350-401 Security — All Questions With Answers

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Question 2hardmultiple choice

Open the full STP breakdown →

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Question 3mediummatching

Match each Spanning Tree Protocol (STP) variant to its key characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Original standard, slow convergence

Fast convergence, backward compatible

Multiple spanning trees per VLAN group

Cisco proprietary, per-VLAN STP

Cisco proprietary, per-VLAN RSTP

Question 4mediummultiple choice

A network administrator is deploying a Cisco Catalyst 9300 switch in a campus access layer. The security policy mandates that when an unauthorized device connects to an access port, the port must immediately shut down and generate a syslog message, and the administrator must manually re-enable the port. The administrator configures the interface with the command 'switchport port-security violation shutdown'. However, after an unauthorized device connects, the port goes into the 'err-disabled' state, but no syslog message is generated. What is the most likely reason for the missing syslog message?

Question 5mediummultiple choice

A network engineer is deploying 802.1X on a Cisco Catalyst 9200 switch. The authentication server is Cisco ISE. The help desk reports that some corporate Windows laptops fail authentication when they are first connected, but succeed after the user manually opens a browser. The switch port is configured with `authentication host-mode multi-auth` and `authentication open`. Which change should the engineer make to allow the laptops to authenticate without user interaction?

Question 6mediummultiple choice

A network administrator is deploying a Cisco Catalyst 9300 switch in a branch office. The security policy requires that when an unauthorized MAC address is detected on interface GigabitEthernet1/0/5, the interface must be placed into the err-disabled state and an SNMP trap must be generated. The administrator has configured 'switchport port-security' on the interface. Which additional command is required to meet the policy?

Question 7mediummultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against CPU overload. The administrator wants to rate-limit ARP packets destined to the control plane to 100 packets per second, while allowing all other traffic to the control plane without rate limiting. Which CoPP configuration accomplishes this?

Question 8hardmultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against denial-of-service attacks. The router has a management interface and several data interfaces. The engineer wants to rate-limit SSH traffic destined to the router's control plane to 100 kbps, while allowing all other management traffic (SNMP, NTP) without rate limiting. The engineer creates a class map named 'SSH-CLASS' matching TCP port 22, and a policy map named 'COPP-POLICY' with a police action of 100000 bps. The policy is applied to the control plane using 'service-policy input COPP-POLICY'. After applying the policy, the engineer notices that SNMP traffic is also being rate-limited, even though it is not explicitly matched. What is the most likely cause?

Question 9easymultiple choice

A network administrator is configuring a Cisco IOS router for IPsec site-to-site VPN with a peer that uses a dynamic public IP address. The administrator needs the router to accept IKE negotiations from any peer while still using pre-shared keys for authentication. Which configuration element is required on the local router?

Question 10mediummultiple choice

A network security team is implementing 802.1X on Cisco Catalyst switches with Cisco ISE. The requirement is that if the RADIUS server is unreachable, endpoints should be placed into a restricted VLAN that only allows access to remediation servers. Which feature should be configured on the switch ports?

Question 11easymultiple choice

A network engineer is deploying MACsec on a Cisco Catalyst 9000 switch to secure Layer 2 traffic between two switches. The engineer wants to ensure that MACsec is enabled on the link and that the switches use MKA for key management. Which command is required to enable MKA on the interface?

Question 12mediummulti select

A network engineer is deploying Cisco TrustSec in a campus network. The engineer needs to enable Security Group Tagging (SGT) on a Cisco Catalyst 9000 switch. Which two actions are required to support SGT propagation and enforcement? (Choose two.)

Question 13hardmultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers over the same WAN interface. The engineer notices that during BGP session flaps, the router's CPU spikes and management SSH sessions become unresponsive. Which CoPP configuration change most directly protects the CPU during these events without disrupting legitimate BGP updates?

Question 14hardmultiple choice

A network administrator is configuring a Cisco IOS Zone-Based Policy Firewall (ZPF) on a router. The inside zone contains the LAN interface, and the outside zone contains the WAN interface. The administrator wants to allow inside-to-outside traffic, deny outside-to-inside traffic, and allow the router itself to initiate SSH to the outside for management. Which configuration is required to meet these requirements?

