Font size
Worksheetsnetwork 4
Total questions: 103
Worksheet time: 52hrs 30mins
Which type of wireless encryption is used for WPA2 in preshared key
mode?
A. AES-128
B. TKIP with RC4
C. AES-256
RC4
What is used to identify spurious DHCP servers?
A. DHCPACK
B. DHCPREQUEST
C. DHCPOFFER
D. DHCPDISCOVER
Which command prevents passwords from being stored in the
configuration as plain text on a router or switch?
A. enable secret
enable password
C. service password-encryption
D. username cisco password encrypt
config t
ip access-list extended wwwblock
permit ip any any
deny tcp any host 10.30.0.100 eq 80
int vlan 20
ip access-group wwwblock in
config t
ip access-list extended wwwblock
permit ip any any
deny tcp any host 10.30.0.100 eq 80
int vlan 30
ip access-group wwwblock in
config t
ip access-list extended wwwblock
deny tcp any host 10.30.0.100 eq 80
int vlan 10
ip access-group wwwblock in
config t
ip access-list extended wwwblock
deny top any host 10.30.0.100 eq 80
permit ip any any
int vlan 20
ip access-group wwwblock in
In which two ways does a password manager reduce the chance of a
hacker stealing a user's password? (Choose two.)
A. It encourages users to create stronger passwords
It uses an internal firewall to protect the password repository
from unauthorized access
It stores the password repository on the local workstation
with built-in antivirus and anti-malware functionality
It automatically provides a second authentication factor that
is unknown to the original user
It protects against keystroke logging on a compromised
device or web site
Which goal is achieved by the implementation of private IPv4 addressing
on a network?
provides an added level of protection against Internet
exposure
provides a reduction in size of the forwarding table on
network routers
allows communication across the Internet to other private
networks
allows servers and workstations to communicate across
public network boundaries
Which type of attack is mitigated by dynamic ARP inspection?
A. DDoS
malware
man-in-the-middle
worm
What is a function of a remote access VPN?
A. establishes a secure tunnel between two branch sites
uses cryptographic tunneling to protect the privacy of data
for multiple users simultaneously
used exclusively when a user is connected to a company's
internal network
allows the users to access company internal network
resources through a secure tunnel
What are two recommendations for protecting network ports from being
exploited when located in an office space outside of an IT closet?
(Choose two.)
configure static ARP entries
configure ports to a fixed speed
D. implement port-based authentication
shut down unused ports
enable the PortFast feature on ports
A. access-list 2699 permit udp 10.20.1.0 0.0.0.255
B. no access-list 2699 deny tep any 10.20.1.0 0.0.0.127 eq 22
C. access-list 2699 permit tep any 10.20.1.0 0.0.0.255 eq 22
D. no access-list 2699 deny ip any 10.20.1.0 0.0.0.255
A port security violation has occurred on a switch port due to the
maximum MAC address count being exceeded. Which command must be
configured to increment the security-violation count and forward an
SNMP trap?
switchport port-security violation access
switchport port-security violation protect
C. switchport port-security violation restrict
D. switchport port-security violation shutdown
What is a practice that protects a network from VLAN hopping attacks?
Enable dynamic ARP inspection
Configure an ACL to prevent traffic from changing VLANs
C. Change native VLAN to an unused VLAN
D. Implement port security on internet-facing VLANs
Where does a switch maintain DHCP snooping information?
In the CAM table
In the frame forwarding database
In the MAC address table
In the binding database
A network administrator must configure SSH for remote access to router
R1. The requirement is to use a public and private key pair to encrypt
management traffic to and from the connecting client. Which
configuration, when applied, meets the requirements?
R1#enable
R1#configure terminal
R1(config)#ip domain-name cisco.com
R1(config)#crypto key generate ec keysize 1024
R1#enable
R1#configure terminal
R1(config)#ip domain-name cisco.com
Rl(config)#crypto key generate ec keysize 2048
R1#enable
R1#configure terminal
R1(config)#ip domain-name cisco.com
R1(config)#crypto key encrypt rsa name myKey
R1#enable
R1#configure terminal
R1(config)#ip domain-name cisco.com
R1(config)#crypto key generate rsa modulus 1024
When a WLAN with WPA2 PSK is configured in the Wireless LAN
Controller GUI, which format is supported?
