300-410 Infrastructure Security Practice Test 3 — 15 Questions

Question 1

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins using an external TACACS+ server. The requirement is that if the TACACS+ server is unreachable, the router should use the local username database. The engineer configures the following:

! aaa new-model
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
aaa authentication login VTY_AUTH group tacacs+ local
line vty 0 4
 login authentication VTY_AUTH

However, when the TACACS+ server is powered off, SSH logins fail. What is the most likely cause?

Accepted Answer

The aaa authentication login command is missing the local keyword as a fallback method.. The aaa authentication login method list must include local as a fallback method after group tacacs+ to allow local authentication when the TACACS+ server is unreachable. Without the local keyword, the router will not attempt local authentication and will reject the login. The line vty configuration correctly applies the named method list.

Answer

The line vty configuration must use the login local command instead of login authentication.

Answer

The TACACS+ server is configured with the wrong IP address.

Answer

The TACACS+ server key is misconfigured.

Question 2

A network administrator is configuring a Cisco IOS router for IPsec VPN and wants to ensure that the IKE Phase 1 negotiation is secure. Which two parameters are configured in an ISAKMP policy? (Choose two.)

Accepted Answer

Hash algorithm. The ISAKMP policy for IKE Phase 1 includes parameters such as encryption algorithm, hash algorithm, authentication method, Diffie-Hellman group, and lifetime. Among the options, encryption algorithm and hash algorithm are two key parameters. Perfect Forward Secrecy and IPsec transform set are not part of the ISAKMP policy; they belong to Phase 2 configuration.

Answer

Perfect Forward Secrecy

Answer

Diffie-Hellman group

Answer

Authentication method

Question 3

A network engineer is configuring a Cisco IOS router to mitigate DHCP starvation attacks. The router is acting as a DHCP server for the local LAN. Which feature should be configured on the router's switch ports to prevent DHCP starvation?

Accepted Answer

DHCP snooping. DHCP snooping is the correct feature because it can rate-limit DHCP messages and prevent DHCP starvation attacks by controlling the number of DHCP requests per port. It also helps prevent rogue DHCP servers. The other options are security features but do not specifically address DHCP starvation.

Answer

IP Source Guard

Answer

Port security

Answer

Dynamic ARP Inspection

Question 4

A network security engineer is deploying IPsec VPN on a Cisco IOS router. The engineer wants to ensure that the control plane and data plane are protected against replay attacks and that the VPN uses perfect forward secrecy (PFS). Which two configurations are required to meet these requirements? (Choose two.)

Accepted Answer

Configure the transform set with the esp-sha-hmac command to enable authentication and anti-replay.. To protect against replay attacks, ESP authentication (e.g., esp-sha-hmac) must be configured, which enables anti-replay by default. To enable PFS, the crypto map must include the set pfs command, which triggers a new Diffie-Hellman exchange during Phase 2. Therefore, the two required configurations are the transform set with esp-sha-hmac and the crypto map with set pfs group2.

Answer

Enable the anti-replay window with the crypto ipsec security-association replay window-size command.

Answer

Configure the crypto map with the set security-association lifetime seconds 3600 command.

Answer

Configure the transform set with the esp-sha-hmac and esp-aes commands.

Question 5

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins using an external TACACS+ server. The requirement is that if the TACACS+ server is unreachable, the router should use the local username database. The engineer configures the following:

! aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key Cisco123

aaa authentication login VTY_AUTH group tacacs+ local
line vty 0 4

login authentication VTY_AUTH

However, when the TACACS+ server is powered off, SSH logins fail. What is the most likely cause?

Accepted Answer

tacacs server TAC1
 address ipv4 10.10.10.5
 key C1sco123
aaa new-model
aaa authentication login default group tacacs+ local
line vty 0 4
 login authentication default. The correct configuration must define a named TACACS+ server, enable AAA, create a method list that lists 'group tacacs+' before 'local' for fallback, and apply that list to the VTY lines. Only the sequence that includes all these elements in the proper order meets the requirement.

