CCNP Security Practice Test 4 — 15 Questions

Question 1

A network engineer is implementing MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two switches. The engineer must ensure that the link is protected against eavesdropping and tampering, and that the switches authenticate each other before exchanging encrypted traffic. Which two statements about MACsec configuration on Cisco IOS XE are true? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MACsec uses MKA (MACsec Key Agreement) to negotiate and exchange keys between peers.. MACsec secures Layer 2 traffic using MKA to negotiate keys and authenticate peers, and it is enabled on switch ports with the 'macsec' command. It does not encrypt MAC addresses, does not require RADIUS for key distribution, and is not limited to routed ports. The two true statements correctly describe the key agreement protocol and the interface-level enablement command.

Answer

MACsec can only be deployed on routed ports, not on switch ports.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec requires the use of a RADIUS server for key distribution.

Question 2

A network security engineer is implementing Cisco TrustSec in a campus network. The engineer has configured security group tags (SGTs) and is using SGACL enforcement on Cisco Catalyst switches. A user in the 'Employees' SGT (tag 10) needs to access a server in the 'Servers' SGT (tag 20) on TCP port 443. The SGACL on the server switch currently denies all traffic from tag 10 to tag 20. Which command must be added to the SGACL policy to permit only HTTPS traffic from Employees to Servers?

Accepted Answer

permit tcp dst eq 443, applied in the SGACL policy for source SGT 10 and destination SGT 20. In Cisco TrustSec, SGACLs are applied to a source-destination SGT pair. To permit only HTTPS from Employees to Servers, the engineer must create or modify the SGACL policy for the cell (source SGT 10, destination SGT 20) and include a rule permitting TCP destination port 443. All other traffic is implicitly denied by the default deny at the end of the SGACL.

Answer

permit ip any any

Answer

permit tcp dst eq 443

Answer

permit tcp dst eq 443 log

Question 3

A network security administrator is configuring a Cisco IOS-XE router to act as a VPN headend using FlexVPN with IKEv2. The administrator wants to ensure that the router uses certificate-based authentication for IKEv2 peers and that the certificate is validated against a specific trustpoint. The administrator has already configured the trustpoint and imported the CA certificate. Which command must be applied under the IKEv2 profile to enforce certificate-based authentication and specify the trustpoint?

Accepted Answer

authentication remote rsa-sig followed by pki trustpoint TP_NAME. In IKEv2, certificate-based authentication requires specifying both the authentication method (rsa-sig) and the trustpoint for validation. The authentication remote rsa-sig command enforces RSA signatures for the remote peer, and pki trustpoint TP_NAME specifies which trustpoint to use. Together they ensure proper certificate validation.

Answer

pki trustpoint TP_NAME

Answer

authentication local rsa-sig

Answer

authentication remote rsa-sig

Question 4

A network engineer is deploying a new Cisco Catalyst 9300 switch at a branch office. The security policy requires that the switch prevent rogue DHCP servers from handing out IP addresses to clients on VLAN 20, while still allowing legitimate DHCP traffic from the corporate DHCP server at 10.10.10.5. The engineer enables DHCP snooping globally and on VLAN 20, then configures the uplink interface GigabitEthernet1/0/24 as trusted. Which additional configuration is required to enforce this policy on the access ports?

Accepted Answer

Configure the access ports as untrusted (default) so that DHCP server messages received on them are dropped.. DHCP snooping establishes a trust boundary: interfaces facing legitimate DHCP servers are trusted, while all others remain untrusted. Untrusted ports drop DHCP server messages (OFFER, ACK), preventing rogue servers from assigning addresses. The uplink is already trusted, so access ports must remain untrusted (the default) to enforce the policy. Rate limiting, IP Source Guard, and Option 82 address different concerns and do not block rogue DHCP servers.

Answer

Enable IP Source Guard on the access ports to filter DHCP server responses.

Answer

Configure the access ports with the ip dhcp snooping limit rate command to restrict DHCP packet rates.

Answer

Configure the access ports with the ip dhcp snooping information option command to insert relay agent information.

Question 5

A network engineer is configuring MACsec on a point-to-point link between two Cisco Catalyst 9300 switches to secure Layer 2 traffic. The engineer must ensure that the MACsec session is established and that data integrity and confidentiality are provided. Which two statements about MACsec configuration on Cisco IOS XE are true? (Choose two.)

Accepted Answer

MACsec provides encryption at Layer 2 and can be enabled with the macsec command under the interface.. MACsec secures Layer 2 traffic by encrypting and integrity-checking frames between peers. It uses MKA to negotiate keys and is enabled with the macsec interface command on Cisco IOS XE. The key server is elected via MKA, and the connectivity association key must be configured consistently on both ends for the session to establish.