Question 15mediummultiple choice

A network administrator is hardening a Cisco IOS XE switch against DHCP starvation attacks. The requirement is to limit the number of DHCP requests that can be processed on an untrusted access port to 10 per second and to err-disable the port if the rate is exceeded. Which configuration accomplishes this?

Question 16mediummultiple choice

A network security engineer is implementing 802.1X authentication on a Cisco Catalyst switch. The switch is configured with RADIUS server 10.1.1.10 and a shared secret. The engineer wants to ensure that if the RADIUS server is unreachable, authenticated devices remain connected and unauthenticated devices are placed in a guest VLAN. The engineer configures 'authentication event server dead action authorize vlan 100' on the interface. However, when the RADIUS server goes down, authenticated devices are disconnected. What is the most likely cause?

Question 17hardmultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, receives SNMP polling from the NMS, and terminates SSH management sessions. The administrator needs to ensure that OSPF hellos are never dropped by the CoPP policy while still rate-limiting SNMP and SSH. Which CoPP action should be applied to the OSPF class to meet this requirement?

Question 18mediummultiple choice

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to secure corporate Wi-Fi access. The requirement is to use 802.1X authentication with EAP-TLS, where both the client and the authentication server present certificates. The administrator has configured the WLAN with WPA2 Enterprise and selected 802.1X as the security policy. Which additional configuration is required on the WLC to support EAP-TLS?

Question 19mediummultiple choice

A network administrator is deploying Cisco TrustSec in a campus network. The security policy requires that all traffic from the employee VLAN (VLAN 10) to the server VLAN (VLAN 20) be encrypted and authenticated at Layer 2, without relying on IPsec or any overlay tunneling. Which TrustSec component should be implemented to meet this requirement?

Question 20hardmultiple choice

A security team is reviewing a Cisco IOS router configuration and finds that an ACL applied inbound on the WAN interface permits TCP port 179 from any source. The team wants to restrict BGP peering to only the two known service provider addresses while keeping the ACL efficient. Which ACL entry should be used to replace the overly permissive statement?

Question 21mediummulti select

A network engineer is hardening a Cisco IOS switch against Layer 2 attacks. The security policy requires mitigating MAC address spoofing, preventing a single port from learning an unlimited number of MAC addresses, and ensuring that a rogue DHCP server cannot hand out addresses. Which two features, when configured together, best address these requirements? (Choose two.)

Question 22mediummultiple choice

A network administrator is deploying a new Cisco Catalyst 9300 switch stack in a campus IDF. The security policy requires that any device connecting to access ports be authenticated before receiving a VLAN assignment, and that if the RADIUS server becomes unreachable, only the voice VLAN should remain accessible while data VLAN access is denied. The administrator enables 802.1X with MAB fallback. Which command sequence correctly configures the fallback behavior on the access ports?

Question 23easymultiple choice

A network administrator is configuring a Cisco IOS router to allow remote management access via SSH. The administrator wants to ensure that only SSH version 2 is used and that the router's RSA key pair is generated with a modulus of 2048 bits. Which set of commands accomplishes this?

Question 24hardmultiple choice

Study the full SD-Access breakdown →

A network engineer is implementing MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches connected via a point-to-point link. The engineer wants to ensure that the link encrypts all traffic and that the switches mutually authenticate before forwarding data. Which configuration element is required to establish the MACsec session?

Question 25hardmultiple choice

A network architect is designing a Cisco SD-Access fabric. The security policy requires that endpoints be authenticated before being allowed into the fabric, and that their traffic be segmented based on user role, with enforcement at the fabric edge. Which combination of components is required to achieve this?

Question 26mediummultiple choice

A network administrator is deploying 802.1X on a Cisco Catalyst switch. The switch must authenticate users against a Cisco ISE server and also allow MAB for devices that do not support 802.1X. Which configuration is required on the switch port to enable both 802.1X and MAB, with 802.1X attempted first?

