Font size
WorksheetsCCNA 6
Total questions: 110
Worksheet time: 59mins
Which two statements about NTP operations are true? (Choose two.)
NTP uses UDP over IP.
Cisco routers can act as both NTP authoritative servers and NTP clients.
Cisco routers can act only as NTP servers.
Cisco routers can act only as NTP clients.
NTP uses TCP over IP.
Refer to the exhibit. Which configuration must be applied to the router that configures PAT to translate all addresses in VLAN 200 while allowing
devices on VLAN
100 to use their own IP addresses?
Router1(config)#access-list 99 permit 192.168.100.32 0.0.0.31 Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200 Router1(config)#ip nat inside Router1(config)#interface gi1/0/0 Router1(config)#ip nat outside
Router1(config)#access-list 99 permit 192.168.100.0 0.0.0.255 Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200 Router1(config)#ip nat inside Router1(config)#interface gi1/0/0 Router1(config)#ip nat outside
Router1(config)#access-list 99 permit 209.165.201.2 255.255.255.255 Router1(config)#ip nat inside source list 99 interface gi1/0/0
overload Router1(config)#interface gi2/0/1.200 Router1(config)#ip nat inside Router1(config)#interface gi1/0/0 Router1(config)#ip nat
outside
Router1(config)#access- list 99 permit 209.165.201.2 0.0.0.0 Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200 Router1(config)#ip nat inside Router1(config)#interface gi1/0/0 Router1(config)#ip nat outside
Refer to the exhibit. Which two commands must be added to update the configuration of router R1 so that it accepts only encrypted connections?
(Choose two.)
transport input ssh
username CNAC secret R!41!3705926@
crypto key generate rsa 1024
line vty 0 4
ip ssh version 2
Which command implies the use of SNMPv3?
snmp-server user
snmp-server host
snmp-server enable traps
snmp-server community
R1 as an NTP server must have:
✑ NTP authentication enabled
✑ NTP packets sourced from Interface loopback 0
✑ NTP stratum 2
✑ NTP packets only permitted to client IP 209.165.200.225
How should R1 be configured?
ntp authenticate ntp authentication-key 2 sha1 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp master 2 ! access-list
10 permit udp host 209.165.200.225 any eq 123
ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp interface Loopback0 ntp access-group server-only 10 ntp stratum 2 ! accesslist
10 permit 209.165.200.225
ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp master 2 ! access-list
10 permit 209.165.200.225
ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp stratum 2 ! access-list
10 permit udp host 209.165.200.225 any eq 123
What is a capability of FTP in network management operations?
offers proprietary support at the session layer when transferring data
uses separate control and data connections to move files between server and client
encrypts data before sending between data resources
devices are directly connected and use UDP to pass file information
A network engineer is configuring a switch so that it is remotely reachable via SSH. The engineer has already configured the host name on the
router. Which additional command must the engineer configure before entering the command to generate the RSA key?
password password
ip ssh authentication-retries 2
ip domain-name domain
crypto key generate rsa modulus 1024
Which QoS traffic handling technique retains excess packets in a queue and reschedules these packets for later transmission when the configured
maximum bandwidth has been surpassed?
traffic policing
weighted random early detection
traffic prioritization
traffic shaping
Refer to the exhibit. The DHCP server and clients are connected to the same switch. What is the next step to complete the DHCP configuration to
allow clients on
VLAN 1 to receive addresses from the DHCP server?
Configure the ip dhcp snooping trust command on the interface that is connected to the DHCP client.
Configure ip dhcp relay information option command on the interface that is connected to the DHCP server.
Configure ip dhcp snooping trust command on the interface that is connected to the DHCP server.
Configure the ip dhcp information option command on the interface that is connected to the DHCP client.
Which command must be entered to configure a DHCP relay?
ip dhcp relay
ip dhcp pool
ip address dhcp
ip helper-address
A network analyst is tasked with configuring the date and time on a router using EXEC mode. The date must be set to January 1, 2020 and the
time must be set to
12:00 am. Which command should be used?
clock timezone
clock summer-time date
clock summer-time recurring
clock set
Which command creates a static NAT binding for a PC address of 10.1.1.1 to the public routable address 209.165.200.225 assigned to the PC?