Answer

tacacs server TAC1
 address ipv4 10.10.10.5
 key C1sco123
aaa new-model
aaa authentication login default local group tacacs+
line vty 0 4
 login authentication default

Answer

tacacs-server host 10.10.10.5 key C1sco123
aaa new-model
aaa authentication login default group tacacs+ local
line vty 0 4
 login authentication default

Answer

tacacs server TAC1
 address ipv4 10.10.10.5
 key C1sco123
aaa new-model
aaa authentication login default group tacacs+
line vty 0 4
 login authentication default
username admin privilege 15 secret Adm1nP@ss

Question 6

A network engineer is configuring a Cisco IOS router to authenticate administrative SSH logins using an external TACACS+ server. The requirement is that if the TACACS+ server is unreachable, the router should use the local username database. The engineer configures the following:

! aaa new-model tacacs server TAC1 address ipv4 10.1.1.100 key Cisco123

aaa authentication login VTY_AUTH group tacacs+ local
line vty 0 4

login authentication VTY_AUTH

However, when the TACACS+ server is powered off, SSH logins fail. What is the most likely cause?

Accepted Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
line vty 0 4
 login authentication default. To authenticate SSH logins via TACACS+ with local fallback, you must enable AAA, define a TACACS+ server, create a method list that lists 'group tacacs+' followed by 'local', and apply that method list to the VTY lines. The fallback ensures administrative access if the TACACS+ server is down. The correct configuration includes all these elements.

Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
line vty 0 4
 login authentication TAC1

Answer

aaa new-model
aaa authentication login default group tacacs+
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
line vty 0 4
 login authentication default

Answer

aaa new-model
aaa authentication login default group tacacs+ local
tacacs server TAC1
 address ipv4 10.1.1.100
 key Cisco123
line vty 0 4
 login local

Question 7

A network engineer is configuring a Cisco IOS router to authenticate administrative access using AAA with TACACS+. The engineer wants to restrict which commands a user can execute after logging in. The TACACS+ server is configured to return an authorization profile that permits only show commands. On the router, the engineer configures:

! aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local

However, when the user logs in, they are able to execute configuration commands. What is the most likely reason?

Accepted Answer

The user's privilege level is not set to 15, so command authorization for level 15 does not apply.. Command authorization using aaa authorization commands 15 only applies to users at privilege level 15. If the user logs in with a lower privilege level, the router does not enforce the level 15 command authorization set. The TACACS+ server may return the correct profile, but the router ignores it for that privilege level. Ensuring the user is at privilege level 15 will enforce the command restrictions.

Answer

The TACACS+ server is not configured to return the correct authorization attributes.

Answer

The aaa authorization commands 15 command is not applied to the VTY lines.

Answer

The aaa authorization exec command is missing the local fallback.

Question 8

A network administrator needs to secure a Cisco IOS router by restricting SNMP access to read-only for a specific host (10.1.1.100) using SNMPv3 with authentication and encryption. The administrator creates a view, group, and user. Which command correctly associates the SNMPv3 user with the group and specifies the security level?

Accepted Answer

snmp-server user admin mygroup v3 auth sha AuthPass priv aes 128 PrivPass. The correct command is 'snmp-server user' that includes the username, group, version, authentication protocol and password, and privacy protocol and password. This creates the user and associates it with the specified group, enabling authPriv security.

Answer

snmp-server group mygroup v3 priv read myview

Answer

snmp-server user admin mygroup v3 auth sha AuthPass priv PrivPass

Answer

snmp-server host 10.1.1.100 version 3 priv admin

Question 9

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect against DoS attacks. The administrator wants to rate-limit ICMP traffic destined to the route processor to 1000 packets per second (pps) with a burst of 2000 packets, while allowing all other traffic without policing. Which configuration snippet correctly achieves this?

Accepted Answer

class-map match-all ICMP
 match access-group 101
policy-map COPP
 class ICMP
  police 1000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop
control-plane
 service-policy input COPP. CoPP requires a class map to identify traffic, a policy map to define policing actions, and application of the policy to the control plane using 'service-policy input' under 'control-plane' configuration mode. The correct snippet matches ICMP, polices it to 1000 pps, and allows other traffic via class-default. Applying the policy to an interface or in the output direction does not achieve the goal.

