CCNA Network Services and Security Practice Test 27 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode, enable AAA globally, configure RADIUS server parameters, define an authentication method list, then enable 802.1X on the interface.. The correct order for AAA with RADIUS and 802.1X is: global config, enable AAA, configure RADIUS server, define authentication method list, then enable 802.1X on the interface.

Answer

Enter global configuration mode, configure RADIUS server parameters, enable AAA globally, define an authentication method list, then enable 802.1X on the interface.

Answer

Enter global configuration mode, enable AAA globally, define an authentication method list, configure RADIUS server parameters, then enable 802.1X on the interface.

Answer

Enter global configuration mode, enable AAA globally, configure RADIUS server parameters, enable 802.1X on the interface, then define an authentication method list.

Question 2

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode, define the RADIUS server, configure AAA authentication, enable 802.1X globally, apply per-interface 802.1X settings.. First enter global config, then define the RADIUS server, then configure AAA authentication, then enable 802.1X globally, and finally apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, define the RADIUS server, configure AAA authentication, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, configure AAA authentication, define the RADIUS server, enable 802.1X globally, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, define the RADIUS server, enable 802.1X globally, configure AAA authentication, apply per-interface 802.1X settings.

Question 3

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interface. First enter global config, then define RADIUS server, then configure AAA authentication, then enable 802.1X globally, then apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interface

Answer

Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interface

Answer

Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interface

Question 4

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Accepted Answer

aaa new-model. AAA configuration must precede 802.1X. The order is global AAA setup, then global 802.1X enablement, followed by per-interface authentication configuration.

Answer

radius server RADIUS-SERVER

Answer

dot1x system-auth-control

Answer

authentication port-control auto

Question 5

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode and enable AAA globally using the 'aaa new-model' command.. Start by entering global configuration mode and enabling AAA with 'aaa new-model' to allow AAA commands. Then, configure the RADIUS server parameters using 'radius-server host' and 'radius-server key' so the switch knows where to send authentication requests. Next, create an authentication method list with 'aaa authentication dot1x default group radius' to define the authentication method. After the method list, the global command 'dot1x system-auth-control' must be issued to enable 802.1X globally; without it, the interface-level commands will not function. Finally, apply 802.1X port authentication on the interface using 'authentication port-control auto'. This order ensures each prerequisite is met before the next step.

Question 6

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Configure RADIUS server, enable AAA globally, create an authentication list for 802.1X, apply 802.1X to the port. First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Answer

Enable AAA globally, configure RADIUS server, apply 802.1X to the port, create an authentication list for 802.1X

Answer

Configure RADIUS server, create an authentication list for 802.1X, enable AAA globally, apply 802.1X to the port

Answer

Apply 802.1X to the port, configure RADIUS server, enable AAA globally, create an authentication list for 802.1X

Question 7

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Accepted Answer

TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.. Option B is correct: TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes. Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Answer

RADIUS encrypts the entire packet payload, including all attributes.

Answer

TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

Answer

When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.

Question 8

Drag and drop the AAA terms on the left to their correct definitions on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device before granting access to the network.. AAA components: Authentication verifies identity, Authorization controls access, Accounting logs activities. RADIUS is an open standard that combines authentication and authorization, while TACACS+ is a Cisco proprietary protocol that separates all three functions.

Answer

Authorization: Determines what actions or resources an authenticated user is permitted to access.

Answer

Accounting: Logs and tracks user activities, such as login times, commands executed, and data usage.

Answer

RADIUS: A protocol that provides centralized authentication, authorization, and accounting for network access.

Question 9

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that denies Telnet from a specific host to a server subnet, then verify the configuration.

Accepted Answer

Enter global configuration mode, create the extended ACL with the deny statement for Telnet from the specific host to the server subnet, then permit other traffic.. The correct sequence is: create the ACL (A), apply it to the interface (B), verify it works (D), then save the configuration (C). This prevents saving a faulty ACL. Verifying after saving (C before D) risks persisting errors and is not the Cisco recommended workflow.

Question 10

Drag and drop the following steps into the correct order to configure and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.1, with the ACL applied inbound on the router's GigabitEthernet0/0 interface, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.. First, enter config mode. Create the ACL permitting HTTP from the source network to the destination host. Apply it inbound on the correct interface. Then exit and verify.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it outbound on GigabitEthernet0/0 with 'ip access-group 100 out', then exit and verify with 'show access-lists'.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then verify with 'show running-config' without exiting configuration mode.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show ip interface brief'.

Question 11

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.100, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the interface facing the 192.168.1.0/24 network, save the configuration, and verify with show access-lists.. First, enter config mode. Then create the ACL allowing HTTP from the source network to the destination host. Apply it inbound on the appropriate interface. Save and verify the configuration.

Answer

Enter global configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it outbound on the interface facing the server, save the configuration, and verify with show ip interface.

Answer

Enter interface configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the same interface, save the configuration, and verify with show running-config.

Answer

Enter global configuration mode, create the ACL with a deny statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the interface facing the server, save the configuration, and verify with show access-lists.

Question 12

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the router's G0/0 interface.

Accepted Answer

Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group <acl-number> in. First enter global config, then create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter interface G0/0, then apply ACL inbound. This order ensures the ACL is created before being applied, and the specific source/destination networks match the requirement.

Question 13

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Accepted Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Apply the ACL inbound on GigabitEthernet0/1. Step 3: Verify the ACL configuration.. ACL configuration requires defining permit/deny statements first, then applying to the interface inbound, and finally verification.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Define the ACL with permit and deny statements. Step 3: Verify the ACL configuration.

Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Verify the ACL configuration. Step 3: Apply the ACL inbound on GigabitEthernet0/1.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Verify the ACL configuration. Step 3: Define the ACL with permit and deny statements.

Question 14

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server 10.0.0.10, applied inbound on interface GigabitEthernet0/1.

Accepted Answer

1. Enter global configuration mode
2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
3. Enter interface configuration mode for GigabitEthernet0/1
4. Apply the ACL inbound with ip access-group ACL_NAME in
5. Exit configuration mode and verify with show access-lists. After entering config mode, create the ACL to allow HTTP from the specified network to the server. Apply it inbound on the correct interface. Then exit and verify.

Answer

1. Enter interface configuration mode for GigabitEthernet0/1
2. Apply the ACL inbound with ip access-group ACL_NAME in
3. Enter global configuration mode
4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
5. Exit configuration mode and verify with show access-lists

Answer

1. Enter global configuration mode
2. Enter interface configuration mode for GigabitEthernet0/1
3. Apply the ACL inbound with ip access-group ACL_NAME in
4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
5. Exit configuration mode and verify with show access-lists

Answer

1. Enter global configuration mode
2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
3. Exit configuration mode and verify with show access-lists
4. Enter interface configuration mode for GigabitEthernet0/1
5. Apply the ACL inbound with ip access-group ACL_NAME in

Question 15

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.

Accepted Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.. First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.

Answer

Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.

Answer

Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.

Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.