R1(config)#ip nat inside source static 10.1.1.1 209.165.200.225
R1(config)#ip nat outside source static 209.165.200.225 10.1.1.1
R1(config)#ip nat inside source static 209.165.200.225 10.1.1.1
R1(config)#ip nat outside source static 10.1.1.1 209.165.200.225
What prevents a workstation from receiving a DHCP address?
STP
VTP
802.1Q
DTP
What is a feature of TFTP?
offers anonymous user login ability
uses two separate connections for control and data traffic
relies on the well-known TCP port 20 to transmit data
provides secure data transfer
Which QoS forwarding per-hop behavior changes a specific value in a packet header to set the class of service for the packet?
shaping
classification
policing
marking
Refer to the exhibit. How should the configuration be updated to allow PC1 and PC2 access to the Internet?
Modify the configured number of the second access list
Change the ip nat inside source command to use interface GigabitEthernet0/0
Remove the overload keyword from the ip nat inside source command
Add either the ip nat {inside|outside} command under both interfaces
What is the purpose of the ip address dhcp command?
to configure an interface as a DHCP relay
to configure an interface as a DHCP client
to configure an interface as a DHCP helper
to configure an interface as a DHCP server
Refer to the exhibit. Which configuration enables DHCP addressing for hosts connected to interface FastEthernet0/1 on router R4?
interface FastEthernet0/1 ip helper-address 10.0.1.1 ! access-list 100 permit tcp host 10.0.1.1 eq 67 host 10.148.2.1
interface FastEthernet0/0 ip helper-address 10.0.1.1 ! access-list 100 permit udp host 10.0.1.1 eq bootps host 10.148.2.1
interface FastEthernet0/0 ip helper-address 10.0.1.1 ! access-list 100 permit host 10.0.1.1 host 10.148.2.1 eq bootps
interface FastEthernet0/1 ip helper-address 10.0.1.1 ! access-list 100 permit udp host 10.0.1.1 eq bootps host 10.148.2.1
An engineer is configuring SSH version 2 exclusively on the R1 router. What is the minimum configuration required to permit remote management
using the cryptographic protocol?
hostname R1 service password-encryption crypto key generate rsa general-keys modulus 1024 username cisco privilege 15 password 0
cisco123 ip ssh version 2 line vty 0 15 transport input ssh login local
hostname R1 ip domain name cisco crypto key generate rsa general-keys modulus 1024 username cisco privilege 15 password 0 cisco123
ip ssh version 2 line vty 0 15 transport input ssh login local
hostname R1 crypto key generate rsa general-keys modulus 1024 username cisco privilege 15 password 0 cisco123 ip ssh version 2 line vty
0 15 transport input ssh login local
hostname R1 ip domain name cisco crypto key generate rsa general-keys modulus 1024 username cisco privilege 15 password 0 cisco123
ip ssh version 2 line vty 0 15 transport input all login local
Which per-hop traffic-control feature does an ISP implement to mitigate the potential negative effects of a customer exceeding its committed
bandwidth?
policing
queuing
marking
shaping
Which remote access protocol provides unsecured remote CLI access?
console
telnet
ssh
bash
Refer to the exhibit. Which router or router group are NTP clients?
R1
R2 and R3
R1, R3, and R4
R1, R2, and R3
Refer to the exhibit. What is the next step to complete the implementation for the partial NAT configuration shown?
Modify the access list for the internal network on e0/1
Reconfigure the static NAT entries that overlap the NAT pool.
Apply the ACL to the pool configuration.
Configure the NAT outside interface.
What is a syslog facility?
host that is configured for the system to send log messages
password that authenticates a Network Management System to receive log messages
group of log messages associated with the configured severity level
set of values that represent the processes that can generate a log message
Refer to the exhibit. A newly configured PC fails to connect to the internet by using TCP port 80 to www.cisco.com. Which setting must be
modified for the connection to work?
Subnet Mask
DNS Servers
Default Gateway
DHCP Servers
Which QoS queuing method discards or marks packets that exceed the desired bit rate of traffic flow?
CBWFQ
policing
LLQ
shaping
Which QoS per-hop behavior changes the value of the ToS field in the IPv4 packet header?
shaping
policing
classification
marking
What is the function of FTP?
