100-150 Security — Timed 15 Questions

Question 1

Refer to the exhibit. A technician notices a port has stopped functioning. Based on the output, what is the most likely cause of the interface status?

Accepted Answer

An unauthorized device was connected to the port.. While the logic regarding port-security is sound, the question is incomplete without the exhibit. To be valid, the exhibit must show the 'Port Status' as 'secure-shutdown' or 'err-disabled' with a violation count.

Answer

The switch port has experienced a hardware failure.

Answer

An administrator manually disabled the port with the 'shutdown' command.

Answer

The port is experiencing a duplex mismatch with the connected host.

Question 2

A small office network uses a Cisco router for internet connectivity. The administrator wants to prevent users from accessing a known malicious website by blocking all traffic to its IP address. Which security feature should the administrator configure on the router to achieve this?

Accepted Answer

An access control list (ACL) applied to the inbound interface. To block traffic to a specific external IP address, an ACL should be applied inbound on the interface connected to the internal network. This ensures that packets destined for the malicious IP are dropped before they are routed. Outbound ACLs would not prevent internal users from initiating connections. Port security and VACLs are not appropriate for this task on a router.

Answer

An access control list (ACL) applied to the outbound interface

Answer

Port security on the switch port connected to the router

Answer

A VLAN access map (VACL) on the router

Question 3

A network engineer is hardening a Cisco switch that serves a public lobby. The engineer wants to ensure that if an unauthorized device is plugged into an access port, the port automatically stops forwarding traffic and generates a syslog message, but does not require manual intervention to recover. Which port security violation mode and recovery configuration should the engineer use?

Accepted Answer

violation restrict with errdisable recovery cause psecure-violation. Restrict mode drops the violating traffic, increments the security violation counter, and generates a syslog message, which meets the logging requirement. Configuring errdisable recovery for the psecure-violation cause lets the port automatically return to service after the recovery timer expires, so no manual intervention is needed, making this combination the best fit for the lobby access ports.

Answer

violation protect with errdisable recovery cause psecure-violation

Answer

violation shutdown with errdisable recovery cause psecure-violation

Answer

violation shutdown with no errdisable recovery configured

Question 4

A network administrator needs to prevent unauthorized devices from connecting to switch ports. Which feature provides the most effective Layer 2 security by verifying the MAC address of the connected device against a database?

Accepted Answer

Port Security. Port Security allows administrators to secure access to ports by locking a specific MAC address to that port. This prevents unauthorized devices from gaining network access. In a Cisco enterprise environment, this is a fundamental defense-in-depth measure against unauthorized physical access. By restricting the number and identity of MAC addresses, the network remains resilient against simple spoofing or unauthorized hardware insertions, ensuring that only trusted endpoints communicate through the designated access layer infrastructure.

Answer

DHCP Snooping

Answer

BPDU Guard

Answer

Dynamic ARP Inspection

Question 5

Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?

Accepted Answer

Restricting unauthorized network access. ACLs are essential tools for traffic filtering and network segmentation. By controlling which packets are permitted or denied based on source, destination, and protocol, administrators enforce security policies at the network edge or between VLANs. Understanding how ACLs manage traffic flow is critical for maintaining network integrity and preventing unauthorized data access, as they provide the fundamental mechanism for restricting communication between sensitive network segments in a controlled and highly audit-able manner.

Answer

Encrypting sensitive data traffic

Answer

Automatically updating firmware

Answer

Providing hardware redundancy

Question 6

Refer to the exhibit. What is the expected behavior if a second device with a different MAC address is plugged into this port?

Accepted Answer

The port will move to err-disabled state.. The 'shutdown' violation mode triggers an immediate err-disable state on the interface when a security violation occurs. By setting the maximum to 1 and using sticky MAC learning, the switch locks the first learned address. A second device triggers the security policy, disabling the port to protect the network. This mechanism is vital for stopping unauthorized device connections, forcing administrators to manually re-enable the port after investigating the potential security breach.

Answer

The port will remain up and drop the traffic.

Answer

The port will alert the console but stay active.

Answer

The switch will replace the existing MAC.

Question 7

Which protocol is recommended for secure remote management of Cisco network devices over insecure networks?

Accepted Answer

SSH. Secure Shell (SSH) provides a secure, encrypted tunnel for remote command-line access. Unlike Telnet, which transmits data in plaintext and exposes administrative credentials to sniffing attacks, SSH ensures that both the connection and the session data are encrypted. Using SSH is a mandatory security best practice for any modern network infrastructure to protect against unauthorized access and credential theft while managing network devices from remote locations.

Answer

Telnet

Answer

HTTP

Answer

SNMPv1

Question 8

An organization wants to implement a security policy that requires users to authenticate against a centralized server before gaining network access. Which protocol provides the necessary AAA framework to achieve this?

