CCNP Security Practice Test 9 — 15 Questions

Question 1

A network administrator must secure management access to a Cisco IOS XE router so that only SSH version 2 is accepted and Telnet is disabled on all VTY lines. Which configuration accomplishes this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure transport input ssh on the VTY lines and set the SSH version to 2 globally.. Restricting management to SSH requires the transport input ssh command applied to the VTY lines, which removes Telnet as an accepted transport. Enforcing SSH version 2 with ip ssh version 2 ensures the stronger protocol is used. Together they block Telnet and guarantee only SSHv2 sessions are accepted on the router.

Answer

Configure line vty 0 4 with the exec-timeout command and set the SSH version to 2.

Answer

Configure transport input telnet ssh on the VTY lines and set the SSH version to 2.

Answer

Configure transport output ssh on the VTY lines and set the SSH version to 2.

Question 2

A network administrator is configuring MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two switches. Which two statements about MACsec are true? (Choose two.)

Accepted Answer

MACsec provides encryption and integrity for Ethernet frames at Layer 2.. MACsec (802.1AE) provides Layer 2 encryption and integrity for Ethernet frames, and it is commonly deployed with Cisco TrustSec for switch-to-switch links. It uses MKA for key agreement, not IPsec. It does not encrypt MAC addresses, and it is hop-by-hop rather than end-to-end.

Answer

MACsec requires IPsec to establish the secure channel.

Answer

MACsec encrypts the entire Ethernet frame including the source and destination MAC addresses.

Answer

MACsec provides end-to-end encryption between any two hosts in a campus network.

Question 3

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and runs SSH for management. The administrator wants to ensure that a sudden flood of BGP updates from a misbehaving peer does not starve the SSH management plane, while still allowing legitimate BGP traffic. Which CoPP configuration approach best meets this requirement?

Accepted Answer

Define separate class-maps for BGP and SSH, assign each to its own policy-map class with independent policers, then apply the policy-map globally with the service-policy command under control-plane.. Effective CoPP design uses granular classification so that different control-plane protocols are policed independently. BGP and SSH have very different traffic profiles, so placing them in separate classes with separate policers lets the administrator tightly limit BGP while reserving bandwidth for SSH. The policy-map must then be attached under the control-plane configuration to affect traffic punted to the route processor.

Answer

Apply an ACL that denies TCP port 179 from the ISP peer addresses directly to the BGP router process using the neighbor command.

Answer

Define a class-map matching BGP (TCP port 179) and SSH (TCP port 22) in a single class, then apply a single policer with a low rate to that combined class.

Answer

Configure a QoS policy-map with a priority queue for SSH and apply it outbound on the ISP-facing interfaces.

Question 4

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The administrator wants to protect the route processor from excessive control-plane traffic while still allowing legitimate routing protocol and management traffic. The administrator creates a class map that matches BGP, OSPF, and SSH traffic and applies a police action with a committed information rate. Which additional configuration element is required to complete the CoPP implementation?

Accepted Answer

Apply the policy map to the control plane using the service-policy input command under control-plane configuration mode.. CoPP is implemented by defining class maps to identify control-plane traffic, a policy map to apply actions such as police, and then attaching the policy map to the control plane with service-policy input under control-plane configuration mode. Without that attachment, the policy is never applied to control-plane traffic, so the route processor remains vulnerable to excessive protocol or management packets.

Answer

Configure a route map that matches the control-plane protocols and reference it in the policy map.

Answer

Apply the policy map to all physical interfaces using the service-policy input command under interface configuration mode.

Answer

Enable NetFlow on the router to export control-plane traffic statistics to a collector.

Question 5

A network engineer is deploying 802.1X on Catalyst access switches with Cisco ISE as the RADIUS server. Some endpoints, such as printers and badge readers, do not support 802.1X supplicants. The design must allow these devices onto a restricted VLAN while still requiring authentication for laptops. Which TWO mechanisms should the engineer configure to achieve this? (Choose two.)

Accepted Answer

Configure MAB (MAC Authentication Bypass) on the switch ports to authenticate non-supplicant devices using their MAC address against ISE.. The design needs one port configuration that serves both endpoint types. MAB authenticates non-supplicant devices by MAC address through ISE, and the authentication order of dot1x followed by mab ensures supplicant-capable laptops use 802.1X while printers and badge readers fall back to MAB. Together these provide differentiated, authenticated access without per-port manual reconfiguration.

Answer

Apply an ACL that permits only MAC addresses in the OUI range of the printer vendor.

Answer

Configure the switch to use TACACS+ for endpoint authentication instead of RADIUS.

Answer

Disable 802.1X on the ports used by non-supplicant devices and assign them to a static VLAN.

Question 6

A company uses Cisco TrustSec in its campus network. Security policy requires that a user authenticated by 802.1X be assigned a Security Group Tag (SGT) based on the user's Active Directory group, and that the SGT be carried to downstream switches for enforcement. The access switch is configured for 802.1X with Cisco ISE. Which combination of features must be enabled to meet the requirement?