Always operated without user connection validation
Uses block number to identify and mitigate data-transfer errors
Relies on the well-known UDO port 69 for data transfer
Uses two separate connections for control and data traffic
How does TFTP operate in a network?
Provides secure data transfer
Relies on the well-known TCP port 20 to transmit data
Uses block numbers to identify and mitigate data-transfer errors
Requires two separate connections for control and data traffic
Refer to the exhibit. Which plan must be implemented to ensure optimal QoS marking practices on this network?
Trust the IP phone markings on SW1 and mark traffic entering SW2 at SW2
As traffic traverses MLS1 remark the traffic, but trust all markings at the access layer
Remark traffic as it traverses R1 and trust all markings at the access layer.
As traffic enters from the access layer on SW1 and SW2, trust all traffic markings.
How does QoS optimize voice traffic?
by reducing bandwidth usage
by reducing packet loss
by differentiating voice and video traffic
by increasing jitter
Which QoS tool can you use to optimize voice traffic on a network that is primarily intended for data traffic?
WRED
FIFO
PQ
WFQ
Refer to the exhibit. Users on existing VLAN 100 can reach sites on the Internet. Which action must the administrator take to establish
connectivity to the Internet for users in VLAN 200?
Define a NAT pool on the router.
Configure the ip nat outside command on another interface for VLAN 200
Configure static NAT translations for VLAN 200.
Update the NAT_INSIDE_RANGES ACL.
An organization secures its network with multi-factor authentication using an authenticator app on employee smartphones. How is the application
secured in the case of a user's smartphone being lost or stolen?
The application requires the user to enter a PIN before it provides the second factor
The application requires an administrator password to reactivate after a configured interval
The application verifies that the user is in a specific location before it provides the second factor
The application challenges a user by requiring an administrator password to reactivate when the smartphone is rebooted
Which device performs stateful inspection of traffic?
switch
firewall
access point
wireless controller
A network administrator enabled port security on a switch interface connected to a printer. What is the next configuration action in order to allow
the port to learn the MAC address of the printer and insert it into the table automatically?
enable dynamic MAC address learning
implement static MAC addressing
enable sticky MAC addressing
implement auto MAC address learning
Refer to the exhibit. An engineer booted a new switch and applied this configuration via the console port. Which additional configuration must be
applied to allow administrators to authenticate directly to enable privilege mode via Telnet using a local username and password?
R1(config)#username admin R1(config-if)#line vty 0 4 R1(config-line)#password p@ss1234 R1(config-line)#transport input telnet
R1(config)#username admin privilege 15 secret p@ss1234 R1(config-if)#line vty 0 4 R1(config-line)#login local
R1(config)#username admin secret p@ss1234 R1(config-if)#line vty 0 4 R1(config-line)#login local R1(config)#enable secret p@ss1234
R1(config)#username admin R1(config-if)#line vty 0 4 R1(config-line)#password p@ss1234
Which effect does the aaa new-model configuration command have?
It enables AAA services on the device.
It configures the device to connect to a RADIUS server for AAA.
It associates a RADIUS server to the group.
It configures a local user on the device.
Refer to the exhibit. Which two events occur on the interface, if packets from an unknown Source address arrive after the interface learns the
maximum number of secure MAC address? (Choose two.)
The security violation counter dose not increment
The port LED turns off
The interface is error-disabled
A syslog message is generated
The interface drops traffic from unknown MAC address
Which technology must be implemented to configure network device monitoring with the highest security?
IP SLA
syslog
NetFlow
SNMPv3
Refer to the exhibit. Which two statements about the interface that generated the output are true? (Choose two.)
learned MAC addresses are deleted after five minutes of inactivity
the interface is error-disabled if packets arrive from a new unknown source address
it has dynamically learned two secure MAC addresses
it has dynamically learned three secure MAC addresses
the security violation counter increments if packets arrive from a new unknown source address
Refer to the exhibit. Which statement about the interface that generated the output is true?
A syslog message is generated when a violation occurs.
One secure MAC address is manually configured on the interface.
One secure MAC address is dynamically learned on the interface.
