Examkin

Device Access Control and Local Password Authentication

26 soru

Tüm türler26Çoktan seçmeli14Çoklu seçim6Sıralama6
Soru 1Soru →

A network administrator wants to encrypt all cleartext passwords stored in a Cisco IOS router's running configuration file, including console line passwords and legacy user passwords. Which global configuration command accomplishes this task?

Cevabı ve açıklamayı göster

Cevap: service password-encryption

Cevap

The command 'service password-encryption' globally obfuscates all current and future cleartext passwords in the configuration file using Type 7 encryption.
Executing 'service password-encryption' in global configuration mode instructs Cisco IOS to apply Cisco Type 7 encryption to all stored plain-text passwords in the running configuration, such as those set via 'line console 0' or legacy 'username' commands.

Adım Adım Çözüm

1
Identify the goal
The requirement is to convert existing and future plain-text passwords across line configurations and local accounts into encrypted strings within the running configuration.
By default, commands like 'password' under line configuration or legacy 'username password' store passwords in plain text.
2
Evaluate Cisco IOS commands for configuration-wide password obfuscation
Entering 'service password-encryption' in global configuration mode immediately encrypts all unencrypted passwords using Cisco Type 7 encryption.
This command specifically targets configuration file display security rather than individual authentication modes.

Anahtar Kavram

Cisco IOS Global Password Encryption
Soru 2Soru →

A network administrator inspects a Cisco IOS router configuration and observes the following line:

`username admin privilege 15 secret 9 99 eG8H$kQzP8xY...`

Which encryption algorithm or password type is used to secure the password for this local account?

Cevabı ve açıklamayı göster

Cevap: scrypt (Type 9)

Cevap

The scrypt algorithm (Type 9) is used to hash the password.
In Cisco IOS software, configuring a password with the 'secret 9' keyword applies the scrypt hashing algorithm to protect the local credential in the running configuration.

Adım Adım Çözüm

1
Examine the CLI syntax from the running configuration line.
The CLI keyword 'secret 9' and the identifier '99' specify the exact password algorithm type.
Cisco IOS explicitly maps numeric type identifiers to specific hash algorithms.
2
Correlate the Cisco IOS password type number to its algorithm.
Type 9 corresponds to the scrypt password-hashing algorithm.
scrypt was introduced in Cisco IOS to provide stronger security than legacy Type 5 (MD5) and Type 7 (Vigenère) methods.

Anahtar Kavram

Cisco IOS Local Password Hashing Types
Soru 3Soru →

A network technician is tasked with securing direct physical access to a Cisco switch console. Which two configuration steps are required to ensure that users connecting through the console port are authenticated against user accounts stored in the local device database? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the 'login local' command under line console 0 configuration mode.; Define a user account using the 'username <name> secret <password>' command in global configuration mode.

Cevap

To enforce local database authentication on the console line, a user account must be created in global configuration mode using 'username <name> secret <password>', and the console line must be configured with 'login local'.
Local authentication requires both a local database entry (created via global configuration 'username secret') and telling the specific line interface to check that database (using 'login local' under line console 0).

Adım Adım Çözüm

1
Define local user credentials
User accounts are created in the local device database using global configuration commands.
The router or switch requires predefined accounts in its running configuration to perform local authentication.
2
Enable local authentication on the console line
Entering 'line console 0' and configuring 'login local' directs authentication attempts to the local user database.
Without 'login local', the line will either use a simple line password or allow unauthenticated access depending on default settings.

Anahtar Kavram

Local User Database Authentication on Cisco IOS Lines
Soru 4Soru →

A network administrator runs the `show running-config` command on a Cisco switch and observes the following user configuration entry:

`username netadmin secret 5 11 mER7$19f.aB3z7QkL9p0`

Which statement accurately describes the security mechanism used to store this password?

Cevabı ve açıklamayı göster

Cevap: The password is hashed using the MD5 algorithm (Type 5).

Cevap

The password is hashed using the MD5 algorithm (Type 5).
The option stating that the password is hashed using the MD5 algorithm (Type 5) is correct because the number 5 following the 'secret' keyword in Cisco IOS configuration syntax indicates an MD5 cryptographic hash. MD5 hashing creates a one-way digest to secure local user credentials.