Answer

MACsec automatically encrypts all control plane protocols including OSPF and EIGRP.

Answer

MACsec can be configured only on routed ports, not on switch ports.

Answer

MACsec requires that both peers use the same pre-shared key configured with the mka key-server command.

Question 6

A network engineer is hardening a Cisco IOS XE router against control plane attacks. The engineer wants to protect the route processor from excessive ARP and IP options traffic while still allowing legitimate management and routing protocols. Which two mechanisms are appropriate to implement? (Choose two.)

Accepted Answer

Control Plane Policing with class-maps that rate-limit ARP and IP options punted traffic.. Protecting the route processor from ARP and IP options floods requires mechanisms that act on punted traffic. Control Plane Policing classifies and rate-limits those packets, and Control Plane Protection with a port-filter policy drops traffic to closed ports before it reaches the host subinterface. Together they harden the control plane while allowing legitimate management and routing protocol traffic.

Answer

Dynamic ARP Inspection on all VLANs that carry management traffic.

Answer

Unicast Reverse Path Forwarding strict mode on all router interfaces.

Answer

IP Source Guard on all switch ports connected to the router.

Question 7

A network administrator is configuring a Cisco ASA firewall for a new DMZ. The DMZ web server must be accessible from the internet on TCP port 80 and 443. The administrator wants to ensure that the web server can initiate outbound connections to the internet for updates but should not be able to initiate connections to the internal network. Which ASA security level configuration should be applied to the DMZ interface to meet these requirements?

Accepted Answer

Security level 50. The ASA assigns security levels to interfaces, with higher levels being more trusted. By default, traffic can flow from higher to lower security levels without an ACL. To allow the DMZ to initiate outbound connections to the internet but not to the internal network, the DMZ should have a security level between the inside (100) and outside (0). A level of 50 is a common best practice for DMZ, enabling outbound access to the internet while preventing initiation to the inside.

Answer

Security level 100

Answer

Security level 0

Answer

Security level 75

Question 8

A network administrator is implementing MACsec on a Cisco Catalyst 9300 switch to secure Layer 2 traffic between two switches. The administrator wants to ensure that the MACsec session uses a pre-shared key (PSK) for authentication and that the key is rotated periodically. Which configuration step is required to enable MACsec with PSK on the switch port?

Accepted Answer

Configure the mka policy with pre-shared-key and apply it to the interface, then enable MACsec with the macsec command. MACsec with PSK requires an MKA policy that includes the pre-shared-key, applied to the interface, and the macsec command to enable MACsec. The MKA policy defines the PSK and other parameters, while the macsec command activates encryption on the link.

Answer

Configure 802.1X authentication with EAP-TLS to derive the MACsec keys

Answer

Configure a MACsec policy with cipher suite and apply it to the interface using the macsec command

Answer

Configure mka key-server priority and mka pre-shared-key on the interface

Question 9

A network administrator is configuring a Cisco IOS router to act as a VPN endpoint for remote users. The requirement is to use a protocol that provides encryption and authentication at Layer 3 and supports dynamic routing protocols over the tunnel. Which technology should be implemented?

Accepted Answer

GRE tunnel with IPsec protection. GRE can carry multicast and broadcast traffic, enabling dynamic routing protocols across the tunnel. When protected by IPsec, the GRE traffic is encrypted and authenticated at Layer 3. This combination satisfies the need for both confidentiality and routing protocol support on a Cisco IOS router acting as a VPN endpoint.

Answer

IPsec in transport mode with AH only

Answer

DMVPN with mGRE and NHRP

Answer

SSL VPN using the AnyConnect client

Question 10

A network engineer is configuring 802.1X authentication on a Cisco Catalyst switch. The switch will use RADIUS with Cisco ISE as the authentication server. The engineer wants to ensure that devices that do not support 802.1X, such as printers and legacy IP phones, can still access the network securely. Which two features should the engineer configure to achieve this? (Choose two.)

Accepted Answer

Flexible Authentication with 802.1X and MAB. To support non-802.1X devices, the engineer should configure MAC Authentication Bypass (MAB) to authenticate based on MAC address, and Flexible Authentication to allow the switch to attempt 802.1X first and fall back to MAB if the device does not respond. Together, these features provide a secure and seamless onboarding experience for both 802.1X-capable and legacy devices.

Answer

802.1X supplicant on the switch

Answer

Dynamic ARP Inspection (DAI)

Answer

Port security with sticky MAC addresses

Question 11

A network administrator is securing OSPFv2 on a Cisco router. The requirement is to authenticate every OSPF packet exchanged on interface GigabitEthernet0/0 using a key chain that supports key rotation, with MD5 hashing. Which configuration accomplishes this?