Five secure MAC addresses are dynamically learned on the interface.
An engineer is asked to protect unused ports that are configured in the default VLAN on a switch. Which two steps will fulfill the request? (Choose
two.)
Configure the ports as trunk ports.
Enable the Cisco Discovery Protocol.
Configure the port type as access and place in VLAN 99.
Administratively shut down the ports.
Configure the ports in an EtherChannel
Which configuration is needed to generate an RSA key for SSH on a router?
Configure VTY access.
Configure the version of SSH.
Assign a DNS domain name.
Create a user with a password
Refer to the exhibit. Which configuration for RTR-1 denies SSH access from PC-1 to any RTR-1 interface and allows all other traffic?
The service password-encryption command is entered on a router. What is the effect of this configuration?
restricts unauthorized users from viewing clear-text passwords in the running configuration
prevents network administrators from configuring clear-text passwords
protects the VLAN database from unauthorized PC connections on the switch
encrypts the password exchange when a VPN tunnel is established
Refer to the exhibit. If the network environment is operating normally, which type of device must be connected to interface fastethernet 0/1?
DHCP client
access point
router
PC
Refer to the exhibit. An administrator configures four switches for local authentication using passwords that are stored as a cryptographic hash.
The four switches must also support SSH access for administrators to manage the network infrastructure. Which switch is configured correctly to
meet these requirements?
1
2
3
4
Refer to the exhibit. What is the effect of this configuration?
The switch discards all ingress ARP traffic with invalid MAC-to-IP address bindings.
All ARP packets are dropped by the switch.
Egress traffic is passed only if the destination is a DHCP server.
All ingress and egress traffic is dropped because the interface is untrusted.
Which type of wireless encryption is used for WPA2 in preshared key mode?
AES-128
TKIP with RC4
AES-256
RC4
Refer to the exhibit. A network engineer must block access for all computers on VLAN 20 to the web server via HTTP. All other computers must be
able to access the web server. Which configuration when applied to switch A accomplishes the task?
In which two ways does a password manager reduce the chance of a hacker stealing a user's password? (Choose two.)
It encourages users to create stronger passwords
It uses an internal firewall to protect the password repository from unauthorized access
It stores the password repository on the local workstation with built-in antivirus and anti-malware functionality
It automatically provides a second authentication factor that is unknown to the original user
It protects against keystroke logging on a compromised device or web site
Which goal is achieved by the implementation of private IPv4 addressing on a network?
provides an added level of protection against Internet exposure
provides a reduction in size of the forwarding table on network routers
allows communication across the Internet to other private networks
allows servers and workstations to communicate across public network boundaries
Which type of attack is mitigated by dynamic ARP inspection?
DDoS
malware
man-in-the-middle
worm
What is a function of a remote access VPN?
establishes a secure tunnel between two branch sites
uses cryptographic tunneling to protect the privacy of data for multiple users simultaneously
used exclusively when a user is connected to a company's internal network
allows the users to access company internal network resources through a secure tunnel
What are two recommendations for protecting network ports from being exploited when located in an office space outside of an IT closet?
(Choose two.)
enable the PortFast feature on ports
configure static ARP entries
configure ports to a fixed speed
implement port-based authentication
shut down unused ports
Refer to the exhibit. A network administrator must permit SSH access to remotely manage routers in a network. The operations team resides on
the 10.20.1.0/25 network. Which command will accomplish this task?
access-list 2699 permit udp 10.20.1.0 0.0.0.255
no access-list 2699 deny tcp any 10.20.1.0 0.0.0.127 eq 22
access-list 2699 permit tcp any 10.20.1.0 0.0.0.255 eq 22
no access-list 2699 deny ip any 10.20.1.0 0.0.0.255
A port security violation has occurred on a switch port due to the maximum MAC address count being exceeded. Which command must be
configured to increment the security-violation count and forward an SNMP trap?
switchport port-security violation access
switchport port-security violation protect
switchport port-security violation restrict
switchport port-security violation shutdown
What is a practice that protects a network from VLAN hopping attacks?
Enable dynamic ARP inspection
Configure an ACL to prevent traffic from changing VLANs
Change native VLAN to an unused VLAN ID
Implement port security on internet-facing VLANs
Where does a switch maintain DHCP snooping information?