Adım Adım Çözüm

1
Analyze the configuration string syntax.
Identify the keyword 'secret' followed by the algorithm indicator '5'.
Cisco IOS uses numeric identifiers following the 'secret' or 'password' keyword to denote the encryption or hashing algorithm used.
2
Map the numerical identifier to the corresponding cryptographic algorithm.
Identifier 5 corresponds to the MD5 password hash (Type 5).
Type 0 is plain text, Type 7 is weak reversible encryption, Type 5 is MD5 hashing, Type 8 is PBKDF2 SHA-256, and Type 9 is scrypt.

Anahtar Kavram

Cisco IOS Password Types and Hashing Algorithms
Soru 5Soru →

A network security architect is hardening a newly initialized Cisco IOS XE enterprise router. Arrange the following CLI configuration commands in the mandatory order required to establish local database authentication for remote management, ensuring that local privileged credentials using scrypt hashing are created prior to entering the line context, local authentication is bound to the VTY lines, and unencrypted management sessions are blocked.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of CLI operations begins in global configuration mode by defining the local administrative account with scrypt secret encryption ('username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026'). Next, enter line subconfiguration mode ('line vty 0 4'). Within the line context, enable local database lookup ('login local'), and finally restrict line access protocols strictly to SSH ('transport input ssh').
The proper administrative sequence requires creating the global local database account first using 'username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026'. Once the account exists, the administrator enters VTY line submode with 'line vty 0 4', binds line authentication to the local database using 'login local', and secures line transport by executing 'transport input ssh'.

Adım Adım Çözüm

1
Define local administrative credentials in global configuration mode.
The local database contains an administrative account with privilege level 15 secured with a high-strength Type 9 scrypt hash.
Creating the account first prevents administrator lockout when local line login enforcement is applied.
2
Navigate into line configuration context for remote VTY interfaces.
The terminal prompt changes to line configuration submode (config-line).
Subsequent line-specific authentication and transport parameters can only be applied inside the line subconfiguration context.
3
Configure VTY lines to enforce local database authentication.
Inbound connection attempts on VTY lines 0-4 now require authentication matching accounts defined in the local running-config database.
The 'login local' command replaces default password checking or unauthenticated line access with local username/password verification.
4
Enforce secure management transport protocols on VTY lines.
Telnet and all other unencrypted remote access protocols are prohibited; only encrypted SSH connections are accepted.
Restricting transport input guarantees remote login credentials and session data are protected against eavesdropping across the network.

Anahtar Kavram

Cisco IOS CLI hierarchy and local authentication dependency sequence
Soru 6Soru →

A network administrator configures a Cisco IOS switch for secure management access. The following excerpt is retrieved from the running configuration:

text
username secadmin privilege 15 secret 8 88 k9A$eP2xL1...
service password-encryption
!
line vty 0 4
transport input ssh
login

When a network engineer attempts to establish an SSH session using the `secadmin` account credentials, the authentication attempt is rejected. Which configuration change must be applied to line vty 0 4 to allow authentication using the local user database?

Cevabı ve açıklamayı göster

Cevap: Replace the `login` command with `login local` under line vty 0 4 configuration mode.

Cevap

Replacing `login` with `login local` under line vty 0 4 configuration mode resolves the authentication failure by directing Cisco IOS to check credentials against accounts in the local running-config database.
The correct answer specifies changing `login` to `login local` on line vty 0 4. In Cisco IOS, the simple `login` command restricts authentication to a line password. If no line password is configured, access is refused. Executing `login local` forces Cisco IOS to authenticate incoming SSH connections against accounts defined in the global local database, such as `secadmin`.

Adım Adım Çözüm

1
Analyze the VTY line authentication configuration.
The configuration shows `login` under `line vty 0 4` without a line-level `password` statement or the `local` keyword.
The bare `login` command expects a password defined directly on the line using `password <string>`. Without it, all login attempts are blocked.
2
Evaluate local database user configuration.
A local user `secadmin` is present with a valid Type 8 PBKDF2 secret hash (`secret 8 ...`).
Local credentials exist, but Cisco IOS must be instructed to consult the local account database for line access.
3
Identify the required CLI command fix.
Configuring `login local` under `line vty 0 4` binds incoming VTY authentication to the local username database.
This allows `secadmin` credentials to be validated successfully during SSH setup.