Answer

class-map match-all ICMP
 match access-group 101
policy-map COPP
 class ICMP
  police 1000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input COPP

Answer

class-map match-any ICMP
 match access-group 101
policy-map COPP
 class ICMP
  police 1000 2000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop
control-plane
 service-policy output COPP

Answer

class-map match-all ICMP
 match access-group 101
policy-map COPP
 class ICMP
  police 1000 conform-action transmit exceed-action drop
 class class-default
  police 8000 conform-action transmit exceed-action drop
interface GigabitEthernet0/0
 service-policy input COPP

Question 10

A network security administrator is configuring IPsec VPN on a Cisco IOS router. The administrator wants to ensure that the VPN tunnel uses IKEv2 with a pre-shared key for authentication, and that the IPsec SA uses AES-256 encryption and SHA-256 for integrity. Which set of commands correctly configures the IKEv2 proposal and policy?

Accepted Answer

crypto ikev2 proposal PROPOSAL
 encryption aes-cbc-256
 integrity sha256
 group 14
crypto ikev2 policy POLICY
 proposal PROPOSAL
crypto ikev2 keyring KEYRING
 peer PEER
  address 0.0.0.0 0.0.0.0
  pre-shared-key local key1
  pre-shared-key remote key1
crypto ikev2 profile PROFILE
 match identity remote address 0.0.0.0 0.0.0.0
 identity local address 10.1.1.1
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING. The correct configuration for IKEv2 with pre-shared key authentication and AES-256/SHA-256 involves defining an IKEv2 proposal with the specified encryption and integrity, a policy that references the proposal, a keyring with the pre-shared key, and a profile that uses pre-shared key authentication. The other options include additional, unrelated configuration elements like IPsec transform-sets, profiles, or crypto maps, which are not part of the IKEv2 proposal and policy.

Answer

crypto ikev2 proposal PROPOSAL
 encryption aes-cbc-256
 integrity sha256
 group 14
crypto ikev2 policy POLICY
 proposal PROPOSAL
crypto ikev2 keyring KEYRING
 peer PEER
  address 0.0.0.0 0.0.0.0
  pre-shared-key local key1
  pre-shared-key remote key1
crypto ikev2 profile PROFILE
 match identity remote address 0.0.0.0 0.0.0.0
 identity local address 10.1.1.1
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING
crypto ipsec profile IPSEC_PROFILE
 set transform-set TS

Answer

crypto ikev2 proposal PROPOSAL
 encryption aes-cbc-256
 integrity sha256
 group 14
crypto ikev2 policy POLICY
 proposal PROPOSAL
crypto ikev2 keyring KEYRING
 peer PEER
  address 0.0.0.0 0.0.0.0
  pre-shared-key local key1
  pre-shared-key remote key1
crypto ikev2 profile PROFILE
 match identity remote address 0.0.0.0 0.0.0.0
 identity local address 10.1.1.1
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING
crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac

Answer

crypto ikev2 proposal PROPOSAL
 encryption aes-cbc-256
 integrity sha256
 group 14
crypto ikev2 policy POLICY
 proposal PROPOSAL
crypto ikev2 keyring KEYRING
 peer PEER
  address 0.0.0.0 0.0.0.0
  pre-shared-key local key1
  pre-shared-key remote key1
crypto ikev2 profile PROFILE
 match identity remote address 0.0.0.0 0.0.0.0
 identity local address 10.1.1.1
 authentication remote pre-share
 authentication local pre-share
 keyring KEYRING
crypto map CMAP 10 ipsec-isakmp
 set peer 10.1.1.2
 set transform-set TS
 match address 101

Question 11

A network engineer is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet is encrypted and sent over the tunnel, while all other traffic is sent unencrypted. The engineer configures a crypto ACL as follows:

access-list 101 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255

After applying the crypto map and bringing up the tunnel, the engineer notices that traffic from 10.1.1.0/24 to 10.2.2.0/24 is being encrypted, but traffic from 10.1.1.0/24 to other destinations is also being encrypted. What is the most likely cause?

Accepted Answer

The router is using a route to send all traffic to the tunnel interface, bypassing the crypto ACL.. The crypto ACL defines which traffic should be encrypted by the IPsec tunnel. However, if the routing table directs other traffic to the tunnel interface (e.g., via a default route), that traffic will also be sent into the tunnel, even though it does not match the crypto ACL. The router will attempt to encrypt it, but since it does not match the ACL, the packet may be dropped or sent unencrypted depending on the configuration. In this case, the observed encryption of other traffic indicates that routing is directing it into the tunnel.

Answer

The crypto ACL is missing a deny statement for other traffic, causing all traffic to match the permit statement.

Answer

The crypto map is applied to the wrong interface, causing all traffic to be encrypted.