In the CAM table
In the frame forwarding database
In the MAC address table
In the binding database
A network administrator must configure SSH for remote access to router R1. The requirement is to use a public and private key pair to encrypt
management traffic to and from the connecting client. Which configuration, when applied, meets the requirements?
R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate ec keysize 1024
R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate ec keysize 2048
R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key encrypt rsa name myKey
R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate rsa modulus 1024
When a WLAN with WPA2 PSK is configured in the Wireless LAN Controller GUI, which format is supported?
decimal
ASCII
unicode
base64
Refer to the exhibit. A network administrator has been tasked with securing VTY access to a router. Which access-list entry accomplishes this
task?
access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq telnet
access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq scp
access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq https
access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255 eq ssh
Which two protocols must be disabled to increase security for management connections to a Wireless LAN Controller? (Choose two.)
https
ssh
http
telnet
tftp
Which security program element involves installing badge readers on data-center doors to allow workers to enter and exit based on their job roles?
physical access control
biometrics
role-based access control
multifactor authentication
Which function is performed by DHCP snooping?
listens to multicast traffic for packet forwarding
rate-limits certain traffic
propagates VLAN information between switches
provides DDoS mitigation
Which protocol is used for secure remote CLI access?
telnet
http
https
ssh
Which implementation provides the strongest encryption combination for the wireless environment?
WEP
WPA + TKIP
WPA + AES
WPA2 + AES
What does physical access control regulate?
access to networking equipment and facilities
access to servers to prevent malicious activity
access to specific networks based on business function
access to computer networks and file systems
A network engineer is asked to configure VLANS 2, 3, and 4 for a new implementation. Some ports must be assigned to the new VLANS with
unused ports remaining. Which action should be taken for the unused ports?
configure in a nondefault native VLAN
configure ports in the native VLAN
configure ports in a black hole VLAN
configure ports as access ports
When a WPA2-PSK WLAN is configured in the Wireless LAN Controller, what is the minimum number of characters that is required in ASCII format?
6
8
12
18
What mechanism carries multicast traffic between remote sites and supports encryption?
ISATAP
IPsec over ISATAP
GRE
GRE over IPsec
Refer to the exhibit. An access-list is required to permit traffic from any host on interface Gi0/0 and deny traffic from interface Gi0/1. Which
access list must be applied?
ip access-list standard 99 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.0.255.255
ip access-list standard 99 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.255.255.255
ip access-list standard 199 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.255.255.255
ip access-list standard 199 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.0.255.255
Refer to the exhibit. Which two commands must be configured on router R1 to enable the router to accept secure remote-access connections?
(Choose two.)
ip ssh pubkey-chain
username cisco password 0 cisco
crypto key generate rsa
transport input telnet
login console
Which service is missing when RADIUS is selected to provide management access to the WLC?
authorization
authentication
accounting
confidentiality
Which action implements physical access control as part of the security program of an organization?
setting up IP cameras to monitor key infrastructure
configuring a password for the console port
backing up syslogs at a remote location
configuring enable passwords on network devices
Which field within the access-request packet is encrypted by RADIUS?
authorized services
password
authenticator
username
A Cisco engineer is configuring a factory-default router with these three passwords:
✑ The user EXEC password for console access is p4ssw0rd1.
✑ The user EXEC password for Telnet access is s3cr3t2.
✑ The password for privileged EXEC mode is priv4t3p4ss.
Which command sequence must the engineer configure?
enable secret priv4t3p4ss ! line con 0 password p4ssw0rd1 ! line vty 0 15 password s3cr3t2
enable secret priv4t3p4ss ! line con 0 password p4ssw0rd1 login ! line vty 0 15 password s3cr3t2 login
enable secret priv4t3p4ss ! line con 0 password login p4ssw0rd1 ! line vty 0 15 password login s3cr3t2 login
enable secret privilege 15 priv4t3p4ss ! line con 0 password p4ssw0rd1 login ! line vty 0 15 password s3cr3t2 login
What is a function of Opportunistic Wireless Encryption in an environment?
provide authentication
protect traffic on open networks
offer compression
increase security by using a WEP connection
Refer to the exhibit. Clients on the WLAN are required to use 802.11r. What action must be taken to meet the requirement?
