CCNP Security — 10 Questions

Question 1

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The traffic is blocked because IP Source Guard requires a static binding for the host.. IP Source Guard (IPSG) validates the source IP address of traffic using DHCP snooping bindings or static IP-source bindings. In this scenario, no DHCP snooping binding exists (host is not using DHCP) and no static binding has been configured, so IPSG will drop the traffic from the host. Port-security ensures the source MAC is valid, but does not provide the IP-MAC binding required by IPSG. Therefore, the traffic is blocked.

Answer

The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.

Answer

The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.

Answer

The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.

Question 2

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Accepted Answer

switchport port-security maximum 2
switchport port-security violation shutdown. The 'shutdown' violation mode places the interface into an err-disabled state when a port security violation occurs, which matches the requirement to disable the interface. The 'maximum 2' command limits the number of allowed MAC addresses to two, and the first two learned MAC addresses are dynamically secured. This combination ensures that any additional MAC address triggers a violation and disables the port.

Answer

switchport port-security maximum 2
switchport port-security violation err-disable

Answer

switchport port-security maximum 2
switchport port-security violation protect

Answer

switchport port-security maximum 2
switchport port-security violation restrict

Question 3

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Accepted Answer

authentication port-control auto. 'authentication port-control auto' is the required interface command to enable 802.1X authentication on a switch port. This command sets the port to initiate the authentication process, placing it in the unauthorized state until the client successfully authenticates via the RADIUS server (Cisco ISE). Without this command, the port will not enforce 802.1X.

Answer

dot1x pae authenticator

Answer

authentication port-control force-authorized

Answer

authentication port-control force-unauthorized

Question 4

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Accepted Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop. It uses the 'match protocol ssh' class-map to identify SSH traffic, applies a police rate of 1,000,000 bps (1 Mbps) with a burst of 2000 bytes, and includes a class-default with a police rate of 8000 bps to drop all other control-plane traffic exceeding a default rate. This matches the requirement to rate-limit SSH and drop other traffic that exceeds a default rate, which is a common CoPP best practice to protect the control plane.

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match access-group name SSH_ACL
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 2000 1000000 conform-action transmit exceed-action drop

Question 5

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Accepted Answer

access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443. In transparent mode, the ASA acts as a Layer 2 bridge, so traffic must be permitted by a global access list applied to the bridge group virtual interface (BVI). Option D correctly uses the GLOBAL access list to permit TCP traffic from the inside subnet (192.168.1.0/24) to any destination on port 443 (HTTPS), which satisfies the security policy.

Answer

access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
access-group INSIDE in interface inside

Answer

access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any

Answer

access-list GLOBAL extended permit tcp any any eq 443

Question 6

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.. The scenario states that DHCP snooping is configured globally and on VLAN 10, and that GigabitEthernet0/1 is connected to the DHCP server. However, for DHCP snooping to allow DHCP server messages (OFFER, ACK) to be forwarded, the interface connected to the legitimate DHCP server must be explicitly configured as a trusted port using the 'ip dhcp snooping trust' interface command. Without this, the switch treats all DHCP server responses as untrusted and drops them, preventing clients from receiving IP addresses.

Answer

The switch has IP Source Guard enabled, blocking valid DHCP traffic.

Answer

The DHCP server is on a different subnet and the switch lacks an IP helper address.

Answer

The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.

Question 7

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.

Question 8

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Accepted Answer

It uses Security Group Tags (SGTs) to classify traffic.. C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

Answer

It uses IPsec to encrypt traffic between network devices.

Answer

It uses VLANs to segment traffic based on security roles.

Question 9

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Accepted Answer

The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.. The DHCP snooping feature on a switch compares the source MAC address in the Ethernet frame with the chaddr (client hardware address) field inside the DHCP packet. When a DHCP client sends a packet with a different MAC in the frame than in the chaddr field, the switch considers it a 'MAC Address Mismatch' and drops the packet. This security mechanism prevents a rogue client from spoofing another device's MAC address to obtain a lease.

Answer

The DHCP server is sending packets with an incorrect server identifier option.

Answer

The DHCP client is sending a request with an incorrect transaction ID.

Answer

The DHCP offer packet is arriving on an untrusted port.

Question 10

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Accepted Answer

The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.. The missing 'aaa authentication enable default group tacacs+ local' command means the device does not require TACACS+ authentication to enter enable mode. Since the user is already at privilege level 15 after login (due to the 'aaa authorization exec' command or local user configuration), they are not prompted for a password and are granted full privileges immediately. Additionally, command authorization is only configured for privilege level 15 ('aaa authorization commands 15'), so once the user is at level 15, no further authorization checks are performed for commands like 'debug', bypassing the intended per-role enforcement.

Answer

The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.

Answer

Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.

Answer

The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.