Anahtar Kavram

Cisco IOS Line VTY Local Database Authentication
Soru 7Soru →

A network security administrator must perform a local password recovery procedure on a Cisco IOS router after administrative credentials were lost. Arrange the procedural steps in the correct chronological order required to restore administrative access without losing the active device configuration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence for Cisco IOS password recovery is: 1) Interrupt the boot sequence in ROMMON and set the configuration register to `0x2142`. 2) Boot into Cisco IOS and enter privileged EXEC mode without password prompt. 3) Execute `copy startup-config running-config`. 4) Set a new password using `enable secret`. 5) Revert the configuration register to `0x2102` and save changes with `copy running-config startup-config`.
The correct sequence follows standard Cisco IOS administrative recovery: First, interrupt boot in ROMMON to change the register to `0x2142`, ignoring startup configuration. Second, complete boot into privileged EXEC mode without credentials. Third, copy startup configuration into running configuration (`copy startup-config running-config`) to restore network settings into RAM. Fourth, define a new password using `enable secret`. Fifth, reset the register to `0x2102` and save the configuration (`copy running-config startup-config`) to NVRAM.

Adım Adım Çözüm

1
Change configuration register in ROMMON mode
Configuration register value set to `0x2142`
Forces Cisco IOS to bypass reading NVRAM (startup-config) during boot up.
2
Boot device and access privileged EXEC mode
Router boots to `Router>` and allows `enable` without credential prompt
Since startup-config is ignored, no local authentication controls or passwords are loaded.
3
Load startup configuration into active RAM using `copy startup-config running-config`
Original operational configuration is restored into RAM
Preserves all existing router settings so they are not accidentally wiped when saving.
4
Configure a new password using `enable secret` in global configuration mode
New encrypted password replaces the old locked password in running-config
Updates the local access password in RAM while keeping all restored settings.
5
Reset configuration register to `0x2102` and save running configuration to startup configuration
Router register set back to normal boot mode and startup-config in NVRAM updated
Ensures future reboots load configuration from NVRAM normally with the new password.

Anahtar Kavram

Cisco IOS Local Password Recovery Procedure and Configuration Register Values
Soru 8Soru →

A network security architect is enforcing local authentication policies on a Cisco IOS XE router. The organization requires local user accounts to utilize scrypt key derivation hashing algorithms and mandates that remote management lines authenticate users against the local device database. Which TWO actions or configuration commands meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure 'username admin algorithm-type scrypt secret P@ssw0rd123!' in global configuration mode.; Execute 'login local' under the line vty configuration mode.

Cevap

Configuring 'username admin algorithm-type scrypt secret P@ssw0rd123!' creates a local user account secured with Type 9 scrypt password hashing, and applying 'login local' under line vty forces virtual terminal connections to authenticate against the local user database.
Specifying 'username admin algorithm-type scrypt secret' creates a Type 9 hashed credential using the scrypt password-based key derivation function, satisfying the requirement for strong non-reversible local hashing. Applying 'login local' under VTY line configuration directs the router to authenticate VTY remote connections using the device's local user database.

Adım Adım Çözüm

1
Identify the hashing algorithm requirement for local user database credentials.
Cisco IOS XE supports Type 9 password hashing using the scrypt algorithm by specifying 'username <name> algorithm-type scrypt secret <password>'.
Using the 'secret' command with 'algorithm-type scrypt' ensures passwords are stored using a strong, non-reversible key derivation function rather than legacy MD5 or reversible Type 7 algorithms.
2
Identify the requirement to authenticate remote management sessions against local accounts.
Entering line vty configuration mode and applying 'login local' enables local database lookup.
Without 'login local', VTY lines may default to password-only authentication ('login') or no authentication at all.

Anahtar Kavram

Cisco IOS Local Password Hashing Types and VTY Local Authentication
Soru 9Soru →

A network administrator inspects a Cisco IOS XE switch and finds the following running configuration snippet:

text
username secadmin privilege 15 password 0 C1sc0123!
!
line vty 0 4
transport input ssh
login local

The organization's security hardening baseline requires all local database user accounts to store credentials using PBKDF2 (Type 8) password hashing rather than unencrypted plaintext (Type 0). Which global configuration command correctly updates the local user credential to meet this security standard?