Under Protected Management Frames, set the PMF option to Required.
Enable CCKM under Authentication Key Management.
Set the Fast Transition option and the WPA gtk-randomize State to disable.
Set the Fast Transition option to Enable and enable FT 802.1X under Authentication Key Management.
Refer to the exhibit. What must be configured to enable 802.11w on the WLAN?
Set Fast Transition to Enabled.
Enable WPA Policy.
Set PMF to Required.
Enable MAC Filtering.
Which type of traffic is sent with pure IPsec?
multicast traffic from a server at one site to hosts at another location
broadcast packets from a switch that is attempting to locate a MAC address at one of several remote sites
unicast messages from a host at a remote site to a server at headquarters
spanning-tree updates between switches that are at two different sites
How does authentication differ from authorization?
Authentication is used to record what resource a user accesses, and authorization is used to determine what resources a user can access.
Authentication verifies the identity of a person accessing a network, and authorization determines what resource a user can access.
Authentication is used to determine what resources a user is allowed to access, and authorization is used to track what equipment is
allowed access to the network.
Authentication is used to verify a person's identity, and authorization is used to create syslog messages for logins.
An engineer has configured the domain name, user name, and password on the local router. What is the next step to complete the configuration
for a Secure Shell access RSA key?
crypto key import rsa pem
crypto key generate rsa
crypto key zeroize rsa
crypto key pubkey-chain rsa
Which type if network attack overwhelms the target server by sending multiple packets to a port until the half-open TCP resources of the target are
exhausted?
SYN flood
reflection
teardrop
amplification
Which two components comprise part of a PKI? (Choose two.)
preshared key that authenticates connections
one or more CRLs
RSA token
CA that grants certificates
clear-text password that authenticates connections
After a recent security breach and a RADIUS failure, an engineer must secure the console port of each enterprise router with a local username and
password.
Which configuration must the engineer apply to accomplish this task?
aaa new-model line con 0 password plaintextpassword privilege level 15
aaa new-model aaa authorization exec default local aaa authentication login default radius username localuser privilege 15 secret
plaintextpassword
username localuser secret plaintextpassword line con 0 no login local privilege level 15
username localuser secret plaintextpassword line con 0 login authentication default privilege level 15
Which wireless security protocol relies on Perfect Forward Secrecy?
WEP
WPA2
WPA
WPA3
What is a zero-day exploit?
It is when the network is saturated with malicious traffic that overloads resources and bandwidth.
It is when an attacker inserts malicious code into a SQL server.
It is when a new network vulnerability is discovered before a fix is available.
It is when the perpetrator inserts itself in a conversation between two parties and captures or alters data.
A network engineer is replacing the switches that belong to a managed-services client with new Cisco Catalyst switches. The new switches will be
configured for updated security standards including replacing.
Telnet services with encrypted connections and doubling the modulus size from 1024. Which two commands must the engineer configure on the
new switches?
(Choose two.)
transport input ssh
transport input all
crypto key generate rsa modulus 2048
crypto key generate rsa general-keys modulus 1024
crypto key generate rsa usage-keys
What are two examples of multifactor authentication? (Choose two.)
single sign-on
soft tokens
passwords that expire
shared password repository
unique user knowledge
Which characteristic differentiates the concept of authentication from authorization and accounting?
consumption-based billing
identity verification
user-activity logging
service limitations
What is a function of Cisco Advanced Malware Protection for a Next-Generation IPS?
inspecting specific files and file types for malware
authorizing potentially compromised wireless traffic
authenticating end users
URL filtering
What is a feature of WPA?
TKIP/MIC encryption
small Wi-Fi application
preshared key
802.1x authentication
Which two practices are recommended for an acceptable security posture in a network? (Choose two.)
Use a cryptographic keychain to authenticate to network devices.
Place internal email and file servers in a designated DMZ.
Back up device configurations to encrypted USB drives for secure retrieval.
Disable unused or unnecessary ports, interfaces, and services.
Maintain network equipment in a secure location.
How does WPA3 improve security?
It uses SAE for authentication.
