CCNP Security Practice Test 6 — 15 Questions

Question 1

A network administrator is configuring a Cisco ASA firewall to allow outside users to access an internal web server at 192.168.1.10 on port 443. The ASA is running software version 9.12. The administrator wants to use the modern NAT configuration that automatically creates the necessary access control list entry. Which command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

object network WEB-SERVER
 host 192.168.1.10
 nat (inside,outside) static 203.0.113.10. In ASA 9.12, the object network configuration with nat (inside,outside) static public-ip automatically creates the necessary ACL to allow inbound access to the mapped address. This provides a one-to-one static NAT for the web server, enabling outside users to reach it on port 443 without manual ACL configuration.

Answer

access-list OUTSIDE-IN extended permit tcp any host 192.168.1.10 eq 443
access-group OUTSIDE-IN in interface outside

Answer

nat (inside,outside) source static WEB-SERVER interface service tcp 443 443

Answer

object network WEB-SERVER
 host 192.168.1.10
 nat (inside,outside) static interface service tcp 443 443

Question 2

A company uses Cisco ISE for 802.1X and wants to also authenticate corporate laptops when they are off-site and connected to public Wi-Fi. The security team requires that the same corporate credentials be used and that the authentication be resistant to credential theft over untrusted networks. Which Cisco solution should be deployed on the laptops?

Accepted Answer

Cisco AnyConnect Network Access Manager with EAP-TLS, using machine certificates issued by the corporate PKI.. AnyConnect NAM acts as an 802.1X supplicant supporting EAP-TLS with machine certificates, authenticating the laptop to ISE without transmitting reusable passwords, which is ideal for off-site public Wi-Fi. ISE-PIC is server-side, Umbrella is DNS security, and EAP-FAST with passwords still exposes reusable credentials, so none meet the requirement as directly.

Answer

Cisco Umbrella Roaming Client with DNS-layer security to authenticate users against ISE via SAML.

Answer

Cisco Identity Services Engine Passive Identity Connector installed on each laptop to map user identity to IP address.

Answer

Cisco Secure Client with EAP-FAST and PAC provisioning, relying on the user's Active Directory password for authentication.

Question 3

A network security engineer is configuring a Zone-Based Firewall (ZBFW) on a Cisco IOS router. The engineer defines a zone pair from the INSIDE zone to the OUTSIDE zone and applies a policy that inspects HTTP and HTTPS traffic. However, return traffic from the OUTSIDE to the INSIDE is being dropped. What is the most likely cause of this issue?

Accepted Answer

The 'inspect' action is not applied to the correct class-map in the policy-map for the INSIDE-to-OUTSIDE zone pair.. The most likely cause is that the 'inspect' action was not applied to the class-map matching HTTP/HTTPS in the INSIDE-to-OUTSIDE policy. Without inspection, the router does not maintain state, so return traffic is dropped. Stateful inspection automatically permits return traffic for sessions that are inspected, so no reverse zone pair or additional actions are needed.

Answer

The policy-map does not include the 'inspect' action for the return traffic.

Answer

The 'pass' action is required for return traffic in the OUTSIDE-to-INSIDE zone pair.

Answer

The zone pair from OUTSIDE to INSIDE is not configured, so return traffic is not permitted.

Question 4

A network administrator is configuring a Cisco ASA firewall to allow outside users to access an internal web server at 192.168.1.10 on port 443. The ASA is running software version 9.12. The administrator wants to use the modern NAT configuration that automatically creates the necessary access control list entry. Which command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cisco IOS SSL VPN (WebVPN) with AnyConnect and associated access policies. Cisco IOS SSL VPN, also known as WebVPN, terminates AnyConnect TLS sessions and integrates with AAA to enforce user- and group-based access policies. This is the feature that allows application-layer inspection inside the TLS tunnel and granular policy enforcement for remote workers. ZBFW, CBAC, and site-to-site IPsec do not terminate AnyConnect sessions or provide the required identity-aware application visibility.