Cevabı ve açıklamayı göster

Cevap: username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!

Cevap

The correct command is 'username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!'.
The command 'username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!' properly replaces the Type 0 unencrypted local password entry with a secure PBKDF2 SHA-256 (Type 8) hash for the specified local user account.

Adım Adım Çözüm

1
Analyze the existing local user configuration statement
The command 'username secadmin privilege 15 password 0 C1sc0123!' uses the 'password 0' syntax, storing the credential as cleartext (Type 0).
Cleartext passwords expose administrative credentials to unauthorized viewing in running configuration files and backups.
2
Identify the Cisco IOS XE command keyword for Type 8 PBKDF2 password hashing
Using 'secret algorithm-type sha256' configures Cisco IOS XE to hash the local user password with SHA-256 based PBKDF2 (Type 8).
The 'secret' keyword replaces weak password storage methods with modern, key-stretching cryptographic algorithms.
3
Formulate the correct global configuration mode command for the specified local user account
'username secadmin privilege 15 secret algorithm-type sha256 C1sc0123!' preserves the username and privilege level while enforcing Type 8 security.
This matches all baseline security requirements specified in the scenario.

Anahtar Kavram

Cisco IOS Local Password Hashing Types and Command Syntax
Soru 10Soru →

A network technician needs to harden local console line access on a Cisco IOS XE switch using the local user database. Arrange the following Cisco IOS CLI commands in the correct sequential order required to perform this configuration, starting from Privileged EXEC mode (`Switch#`).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct command sequence begins with entering global configuration mode (`configure terminal`), creating the local user account (`username admin algorithm-type scrypt secret C1scoPass123!`), accessing the line console context (`line console 0`), enforcing local authentication (`login local`), and exiting line configuration mode (`exit`).
Configuring local user access requires navigating hierarchy levels in Cisco IOS. Starting from `Switch#`, the administrator enters global configuration mode using `configure terminal`. Next, creating the local account with `username ... secret ...` populates the local user database. The technician then transitions into line configuration mode with `line console 0` and binds authentication to the local database using `login local`. Finally, issuing `exit` leaves line configuration mode.

Adım Adım Çözüm

1
Transition from Privileged EXEC mode to Global Configuration mode.
Prompt changes to `Switch(config)#`.
Global configuration commands cannot be executed directly from Privileged EXEC mode.
2
Create the local administrator user account using `username admin algorithm-type scrypt secret C1scoPass123!`.
Local database account is created with a strong Type 9 encrypted secret.
The local account must exist in the device configuration so local authentication succeeds.
3
Navigate into line console configuration mode using `line console 0`.
Prompt changes to `Switch(config-line)#`.
Line-specific authentication settings must be applied within the line configuration sub-mode.
4
Apply the `login local` command under line console configuration.
Console prompt prompts for a username and password defined in the local database.
By default, console lines may require only a line password or no authentication; `login local` forces local database verification.
5
Execute `exit` from line configuration mode.
Prompt returns to `Switch(config)#`.
Completes line configuration and returns to global configuration mode.

Anahtar Kavram

Local Database Authentication and Line Console Security Configuration
Tahmini Süre:1m 30s
Soru 11Soru →

A network administrator reviews a Cisco IOS XE router configuration and notices the following line in the running configuration:

`username netadmin privilege 15 password 7 08221509421E05150C`

This entry was created after a technician executed `username netadmin privilege 15 password 0 SecretPass123` followed by `service password-encryption`.

Which statement accurately describes the primary security risk of using this password storage method compared to configuring `username netadmin secret SecretPass123`?

Cevabı ve açıklamayı göster

Cevap: The Type 7 algorithm uses weak vigenère-based obfuscation that can be easily reversed to plain text using standard tools.

Cevap

The Type 7 algorithm uses weak vigenère-based obfuscation that can be easily reversed to plain text using standard tools.
The statement identifying Type 7 as a weak, reversible algorithm is correct. In Cisco IOS, using the `password` command combined with `service password-encryption` produces a Type 7 obfuscated password string. Type 7 uses a simple vigenère-style cipher designed purely to prevent shoulder surfing. It is easily reversible back to plain text. To secure local credentials, administrators should use the `username <name> secret <password>` command, which uses secure one-way hash algorithms (Type 5, Type 8, or Type 9).

