed by a centralized AAA infrastructure.

Anahtar Kavram

WPA3-Enterprise mandatory security requirements (PMF enforcement and 802.1X/EAP authentication architecture)

Soru 176Soru →

A network administrator is migrating an enterprise wireless network from WPA2-Enterprise to WPA3-Enterprise by enabling a transition mode on a Cisco Wireless LAN Controller (WLC). Which two statements accurately describe the protocol mechanisms and operational requirements for this transition deployment? (Select two.)

Geçerli olan tümünü seçin

Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients.

Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.

WPA3-Enterprise replaces RADIUS authentication with Simultaneous Authentication of Equals (SAE) to establish client identity.

FlexConnect local switching mode must be disabled because WPA3-Enterprise requires all client traffic to be centrally switched to process TACACS+ AAA packets.

Cevabı ve açıklamayı göster

Cevap: Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients.; Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.

Cevap

Protected Management Frames (PMF) must be set to optional (capable) on the WLAN to allow legacy WPA2 clients to connect alongside WPA3 clients, and both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X framework and Extensible Authentication Protocol (EAP) for user authentication.

Both WPA2-Enterprise and WPA3-Enterprise utilize the IEEE 802.1X port-based authentication architecture paired with EAP for centralized client credential verification via RADIUS. Furthermore, because WPA3 mandates Protected Management Frames (802.11w) while WPA2 does not, enabling transition mode on a Wireless LAN Controller requires setting PMF to optional (capable) so both modern WPA3 and legacy WPA2 clients can successfully associate.

Adım Adım Çözüm

Analyze authentication requirements across WPA2-Enterprise and WPA3-Enterprise.

Identify that both enterprise standards use IEEE 802.1X/EAP with a backend RADIUS server for identity management.

Enterprise wireless security relies on 802.1X port-based access control regardless of whether WPA2 or WPA3 framing is in use.

Evaluate Protected Management Frame (PMF / 802.11w) configuration requirements for WLAN transition mode.

Determine that setting PMF to optional (capable) allows WPA3 devices to negotiate management frame protection while permitting WPA2 devices without PMF support to join.

WPA3 mandates PMF, whereas WPA2 does not require it; setting PMF to optional on the WLC resolves client compatibility gaps.

Anahtar Kavram

WPA2/WPA3 Enterprise authentication frameworks and Protected Management Frame (PMF) transition mode settings

Soru 177Soru →

A network administrator needs to deploy a secure wireless LAN for a small branch office. The security policy dictates that wireless client authentication must prevent offline dictionary attacks against pre-shared credentials and enforce Protected Management Frames (PMF), while avoiding the deployment cost and complexity of an external RADIUS or AAA server. Which wireless security deployment mode meets all of these requirements?

WPA3-Personal using Simultaneous Authentication of Equals (SAE)

WPA2-Personal using Pre-Shared Key (PSK) with CCMP encryption

WPA2-Enterprise using 802.1X authentication and EAP-FAST

WPA3-Enterprise operating in 192-bit security mode

Cevabı ve açıklamayı göster

Cevap: WPA3-Personal using Simultaneous Authentication of Equals (SAE)

Cevap

WPA3-Personal using Simultaneous Authentication of Equals (SAE)

WPA3-Personal uses Simultaneous Authentication of Equals (SAE), a peer-to-peer key exchange protocol based on the Dragonfly handshake. SAE prevents offline dictionary attacks even if weak passphrases are selected, provides forward secrecy, and mandates Protected Management Frames (PMF), fulfilling all requirements without requiring a RADIUS server.

Adım Adım Çözüm

Analyze deployment constraints

Requirements are offline dictionary attack protection, mandatory Protected Management Frames (PMF), and operating without an external RADIUS/AAA server.

Branch offices without dedicated AAA infrastructure require a personal/passphrase mode rather than an enterprise mode.

Evaluate key exchange mechanisms

WPA3-Personal introduces Simultaneous Authentication of Equals (SAE), based on the Dragonfly key exchange algorithm.

SAE provides forward secrecy and renders captured handshakes immune to offline dictionary attacks.

Verify compliance with PMF standards

PMF (IEEE 802.11w) is optional in WPA2 but strictly mandatory in all WPA3 modes.

Selecting WPA3-Personal SAE ensures both PMF compliance and non-RADIUS operation.

Anahtar Kavram

WPA3-Personal key exchange via SAE and mandatory Protected Management Frames

Soru 178Soru →

An engineer audits an enterprise wireless deployment configured strictly for WPA3-Enterprise mode. During client connectivity testing, older legacy wireless client devices fail to associate with the SSID, even though their security profiles are configured with valid 802.1X EAP credentials. What mandatory feature of WPA3 security causes these legacy clients to fail association?

Protected Management Frames (PMF) are strictly required for all associations.

RADIUS authentication traffic must be negotiated directly between the client and RADIUS server without access point participation.

Pre-Shared Keys (PSK) must be negotiated alongside 802.1X credentials during the 4-way handshake.

Temporal Key Integrity Protocol (TKIP) is required as the default broadcast cipher suite.

Cevabı ve açıklamayı göster

Cevap: Protected Management Frames (PMF) are strictly required for all associations.

Cevap

Protected Management Frames (PMF) are strictly required for all associations.

Under the Wi-Fi Alliance WPA3 standard specification, Protected Management Frames (PMF / IEEE 802.11w) transition from being optional (as in WPA2) to strictly mandatory. Any legacy wireless client device that lacks support for PMF capability negotiation is rejected at association time by a WPA3-configured access point.

Adım Adım Çözüm

Identify the protocol requirements introduced in the WPA3 wireless security standard.