Answer

Zone-Based Policy Firewall (ZBFW)

Answer

IPsec Site-to-Site VPN with IKEv2

Answer

Cisco IOS SSL VPN with Context-Based Access Control (CBAC)

Question 5

A network engineer is configuring IPsec VPN on a Cisco IOS router. The security policy requires that the data payload be encrypted and that the integrity of the packet be verified. The engineer wants to use the strongest available encryption algorithm supported by the platform and a hashing algorithm that provides strong integrity protection. Which combination of IPsec transform parameters should be configured?

Accepted Answer

esp-aes 256 and esp-sha256-hmac. ESP with AES 256-bit encryption delivers the strongest confidentiality, while SHA-256 HMAC provides robust integrity and authentication. Together they satisfy the policy requiring both encryption and integrity verification using the strongest algorithms available on Cisco IOS platforms.

Answer

esp-3des and esp-md5-hmac

Answer

ah-sha-hmac and esp-aes 256

Answer

esp-aes 128 and esp-sha1-hmac

Question 6

A network administrator is deploying 802.1X on a Cisco Catalyst switch with Cisco ISE as the RADIUS server. The switch ports must support both 802.1X-capable devices and non-supplicant devices such as printers. The requirement is to authenticate supplicants and allow non-supplicants into a restricted VLAN. Which feature should the administrator configure on the switch ports to meet this requirement?

Accepted Answer

Enable MAB (MAC Authentication Bypass) on the switch ports so that non-supplicant devices can be authenticated by their MAC address and placed into a restricted VLAN if needed.. MAB enables non-supplicant devices to be authenticated by their MAC address, working alongside 802.1X for supplicants. When configured on switch ports, supplicants use 802.1X, while devices without a supplicant fall back to MAB. ISE can then authorize them into a restricted VLAN, satisfying the requirement to support both device types securely.

Answer

Configure the authentication host-mode as multi-auth and enable the restricted VLAN with the authentication event fail action authorize vlan command.

Answer

Configure the authentication port-control mode as auto and apply an ACL to restrict non-supplicant traffic.

Answer

Enable web authentication on the switch ports to allow non-supplicant devices to authenticate through a browser.

Question 7

A network engineer is deploying Cisco Identity Services Engine (ISE) for wired 802.1X authentication. The requirement is that endpoints which do not support 802.1X supplicants must still be authenticated and placed into a restricted VLAN until they can be remediated. The switches are Cisco Catalyst 9000 series running IOS-XE. Which combination of features on the switch and ISE is required to support this behavior?

Accepted Answer

MAB with a restricted VLAN (auth-fail VLAN) configured on the switch port. MAB authenticates endpoints that lack an 802.1X supplicant by using the MAC address as the identity. When the endpoint is not authorized or fails MAB, the switch can place the port into the auth-fail VLAN, which serves as the restricted VLAN for remediation. This combination on Catalyst 9000 switches running IOS-XE, with ISE as the RADIUS server, delivers the required behavior for non-supplicant endpoints.

Answer

MAB with a critical VLAN configured on the switch port

Answer

802.1X with MACsec and a guest VLAN

Answer

WebAuth with a guest VLAN and downloadable ACLs

Question 8

A network administrator is configuring a Cisco ASA firewall to allow outside users to access an internal web server at 192.168.1.10 on port 443. The ASA is running software version 9.12. The administrator wants to use the modern NAT configuration that automatically creates the necessary access control list entry. Which command accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An inbound ACL that permits only the internal subnet as the source and denies all other source addresses. An inbound ACL on the LAN interface that permits only the internal subnet as a source and denies everything else directly prevents hosts from spoofing outside addresses. It is deterministic and does not rely on DHCP snooping or routing symmetry, unlike IP Source Guard or uRPF, and it operates at Layer 3 where the router enforces the policy.

Answer

Unicast Reverse Path Forwarding in strict mode

Answer

Dynamic ARP Inspection on the LAN interface

Answer

IP Source Guard

Question 9

A network engineer is configuringControl Plane Policing (CoPP) on a Cisco router to protect the route processor from excessive traffic. The engineer wants to rate-limit SSH traffic destined to the router's management IP address. Which CoPP action should be taken for traffic that exceeds the configured rate?