Adım Adım Çözüm

1
Analyze the password syntax used in the configuration command
The command `username netadmin password 0 SecretPass123` creates a local database account using plain text (Type 0).
The `password` keyword in Cisco IOS specifies unhashed or weak password storage unless superseded by `secret`.
2
Evaluate the effect of `service password-encryption`
It converts plain text passwords into Type 7 obfuscated strings in the configuration file.
Type 7 encryption uses a well-known, simple reversible cipher intended solely to protect against visual inspection over an admin's shoulder.
3
Compare Type 7 password storage with the `secret` keyword
The `secret` keyword applies strong one-way cryptographic hashing (Type 5 MD5, Type 8 PBKDF2 SHA-256, or Type 9 scrypt), which cannot be reversed back to plain text.
Hardening Cisco IOS device access requires non-reversible hashing algorithms rather than reversible Type 7 obfuscation.

Anahtar Kavram

Local Password Hashing vs Type 7 Obfuscation in Cisco IOS
Soru 12Soru →

A network security administrator needs to configure a local database user account named 'opsman' on a Cisco IOS XE router. The requirement specifies using PBKDF2 with SHA-256 hashing (Type 8 encryption) to securely store the plaintext password 'Secur3#Pass2026'. Which Cisco IOS global configuration command correctly satisfies this requirement?

Cevabı ve açıklamayı göster

Cevap: username opsman secret algorithm-type pbkdf2 Secur3#Pass2026

Cevap

The command 'username opsman secret algorithm-type pbkdf2 Secur3#Pass2026' correctly configures the local account with PBKDF2 (Type 8) password hashing.
In Cisco IOS XE, creating a local database user account with PBKDF2 hashing (Type 8) from a cleartext string requires the syntax 'username <name> secret algorithm-type pbkdf2 <plaintext_password>'. The router automatically computes the SHA-256 PBKDF2 hash and stores it in the running configuration as a Type 8 secret.

Adım Adım Çözüm

1
Identify the target requirement
The goal is to configure a local user secret using PBKDF2 (Type 8 encryption) from a cleartext input password on Cisco IOS XE.
Cisco IOS XE supports enhanced password hashing algorithms via the 'secret' command branch.
2
Evaluate Cisco IOS XE syntax rules for local user database creation
The 'username <name> secret algorithm-type <type> <password>' syntax is used to define cleartext passwords hashed with specific algorithms such as pbkdf2 or scrypt.
Using 'secret algorithm-type pbkdf2' specifies Type 8 SHA-256 PBKDF2 hashing.
3
Differentiate from incorrect options
The 'password' keyword cannot take hashing algorithms, the literal number '8' expects an already computed hash string, and 'service password-encryption' is a global command for legacy Type 7 encryption.
Syntax elements must match the command state and input format expected by IOS XE.

Anahtar Kavram

Local database user authentication and password hashing algorithms (Type 5 MD5, Type 8 PBKDF2, Type 9 scrypt, Type 7 service password-encryption).
Soru 13Soru →

A network administrator needs to harden administrative access on a Cisco IOS XE router. The requirement specifies that users connecting via SSH must authenticate against the local device user database, and privileged EXEC mode access must be protected using Type 9 (scrypt) password hashing. Which two CLI configuration tasks must be performed to meet these security requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure enable secret algorithm-type scrypt <password> in global configuration mode.; Execute the login local command under line vty configuration mode.

Cevap

The two required CLI configuration tasks are configuring enable secret algorithm-type scrypt <password> in global configuration mode and executing login local under line vty configuration mode.
Configuring enable secret with the algorithm-type scrypt option enforces strong Type 9 hashing for privileged EXEC access, and issuing login local under line vty mode forces VTY remote access to validate credentials against local user database accounts.

Adım Adım Çözüm

1
Identify the command required to enforce strong Type 9 privileged EXEC password protection.
Executing enable secret algorithm-type scrypt <password> creates a Type 9 password hash using the scrypt key derivation function for privileged EXEC mode.
Cisco IOS XE supports Type 9 scrypt encryption, which provides significantly stronger protection than standard Type 5 MD5 or Type 7 obfuscation.
2
Identify the line configuration command required for local user database authentication on VTY lines.
Navigating to line vty configuration mode and executing login local configures VTY sessions to authenticate incoming connections against accounts created in the local database.
Using the standalone login command checks only a line-level password, whereas login local directs authentication to the local username database.