A. decimal
ASCII
unicode
base64
access-list 101 permit tep 10.1.1.0 0.0.0.255 172.16.1.0
0.0.0.255 eq telnet
access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0
0.0.0.255 eq sep
access-list 101 permit tep 10.1.1.0 0.0.0.255 172.16.1.0
0.0.0.255 eq https
access-list 101 permit tep 10.1.1.0 0.0.0.255 172.16.1.0
0.0.0.255 eq ssh
Which two protocols must be disabled to increase security for
management connections to a Wireless LAN Controller? (Choose two.)
HTTPS
B. SSH
HTTP
Telnet
TFTP
Which security program element involves installing badge readers on
data-center doors to allow workers to enter and exit based on their job
roles?
physical access control
biometrics
role-based access control
multifactor authentication
Which function is performed by DHCP snooping?
listens to multicast traffic for packet forwarding
B. rate-limits certain traffic
propagates VLAN information between switches
provides DDoS mitigation
Which protocol is used for secure remote CLI access?
Telnet
HTTP
C. HTTPS
SSH
Which implementation provides the strongest encryption combination for
the wireless environment?
A. WEP
WPA+ TKIP
C. WPA + AES
WPA2+ AES
What does physical access control regulate?
access to networking equipment and facilities
access to servers to prevent malicious activity
access to specific networks based on business function
access to computer networks and file systems
A network administrator is asked to configure VLANS 2, 3, and 4 for a
new implementation. Some ports must be assigned to the new VLANS
with unused ports remaining. Which action should be taken for the
unused ports?
configure in a nondefault native VLAN
configure ports in the native VLAN
C. configure ports in a black hole VLAN
configure ports as access ports
When a WPA2-PSK WLAN is configured in the Wireless LAN
Controller, what is the minimum number of characters that is required in
ASCII format?
A. 6
B. 8
12
18
A. ISATAP
A. ISATAP
IPsec over ISATAP
C. GRE
D. GRE over IPsec
ip access-list standard 99
permit 10.100.100.0 0.0.0.255
deny 192.168.0.0 0.0.255.255
B.
ip access-list standard 99
permit 10.100.100.0 0.0.0.255
deny 192.168.0.0 0.255.255.255
ip access-list standard 199
permit 10.100.100.0 0.0.0.255
deny 192.168.0.0 0.255.255.255
ip access-list standard 199
permit 10.100.100.0 0.0.0.255
deny 192.168.0.0 0.0.255.255
A. ip ssh pubkey-chain
B. username cisco password 0 cisco
C. crypto key generate rsa
D. transport input telnet
E. login console
Which service is missing when RADIUS is selected to provide
management access to the WLC?
authorization
authentication
C. accounting
confidentiality
Which action implements physical access control as part of the security
program of an organization?
setting up IP cameras to monitor key infrastructure
B. configuring a password for the console port
backing up syslogs at a remote location
configuring enable passwords on network devices
Which field within the access-request packet is encrypted by RADIUS?
authorized services
password
C. authenticator
username
A Cisco engineer is configuring a factory-default router with these three
passwords:
. The user EXEC password for console access is p4ssw0rd1.
. The user EXEC password for Telnet access is s3cr3t2.
. The password for privileged EXEC mode is priv4t3p4ss.
Which command sequence must the engineer configure?
enable secret priv4t3p4ss
!
line con 0
password p4ssw0rd1
!
line vty 0 15
password s3cr3t2
enable secret priv4t3p4ss
!
line con 0
password p4ssw0rd1
login
!
line vty 0 15
password s3cr3t2
login
C.
enable secret priv4t3p4ss
!
line con 0
password login p4ssw0rd1
!
line vty 0 15
password login s3cr3t2
login
enable secret privilege 15 priv4t3p4ss
!
line con 0
password p4ssw0rd1
login
!
line vty 0 15
password s3cr3t2
login
Add the access-list 10 permit any command to the
configuration.