Answer

The crypto ACL is applied in the wrong direction on the interface.

Question 12

A network engineer is deploying 802.1X authentication on a Cisco Catalyst switch. The engineer wants to authenticate users against a RADIUS server and assign them to a specific VLAN based on their credentials. The RADIUS server is at 10.2.2.2 with shared secret 'Radius123'. Which configuration is required to enable dynamic VLAN assignment?

Accepted Answer

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
radius server RAD1
 address ipv4 10.2.2.2 auth-port 1812 acct-port 1813
 key Radius123
dot1x system-auth-control
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator. Dynamic VLAN assignment with 802.1X requires both authentication and authorization via RADIUS. The switch must be configured with 'aaa authentication dot1x' and 'aaa authorization network' using the RADIUS group. The interface must have 'authentication port-control auto' and 'dot1x pae authenticator' to enable 802.1X. The RADIUS server must return the appropriate VLAN attributes. The correct configuration includes all these elements.

Answer

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
radius server RAD1
 address ipv4 10.2.2.2 auth-port 1812 acct-port 1813
 key Radius123
dot1x system-auth-control
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 authentication host-mode multi-auth

Answer

aaa new-model
aaa authentication dot1x default group radius
radius server RAD1
 address ipv4 10.2.2.2 auth-port 1812 acct-port 1813
 key Radius123
dot1x system-auth-control
interface GigabitEthernet0/1
 switchport mode access
 authentication port-control auto
 dot1x pae authenticator

Answer

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
radius server RAD1
 address ipv4 10.2.2.2 auth-port 1812 acct-port 1813
 key Radius123
dot1x system-auth-control
interface GigabitEthernet0/1
 switchport mode access
 dot1x port-control auto
 dot1x pae authenticator

Question 13

A network security administrator is configuring AAA on a Cisco IOS router. The administrator wants to use TACACS+ for authentication and authorization, and wants to ensure that if the TACACS+ server is unreachable, the router falls back to local authentication. Which configuration achieves this?

Accepted Answer

aaa new-model
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local. The correct configuration uses 'aaa authentication login default group tacacs+ local' and 'aaa authorization exec default group tacacs+ local'. This sets TACACS+ as the primary method and local as fallback, ensuring administrative access if the TACACS+ server is down. The order of methods is critical.

Answer

aaa new-model
aaa authentication login default group tacacs+ none
aaa authorization exec default group tacacs+ none

Answer

aaa new-model
aaa authentication login default local group tacacs+
aaa authorization exec default local group tacacs+

Answer

aaa new-model
aaa authentication login default group tacacs+
aaa authorization exec default group tacacs+
tacacs-server host 10.1.1.1

Question 14

A network engineer is troubleshooting an IPsec VPN tunnel between two Cisco IOS routers. The tunnel is up, but traffic is not passing. The engineer suspects a routing issue. Which two actions should the engineer take to verify and resolve the problem? (Choose two.)

Accepted Answer

Verify the crypto ACL matches the traffic that should be encrypted.. To troubleshoot an IPsec VPN where the tunnel is up but traffic is not passing, the engineer should check the routing table for a route to the remote peer's public IP and verify the crypto ACL matches the intended traffic. These two actions address common causes: missing routes and incorrect interesting traffic definitions.

Answer

Ensure that the OSPF process is configured with the correct router ID.

Answer

Verify that the transform set is configured with the correct encryption algorithm.

Answer

Check the IPsec SA counters for encapsulations and decapsulations.

Question 15

A network administrator is deploying 802.1X on a Cisco switch port. The switch is configured as an authenticator, and the RADIUS server is reachable. However, when a new PC connects, the port remains in the unauthorized state even after the PC successfully authenticates. The administrator notices that the port is configured with 'authentication host-mode multi-auth'. What is the most likely cause?

Accepted Answer

The 'authentication port-control auto' command is missing on the interface.. The correct answer is that the 'authentication port-control auto' command is missing. This command is required to enable 802.1X authentication on the interface. Without it, the port stays in the unauthorized state even if the host-mode is set correctly and the PC attempts authentication. The other options are less likely because they either do not prevent authorization or contradict the scenario details.

Answer

The PC does not support 802.1X and is sending EAPOL Start frames.

Answer

The switch port is configured as a trunk instead of an access port.

Answer

The RADIUS server is not configured to send the Tunnel-Type attribute.