Anahtar Kavram

Cisco IOS Local User Authentication and Password Hashing Types
Soru 14Soru →

A network engineer observes the following partial running configuration on a Cisco IOS XE switch:

text
username netops privilege 15 secret Cisc0#2026!
!
line vty 0 4
password 7 094F471A1A0A
login
!

When administrators attempt to establish a remote SSH session to the switch, the prompt requests only a line password rather than asking for user credentials. Which command must be configured under line configuration mode to enforce authentication against the local user database?

Cevabı ve açıklamayı göster

Cevap: login local

Cevap

The command 'login local' must be configured under line configuration mode to require local database authentication.
Configuring 'login local' under line configuration mode instructs Cisco IOS to authenticate incoming VTY session users using usernames and passwords stored in the router's local user database.

Adım Adım Çözüm

1
Analyze current line configuration
The current line configuration contains the keyword 'login', which only checks the line password specified by 'password 7 094F471A1A0A'.
The standard 'login' keyword directs Cisco IOS to validate against line-specific passwords rather than individual user accounts.
2
Determine the required authentication behavior
Local user account 'netops' exists in global configuration, requiring VTY lines to perform local database lookups.
Security best practices demand individual accountability using local database credentials instead of shared line passwords.
3
Select the correct CLI command for line configuration mode
Configuring 'login local' under 'line vty 0 4' replaces line password authentication with local database authentication.
The 'local' parameter appended to 'login' explicitly directs the line interface to consult the device local account database for login verification.

Anahtar Kavram

Local Database Authentication on Cisco IOS Lines
Tahmini Süre:1m 0s
Soru 15Soru →

Place the following Cisco IOS password encryption types in order of security strength, from weakest (least secure) to strongest (most secure).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order from weakest to strongest security strength is Type 0 (Plaintext), Type 7 (Reversible Vigenère cipher), Type 5 (MD5 hash), and Type 9 (scrypt hash).
The sequence from weakest to strongest begins with Type 0 (unencrypted plaintext). Next is Type 7, which uses weak, reversible Vigenère encryption intended only to stop casual viewing. Type 5 uses a one-way MD5 hash which cannot be mathematically decrypted. Finally, Type 9 uses the modern memory-hard scrypt algorithm to provide maximum protection against high-speed dictionary and brute-force attacks.

Adım Adım Çözüm

1
Identify unencrypted plaintext storage
Type 0 represents completely unencrypted text in the configuration file.
Plaintext offers no protection because anyone viewing the running configuration can read the password.
2
Identify weakly obfuscated passwords
Type 7 is created by 'service password-encryption' using a reversible algorithm.
Type 7 prevents casual shoulder surfing but can be trivially reversed back to plaintext.
3
Identify standard cryptographic hashes
Type 5 relies on the MD5 one-way hash algorithm.
One-way hashes cannot be decrypted back to plaintext, making Type 5 much stronger than Type 7 obfuscation.
4
Identify modern memory-hard password hashes
Type 9 uses the scrypt algorithm for enhanced key derivation.
scrypt is designed to resist hardware-accelerated offline brute-force attacks, making it stronger than MD5.

Anahtar Kavram

Cisco IOS Password Encryption Algorithm Types and Relative Security Strengths
Soru 16Soru →

An infrastructure auditor reviews the local access credentials and line configuration snippet on an enterprise Cisco IOS switch:

text
username auditmgr privilege 15 secret 8 88 vG4k$9mP...
username techuser privilege 1 password 0 Cisco123!
service password-encryption
!
line console 0
login local
!
line vty 0 4
login local
transport input ssh
!
line vty 5 15
login
transport input ssh

Based on this configuration, which statement accurately describes the operational and security impact on administrative access?

Cevabı ve açıklamayı göster

Cevap: VTY lines 5 through 15 will fail local database authentication because they specify login instead of login local, while techuser credentials are protected only by weak Type 7 encryption.

