Module 10 Post - Assessment

Which authentication method stores usernames and passwords in the router and is ideal for small networks?

• local AAA

• local AAA over RADIUS

• local AAA over TACACS+

• server-based AAA

• server-based AAA over RADIUS

Answer explanation

In a small network with a few network devices, AAA authentication can be implemented with the local database and with usernames and passwords stored on the network devices. Authentication using the TACACS+ or RADIUS protocol will require dedicated ACS servers although this authentication solution scales well in a large network.

What are two protocols that are used by AAA to authenticate users against a central database of usernames and password? (Choose two.)

• NTP

• TACACS+

• SSH

• HTTPS

• RADIUS

Answer explanation

By using TACACS+ or RADIUS, AAA can authenticate users from a database of usernames and passwords stored centrally on a server such as a Cisco ACS server.

What is the result of a DHCP starvation attack?

• Legitimate clients are unable to lease IP addresses.

• Clients receive IP address assignments from a rogue DHCP server.

• The attacker provides incorrect DNS and default gateway information to clients.

• The IP addresses assigned to legitimate clients are hijacked.

Answer explanation

DCHP starvation attacks are launched by an attacker with the intent to create a DoS for DHCP clients. To accomplish this goal, the attacker uses a tool that sends many DHCPDISCOVER messages to lease the entire pool of available IP addresses, thus denying them to legitimate hosts.

What represents a best practice concerning discovery protocols such as CDP and LLDP on network devices?

• Use the open standard LLDP rather than CDP.

• Disable both protocols on all interfaces where they are not required.

• Use the default router settings for CDP and LLDP.

• Enable CDP on edge devices, and enable LLDP on interior devices.

Answer explanation

Both discovery protocols can provide hackers with sensitive network information. They should not be enabled on edge devices, and should be disabled globally or on a per-interface basis if not required. CDP is enabled by default.​

Which protocol should be used to mitigate the vulnerability of using Telnet to remotely manage network devices?

• SCP

• SSH

• TFTP

• SNMP

Answer explanation

Telnet uses plain text to communicate in a network. The username and password can be captured if the data transmission is intercepted. SSH encrypts data communications between two network devices. TFTP and SCP are used for file transfer over the network. SNMP is used in network management solutions.

Which statement describes the behavior of a switch when the MAC address table is full?

• It treats frames as unknown unicast and floods all incoming frames to all ports on the switch.

• It treats frames as unknown unicast and floods all incoming frames to all ports within the local VLAN.

• It treats frames as unknown unicast and floods all incoming frames to all ports within the collision domain.

• It treats frames as unknown unicast and floods all incoming frames to all ports across multiple switches.

Answer explanation

When the MAC address table is full, the switch treats the frame as an unknown unicast and begins to flood all incoming traffic to all ports only within the local VLAN.

Which feature on a switch makes it vulnerable to VLAN hopping attacks?

• the mixed duplex mode enabled for all ports by default

• the limited size of content-addressable memory space

• mixed port bandwidth support enabled for all ports by default

• the automatic trunking port feature enabled for all ports by default

Answer explanation

A VLAN hopping attack enables traffic from one VLAN to be seen by another VLAN without routing. In a basic VLAN hopping attack, the attacker takes advantage of the automatic trunking port feature enabled by default on most switch ports.

Which feature or configuration on a switch makes it vulnerable to VLAN double-tagging attacks?

• mixed duplex mode enabled for all ports by default

• the limited size of content-addressable memory space

• the automatic trunking port feature enabled for all ports by default

• the native VLAN of the trunking port being the same as a user VLAN

Answer explanation

A double-tagging (or double-encapsulated) VLAN hopping attack takes advantage of the way that hardware on most switches operates. Most switches perform only one level of 802.1Q de-encapsulation, which allows an attacker to embed a hidden 802.1Q tag inside the frame. This tag allows the frame to be forwarded to a VLAN that the original 802.1Q tag did not specify. An important characteristic of the double-encapsulated VLAN hopping attack is that it works even if trunk ports are disabled, because a host typically sends a frame on a segment that is not a trunk link. This type of attack is unidirectional and works only when the attacker is connected to a port residing in the same VLAN as the native VLAN of the trunk port.

Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?

• auditing

• accounting

• authorization

• authentication

Answer explanation

One of the components in AAA is authorization. After a user is authenticated through AAA, authorization services determine which resources the user can access and which operations the user is allowed to perform.

Which component of AAA allows an administrator to track individuals who access network resources and any changes that are made to those resources?

• accessibility

• accounting

• authentication

• authorization

Answer explanation

One of the components in AAA is accounting. After a user is authenticated through AAA, AAA servers keep a detailed log of exactly what actions the authenticated user takes on the device.