Accepted Answer

SGT assignment via ISE authorization policy and inline tagging or SXP propagation on the switch uplinks. Cisco TrustSec assigns SGTs through ISE authorization rules that can reference Active Directory group membership. For the tag to reach downstream switches, the network must propagate it using inline tagging on capable links or SXP where inline tagging is not supported. This enables consistent group-based enforcement across the campus.

Answer

SGT assignment via ISE and enabling MACsec on all inter-switch links

Answer

SGT assignment via ISE and enabling 802.1X on all downstream switch ports

Answer

SGT assignment via ISE and configuring dynamic ARP inspection on all switches

Question 7

A network administrator must protect the control plane of a Cisco IOS XE router that peers BGP with an ISP. The requirement is to rate-limit specifically ARP and IPv4 TTL-expired packets destined to the route processor while allowing all other transit traffic to be forwarded normally. Which CoPP implementation step is required to achieve this?

Accepted Answer

Create an ACL matching ARP and TTL-expired traffic, reference it in a class-map of type control-plane, define a policy-map with police actions, and attach it with service-policy type control-plane in global configuration.. CoPP uses MQC with a class-map of type control-plane to identify traffic punted to the route processor, a policy-map to police that class, and a global service-policy type control-plane attachment. Matching ARP and TTL-expired packets with an ACL inside the class-map isolates exactly the traffic to be rate-limited, while transit traffic continues to be forwarded in hardware and is never inspected by CoPP.

Answer

Enable Control Plane Protection with a port-filter policy that drops ARP and TTL-expired packets before they reach the route processor.

Answer

Apply an ACL directly to the BGP peer interface inbound to deny ARP and TTL-expired packets, then rely on uRPF to drop remaining control-plane traffic.

Answer

Configure an MQC service policy with service-policy type control-plane on the BGP-facing interface to rate-limit ARP and TTL-expired packets.

Question 8

A network security team deploys Cisco TrustSec on a Catalyst 9500 fabric. The team wants to enforce a policy where a user authenticated into the 'Contractor' security group tag (SGT) is denied access to servers tagged with the 'Finance' SGT, while remaining able to reach the 'Printers' SGT. Which enforcement mechanism applies the SGACL to traffic between the tagging devices?

Accepted Answer

SGACL enforcement applied on the egress enforcement device using the SGT carried in the Cisco Metadata (CMD) header.. Cisco TrustSec enforces group-based policy by inserting the source SGT into the Cisco Metadata header and evaluating SGACLs on the egress enforcement device against the destination SGT. The policy matrix authored on ISE defines deny Contractor-to-Finance and permit Contractor-to-Printers, and the enforcement device applies it inline. SXP only propagates bindings, dACLs only filter at the port, and MACsec only secures the link.

Answer

802.1X with downloadable ACLs pushed from Cisco ISE to the access switch on the user's port.

Answer

SGT Exchange Protocol (SXP) on the enforcement device, mapping IP addresses to SGTs at the egress point.

Answer

MACsec encryption with MKA on the fabric uplinks, which implicitly denies unauthorized SGT combinations.

Question 9

An engineer is configuring an IPsec site-to-site VPN between two Cisco IOS XE routers. Phase 1 completes successfully, but Phase 2 fails and no interesting traffic is encrypted. The engineer confirms that the ACLs on both peers mirror each other correctly. Which configuration element should be verified next to resolve the Phase 2 failure?

Accepted Answer

Verify that the transform set on both peers specifies matching encryption and integrity algorithms for Phase 2.. IPsec Phase 2 negotiation, also called quick mode, relies on matching transform sets that define the encryption and integrity algorithms for the data SA. When Phase 1 succeeds but Phase 2 fails, mismatched transform sets are a common cause. Verifying that both peers use identical transform set definitions resolves the negotiation failure.

Answer

Verify that the Diffie-Hellman group in the ISAKMP policy matches the group used in the transform set.

Answer

Verify that the crypto map sequence number is higher on the responding peer than on the initiating peer.

Answer

Verify that the ISAKMP policy on both peers uses the same pre-shared key for Phase 1 authentication.

Question 10

A network security engineer is deploying MACsec on a Cisco Catalyst 9000 switch. The switch is connected to a Cisco IP phone that does not support MACsec, and a PC is connected to the phone. The engineer wants to encrypt traffic between the switch and the phone, but the phone does not support MACsec. What should the engineer do to secure the link?

Accepted Answer

Replace the phone with a MACsec-capable model or use a different encryption method such as IPsec for the traffic.. MACsec is a link-layer encryption protocol that requires both endpoints to support it. If the IP phone does not support MACsec, the switch cannot encrypt traffic to the phone at Layer 2. The engineer must either replace the phone with a MACsec-capable model or use a higher-layer encryption method such as IPsec to secure the traffic.

Answer

Use a MACsec-capable switch port and enable `macsec` with `fallback` to allow unencrypted traffic if the phone does not support it.