Remove the access-class 10 in command from line vty 0 4
Add the ip access-group 10 out command to interface g0/0.
Remove the password command from line vty 0 4.
What is a function of Opportunistic Wireless Encryption in an
environment?
provide authentication
B. protect traffic on open networks
offer compression
increase security by using a WEP connection
Under Protected Management Frames, set the PMF option to
Required.
Enable CCKM under Authentication Key Management.
Set the Fast Transition option and the WPA gtk-randomize
State to disable.
Set the Fast Transition option to Enable and enable FT
802.1X under Authentication Key Management.
Set Fast Transition to Enabled.
B. Enable WPA Policy.
C. Set PMF to Required.
Enable MAC Filtering.
Which encryption method is used by WPA3?
TKIP
AES
SAE
PSK
Which type of traffic is sent with pure IPsec?
multicast traffic from a server at one site to hosts at another
location
B.
broadcast packets from a switch that is attempting to locate a
MAC address at one of several remote sites
C.
unicast messages from a host at a remote site to a server at
headquarters
spanning-tree updates between switches that are at two
different sites
How does authentication differ from authorization?
A.
Authentication is used to record what resource a user
accesses, and authorization is used to determine what
resources a user can access.
B.
Authentication verifies the identity of a person accessing a
network, and authorization determines what resource a user
can access.
c.
Authentication is used to determine what resources a user is
allowed to access, and authorization is used to track what
equipment is allowed access to the network.
Authentication is used to verify a person's identity, and
authorization is used to create syslog messages for logins.
An engineer has configured the domain name, user name, and password
on the local router. What is the next step to complete the configuration
for a Secure Shell access RSA key?
crypto key import rsa pem
crypto key generate rsa
C. crypto key zeroize rsa
D. crypto key pubkey-chain rsa
Which type if network attack overwhelms the target server by sending
multiple packets to a port until the half-open TCP resources of the target
are exhausted?
SYN flood
B. reflection
teardrop
amplification
Which type if network attack overwhelms the target server by sending
multiple packets to a port until the half-open TCP resources of the target
are exhausted?
SYN flood
reflection
teardrop
amplification
Which two components comprise part of a PKI? (Choose two.)
one or more CRLs
RSA token
CA that grants certificates
clear-text password that authenticates connections
A. preshared key that authenticates connections
After a recent security breach and a RADIUS failure, an engineer must
secure the console port of each enterprise router with a local username
and password. Which configuration must the engineer apply to
accomplish this task?
aaa new-model
line con 0
password plaintextpassword
privilege level 15
aaa new-model
aaa authorization exec default local
aaa authentication login default radius
username localuser privilege 15 secret plaintextpassword
username localuser secret plaintextpassword
line con 0
no login local
privilege level 15
username localuser secret plaintextpassword
line con 0
login authentication default
privilege level 15
Which wireless security protocol relies on Perfect Forward Secrecy?
WEP
WPA2
WPA
WPA3
What is a zero-day exploit?
It is when the network is saturated with malicious traffic that
overloads resources and bandwidth.
It is when an attacker inserts malicious code into a SQL
server.
It is when a new network vulnerability is discovered before
a fix is available.
It is when the perpetrator inserts itself in a conversation
between two parties and captures or alters data.
A network engineer is replacing the switches that belong to a managed-
services client with new Cisco Catalyst switches. The new switches will
be configured for updated security standards including replacing.
Telnet services with encrypted connections and doubling the modulus
size from 1024. Which two commands must the engineer configure on
the new switches? (Choose two.)
A. transport input ssh
transport input all
C. crypto key generate rsa modulus 2048
crypto key generate rsa general-keys modulus 1024
crypto key generate rsa usage-keys
Which characteristic differentiates the concept of authentication from
authorization and accounting?
consumption-based billing
identity verification
user-activity logging
service limitations
What is a function of Cisco Advanced Malware Protection for a Next-
Generation IPS?
inspecting specific files and file types for malware
authorizing potentially compromised wireless traffic
authenticating end users
URL filtering
What is a feature of WPA?