Accepted Answer

Drop. CoPP uses policy-maps to define actions for traffic that exceeds configured rates. The 'drop' action discards excess packets, which is suitable for non-critical management traffic like SSH to protect the route processor. The 'transmit' action would allow all packets, defeating the purpose. 'Police' and 'mark' are not valid CoPP actions for rate-limiting in this context.

Answer

Transmit

Answer

Mark

Answer

Police

Question 10

A network security engineer is deploying 802.1X authentication on Cisco switches with Cisco Identity Services Engine (ISE) as the RADIUS server. The engineer must ensure that the switch dynamically assigns the appropriate VLAN to authenticated endpoints based on their identity group. Which two configurations are required on the switch to support dynamic VLAN assignment? (Choose two.)

Accepted Answer

Configure the switch to use RADIUS for authentication and authorization.. Dynamic VLAN assignment requires the switch to use RADIUS for authentication and authorization so it can process the VLAN attributes sent by ISE. Additionally, the switch ports must be enabled as 802.1X authenticators to perform the authentication exchange. Together, these allow the switch to receive and apply the VLAN assignment from the RADIUS server, placing the endpoint in the correct VLAN based on its identity group.

Answer

Enable MACsec on the switch ports to encrypt the VLAN assignment attributes.

Answer

Configure the switch to use TACACS+ for authorization to enforce VLAN assignment.

Answer

Configure the switch to use the 'aaa authorization network default group radius' command.

Question 11

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Accepted Answer

switchport port-security maximum 2
switchport port-security violation shutdown. The 'shutdown' violation mode places the interface into an err-disabled state when a port security violation occurs, which matches the requirement to disable the interface. The 'maximum 2' command limits the number of allowed MAC addresses to two, and the first two learned MAC addresses are dynamically secured. This combination ensures that any additional MAC address triggers a violation and disables the port.

Answer

switchport port-security maximum 2
switchport port-security violation err-disable

Answer

switchport port-security maximum 2
switchport port-security violation protect

Answer

switchport port-security maximum 2
switchport port-security violation restrict

Question 12

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Accepted Answer

authentication port-control auto. 'authentication port-control auto' is the required interface command to enable 802.1X authentication on a switch port. This command sets the port to initiate the authentication process, placing it in the unauthorized state until the client successfully authenticates via the RADIUS server (Cisco ISE). Without this command, the port will not enforce 802.1X.

Answer

dot1x pae authenticator

Answer

authentication port-control force-authorized

Answer

authentication port-control force-unauthorized

Question 13

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Accepted Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop. It uses the 'match protocol ssh' class-map to identify SSH traffic, applies a police rate of 1,000,000 bps (1 Mbps) with a burst of 2000 bytes, and includes a class-default with a police rate of 8000 bps to drop all other control-plane traffic exceeding a default rate. This matches the requirement to rate-limit SSH and drop other traffic that exceeds a default rate, which is a common CoPP best practice to protect the control plane.

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match access-group name SSH_ACL
policy-map COPP
 class SSH
  police 1000000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop

Answer

class-map match-all SSH
 match protocol ssh
policy-map COPP
 class SSH
  police 2000 1000000 conform-action transmit exceed-action drop

Question 14

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Accepted Answer

access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443. In transparent mode, the ASA acts as a Layer 2 bridge, so traffic must be permitted by a global access list applied to the bridge group virtual interface (BVI). Option D correctly uses the GLOBAL access list to permit TCP traffic from the inside subnet (192.168.1.0/24) to any destination on port 443 (HTTPS), which satisfies the security policy.

Answer

access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
access-group INSIDE in interface inside

Answer

access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any

Answer

access-list GLOBAL extended permit tcp any any eq 443

Question 15

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Accepted Answer

Disable Dynamic Trunking Protocol (DTP) on all access ports.. Disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Answer

Configure switchport mode dynamic auto on all ports.

Answer

Set the native VLAN to VLAN 1 on all trunk ports.

Answer

Use 802.1Q trunking instead of ISL.