100-150 Security — All Questions With Answers

Study the full ACL explanation →

A network administrator needs to prevent unauthorized devices from connecting to switch ports. Which feature provides the most effective Layer 2 security by verifying the MAC address of the connected device against a database?

Question 5mediummulti select

Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?

Question 6hardmultiple choice

Refer to the exhibit. What is the expected behavior if a second device with a different MAC address is plugged into this port?

Exhibit

switch(config-if)# switchport port-security violation shutdown
switch(config-if)# switchport port-security maximum 1
switch(config-if)# switchport port-security mac-address sticky

Question 7easymultiple choice

Study the full AAA explanation →

Which protocol is recommended for secure remote management of Cisco network devices over insecure networks?

Question 8mediummultiple choice

An organization wants to implement a security policy that requires users to authenticate against a centralized server before gaining network access. Which protocol provides the necessary AAA framework to achieve this?

Question 9mediummultiple choice

Study the full ACL explanation →

Which security threat involves an attacker sending unsolicited and massive amounts of traffic to a network service to make it unavailable to legitimate users?

Question 10hardmultiple choice

Refer to the exhibit. What is the result of applying this ACL to a router interface, and what is its implication for other traffic?

Exhibit

access-list 101 permit tcp any any eq 80
access-list 101 deny ip any any

Question 11mediummultiple choice

Which security feature is used to mitigate DHCP starvation attacks by limiting the number of DHCP messages per port?

Question 12mediummulti select

Which THREE of the following are considered best practices for hardening a Cisco network device?

Question 13mediummultiple choice

Study the full AAA explanation →

An administrator wants to ensure that only legitimate DHCP servers provide IP addresses to clients on the network. Which feature should be enabled?

Question 14easymultiple choice

Which of the following is a primary goal of the 'Accounting' component in the AAA security framework?

Question 15mediummultiple choice

Which Cisco feature is used to prevent Man-in-the-Middle attacks that rely on corrupting the ARP cache of connected hosts?

Question 16hardmulti select

Which TWO of the following are valid methods for securing the administrative access of a Cisco device?

Question 17easymultiple choice

What is the primary function of a firewall when placed at the edge of a network?

Question 18mediummultiple choice

Refer to the exhibit. What is the effect of the 'ip dhcp snooping trust' command on the designated interface?

Exhibit

switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping vlan 10
switch(config-if)# ip dhcp snooping trust

Question 19easymultiple choice

Read the full network assurance explanation →

A small business owner wants to ensure that internal financial records are only viewed by authorized management personnel. Which pillar of the CIA triad is primarily addressed by implementing restricted folder permissions and encryption for these files?

Question 20mediummultiple choice

Which port security violation mode will drop packets from an unauthorized MAC address, increment the security violation counter, and send a syslog message, but will not shut down the interface?

Question 21easymultiple choice

Study the full AAA explanation →

An employee receives an email that appears to be from the company's IT department, requesting their login credentials to perform an urgent system update. What type of social engineering attack does this represent?

Question 22mediummultiple choice

Which component of the AAA security framework is responsible for determining which specific commands a user is permitted to execute on a Cisco router after they have successfully logged in?

Question 23easymultiple choice

Read the full VPN explanation →

A company requires employees to use both a password and a one-time code sent to their mobile device to access the corporate VPN. Which security concept is being implemented?

Question 24mediummulti select

Read the full VPN explanation →

A network administrator needs to implement a VPN solution. Which TWO types of VPNs are commonly used in enterprise environments? (Choose TWO).

Question 25hardmulti select

Which THREE features are introduced or enhanced in WPA3 to improve wireless security compared to WPA2? (Choose THREE).

Question 26mediummulti select

A network technician is selecting devices to protect a corporate network from external threats. Which TWO devices provide active threat mitigation by inspecting and blocking malicious traffic? (Choose TWO).

Question 27mediummultiple choice

A technician is configuring DHCP snooping on a Cisco switch to prevent rogue DHCP servers. On which type of port should the technician apply the 'ip dhcp snooping trust' command?

Question 28easymultiple choice

A company wants to prevent unauthorized individuals from entering the server room by following closely behind an employee. Which physical security control is specifically designed to address this risk?

Question 29easymultiple choice

A user discovers that all their files have been encrypted and a message is displayed demanding payment in exchange for the decryption key. What type of malware has infected the system?

Question 30mediummultiple choice

A network administrator needs to prevent unauthorized devices from connecting to a switch port while ensuring that only a specific workstation can access the network. Which security feature should be implemented?

Question 31easymultiple choice

Which of the following describes the primary purpose of a security policy in a network environment?

Question 32mediummulti select

Which TWO methods are considered effective for securing the control plane of Cisco networking devices? (Choose two.)

Question 33hardmultiple choice

Refer to the exhibit. Why is the interface fa0/1 currently in the 'Secure-shutdown' state?

Exhibit

Switch# show port-security interface fa0/1
Port Security              : Enabled
Port Status                : Secure-shutdown
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Max MAC Addresses          : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last MAC Address           : 0011.2233.4455

Question 34mediummultiple choice

Which feature is best suited to prevent VLAN hopping attacks where an attacker sends double-tagged 802.1Q frames to reach a restricted VLAN?

Question 35mediummultiple choice

A network technician is reviewing a Cisco switch configuration and sees that PortFast and BPDU Guard are enabled on an access port that connects to a user's desktop. The user calls and reports that they accidentally plugged a small unmanaged switch into that wall jack so they could connect both a PC and a printer. Shortly afterward, the port stopped forwarding traffic. What is the most likely explanation for this behavior?

Question 36easymultiple choice

A user at a branch office reports that when they browse to their bank's website, the browser displays a certificate warning and the address bar shows a lock with a red line through it. The help desk confirms the user's PC has the correct date and time. Which security concept is MOST likely being violated in this scenario?

Question 37easymultiple choice

A small office has a single Cisco wireless router providing both employee and guest access. The manager wants guests to reach the internet but must not be able to reach the internal file server or the printer on the office LAN. Which feature should be enabled on the wireless router to meet this requirement?

Question 38mediummultiple choice

A network administrator wants to prevent users on the corporate LAN from connecting unauthorized wireless access points and switches to wall jacks in conference rooms. The administrator needs a feature that restricts which MAC addresses are allowed to send traffic on each access port. Which Cisco switch feature should be configured?

Question 39easymultiple choice

Read the full VPN explanation →

A small office wants to keep its wireless network traffic private so that neighbors cannot read the data being transmitted. Which technology should be enabled on the wireless access point to encrypt traffic between clients and the access point?

Question 40easymultiple choice

A user at a branch office receives a phone call from someone claiming to be a help desk technician. The caller already knows the user's employee ID, manager's name, and the model of laptop issued to the user, and asks the user to read back the six-digit code that was just texted to their phone so the technician can 'verify the device.' The user complies, and minutes later the attacker logs into the corporate VPN using the user's credentials. Which type of attack has occurred?

Question 41mediummultiple choice

A network administrator is reviewing a Cisco switch configuration and sees that a port in the employee area has been configured with the 'switchport port-security' command and a maximum of one MAC address. A user unplugs their laptop and connects a different laptop to the same port. Assuming the default violation mode, what happens?

Question 42mediummulti select

A security team is reviewing how to protect a small office network from common Layer 2 attacks. The team wants to implement features that specifically prevent MAC address table overflow and ARP cache poisoning. Which two Cisco switch features should the team deploy? (Choose two.)

Question 43mediummultiple choice

A network administrator must ensure that only specific management stations can reach the management VLAN on a Cisco switch, while ordinary user traffic on other VLANs flows unrestricted. The administrator wants a mechanism that filters traffic based on source IP addresses and can log denied attempts. Which feature should be configured?

Question 44mediummultiple choice

A network administrator is configuring a Cisco switch and wants to ensure that only the designated uplink port can send DHCP server replies, while all other ports are prevented from acting as DHCP servers. Which command should be applied to the uplink port?

Question 45mediummulti select

A network team is hardening a Cisco Catalyst switch that will be deployed at the edge of the corporate network. They want to reduce the risk of Layer 2 attacks such as MAC flooding and unauthorized device attachment. Which two actions should they take? (Choose two.)

Question 46mediummultiple choice

A network administrator at a small clinic wants to prevent unauthorized users from plugging a personal laptop into an unused wall jack in the waiting room and obtaining an IP address on the internal VLAN. The clinic uses a Cisco Catalyst switch with 802.1X-capable access ports and a RADIUS server. Which solution best meets this requirement?

Question 47hardmultiple choice

A security team wants to protect users who connect laptops to the corporate wireless network from attackers who set up a nearby access point broadcasting the same SSID with a stronger signal. The requirement is that clients authenticate the network before associating and that the credentials never traverse the wireless medium in a recoverable form. Which technology satisfies these requirements?

Question 48mediummultiple choice

A company wants to ensure that even if an attacker steals a user's password, the attacker cannot log in without a second factor. Which authentication approach best meets this requirement?

Question 49easymultiple choice

A help desk technician receives a call from an employee who says they received a text message claiming to be from the bank's fraud department, asking them to click a link and confirm their online banking password. The employee has not clicked the link. Which type of attack is this?

Question 50hardmultiple choice

A security analyst notices that an attacker on the same VLAN as a user is sending forged ARP replies so that the user's traffic to the default gateway is redirected through the attacker's workstation. The switch is a Cisco Catalyst with DHCP snooping already configured and working. Which feature should the analyst enable to block this specific attack?

Question 51mediummulti select

Review the full subnetting walkthrough →

A small office wants to reduce the risk of malware arriving through email and malicious websites while keeping administration simple. Which two measures provide the strongest protection against these threats? (Choose two.)

Question 52mediummultiple choice

An attacker on the same subnet sends frames with forged source MAC addresses to overwhelm a switch's MAC address table, causing the switch to flood unicast traffic out all ports. Which switch feature should be enabled to prevent this behavior on access ports?

Question 53mediummulti select

A network engineer is hardening a new Cisco switch that will be deployed in a lobby area accessible to visitors. The engineer wants to protect against MAC flooding attacks and against unauthorized devices connecting to access ports. Which two measures should the engineer implement? (Choose two.)

Question 54easymultiple choice

A company's IT policy states that only members of the finance group may access the payroll application, and that all access to it must be logged. A technician is asked to enforce this at the network level. Which concept does this requirement primarily describe?

Question 55hardmultiple choice

A company issues employees corporate laptops that contain confidential project data. The security policy requires that if a laptop is lost or stolen, the data on its drive cannot be read even if the disk is removed and attached to another computer. Which control should be implemented?

Question 56hardmultiple choice