A. TKIP/MIC encryption
B. small Wi-Fi application
preshared key
802.1x authentication
Which two practices are recommended for an acceptable security posture
in a network? (Choose two.)
B. Place internal email and file servers in a designated DMZ.
Back up device configurations to encrypted USB drives for
secure retrieval.
Disable unused or unnecessary ports, interfaces, and
services.
E. Maintain network equipment in a secure location.
Use a cryptographic keychain to authenticate to network
devices.
How does WPA3 improve security?
It uses SAE for authentication.
It uses RC4 for encryption.
C. It uses TKIP for encryption.
It uses a 4-way handshake for authentication.
What is a function of a Next-Generation IPS?
A. correlates user activity with network events
B. serves as a controller within a controller-based network
integrates with a RADIUS server to enforce Layer 2 devic
authentication rules
makes forwarding decisions based on learned MAC
addresses
Which IPsec transport mode encrypts the IP header and the payload?
A. pipe
B. transport
control
D. tunnel
What is the default port-security behavior on a trunk link?
It places the port in the err-disabled state if it learns more
than one MAC address.
It causes a network loop when a violation occurs.
It disables the native VLAN configuration as soon as port
security is enabled.
It places the port in the err-disabled state after 10 MAC
addresses are statically configured.
Which device separates networks by security domains?
intrusion protection system
firewall
wireless controller
D. access point
How are VLAN hopping attacks mitigated?
A. manually implement trunk ports and disable DTP
configure extended VLANs
activate all ports and place in the default VLAN
enable dynamic ARP inspection
Which enhancements were implemented as part of WPA3?
Forward secrecy and SAE in personal mode for secure
initial key exchange
802.1x authentication and AES-128 encryption
AES-64 in personal mode and AES-128 in enterprise mode
D. TKIP encryption improving WEP and per-packet keying
When a site-to-site VPN is configured which IPsec mode provides
encapsulation and encryption of the entire original IP packet?
A. IPsec transport mode with AH
IPsec tunnel mode with AH
IPsec transport mode with ESP
IPsec tunnel mode with ESP
An engineer is configuring remote access to a router from IP subnet
10.139.58.0/28. The domain name, crypto keys, and SSH have been
configured. Which configuration enables the traffic on the destination
router?
line vty 0 15
access-class 120 in
!
ip access-list extended 120
permit tcp 10.139.58.0 0.0.0.15 any eq 22
interface FastEthernet0/0
ip address 10.122.49.1 255.255.255.252
ip access-group 10 in
!
ip access-list standard 10
permit udp 10.139.58.0 0.0.0.7 host 10.122.49.1 eq 22
interface FastEthernet0/0
ip address 10.122.49.1 255.255.255.252
ip access-group 110 in
!
ip access-list standard 110
permit tcp 10.139.58.0 0.0.0.15 eq 22 host 10.122.49.1
line vty 0 15
access-group 120 in
!
ip access-list extended 120
permit tep 10.139.58.0 0.0.0.15 any eq 22
In an SDN architecture, which function of a network node is centralized
on a controller?
A. Creates the IP routing table
Discards a message due filtering
Makes a routing decision
Provides protocol access for remote access devices
Which management security process is invoked when a user logs in to a
network device using their username and password?
authentication
auditing
accounting
authorization
Select PSK under Authentication Key Management.
B. Select Static-WEP+802.1X on Layer 2 Security.
Select WPA+WPA2 on Layer 2 Security.
Select 802.1X from under Authentication Key Management.
Select WPA Policy with TKIP Encryption.