It uses RC4 for encryption
It uses TKIP for encryption.
It uses a 4-way handshake for authentication.
What is a function of a Next-Generation IPS?
correlates user activity with network events
serves as a controller within a controller-based network
integrates with a RADIUS server to enforce Layer 2 device authentication rules
makes forwarding decisions based on learned MAC addresses
Which IPsec transport mode encrypts the IP header and the payload?
pipe
transport
control
tunnel
What is the default port-security behavior on a trunk link?
It places the port in the err-disabled state if it learns more than one MAC address.
It causes a network loop when a violation occurs.
It disables the native VLAN configuration as soon as port security is enabled.
It places the port in the err-disabled state after 10 MAC addresses are statically configured.
Which device separates networks by security domains?
intrusion protection system
firewall
wireless controller
access point
How are VLAN hopping attacks mitigated?
manually implement trunk ports and disable DTP
configure extended VLANs
activate all ports and place in the default VLAN
enable dynamic ARP inspection
Which enhancements were implemented as part of WPA3?
Forward secrecy and SAE in personal mode for secure initial key exchange
802.1x authentication and AES-128 encryption
AES-64 in personal mode and AES-128 in enterprise mode
TKIP encryption improving WEP and per-packet keying
When a site-to-site VPN is configured which IPsec mode provides encapsulation and encryption of the entire original IP packet?
IPsec transport mode with AH
IPsec tunnel mode with AH
IPsec transport mode with ESP
IPsec tunnel mode with ESP
An engineer is configuring remote access to a router from IP subnet 10.139.58.0/28. The domain name, crypto keys, and SSH have been
configured. Which configuration enables the traffic on the destination router?
line vty 0 15 access-class 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22
interface FastEthernet0/0 ip address 10.122.49.1 255.255.255.252 ip access-group 10 in ! ip access-list standard 10 permit udp
10.139.58.0 0.0.0.7 host 10.122.49.1 eq 22
interface FastEthernet0/0 ip address 10.122.49.1 255.255.255.252 ip access-group 110 in ! ip access-list standard 110 permit tcp
10.139.58.0 0.0.0.15 eq 22 host 10.122.49.1
line vty 0 15 access-group 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22
In an SDN architecture, which function of a network node is centralized on a controller?
Creates the IP routing table
Discards a message due filtering
Makes a routing decision
Provides protocol access for remote access devices
Refer to the exhibit. What are the two steps an engineer must take to provide the highest encryption and authentication using domain credentials
from LDAP?
(Choose two.)
Select PSK under Authentication Key Management.
Select Static-WEP + 802.1X on Layer 2 Security.
Select WPA+WPA2 on Layer 2 Security
Select 802.1X from under Authentication Key Management.
Select WPA Policy with TKIP Encryption.
Which enhancement is implemented in WPA3?
employs PKI to identify access points
applies 802.1x authentication
uses TKIP
protects against brute force attacks
SW1 supports connectivity for a lobby conference room and must be secured. The engineer must limit the connectivity from PC1 to the SW1 and
SW2 network.
The MAC addresses allowed must be limited to two. Which configuration secures the conference room connectivity?
interface gi1/0/15 switchport port-security switchport port-security maximum 2
interface gi1/0/15 switchport port-security switchport port-security mac-address 0000.abcd.0004vlan 100
interface gi1/0/15 switchport port-security mac-address 0000.abcd.0004 vlan 100
interface gi1/0/15 switchport port-security mac-address 0000.abcd.0004 vlan 100 interface switchport secure-mac limit 2
Refer to the exhibit. An engineer is updating the management access configuration of switch SW1 to allow secured, encrypted remote
configuration. Which two commands or command sequences must the engineer apply to the switch? (Choose two.)
SW1(config)#enable secret ccnaTest123
SW1(config)#username NEW secret R3mote123
SW1(config)#line vty 0 15 SW1(config-line)#transport input ssh
SW1(config)# crypto key generate rsa
SW1(config)# interface f0/1 SW1(confif-if)# switchport mode trunk
Which port security violation mode allows from valid MAC addresses to pass but blocks traffic from invalid MAC addresses?
restrict
shutdown
protect
shutdown VLAN
