Ping

Network security

Topic 14 of 26. 29 questions: 14 pick one, 3 pick all, 6 type it, 3 put in order, 3 interview

Start 10All 29Interview questions
What this topic covers
  • standard extended and named ACLs
  • ACL placement
  • wildcard masks
  • implicit deny
  • AAA
  • RADIUS vs TACACS+
  • 802.1X EAP supplicant authenticator server
  • MAB
  • port security and violation modes
  • DHCP snooping
  • dynamic ARP inspection
  • IP source guard
  • stateful vs stateless firewalls
  • zone-based firewall
  • next generation firewall features
  • IDS vs IPS
  • DMZ design
  • defense in depth
  • device hardening
  • control plane policing
  • attacks MAC flooding VLAN hopping ARP spoofing DHCP starvation DDoS SYN flood
  • zero trust

Study it in depth on Octet.

  1. 1R1 applies this ACL inbound on its interface toward the user LAN 10.1.20.0/24. Host 10.1.20.5 opens SSH (TCP 22) to 10.2.50.20. What happens to its SYN?Pick oneWorking
  2. 2Guests in VLAN 50 (10.50.0.0/16) must reach the internet but not the internal ranges 10.10.0.0/16 and 10.20.0.0/16. The engineer applies this ACL on a Cisco layer 3 switch. What happens to guest traffic bound for the internet?Pick oneCore
  3. 3In a Cisco IOS ACL, which wildcard mask matches exactly the subnet 192.168.10.64/27?Type itCore
  4. 4You need one ACL entry that matches every address from 172.16.16.0 to 172.16.31.255, written as 172.16.16.0 followed by a wildcard. What is the wildcard mask?Type itWorking
  5. 5An engineer types access-list 10 permit 10.1.1.0 255.255.255.0 on Cisco IOS, meaning to permit the subnet 10.1.1.0/24. Which source addresses does this line actually permit?Pick oneWorking
  6. 6Which single ACL entry matches every odd-numbered /24 in 10.1.0.0/16 (10.1.1.0/24, 10.1.3.0/24 and so on up to 10.1.255.0/24) and nothing else?Pick oneExpert
  7. 7Users in 10.1.20.0/24 at a branch must not reach the server subnet 10.2.50.0/24 at HQ, but must keep every other access. You may only use a standard ACL. Where do you apply it?Pick oneCore
  8. 8This ACL is applied inbound on R1's management interface. An engineer added a line so the monitoring server 10.50.1.10 can reach R1 over HTTPS, but its connections still fail. Why?Pick oneWorking
  9. 9A packet arrives on R1's Gi0/0 and is routed out Gi0/1. Gi0/0 has an IPv4 ACL applied in and Gi0/1 has one applied out. Put the steps in the order R1 performs them, first to last.Put in orderWorking
  10. 10After WAN-IN was applied inbound on R2's Gi0/0/0, the OSPF neighbor on that link went down. Which IP protocol number must the ACL permit to bring OSPF back?Type itWorking
  11. 11An inbound ACL on an internet-facing router contains permit tcp any 10.1.0.0 0.0.255.255 established. What does the established keyword actually check?Pick oneWorking
  12. 12R1 applies this ACL outbound on its interface toward the server subnet 10.9.9.0/24. Which of these packets, routed through R1, are forwarded onto that subnet? Choose all that apply.Pick allExpert
  13. 13What is the difference between standard, extended and named ACLs on Cisco IOS?InterviewCore
  14. 14R1 has this AAA configuration and both TACACS+ servers are up and reachable. An engineer tries to log in over SSH with the local username breakglass and its correct password. The user does not exist on the TACACS+ servers. What happens?Pick oneWorking
  15. 15Which of these are true of TACACS+ compared with RADIUS? Choose all that apply.Pick allCore
  16. 16Which UDP port does the current standard assign to RADIUS authentication?Type itCore
  17. 17What does AAA stand for, and how would you set up central login for network engineers on Cisco routers?InterviewCore
  18. 18In an 802.1X deployment on a wired access port, which role does the access switch play?Pick oneCore
  19. 19A laptop with a working 802.1X supplicant plugs into a Cisco switch port configured for 802.1X, and the switch starts the exchange. Put the steps in order, first to last.Put in orderWorking
  20. 20Which EAP method authenticates the client with its own certificate, so that no password is used at all?Pick oneWorking
  21. 21A Cisco access port runs authentication order dot1x mab with the default 802.1X timers (tx-period 30 seconds, max-reauth-req 2). A printer with no supplicant is plugged in. About how many seconds pass before the switch falls back to MAB?Type itExpert
  22. 22What is MAC Authentication Bypass, why is it considered weak, and how do you make it safer?InterviewWorking
  23. 23On a Cisco switch, which port security violation mode drops frames from unauthorized MAC addresses, increments the violation counter and sends a syslog message, but keeps the port up?Pick oneCore
  24. 24You enable switchport port-security on a Cisco access port and change nothing else. How many secure MAC addresses does the port allow?Type itCore
  25. 25After this change on access switch ASW1, no client in VLAN 10 can get an address, although the DHCP server and the relay on DSW1 are healthy. What is wrong?Pick oneWorking
  26. 26With DHCP snooping enabled, which DHCP message types does the switch always drop when they arrive on an untrusted port? Choose all that apply.Pick allWorking
  27. 27DAI is enabled in VLAN 10, whose default gateway is 10.10.10.1 and whose hosts use DHCP. Gi1/0/7 is an access port for a desk PC, and the uplink Gi1/0/48 is trusted. What does this log entry show?Pick oneExpert
  28. 28DHCP snooping and Dynamic ARP Inspection already run on an access VLAN. What does adding IP Source Guard on the access ports stop that they do not?Pick oneWorking
  29. 29Cisco's phased model for rolling out 802.1X across a campus has three modes. Put them in the order you introduce them, first to last.Put in orderExpert