Which enhancement is implemented in WPA3?
employs PKI to identify access points
applies 802.1x authentication
C. uses TKIP
protects against brute force attacks
interface gi1/0/15
switchport port-security
switchport port-security maximum 2
interface gi1/0/15
switchport port-security
switchport port-security mac-address 0000.abcd.0004
vlan 100
interface gi1/0/15
switchport port-security mac-address 0000.abcd.0004
vlan 100
interface gi1/0/15
switchport port-security mac-address 0000.abcd.0004
vlan 100
interface switchport secure-mac limit
SW1(config)#enable secret ccnaTest123
SW1(config)#username NEW secret R3mote123
SW1(config)#line vty 0 15
SW1(config-line)#transport input ssh
SW1(config)# crypto key generate rsa
SW1(config)# interface f0/1
SW1(config-if)# switchport mode trunk
Which port security violation mode allows from valid MAC addresses to
pass but blocks traffic from invalid MAC addresses?
restrict
B. shutdown
protect
shutdown VLAN
Which port security violation mode allows from valid MAC addresses to
pass but blocks traffic from invalid MAC addresses?
restrict
B. shutdown
protect
shutdown VLAN
A customer wants to provide wireless access to contractors using a guest
portal on Cisco ISE. The portal is also used by employees. A solution is
implemented, but contractors receive a certificate error when they
attempt to access the portal. Employees can access the portal without any
errors. Which change must be implemented to allow the contractors and
employees to access the portal?
Install an Internal CA signed certificate on the Cisco ISE.
Install a trusted third-party certificate on the Cisco ISE.
Install an internal CA signed certificate on the contractor
devices.
Install a trusted third-party certificate on the contractor
devices.
Which two wireless security standards use counter mode cipher block
chaining Message Authentication Code Protocol for encryption and data
integrity? (Choose two.)
Wi-Fi 6
B. WPA3
WEP
WPA2
WPA
A network engineer is implementing a corporate SSID for WPA3-
Personal security with a PSK. Which encryption cipher must be
configured?
CCMP128
GCMP256
CCMP256
GCMP128
What is a practice that protects a network from VLAN hopping attacks?
Implement port security on internet-facing VLANs
Enable dynamic ARP inspection
Assign all access ports to VLANs other than the native
VLAN
Configure an ACL to prevent traffic from changing VLANs
Which WLC management connection type is vulnerable to man-in-the-
middle attacks?
console
Telnet
SSH
HTTPS
R1(config)#username admin
R1(config-if)#line vty 04
R1(config-line)#password p@ss1234
R1(config-line)#transport input telnet
R1(config)#username admin privilege 15 secret
p@ss1234
R1(config-if)#line vty 04
R1(config-line)#login local
Rl(config)#username admin secret p@ss1234
R1(config-if)#line vty 04
R1(config-line)#login local
R1(config)#enable secret p@ss1234
R1(config)#username admin
R1(config-if)#line vty 0 4
R1(config-line)#password p@ss1234
Which type of encryption does WPAI use for data protection?
A. PEAP
TKIP
AES
EAP
The router accepts all incoming traffic to Serial0 with the
last octet of the source IP set to 0.
The permit command fails and returns an error code.
The router fails to apply the access list to the interface.
The sourced traffic from IP range 10.0.0.0 - 10.0.0.255 is
allowed on Serial0.
A network engineer must configure an access list on a new Cisco IOS
router. The access list must deny HTTP traffic to network
10.125.128.32/27 from the 192.168.240.0/20 network, but it must allow
the 192.168.240.0/20 network to reach the rest of the 10.0.0.0/8 network.
Which configuration must the engineer apply?
ip access-list extended deny_outbound
B.
10 deny tep 192.168.240.0 0.0.15.255 10.125.128.32
0.0.0.31 eq 80
20 permit ip 192.168.240.0 0.0.15.255 10.0.0.0
0.255.255.255
30 deny ip any any log
ip access-list extended deny_outbound
B.
