CCNP Security — 20 Questions

Question 1

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Accepted Answer

switchport port-security maximum 2
switchport port-security violation shutdown. Option B is correct because the 'shutdown' violation mode places the interface into an err-disabled state when a port security violation occurs, which matches the requirement to disable the interface. The 'maximum 2' command limits the number of allowed MAC addresses to two, and the first two learned MAC addresses are dynamically secured. This combination ensures that any additional MAC address triggers a violation and disables the port.

Answer

switchport port-security maximum 2
switchport port-security violation err-disable

Answer

switchport port-security maximum 2
switchport port-security violation protect

Answer

switchport port-security maximum 2
switchport port-security violation restrict

Question 2

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Accepted Answer

authentication port-control auto. Option B is correct because 'authentication port-control auto' is the required interface command to enable 802.1X authentication on a switch port. This command sets the port to initiate the authentication process, placing it in the unauthorized state until the client successfully authenticates via the RADIUS server (Cisco ISE). Without this command, the port will not enforce 802.1X.

Answer

dot1x pae authenticator

Answer

authentication port-control force-authorized

Answer

authentication port-control force-unauthorized

Question 3

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Accepted Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop. Option C is correct because it uses the 'match protocol ssh' class-map to identify SSH traffic, applies a police rate of 1,000,000 bps (1 Mbps) with a burst of 2000 bytes, and includes a class-default with a police rate of 8000 bps to drop all other control-plane traffic exceeding a default rate. This matches the requirement to rate-limit SSH and drop other traffic that exceeds a default rate, which is a common CoPP best practice to protect the control plane.

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match access-group name SSH_ACL
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 2000 1000000 conform-action transmit exceed-action drop

Question 4

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Accepted Answer

access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443. In transparent mode, the ASA acts as a Layer 2 bridge, so traffic must be permitted by a global access list applied to the bridge group virtual interface (BVI). Option D correctly uses the GLOBAL access list to permit TCP traffic from the inside subnet (192.168.1.0/24) to any destination on port 443 (HTTPS), which satisfies the security policy.

Answer

access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
access-group INSIDE in interface inside

Answer

access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any

Answer

access-list GLOBAL extended permit tcp any any eq 443

Question 5

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.. Option B is correct because the scenario states that DHCP snooping is configured globally and on VLAN 10, and that GigabitEthernet0/1 is connected to the DHCP server. However, for DHCP snooping to allow DHCP server messages (OFFER, ACK) to be forwarded, the interface connected to the legitimate DHCP server must be explicitly configured as a trusted port using the 'ip dhcp snooping trust' interface command. Without this, the switch treats all DHCP server responses as untrusted and drops them, preventing clients from receiving IP addresses.

Answer

The switch has IP Source Guard enabled, blocking valid DHCP traffic.

Answer

The DHCP server is on a different subnet and the switch lacks an IP helper address.

Answer

The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.

Question 6

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Option B is correct because disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.

Question 7

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Accepted Answer

It uses Security Group Tags (SGTs) to classify traffic.. C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

Answer

It uses IPsec to encrypt traffic between network devices.

Answer

It uses VLANs to segment traffic based on security roles.

Question 8

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Accepted Answer

The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.. The DHCP snooping feature on a switch compares the source MAC address in the Ethernet frame with the chaddr (client hardware address) field inside the DHCP packet. When a DHCP client sends a packet with a different MAC in the frame than in the chaddr field, the switch considers it a 'MAC Address Mismatch' and drops the packet. This security mechanism prevents a rogue client from spoofing another device's MAC address to obtain a lease.

Answer

The DHCP server is sending packets with an incorrect server identifier option.

Answer

The DHCP client is sending a request with an incorrect transaction ID.

Answer

The DHCP offer packet is arriving on an untrusted port.

Question 9

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Accepted Answer

The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.. Option D is correct because IP Source Guard (IPSG) on a switch port typically uses DHCP snooping bindings to validate traffic. However, when port-security is also enabled and the host's IP (10.1.1.1) falls within the configured subnet (e.g., 10.0.0.0/8), and the MAC address (00:1A:2B:3C:4D:5E) matches a port-security secure MAC address, the switch can permit the traffic. IPSG does not inherently block all non-DHCP traffic; it can be configured with static bindings or rely on DHCP snooping, but in this scenario, the combination of a valid subnet and port-security allows the traffic.

Answer

The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.

Answer

The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.

Answer

The traffic is blocked because IP Source Guard requires a static binding for the host.

Question 10

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Accepted Answer

The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.. The missing 'aaa authentication enable default group tacacs+ local' command means the device does not require TACACS+ authentication to enter enable mode. Since the user is already at privilege level 15 after login (due to the 'aaa authorization exec' command or local user configuration), they are not prompted for a password and are granted full privileges immediately. Additionally, command authorization is only configured for privilege level 15 ('aaa authorization commands 15'), so once the user is at level 15, no further authorization checks are performed for commands like 'debug', bypassing the intended per-role enforcement.

Answer

The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.

Answer

Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.

Answer

The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.

Question 11

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Accepted Answer

Security Group Access Control Lists (SGACLs). Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.

Answer

Change of Authorization (CoA)

Answer

802.1X authentication

Answer

MACsec encryption

Question 12

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Accepted Answer

BGP sessions may flap due to dropped keepalives.. The CoPP policy applies to control plane traffic, not data plane traffic. BGP keepalives are control plane packets; if the policy drops or rate-limits them, BGP sessions may time out and flap. The correct answer is A because BGP keepalives are essential for maintaining neighbor adjacency, and dropping them directly causes session instability.

Answer

Data plane traffic will be dropped.

Answer

Only SSH sessions will be rate-limited.

Answer

SNMP and SSH will be unaffected because they are explicitly permitted.

Question 13

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Accepted Answer

Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.. The DHCP snooping feature treats all ports as untrusted by default, which means DHCP server messages (DHCPOFFER, DHCPACK, DHCPNAK) are dropped on untrusted ports. Since the DHCP server is connected to a trunk port and DHCPACK messages are being dropped, that trunk port must be explicitly configured as a trusted port for DHCP snooping using the 'ip dhcp snooping trust' interface command. This allows legitimate DHCP server responses to reach clients, resolving the duplicate IP address issue caused by clients not receiving their assigned addresses.

Answer

Manually shut down the access ports that have unknown MAC addresses in the binding table.

Answer

Disable Dynamic ARP Inspection on VLAN 10.

Answer

Disable IP Source Guard on all access ports in VLAN 10.

Question 14

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Question 15

Match each Spanning Tree Protocol (STP) variant to its key characteristic.