Cevap

VTY lines 5 through 15 will fail local database authentication because they specify 'login' instead of 'login local', and 'techuser' credentials are stored using weak reversible Type 7 encryption.
The statement identifying that VTY lines 5 through 15 will fail local database authentication due to using 'login' instead of 'login local', alongside identifying that 'techuser' relies on weak Type 7 encryption, is correct. On Cisco IOS lines, 'login' requires a line-specific password and ignores the local username database. Additionally, 'service password-encryption' only applies weak Type 7 reversible obfuscation to 'password' commands rather than strong 'secret' hashing (Type 5, 8, or 9).

Adım Adım Çözüm

1
Analyze VTY line configuration for authentication mode consistency.
Lines 0-4 use 'login local' which queries the local database. Lines 5-15 use 'login' which expects a line password rather than checking local usernames, resulting in authentication failures for local database users accessing lines 5-15.
The 'login' command alone tells IOS to prompt for a line password set via 'password <str>' under the line context, whereas 'login local' instructs IOS to authenticate against configured 'username' database statements.
2
Evaluate local username password security types.
The 'auditmgr' account uses 'secret 8' (Type 8 PBKDF2 SHA-256 hash). The 'techuser' account uses 'password 0' which 'service password-encryption' transforms into a weak, easily reversible Type 7 cipher.
Type 7 encryption is weak Vigenère obfuscation meant only to prevent shoulder surfing. Type 8 (PBKDF2) and Type 9 (scrypt) secret hashes are cryptographically secure.
3
Combine line authentication behavior and password security analysis.
The configuration suffers from both line authentication misconfiguration on VTY 5-15 and weak credential protection for 'techuser'.
Combining these evaluations identifies the statement correctly detailing line authentication failure for local accounts on VTY 5-15 and weak Type 7 encryption.

Anahtar Kavram

Line Access Authentication and Cisco IOS Password Encryption Types
Soru 17Soru →

A network administrator needs to secure remote administrative access to a Cisco IOS switch by requiring users to authenticate against the local user database. Which two steps are required to implement local user database authentication for remote VTY line access? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a local user account using the global configuration command 'username <name> secret <password>'.; Apply the line configuration command 'login local' under the VTY lines.

Cevap

To configure local user database authentication for remote VTY line access, you must define a local user account in global configuration mode using 'username <name> secret <password>' and configure 'login local' under the line configuration mode for VTY lines.
Local authentication requires both the creation of user credentials in the local security database using the global 'username' command and configuring the terminal lines (VTY) with 'login local' so Cisco IOS checks incoming connections against that database.

Adım Adım Çözüm

1
Define local user account
Local database contains valid credentials.
The system requires a defined user account stored in the local running-config database to check credentials against upon user connection.
2
Enable local authentication on line VTY mode
VTY lines prompt for username and password checked against local database.
By default, line configuration might look for simple line passwords or no password; 'login local' directs the line to check the username and password against the local device database.

Anahtar Kavram

Local User Database Authentication on Cisco IOS VTY Lines
Soru 18Soru →

A network security engineer is hardening a Cisco IOS router for remote administrative access. The running configuration contains the following entries:

text
username opsadmin privilege 15 secret 9 99 eG8H kQzP8vX...usernameopstechsecret5kQzP8vX... username opstech secret 5 1 mER7mER7 h8GzK2Pq...
username opsguest password 0 Cisco12345!
service password-encryption
!
line vty 0 4
exec-timeout 10 0
privilege level 5
login local
transport input ssh

Based on this configuration, which operational behavior will occur when users authenticate remotely via SSH?

Cevabı ve açıklamayı göster

Cevap: The account without an explicit privilege level enters privilege level 5 upon successful login because it inherits the line configuration, whereas the administrator account enters privilege level 15.

Cevap

The user account without an explicit privilege level definition inherits privilege level 5 from the line VTY configuration upon login, while the administrator account with privilege 15 specified in its username command overrides the line setting and enters privilege level 15 directly.
In Cisco IOS, when VTY lines are configured with 'login local' and a baseline 'privilege level X', any local database account that authenticates without an explicit privilege level defined in its 'username' statement will inherit privilege level X from the line. Accounts configured with an explicit 'privilege Y' attribute in the local database override the line setting and enter privilege level Y immediately upon successful authentication.