Answer

Configure the switch port to use MACsec for the PC traffic and leave the phone traffic unencrypted.

Answer

Enable MACsec on the switch port with `macsec` and configure the phone to use 802.1X with MAB.

Question 11

A network engineer is deploying MACsec on a Cisco Catalyst 9300 switch to secure a point-to-point link between two access switches. The engineer configures the switchport with the macsec command and a pre-shared key. After applying the configuration, the link comes up but MACsec is not encrypting traffic. Which action should the engineer take to resolve the issue?

Accepted Answer

Configure the key server protocol (MKA) with a matching connectivity association key (CAK) on both switches and ensure the key server priority is set.. MACsec relies on MKA to establish a secure channel between two directly connected devices. For MKA to succeed, both peers must share the same connectivity association key and agree on the key server. If these parameters are missing or mismatched, the link remains up but MACsec encryption does not activate. Verifying and matching the MKA configuration on both switches is the correct troubleshooting step.

Answer

Apply the macsec command under the VLAN interface instead of the physical interface.

Answer

Change the switchport mode to trunk to allow MACsec frames to pass.

Answer

Enable MACsec globally using the macsec command in global configuration mode.

Question 12

An engineer is configuring a Cisco IOS XE switch to secure the management plane. The requirement is to allow SSH only from the management subnet 10.10.10.0/24 and block all other management protocols such as Telnet and HTTP. Which configuration approach best meets this requirement?

Accepted Answer

Apply an ACL to the VTY lines with transport input ssh and configure the ACL to permit 10.10.10.0/24 only.. The VTY lines control remote management access. Setting transport input ssh disables Telnet and other line protocols, while an access-class ACL applied to the VTY lines filters source addresses before login. Permitting only 10.10.10.0/24 satisfies the subnet restriction. Together these settings secure the management plane by limiting both the protocol and the source of administrative connections.

Answer

Configure an ACL on the management VLAN SVI to deny Telnet and HTTP, and rely on the default transport input all on the VTY lines.

Answer

Enable AAA with a local database and configure privilege levels so that only users from 10.10.10.0/24 can log in.

Answer

Configure ip http secure-server, disable ip http server, and apply an ACL to the VTY lines that permits any source using SSH.

Question 13

A network engineer is hardening a Cisco IOS XE router that terminates IPsec site-to-site tunnels with remote branches. The security policy requires that the router only accept IKEv2 negotiations using cryptographically strong parameters and that it validate peer identity via certificates issued by the corporate PKI. Which two configuration elements must the engineer apply to meet these requirements? (Choose two.)

Accepted Answer

Configure an IKEv2 proposal that includes aes-cbc-256 for encryption, sha512 for integrity, and group 19 for the DH key exchange.. Meeting the policy requires two things: an IKEv2 proposal that enforces strong encryption, integrity, and DH groups, and an IKEv2 profile that authenticates both local and remote peers with RSA signatures validated against the corporate PKI trustpoint. PSK keyrings, DPD timers, and SA throttling controls address other concerns and do not satisfy the cryptographic-strength or certificate-validation requirements.

Answer

Configure 'crypto ikev2 limit max-in-negotiation-sa 10' on the router to throttle aggressive IKEv2 negotiations.

Answer

Configure 'crypto ikev2 dpd 10 3 periodic' to detect dead peers and tear down stale SAs quickly.

Answer

Configure an IKEv2 keyring with pre-shared keys per peer and bind the keyring to the IKEv2 profile.

Question 14

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce role-based access control between endpoints without relying on IP addresses or VLANs, and they need to ensure that access policies are consistently applied even when endpoints move between switches. The administrator has already configured Cisco ISE for authentication and authorization. Which technology should be used to propagate the security group tag (SGT) information to network devices that do not support SGT tagging natively?

Accepted Answer

SXP (SGT Exchange Protocol). SXP is designed to share SGT-to-IP bindings with devices that cannot natively tag packets with SGTs, enabling consistent role-based access control across mixed hardware. The other options either provide encryption, authentication, or tunneling but do not propagate SGT information. In a Cisco TrustSec deployment where some switches lack hardware SGT support, SXP bridges the gap so that SGACLs can still be enforced based on the endpoint's security group.

Answer

MACsec (802.1AE)

Answer

IPsec VPN tunnels

Answer

802.1X with EAP-TLS

Question 15

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and is managed over SSH. The administrator needs to protect the route processor from excessive BGP and SSH traffic without breaking the existing sessions. Which action should be taken when applying the CoPP policy?

Accepted Answer

Apply the policy-map to the control-plane interface using the service-policy input command.. CoPP is designed to classify and police traffic destined to the route processor. The policy-map must be attached to the control-plane interface with service-policy input so that only CPU-bound traffic is policed while transit traffic remains unaffected, preserving BGP peering and SSH management access.

Answer

Apply the policy-map to the management VRF interface using service-policy input.

Answer

Apply the policy-map globally with the service-policy command in global configuration mode.

Answer

Apply the policy-map to each ISP-facing physical interface with service-policy output.