WPA3 introduces mandatory Protected Management Frames (PMF / IEEE 802.11w) for both Personal and Enterprise operating modes.

PMF protects management frames such as deauthentication and disassociation from spoofing and eavesdropping attacks.

Evaluate the impact of mandatory PMF on legacy client devices.

Clients that do not support 802.11w PMF or only support optional PMF negotiation cannot complete the association handshake with an SSID running pure WPA3.

When an access point operates in WPA3 mode, PMF requirement is set to Required (Required/Mandatory), rejecting legacy clients lacking PMF support.

Anahtar Kavram

WPA3 Mandatory Protected Management Frames (PMF / IEEE 802.11w)

Soru 179Soru →

A network engineer is troubleshooting an IPsec site-to-site VPN tunnel established between a main office router and a remote branch router situated behind an intermediate Port Address Translation (PAT) gateway. During tunnel negotiation, Phase 1 completes successfully, but encrypted data packets fail to pass between the sites when NAT-Traversal (NAT-T) is disabled on both gateways. Which operational characteristic of IPsec explains why the PAT gateway drops the data phase traffic?

Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.

ESP relies on TCP sliding window mechanisms to maintain state across translation tables, causing PAT devices to reject non-sequenced IKE exchanges.

The PAT device drops ESP traffic because dynamic translation without the overload keyword forces IPsec tunnels into unencrypted transport mode.

ESP encapsulation embeds TACACS+ header authentication into Phase 2 negotiations, which prevents RADIUS-based PAT state tables from tracking sessions.

Cevabı ve açıklamayı göster

Cevap: Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.

Cevap

Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.

The correct answer identifies that native Encapsulating Security Payload (ESP) uses IP protocol 50 without Layer 4 TCP or UDP port headers. Because Port Address Translation (PAT) relies on modifying Layer 4 port numbers to multiplex multiple private IP streams across a single public IP address, it cannot translate native ESP packets. Enabling NAT-Traversal (NAT-T) solves this issue by encapsulating ESP packets within UDP port 4500 headers, allowing PAT gateways to translate the traffic successfully.

Adım Adım Çözüm

Analyze IPsec protocol headers for Phase 2 data plane traffic.

IPsec Encapsulating Security Payload (ESP) resides directly above the IP layer using IP protocol 50.

ESP does not contain Layer 4 source or destination port fields such as TCP or UDP.

Evaluate the operational mechanics of Port Address Translation (PAT).

PAT requires Layer 4 TCP or UDP port numbers to translate multiple internal IP addresses onto a single public IP address.

Without Layer 4 port identifiers, a PAT device cannot create unique translation entries in its translation table.

Determine the impact of disabling NAT-Traversal (NAT-T).

Without NAT-T, ESP packets are sent in their native format (IP protocol 50) rather than being encapsulated inside UDP port 4500 wrappers.

The intermediate PAT device cannot translate native ESP packets, causing Phase 2 data traffic to be dropped.

Anahtar Kavram

IPsec NAT-Traversal (NAT-T) and ESP Encapsulation Mechanics

Soru 180Soru →

An enterprise router is configured with the following extended IPv4 access control list applied inbound on interface GigabitEthernet0/0/0:

text ip access-list extended SECURE_APP permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80 permit ip host 172.16.5.10 host 10.0.1.20

Host A (IP address 172.16.5.15) attempts to establish an HTTPS connection (TCP port 443) to the application server at 10.0.1.20. Which statement accurately describes how the router processes this traffic?

The router drops the packet because it fails to match the TCP destination port in the first line and does not match the source host in the second line, causing it to fall through to the implicit deny.

The router permits the packet because the first access list entry matches any TCP traffic originating from the 172.16.5.0/24 source subnet regardless of destination port.

The router permits the packet because the second access list entry permits all IP protocols for any host within the 172.16.5.0/24 subnet.

The router forwards the packet because extended ACLs automatically permit return traffic for established TCP sessions matching the source subnet.

Cevabı ve açıklamayı göster

Cevap: The router drops the packet because it fails to match the TCP destination port in the first line and does not match the source host in the second line, causing it to fall through to the implicit deny.

Cevap

The router drops the traffic because it fails to match both explicit permit rules and consequently hits the unwritten implicit deny clause at the end of the access list.

The correct response identifies that extended access control lists process rules top-down, checking source address, destination address, and protocol port numbers. For host 172.16.5.15 using HTTPS (port 443), line 1 fails because the destination port is 443 instead of 80. Line 2 fails because the source host address 172.16.5.15 does not match host 172.16.5.10. Consequently, the packet reaches the default implicit deny clause at the end of the list and is dropped.

Adım Adım Çözüm

Evaluate the packet against the first access-list entry (`permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80`).

The packet source IP 172.16.5.15 matches `172.16.5.0 0.0.0.255` and destination IP `10.0.1.20` matches `host 10.0.1.20`. However, the destination port is 443 (HTTPS), which does not equal port 80 (HTTP). Line 1 does not match.

Extended ACLs process criteria sequentially and require all specified Layer 3 and Layer 4 fields to match.

Evaluate the packet against the second access-list entry (`permit ip host 172.16.5.10 host 10.0.1.20`).

The packet source IP is 172.16.5.15, which does not match `host 172.16.5.10`. Line 2 does not match.

The `host` keyword strictly matches only the specific IP address designated.

Evaluate the packet against the end of the ACL structure.

Having failed all preceding explicit permit statements, the packet encounters the default implicit `deny ip any any` statement.

Cisco IOS automatically appends an invisible implicit deny statement to the end of every IPv4 access control list.

Anahtar Kavram

Extended Access Control List Sequential Matching and Implicit Deny Behavior

ÖncekiSayfa 9 / 15Sonraki

Security Fundamentals

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram