100-150 Security — Timed 10 Questions

Question 1

Refer to the exhibit. A technician notices a port has stopped functioning. Based on the output, what is the most likely cause of the interface status?

Accepted Answer

An unauthorized device was connected to the port.. While the logic regarding port-security is sound, the question is incomplete without the exhibit. To be valid, the exhibit must show the 'Port Status' as 'secure-shutdown' or 'err-disabled' with a violation count.

Answer

The switch port has experienced a hardware failure.

Answer

An administrator manually disabled the port with the 'shutdown' command.

Answer

The port is experiencing a duplex mismatch with the connected host.

Question 2

A small office network uses a Cisco router for internet connectivity. The administrator wants to prevent users from accessing a known malicious website by blocking all traffic to its IP address. Which security feature should the administrator configure on the router to achieve this?

Accepted Answer

An access control list (ACL) applied to the inbound interface. To block traffic to a specific external IP address, an ACL should be applied inbound on the interface connected to the internal network. This ensures that packets destined for the malicious IP are dropped before they are routed. Outbound ACLs would not prevent internal users from initiating connections. Port security and VACLs are not appropriate for this task on a router.

Answer

An access control list (ACL) applied to the outbound interface

Answer

Port security on the switch port connected to the router

Answer

A VLAN access map (VACL) on the router

Question 3

A network engineer is hardening a Cisco switch that serves a public lobby. The engineer wants to ensure that if an unauthorized device is plugged into an access port, the port automatically stops forwarding traffic and generates a syslog message, but does not require manual intervention to recover. Which port security violation mode and recovery configuration should the engineer use?

Accepted Answer

violation restrict with errdisable recovery cause psecure-violation. Restrict mode drops the violating traffic, increments the security violation counter, and generates a syslog message, which meets the logging requirement. Configuring errdisable recovery for the psecure-violation cause lets the port automatically return to service after the recovery timer expires, so no manual intervention is needed, making this combination the best fit for the lobby access ports.

Answer

violation protect with errdisable recovery cause psecure-violation

Answer

violation shutdown with errdisable recovery cause psecure-violation

Answer

violation shutdown with no errdisable recovery configured

Question 4

A network administrator needs to prevent unauthorized devices from connecting to switch ports. Which feature provides the most effective Layer 2 security by verifying the MAC address of the connected device against a database?

Accepted Answer

Port Security. Port Security allows administrators to secure access to ports by locking a specific MAC address to that port. This prevents unauthorized devices from gaining network access. In a Cisco enterprise environment, this is a fundamental defense-in-depth measure against unauthorized physical access. By restricting the number and identity of MAC addresses, the network remains resilient against simple spoofing or unauthorized hardware insertions, ensuring that only trusted endpoints communicate through the designated access layer infrastructure.

Answer

DHCP Snooping

Answer

BPDU Guard

Answer

Dynamic ARP Inspection

Question 5

Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?

Accepted Answer

Restricting unauthorized network access. ACLs are essential tools for traffic filtering and network segmentation. By controlling which packets are permitted or denied based on source, destination, and protocol, administrators enforce security policies at the network edge or between VLANs. Understanding how ACLs manage traffic flow is critical for maintaining network integrity and preventing unauthorized data access, as they provide the fundamental mechanism for restricting communication between sensitive network segments in a controlled and highly audit-able manner.

Answer

Encrypting sensitive data traffic

Answer

Automatically updating firmware

Answer

Providing hardware redundancy

Question 6

Refer to the exhibit. What is the expected behavior if a second device with a different MAC address is plugged into this port?

Accepted Answer

The port will move to err-disabled state.. The 'shutdown' violation mode triggers an immediate err-disable state on the interface when a security violation occurs. By setting the maximum to 1 and using sticky MAC learning, the switch locks the first learned address. A second device triggers the security policy, disabling the port to protect the network. This mechanism is vital for stopping unauthorized device connections, forcing administrators to manually re-enable the port after investigating the potential security breach.

Answer

The port will remain up and drop the traffic.

Answer

The port will alert the console but stay active.

Answer

The switch will replace the existing MAC.

Question 7

Which protocol is recommended for secure remote management of Cisco network devices over insecure networks?

Accepted Answer

SSH. Secure Shell (SSH) provides a secure, encrypted tunnel for remote command-line access. Unlike Telnet, which transmits data in plaintext and exposes administrative credentials to sniffing attacks, SSH ensures that both the connection and the session data are encrypted. Using SSH is a mandatory security best practice for any modern network infrastructure to protect against unauthorized access and credential theft while managing network devices from remote locations.

Answer

Telnet

Answer

HTTP

Answer

SNMPv1

Question 8

An organization wants to implement a security policy that requires users to authenticate against a centralized server before gaining network access. Which protocol provides the necessary AAA framework to achieve this?

Accepted Answer

RADIUS. The AAA framework (Authentication, Authorization, and Accounting) is the cornerstone of modern network security. Protocols like RADIUS and TACACS+ allow centralized management of user identity and access policies. By offloading authentication to a central server, administrators can ensure consistent security policies, audit trails for access, and rapid revocation of credentials, which is essential for scaling security across a complex enterprise network environment.

Answer

ICMP

Answer

DHCP

Answer

DNS

Question 9

Which security threat involves an attacker sending unsolicited and massive amounts of traffic to a network service to make it unavailable to legitimate users?

Accepted Answer

Denial of Service. Denial of Service (DoS) attacks focus on exhausting system resources or bandwidth. By overwhelming a target, the attacker prevents legitimate traffic from reaching the intended service. Understanding this threat is crucial for engineers who must implement traffic shaping, rate limiting, and ACLs to mitigate the impact of such attacks, thereby preserving the availability and reliability of critical network services for authorized users.

Answer

Phishing

Answer

Man-in-the-Middle

Answer

MAC Spoofing

Question 10

Refer to the exhibit. What is the result of applying this ACL to a router interface, and what is its implication for other traffic?

Accepted Answer

Permits only HTTP and blocks others.. The ACL permits HTTP traffic and implicitly denies everything else due to the 'deny ip any any' statement. This is a common 'whitelist' approach used to secure interfaces by allowing only necessary services. Understanding this logic is vital because every Cisco ACL has an implicit deny at the end; failing to explicitly permit required traffic will result in connectivity issues, making careful ACL planning essential for maintaining network functionality.

Answer

Permits all traffic including HTTP.

Answer

Permits all traffic except HTTP.

Answer

Allows all traffic by default.