Adım Adım Çözüm

1
Analyze local database user configuration attributes
The administrator user account specifies explicit privilege level 15. The secondary technical user account specifies no privilege attribute, defaulting to privilege level 1 in its user definition.
Explicit privilege settings tied to a username dictate the user's privilege level unless unassigned.
2
Evaluate line VTY privilege level interaction with local authentication
The line VTY range is configured with 'privilege level 5' and 'login local'.
When authenticating against the local database via VTY lines, Cisco IOS uses the line's configured privilege level as the default EXEC level for any authenticated user account that does not have an explicit privilege level assigned.
3
Determine session privilege outcomes for both accounts
The administrator account enters privilege level 15 (explicit user override). The secondary technical account enters privilege level 5 (inherited from VTY line).
User-specific privilege levels take precedence over line privilege settings, but line privilege settings override the default level 1 for unassigned local accounts.

Anahtar Kavram

Interaction between local database username privilege settings, line VTY privilege levels, and Cisco IOS password hashing types
Soru 19Soru →

A network engineer applies the following local authentication and access configuration to a Cisco IOS XE router:

text
username opsuser privilege 7 secret OpsPass#2026
username auditor privilege 1 secret AuditPass#2026
enable secret EnablePass#2026
!
line vty 0 15
transport input ssh
login local

When `opsuser` successfully establishes an SSH session to the router using local database credentials, which initial operational state and privilege level behavior does the user experience?

Cevabı ve açıklamayı göster

Cevap: The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.

Cevap

The user is placed directly into EXEC mode at privilege level 7 without needing to issue the enable command.
When a local user account is created with an explicit privilege parameter (such as 'privilege 7'), Cisco IOS applies that privilege level immediately upon successful authentication via 'login local'. The user lands directly in EXEC mode at privilege level 7 with access to commands permitted at or below that level.

Adım Adım Çözüm

1
Analyze local database user configuration
The user 'opsuser' is defined with explicit privilege level 7 using 'username opsuser privilege 7 secret OpsPass#2026'.
Explicit privilege level keywords in local user creation define the initial privilege level assigned to the session upon authentication.
2
Analyze line VTY access control settings
The VTY lines use 'login local' to authenticate inbound SSH sessions against the local user database.
'login local' instructs Cisco IOS to validate credentials against the local running configuration user database and apply associated user attributes.
3
Determine post-authentication session environment
Upon successful login, Cisco IOS grants the session privilege level 7 immediately with the CLI prompt showing 'opsuser#'.
Users with custom privilege levels defined in the local database bypass default user EXEC (level 1) restriction and enter directly at their configured level without requiring the 'enable' command.

Anahtar Kavram

Cisco IOS Local Database User Privilege Level Assignment and VTY Access Behavior
Tahmini Süre:2m 0s
Soru 20Soru →

A technician configures initial administrative security on a newly racked Cisco IOS XE switch using the following CLI commands:

text
username netadmin secret C1sco!Pass2026
line console 0
password C1sco!Pass2026
login

During validation, the technician observes that connecting via the serial console prompts only for a password, allowing login without entering the username `netadmin` stored in the local database.

Which command must be executed under `line console 0` to require authentication against the local user database?

Cevabı ve açıklamayı göster

Cevap: login local

Cevap

The 'login local' command must be executed under line console 0 to force the switch to prompt for both a username and password defined in the local user database.
The 'login local' command configures line console 0 to authenticate access using credentials defined in the device's local database (created via 'username' commands). This causes the device to display both 'Username:' and 'Password:' prompts during login.

Adım Adım Çözüm

1
Analyze the current line console 0 configuration snippet
The current line configuration contains 'password C1sco!Pass2026' followed by 'login', which configures simple password-only line authentication.
The standard 'login' keyword under line configuration checks only against the line-specific password and ignores local username database entries.
2
Identify the CLI keyword required to consult the local user database
Replacing 'login' with 'login local' instructs Cisco IOS XE to prompt for both username and password credentials.
The 'local' parameter directs authentication requests to user accounts configured via global 'username' statements.

Anahtar Kavram

Cisco IOS Line Authentication Modes and Local Database Integration
Tahmini Süre:1m 0s
Sayfa 1 / 2Sonraki