Password Security Policies, MFA, and Certificates

Match each Public Key Infrastructure (PKI) component on the left with its primary function on the right.

An network administrator is implementing Multi-Factor Authentication (MFA) to secure access to network infrastructure devices. Which two of the following options represent a possession factor ('something you have')? (Select two.)

A network administrator is establishing password security policies on network devices to protect administrative logins from brute-force attacks. Which security policy control directly ensures that users choose strong passwords that resist dictionary attacks?

An organization is deploying 802.1X authentication using EAP-TLS to secure network access. During testing, a user laptop fails the TLS handshake when attempting to authenticate against the Cisco Identity Services Engine (ISE) RADIUS server. Inspection of the server logs reveals that the client presented a valid user certificate issued by an Intermediate Certificate Authority (CA), and the root CA certificate is present in the server's trusted store. However, the handshake fails because ISE cannot verify whether the client certificate has been revoked due to an unreachable Revocation Check endpoint. Which mechanism or component must be accessible to resolve this authentication failure?

An enterprise organization is updating its infrastructure security baseline to comply with zero-trust architecture guidelines. The network security team is establishing policies governing administrative SSH access to core switches and 802.1X EAP-TLS client authentication across corporate wireless networks. Which TWO of the following implementation details correctly align with Cisco recommended standards for multi-factor authentication (MFA) factor classification and Public Key Infrastructure (PKI) digital certificate validation? (Choose two.)

A network engineer is configuring digital certificate authentication for Cisco Identity Services Engine (ISE) and enterprise network infrastructure. To ensure proper certificate deployment and validation, the engineer must correctly identify the operational function of each Public Key Infrastructure (PKI) element. Match each PKI component on the left to its corresponding primary function on the right.

A network security engineer is implementing multi-factor authentication (MFA) for administrative switch access using a centralized AAA server. When the primary RADIUS server is unreachable, the switch falls back to a locally configured emergency user account, allowing administrators to log in using only a local password without prompting for a dynamic one-time passcode (OTP). Which operational factor explains why multi-factor authentication is bypassed during this fallback scenario?

A network security administrator is configuring digital certificate services and Multi-Factor Authentication (MFA) to secure management sessions on enterprise network infrastructure. Which of the following statements accurately describe digital certificate verification and MFA factor rules? (Select TWO.)

A network administrator is implementing administrative security controls for enterprise network switches and configuring Public Key Infrastructure (PKI) certificate validation for HTTPS management access. When evaluating multi-factor authentication (MFA) factor categories and PKI digital certificate validation mechanics, which two statements are correct?

Match each Public Key Infrastructure (PKI) component or Multi-Factor Authentication (MFA) element on the left to its corresponding function or definition on the right.

An organization is updating its administrative access policy for Cisco enterprise network devices. To enforce multi-factor authentication (MFA) for secure SSH management access, network administrators configure AAA authentication to require both a static account password and a one-time passcode (OTP) generated by a physical hardware token fob. Which statement correctly classifies these two authentication controls under standard MFA factor categories?

A network administrator is implementing certificate-based client authentication (EAP-TLS) for 802.1X enterprise wireless access. When an authentication server receives a digital certificate presented by a client device, which two methods or attributes are used by the server to check whether the certificate has been explicitly revoked before its natural expiration date? (Select TWO.)

An organization is updating its enterprise security standards for administrative access and infrastructure security. Match each security control or PKI concept on the left to its corresponding operational function on the right.

A network administrator installs a new identity certificate on a Cisco IOS router to secure HTTPS management access. However, when administrative workstations attempt to connect to the router via HTTPS, their web browsers display a security warning stating that the certificate issuer is untrusted. The router's system clock is synchronized via NTP, and the certificate is within its valid date range. What is the root cause of this trust failure?

An enterprise network policy mandates Multi-Factor Authentication (MFA) for network administrators establishing SSH sessions to core infrastructure devices. The policy specifically requires combining a 'something you know' factor with a 'something you have' factor. Which authentication combination satisfies this policy requirement?

A network administrator is configuring Public Key Infrastructure (PKI) certificate services to secure administrative access and VPN connections on Cisco routers. Match each PKI component on the left with its correct operational description on the right.

An organization is updating its infrastructure access control policies and mandates Multi-Factor Authentication (MFA) for administrative SSH connections to all core routers. Which combination of credentials satisfies true Multi-Factor Authentication by employing two distinct authentication factor categories?

An enterprise network security policy mandates Multi-Factor Authentication for administrative access to core switches. An administrator logs in by entering a static PIN followed by a one-time passcode generated by a physical hardware token. Which statement correctly categorizes the authentication factors used in this scenario?

A network administrator configures Multi-Factor Authentication (MFA) for engineers establishing SSH connections to core routers. The login policy requires engineers to enter their domain password followed by a dynamic time-based passcode generated by a mobile application on their corporate-managed phone. Which two authentication factor categories are being used in this scenario?

A network security administrator configures mutual certificate-based authentication (EAP-TLS) for remote access VPN endpoints. During initial validation testing, client endpoints successfully verify the identity of the VPN gateway. However, the VPN gateway fails to authenticate the client certificates. Detailed inspection reveals that the gateway is configured for mandatory certificate status checking using the Online Certificate Status Protocol (OCSP), but outbound HTTP requests sent to the Uniform Resource Identifier (URI) listed in the Authority Information Access (AIA) extension are being dropped by a perimeter security policy. Which statement correctly identifies the cause of the failure and the necessary resolution?