Accepted Answer

RADIUS. The AAA framework (Authentication, Authorization, and Accounting) is the cornerstone of modern network security. Protocols like RADIUS and TACACS+ allow centralized management of user identity and access policies. By offloading authentication to a central server, administrators can ensure consistent security policies, audit trails for access, and rapid revocation of credentials, which is essential for scaling security across a complex enterprise network environment.

Answer

ICMP

Answer

DHCP

Answer

DNS

Question 9

Which security threat involves an attacker sending unsolicited and massive amounts of traffic to a network service to make it unavailable to legitimate users?

Accepted Answer

Denial of Service. Denial of Service (DoS) attacks focus on exhausting system resources or bandwidth. By overwhelming a target, the attacker prevents legitimate traffic from reaching the intended service. Understanding this threat is crucial for engineers who must implement traffic shaping, rate limiting, and ACLs to mitigate the impact of such attacks, thereby preserving the availability and reliability of critical network services for authorized users.

Answer

Phishing

Answer

Man-in-the-Middle

Answer

MAC Spoofing

Question 10

Refer to the exhibit. What is the result of applying this ACL to a router interface, and what is its implication for other traffic?

Accepted Answer

Permits only HTTP and blocks others.. The ACL permits HTTP traffic and implicitly denies everything else due to the 'deny ip any any' statement. This is a common 'whitelist' approach used to secure interfaces by allowing only necessary services. Understanding this logic is vital because every Cisco ACL has an implicit deny at the end; failing to explicitly permit required traffic will result in connectivity issues, making careful ACL planning essential for maintaining network functionality.

Answer

Permits all traffic including HTTP.

Answer

Permits all traffic except HTTP.

Answer

Allows all traffic by default.

Question 11

Which security feature is used to mitigate DHCP starvation attacks by limiting the number of DHCP messages per port?

Accepted Answer

DHCP Snooping. DHCP starvation attacks deplete the available IP address pool by requesting numerous leases. DHCP Snooping protects the network by acting as a firewall between untrusted hosts and DHCP servers, limiting the rate of DHCP messages. This is a critical enterprise security control, as DHCP is often an overlooked vector that can lead to DoS or man-in-the-middle attacks if left entirely unprotected on access-layer switches.

Answer

Port Security

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Question 12

Which THREE of the following are considered best practices for hardening a Cisco network device?

Accepted Answer

Disabling unused services and ports. Hardening a device is a continuous process of reducing the attack surface. Disabling unused services, using strong authentication, and physical security are foundational. These steps are crucial because many attacks exploit default configurations or legacy, insecure services. By proactively minimizing the services running on a device and enforcing rigorous access controls, administrators significantly lower the risk of unauthorized exploitation and ensure the device remains compliant with security standards.

Answer

Using Telnet for remote access

Answer

Configuring SNMPv1 with 'public' string

Question 13

An administrator wants to ensure that only legitimate DHCP servers provide IP addresses to clients on the network. Which feature should be enabled?

Accepted Answer

DHCP Snooping. Rogue DHCP servers can be used to launch man-in-the-middle attacks by providing clients with malicious gateway addresses. DHCP Snooping creates a distinction between trusted and untrusted ports. By designating only ports connected to authorized servers as trusted, the network automatically blocks DHCP response traffic from unauthorized sources. This is essential for maintaining control over the network's address allocation process and preventing redirection of user traffic.

Answer

Port Security

Answer

Dynamic ARP Inspection

Answer

IP Source Guard

Question 14

Which of the following is a primary goal of the 'Accounting' component in the AAA security framework?

Accepted Answer

Recording user activities. Accounting tracks the actions performed by users on the network, including the time they logged in and the commands they executed. This data is critical for auditing and compliance, providing a clear record of activity. By maintaining an audit trail, administrators can investigate security incidents, identify misuse, and ensure that individuals remain accountable for their actions during their network session, which is vital for forensic analysis.

Answer

Encrypting all user traffic

Answer

Verifying user identities

Answer

Assigning permissions to users

Question 15

Which Cisco feature is used to prevent Man-in-the-Middle attacks that rely on corrupting the ARP cache of connected hosts?

Accepted Answer

Dynamic ARP Inspection. ARP spoofing allows attackers to associate their MAC address with the IP address of a default gateway, effectively intercepting traffic. Dynamic ARP Inspection (DAI) uses the DHCP snooping database to validate ARP packets, ensuring that only legitimate mappings are allowed. This is a critical security feature in modern switches to prevent internal traffic interception, ensuring data privacy and integrity between hosts on the same Layer 2 domain.

Answer

DHCP Snooping

Answer

Port Security

Answer

IP Source Guard