10 deny tep 192.168.240.0 0.0.15.255 10.125.128.32
0.0.0.31 eq 80
20 permit ip 192.168.240.0 0.0.15.255 10.0.0.0
0.255.255.255
30 deny ip any any log
ip access-list extended deny_outbound
10 deny tcp 10.125.128.32 255.255.255.224
192.168.240.0 255.255.240.0 eq 443
20 deny tcp 192.168.240.0 255.255.240.0 10.125.128.32
255.255.255.224 eq 443
30 permit ip 192.168.240.0 255.255.240.0 10.0.0.0
255.0.0.0
ip access-list extended deny_outbound
10 deny tcp 192.168.240.0 0.0.15.255 any eq 80
20 deny tcp 192.168.240.0 0.0.15.255 10.125.128.32
0.0.0.31 eq 80
30 permit ip 192.168.240.0 0.0.15.255 10.0.0.0
0.255.255.255
What is the definition of backdoor malware?
malicious code that is installed onto a computer to allow
access by an unauthorized user
malicious program that is used to launch other malicious
programs
malicious code that infects a user machine and then uses that
machine to send spam
malicious code with the main purpose of downloading other
malicious code
What does WPA3 provide in wireless networking?
A. backward compatibility with WPA and WPA2
B. safeguards against brute force attacks with SAE
increased security and requirement of a complex
configuration
optional Protected Management Frame negotiation
Which global command encrypts all passwords in the running
configuration?
service password-encryption
enable password-encryption
enable secret
password-encrypt
username CCUser privilege 10 password NA!2$cc
username CCUser privilege 15 password NA!2Scc
enable secret 0 NA!2$cc
username CCUser secret NA!2Sce
username CCUser password NA!2$cc
enable password level 5 NA!2$cc
SW(config-if)#switchport port-security violation restrict
SW(config-if)#switchport port-security mac-address
0010.7B84.45E6
SW(config-if)#switchport port-security maximum 2
SW(config-if)#switchport port-security violation
shutdown
An engineer is configuring a switch port that is connected to a VoIP
handset. Which command must the engineer configure to enable port
security with a manually assigned MAC address of abcd.abcd.abcd on
voice VLAN 4?
switchport port-security mac-address abcd.abed.abcd
vlan 4
switchport port-security mac-address abed.abed.abed
vlan voice
switchport port-security mac-address abcd.abcd.abcd
switchport port-security mac-address sticky
abcd.abcd.abcd vlan 4
Which type of security program is violated when a group of employees
enters a building using the ID badge of only one person?
A. intrusion detection
network authorization
physical access control
user awareness
What are two protocols within the IPsec suite? (Choose two.)
3DES
ESP
TLS
AH
AES
!
conf t
!
username test1 password testpass1
enable secret level 15 0 Test123
!
line vty 0 15
login local
transport input telnet
!
config t
!
username test1 password testpass1
enable password level 15 0 Test123
!
line vty 0 15
login local
transport input all
C.
!
config t
!
username test1 password testpass1
enable password level 1 7 Test123
!
line vty 0 15
accounting exec default
transport input all
D.
!
config t
!
username test1 password testpass1
enable secret level 1 0 Test123
line vty 0 15
login authentication
password Test123
transport input telnet
What is a characteristic of RSA?
A. It uses preshared keys for encryption.
B. It is an asymmetric encryption algorithm.
It is a symmetric decryption algorithm.
It requires both sides to have identical keys for encryption.
What are two differences between WPA2 and WPA3 wireless security?
(Choose two.)
WPA2 uses 192-bit key encryption, and WPA3 requires 256-
bit key encryption.
WPA3 uses AES for stronger protection than WPA2, which
uses SAE.
WPA2 uses 128-bit key encryption, and WPA3 supports
128-bit and 192-bit key encryption.
WPA3 uses SAE for stronger protection than WPA2, which
uses AES.
WPA3 uses AES for stronger protection than WPA2, which
uses TKIP.
What is an enhancement implemented in WPA3?
applies 802.1x authentication and AES-128 encryption
employs PKI and RADIUS to identify access points
uses TKIP and per-packet keying
defends against deauthentication and disassociation attacks
Which action must be taken when password protection is implemented?
Use less than eight characters in length when passwords are
complex.
Include special characters and make passwords as long as
allowed.
Share passwords with senior IT management to ensure
proper oversight.
Store passwords as contacts on a mobile device with single-
factor authentication.
An engineer must configure R1 for a new user account. The account
must meet these requirements:
· It must be configured in the local database.