Accepted Answer

key chain OSPF-KEYS
 key 1
  key-string Cisco123
  cryptographic-algorithm md5
interface GigabitEthernet0/0
 ip ospf authentication key-chain OSPF-KEYS. OSPFv2 supports authentication via a key chain that can hold multiple keys with independent lifetimes, allowing rotation without service interruption. Referencing the key chain on the interface with the OSPF authentication command and specifying MD5 as the cryptographic algorithm satisfies both the rotation and hashing requirements. Static per-interface keys and area-level MD5 lack the rotation capability the design calls for.

Answer

key chain OSPF-KEYS
 key 1
  key-string Cisco123
  cryptographic-algorithm hmac-sha-256
interface GigabitEthernet0/0
 ip ospf authentication key-chain OSPF-KEYS

Answer

interface GigabitEthernet0/0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 Cisco123

Answer

router ospf 1
 area 0 authentication message-digest
interface GigabitEthernet0/0
 ip ospf message-digest-key 1 md5 Cisco123

Question 12

A network engineer is configuring MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches on a trunk link. The engineer wants to ensure that the MACsec session is established and that encryption is active. Which command should be used to verify the MACsec session status and encryption on the interface?

Accepted Answer

show macsec interface GigabitEthernet1/0/1. The show macsec interface command is the correct way to verify MACsec session status and encryption on a specific interface. It shows whether the session is secured, the encryption mode, and other details. The other commands either are invalid syntax or only show MKA session information without confirming encryption status on the interface.

Answer

show interfaces GigabitEthernet1/0/1 macsec

Answer

show mka session

Answer

show macsec mka session interface GigabitEthernet1/0/1

Question 13

A network administrator is deploying MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches. The administrator wants to ensure that the MACsec session is established correctly. Which two statements about MACsec configuration on Cisco IOS are true? (Choose two.)

Accepted Answer

MACsec can be configured using the 'macsec' command under the interface configuration mode.. MACsec is enabled on an interface with the 'macsec' command, and because it is a point-to-point protocol, it must be configured on both ends of the link. While 802.1X can be used for key management, it is not mandatory; pre-shared keys are also supported. MACsec encrypts the frame payload but not the MAC addresses, and it can be used on both switch and routed ports.

Answer

MACsec requires the use of 802.1X authentication to establish the secure session.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec can only be configured on routed ports, not switch ports.

Question 14

A network engineer is configuring a Cisco IOS router to authenticate management access using TACACS+ with a Cisco ISE server. The engineer wants to ensure that authorization is performed per-command and that accounting records are sent to the server. Which set of commands must be configured on the router?

Accepted Answer

aaa authentication login default group tacacs+ local, aaa authorization commands default group tacacs+, aaa accounting commands default start-stop group tacacs+. TACACS+ supports per-command authorization and accounting, which RADIUS does not. Configuring aaa authorization commands and aaa accounting commands with the tacacs+ group ensures that each command entered by an administrator is authorized and logged. The aaa new-model command must be enabled first, and authentication login should reference the TACACS+ group.

Answer

aaa authentication login default group tacacs+ local, aaa authorization exec default group tacacs+ local, aaa accounting exec default start-stop group tacacs+

Answer

aaa new-model, aaa authentication login default group tacacs+ local, aaa authorization exec default group tacacs+ local, aaa accounting network default start-stop group tacacs+

Answer

aaa authentication login default group radius local, aaa authorization commands default group radius, aaa accounting commands default start-stop group radius

Question 15

A network administrator is deploying MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches connected via a point-to-point link. The administrator configures the switchport with 'macsec' and 'dot1x' commands, but the link fails to come up. The administrator verifies that both switches support MACsec and are running compatible IOS XE versions. Which additional configuration is required to establish the MACsec session?

Accepted Answer

Enable MKA (MACsec Key Agreement) by configuring an MKA policy and applying it to the interface.. MACsec on Cisco switches requires MKA to dynamically negotiate keys when used with 802.1X. The interface configuration must include an MKA policy that defines the key server priority and other parameters. Without this policy, the MACsec session cannot be established, causing the link to fail. Applying the MKA policy to the interface completes the configuration and allows the secure session to come up.

Answer

Ensure that the global 'macsec' command is configured on both switches to enable the feature.

Answer

Configure a pre-shared key (PSK) for MACsec on both switches using the 'macsec key' command.

Answer

Configure the switchport to use 'macsec network-link' mode instead of the default 'macsec' mode.