WorksheetsModule 5-7
Total questions: 38
Worksheet time: 19mins
What must be done before any role-based CLI views can be created?
Assign multiple privilege levels.
Configure usernames and passwords.
Issue the aaa new-model command.
Create the secret password for the root user.
Which three statements describe limitations in using privilege levels for assigning command authorization? (Choose three.)
The root user must be assigned to each privilege level that is defined.
Commands set on a higher privilege level are not available for lower privilege users.
Creating a user account that needs access to most but not all commands can be a tedious process.
There is no access control to specific interfaces on a router.
It is required that all 16 privilege levels be defined, whether they are used or not.
Which two router commands can a user issue when granted privilege level 0? (Choose two.)
ping
disable
help
configure
show
What does level 5 in the following enable secret global configuration mode command indicate? Router(config)# enable secret level 5 csc5io
The enable secret password can only be set by individuals with privileges for EXEC level 5.
The enable secret password is hashed using SHA.
The enable secret password is hashed using MD5.
The enable secret password grants access to privileged EXEC level 5.
What are three network enhancements achieved by implementing the Cisco IOS software role-based CLI access feature? (Choose three.)
operational efficiency
fault tolerance
cost reduction
security
availability
A network administrator wants to create a new view so that a user only has access to certain configuration commands. In role-based CLI, which view should the administrator use to create the new view?
superview
admin view
CLI view
root view
A network administrator enters the command R1# enable view adminview. What is the purpose of this command?
to enter a superview named adminview
to enter a CLI view named adminview
to create a CLI view named adminview
to enter the root view
Which range of custom privilege levels can be configured on Cisco routers?
0 through 15
2 through 14
1 through 15
2 through 15
1 through 16
Which command will move the show interface command to privilege level 10?
router(config)# show interface level 10
router(config)# privilege exec level 10 show interface
router(config-if)# privilege exec level 10 show interface
router(config-if)# show interface level 10
router(config)# privilege level 10 show interface
What is the default privilege level of user accounts created on Cisco routers?
0
15
1
16
An administrator assigned a level of router access to the user ADMIN using the commands below. Router(config)# privilege exec level 14 show ip route Router(config)# enable algorithm-type scrypt secret level 14 cisco-level-10 Router(config)# username ADMIN privilege 14 algorithm-type scrypt secret cisco-level-10 Which two actions are permitted to the user ADMIN? (Choose two.)
The user can issue the show version command.
The user can only execute the subcommands under the show ip route command.
The user can issue the ip route command.
The user can issue all commands because this privilege level can execute all Cisco IOS commands.
The user can execute all subcommands under the show ip interfaces command.
What service or protocol does the Secure Copy Protocol rely on to ensure that secure copy transfers are from authorized users?
AAA
RADIUS
IPsec
SNMP
When password recovery on a router is being performed and the settings in NVRAM have been bypassed, which step should be taken next?
Copy the contents of RAM to the NVRAM.
Copy the contents of NVRAM to the RAM.
Reload the router.
Reset the router.
Which protocol or service is used to automatically synchronize the software clocks on Cisco routers?
DHCP
NTP
DNS
SNMP
A network engineer wants to synchronize the time of a router with an NTP server at the IPv4 address 209.165.200.225. The exit interface of the router is configured with an IPv4 address of 192.168.212.11. Which global configuration command should be used to configure the NTP server as the time source for this router?
ntp peer 192.168.212.11
ntp peer 209.165.200.225
ntp server 209.165.200.225
ntp server 192.168.212.11
What are three functions provided by the syslog service? (Choose three.)
to select the type of logging information that is captured
to specify the destinations of captured messages
to gather logging information for monitoring and troubleshooting
to periodically poll agents for data
to provide statistics on packets that are flowing through a Cisco device
Which service should be disabled on a router to prevent a malicious host from falsely responding to ARP requests with the intent to redirect the Ethernet frames?
LLDP
reverse ARP
CDP
proxy ARP
What is the purpose of issuing the ip ospf message-digest-key key md5 password command and the area area-id authentication message-digest command on a router?
to enable OSPF MD5 authentication on a per-interface basis
to configure OSPF MD5 authentication globally on the router
to encrypt OSPF routing updates
to facilitate the establishment of neighbor adjacencies
Which service is enabled on a Cisco router by default that can reveal significant information about the router and potentially make it more vulnerable to attack?