. The username is engineer2.
· It must use the strongest password configurable.
Which command must the engineer configure on the router?
R1(config)# username engineer2 privilege 1 password 7
test2021
R1(config)# username engineer2 secret 4
$1$b1JuSkZbBS1Pyh4QzwXyZ
R1(config)# username engineer2 algorithm-type scrypt
secret test2021
R1(config)# username engineer2 secret 5 password
$1$b1Ju$kZbBS1Pyh4QzwXyZ
Which two VPN technologies are recommended by Cisco for multiple
branch offices and large-scale deployments? (Choose two.)
GETVPN
DMVPN
site-to-site VPN
clientless VPN
IPsec remote access
What is a characteristic of RSA?
It uses preshared keys for encryption.
It is a public-key cryptosystem.
It is a private-key encryption algorithm.
It requires both sides to have identical keys.
What is used as a solution for protecting an individual network endpoint
from attack?
antivirus software
wireless controller
router
D. Cisco DNA Center
Which security method is used to prevent man-in-the-middle attacks?
authentication
anti-replay
authorization
accounting
Which cipher is supported for wireless encryption only with the WPA2
standard?
RC4
B. AES
C. SHA
AES256
Which WPA mode uses PSK authentication?
Local
Personal
Enterprise
Client
An engineer is configuring remote access to a router from IP subnet
10.139.58.0/28. The domain name, crypto keys, and SSH have been
configured. Which configuration enables the traffic on the destination
router?
interface FastEthernet0/0
ip address 10.122.49.1 255.255.255.252
ip access-group 110 in
ip access-list extended 110
permit tcp 10.139.58.0 0.0.0.15 host 10.122.49.1 eq 22
interface FastEthernet0/0
ip address 10.122.49.1 255.255.255.240
access-group 120 in
ip access-list extended 120
permit tep 10.139.58.0 255.255.255.248 any eq 22
interface FastEthernet0/0
ip address 10.122.49.1 255.255.255.252
ip access-group 105 in
ip access-list standard 105
permit tep 10.139.58.0 0.0.0.7 eq 22 host 10.122.49.1
interface FastEthernet0/0
ip address 10.122.49.1 255.255.255.248
ip access-group 10 in
ip access-list standard 10
permit udp 10.139.58.0 0.0.0.7 host 10.122.49.1 eq 22
To improve corporate security, an organization is planning to implement
badge authentication to limit access to the data center. Which element of
a security program is being deployed?
A.
user awareness
user training
physical access control
vulnerability verification
An organization secures its network with multi-factor authentication
using an authenticator app on employee smartphones. How is the
application secured in the case of a user's smartphone being lost or
stolen?
The application requires the user to enter a PIN before it
provides the second factor
B.
The application requires an administrator password to
reactivate after a configured interval
The application verifies that the user is in a specific location
before it provides the second factor
The application challenges a user by requiring an
administrator password to reactivate when the smartphone is
rebooted
Which device performs stateful inspection of traffic?
switch
B. firewall
access point
wireless controller
A network administrator enabled port security on a switch interface
connected to a printer. What is the next configuration action in order to
allow the port to learn the MAC address of the printer and insert it into
the table automatically?
enable dynamic MAC address learning
implement static MAC addressing
enable sticky MAC addressing
implement auto MAC address learning
R1(config)#username admin
R1(config-if)#line vty 0 4
R1(config-line)#password p@ss1234
R1(config-line)#transport input telnet
R1(config)#username admin privilege 15 secret
p@ss1234
R1(config-if)#line vty 04
R1(config-line)#login local
Rl(config)#username admin secret p@ss1234
R1(config-if)#line vty 0 4
R1(config-line)#login local
R1(config)#enable secret p@ss1234
R1(config)#username admin
R1(config-if)#line vty 0 4
R1(config-line)#password p@ss1234
Which effect does the aaa new-model configuration command have?
It enables AAA services on the device.
It configures the device to connect to a RADIUS server for
AAA.
It associates a RADIUS server to the group.
It configures a local user on the device.
