300-410 Infrastructure Security — All Questions With Answers

Question 1easymultiple choice

A network engineer wants to secure management access to a Cisco IOS router by allowing only SSH and denying Telnet. The engineer applies the following configuration:

line vty 0 4

transport input ssh

However, after applying this, the engineer is unable to establish an SSH session to the router. Which additional configuration is required to enable SSH?

Question 2mediummultiple choice

300-410 Infrastructure Security — All Questions With Answers

A network engineer is configuring a site-to-site IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted. Which configuration element defines this traffic?

A network administrator is configuring SSH access on a Cisco IOS router. The administrator wants to ensure that only SSH version 2 is used and that the RSA key modulus is at least 2048 bits. Which set of commands accomplishes this?

A network administrator is configuring a Cisco IOS router to use SSH for remote management instead of Telnet. The administrator has already generated an RSA key pair and configured a username and password. Which additional command is required to enable SSH on the router?

A network administrator is configuring a Cisco IOS router for IPsec VPN and wants to ensure that the IKE Phase 1 negotiation is secure. Which two parameters are configured in an ISAKMP policy? (Choose two.)

A network engineer is configuring a Cisco IOS router to mitigate DHCP starvation attacks. The router is acting as a DHCP server for the local LAN. Which feature should be configured on the router's switch ports to prevent DHCP starvation?

A network security administrator is configuring AAA on a Cisco IOS router. The administrator wants to use TACACS+ for authentication and authorization, and wants to ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. Which configuration achieves this?

A network engineer is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The engineer suspects a routing issue. Which two actions should the engineer take to verify and resolve the problem? (Choose two.)

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel uses IKEv2 with certificate-based authentication and that the tunnel is established only when there is interesting traffic. Which configuration is required?

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The engineer wants to rate-limit ARP and ICMP traffic destined to the control plane. Which two statements are true about CoPP configuration and behavior? (Choose two.)

A network administrator is configuring AAA on a Cisco IOS router using TACACS+. The requirement is that if the TACACS+ server is unreachable, the router should allow administrative access using the local username and password configured on the router. Which configuration accomplishes this?

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The administrator wants to rate-limit ARP traffic destined to the route processor. Which configuration correctly applies a CoPP policy to ARP traffic?

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins against an external TACACS+ server. The engineer wants to ensure that if the TACACS+ server becomes unreachable, local authentication is used as a fallback. Which configuration accomplishes this?

A network engineer is implementing 802.1X authentication on a Cisco Catalyst switch. The engineer wants to ensure that if the RADIUS server is unavailable, the switch will place the port in a restricted VLAN for guest access. Which command must be configured on the switch port?

A network engineer is configuring AAA on a Cisco IOS router. The engineer wants to authenticate administrative users against a TACACS+ server and ensure that if the server is unreachable, a local username and password can be used as a fallback. Which configuration achieves this?

A network engineer is configuring SSH access on a Cisco IOS router. The engineer wants to restrict SSH access to only the management subnet 192.168.1.0/24 and ensure that only SSH version 2 is used. Which set of commands accomplishes this?

A network engineer is configuring a site-to-site IPsec VPN on a Cisco IOS router. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which crypto ACL configuration achieves this?

A network administrator is configuring a site-to-site VPN on a Cisco IOS router using IPsec. The administrator wants to ensure that only traffic from the 192.168.1.0/24 subnet is encrypted and sent over the VPN tunnel. Which configuration component is used to define the interesting traffic?

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to ensure that uRPF is applied in a way that allows asymmetric routing. Which uRPF mode should be configured?

A network engineer is configuring AAA authorization on a Cisco IOS router. The engineer wants to limit which commands a user can execute after logging in via SSH. The user should be allowed to run show commands but not configuration commands. Which AAA authorization method should be used?

A network administrator is configuring AAA on a Cisco IOS router. The administrator wants to use a RADIUS server for authentication and authorization, but wants to use local authentication as a fallback if the RADIUS server is unreachable. Which command should be used to configure the fallback?

A network administrator is configuring IPsec VPN on a Cisco IOS router using IKEv2. The administrator wants to ensure that the IKEv2 proposal includes encryption and integrity algorithms that are considered secure. Which two algorithms should be included in the IKEv2 proposal? (Choose two.)

A network technician is configuring SSH access on a Cisco IOS router. The technician wants to ensure that only SSH version 2 is allowed and that the RSA key pair is generated with a modulus of 2048 bits. Which commands are required?

A network engineer is configuring Unicast Reverse Path Forwarding (uRPF) on a Cisco IOS router to mitigate spoofed source IP addresses. The engineer wants to allow traffic from a multihomed customer that uses asymmetric routing. Which uRPF mode should the engineer configure?