FTP
LLDP
CDP
HTTP
Which statement describes SNMP operation?
An SNMP agent that resides on a managed device collects information about the device and stores that information remotely in the MIB that is located on the NMS.
A get request is used by the SNMP agent to query the device for data.
An NMS periodically polls the SNMP agents that are residing on managed devices by using traps to query the devices for data.
A set request is used by the NMS to change configuration variables in the agent device.
When SNMPv1 or SNMPv2 is being used, which feature provides secure access to MIB objects?
message integrity
packet encryption
source validation
community strings
What are two reasons to enable OSPF routing protocol authentication on a network? (Choose two.)
to prevent data traffic from being redirected and then discarded
to ensure faster network convergence
to provide data security through encryption
to prevent redirection of data traffic to an insecure link
to ensure more efficient routing
What are SNMP trap messages?
unsolicited messages that are sent by the SNMP agent and alert the NMS to a condition on the network
messages that are used by the NMS to change configuration variables in the agent device
messages that are used by the NMS to query the device for data
messages that are sent periodically by the NMS to the SNMP agents that reside on managed devices to query the device for data
Which technology allows syslog messages to be filtered to different devices based on event importance?
syslog severity levels
syslog service timestamps
syslog service identifiers
syslog facilities
What is a characteristic of the Cisco IOS Resilient Configuration feature?
It maintains a secure working copy of the bootstrap startup program.
Once issued, the secure boot-config command automatically upgrades the configuration archive to a newer version after new configuration commands have been entered.
The secure boot-image command works properly when the system is configured to run an image from a TFTP server.
A snapshot of the router running configuration can be taken and securely archived in persistent storage.
What is a feature of the TACACS+ protocol?
It combines authentication and authorization as one process.
It encrypts the entire body of the packet for more secure communications.
It hides passwords during transmission using PAP and sends the rest of the packet in plaintext.
It utilizes UDP to provide more efficient packet transfer.
Which two protocols are used to provide server-based AAA authentication? (Choose two.)
SSH
SNMP
TACACS+
802.1x
RADIUS
Which functionality does the TACACS single-connection keyword provide to AAA services?
allows the use of differing keys between the TACACS+ server and the AAA client
enhances the performance of the TCP connection
maintains a single UDP connection for the life of the session
encrypts the data transfer between the TACACS+ server and the AAA client
What are three access control security services? (Choose three.)
authorization
accounting
access
authentication
repudiation
What is the purpose of the network security accounting function?
to keep track of the actions of a user
to provide challenge and response questions
to require users to prove who they are
to determine which resources a user can access
What does the TACACS+ protocol provide in a AAA deployment?
AAA connectivity via UDP
authorization on a per-user or per-group basis
password encryption without encrypting the packet
compatibility with previous TACACS protocols
Which term describes the ability of a web server to keep a log of the users who access the server, as well as the length of time they use it?
accounting
authentication
assigning permissions
authorization
What is the first required task when configuring server-based AAA authentication?
Configure the IP address of the server.
Specify the type of server providing the authentication.
Configure the type of AAA authentication.
Enable AAA globally.
What is a characteristic of AAA accounting?
Accounting can only be enabled for network connections.
Users are not required to be authenticated before AAA accounting logs their activities on the network.
Accounting is concerned with allowing and disallowing authenticated users access to certain areas and programs on the network.
Possible triggers for the aaa accounting exec default command include start-stop and stop-only.
When a method list for AAA authentication is being configured, what is the effect of the keyword local?
It uses the enable password for authentication.
It defaults to the vty line password for authentication.
The login succeeds, even if all methods return an error.
It accepts a locally configured username, regardless of case.
Which statement describes a difference between RADIUS and TACACS+?
RADIUS separates authentication and authorization whereas TACACS+ combines them as one process.
RADIUS uses TCP whereas TACACS+ uses UDP.
RADIUS encrypts only the password whereas TACACS+ encrypts all communication.
RADIUS is supported by the Cisco Secure ACS software whereas TACACS+ is not.
A user complains about not being able to gain access to a network device configured with AAA. How would the network administrator determine if login access for the user account is disabled?
Use the show aaa user command.
Use the show running-configuration command.
Use the show aaa sessions command.
Use the show aaa local user lockout command.
Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?
authorization
authentication
accounting
auditing