Question 27mediummultiple choice

A network engineer is configuring Control Plane Policing on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The goal is to rate-limit SSH traffic destined to the router's own control plane to 100 kbps without affecting BGP or SNMP. The engineer applies a class-map matching 'access-group SSH-ACL' and a policy-map with a police rate of 100000 bps. After applying the service-policy to the control-plane, the engineer notices that SSH sessions are still allowed at higher rates and BGP remains unaffected. Which action should the engineer take to correctly enforce the rate limit?

Question 28easymultiple choice

An administrator is configuring a Cisco IOS router to act as a VPN headend for remote workers. The requirement is to use a protocol that provides strong encryption, supports NAT traversal, and can dynamically establish secure tunnels with minimal configuration. Which technology should be implemented?

Question 29mediummultiple choice

A network security team is deploying 802.1X on Catalyst switches using Cisco ISE. The requirement is that the switch must forward EAPoL frames from supplicants to the authentication server even before the port is authorized, and must relay authentication messages without terminating the EAP conversation. Which host mode and configuration should be applied to the switch port?

Question 30mediummulti select

Read the full NAT/PAT explanation →

A network security engineer is implementing Dynamic ARP Inspection (DAI) on a Cisco Catalyst switch to mitigate ARP spoofing attacks. The engineer has enabled DHCP snooping globally and on the relevant VLANs. Which two additional steps are required to ensure DAI operates correctly on a VLAN that includes both DHCP and statically addressed hosts? (Choose two.)

Question 31mediummultiple choice

A network administrator is configuring a Cisco ASA firewall for a new DMZ. The DMZ web server at 192.168.10.10 must be accessible from the internet on TCP port 443. The outside interface is GigabitEthernet0/0 with IP 203.0.113.5. The administrator wants to use a static NAT with a public IP address 203.0.113.10. Which configuration accomplishes this?

Question 32mediummultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The policy must rate-limit SNMP and SSH traffic while allowing BGP and OSPF control traffic without restriction. After applying the service-policy to the control plane, the administrator notices that BGP adjacencies are flapping. What is the most likely cause?

Question 33hardmultiple choice

A security architect is deploying MACsec on a Cisco Catalyst 9300 switch connecting to a Cisco IP phone that also provides a PC port. The requirement is to encrypt traffic between the switch and the phone, while allowing the PC behind the phone to communicate without MACsec. The switch port is configured as a trunk with voice VLAN 100 and data VLAN 200. Which configuration approach meets the requirement?

Question 34hardmultiple choice

A network engineer is configuring 802.1X authentication on a Cisco Catalyst 9000 switch. The switch is connected to a Cisco ISE server for authentication and authorization. The engineer wants to ensure that if the ISE server becomes unreachable, the switch will allow devices to connect to a guest VLAN. Which command must be configured on the switch to achieve this?

Question 35mediummulti select

A network administrator is deploying Control Plane Policing on a Cisco IOS router to protect the route processor from excessive traffic. Which two statements correctly describe how CoPP behaves in this deployment? (Choose two.)

Question 36hardmultiple choice

A network engineer is implementing MACsec on a Cisco Catalyst 9000 switch series to secure Layer 2 traffic between two switches. The engineer configures MKA (MACsec Key Agreement) with a pre-shared key and applies the configuration to the uplink interface. However, the MACsec session fails to establish, and the interface remains in a down state. Which of the following is the most likely reason for the failure?

Question 37mediummultiple choice

A network administrator is deploying a new Cisco Catalyst 9300 switch at a branch office. The security policy requires that when an unauthorized device is connected to an access port, the port must be placed into the error-disabled state and an SNMP trap must be sent. The administrator configures the following on interface GigabitEthernet1/0/1: switchport mode access, switchport port-security, switchport port-security maximum 1, switchport port-security mac-address sticky. Which additional command is required to meet the policy requirement?

Question 38mediummultiple choice

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS-XE router that runs OSPF, BGP, and SSH management. The router is experiencing high CPU utilization due to excessive ARP requests from a misbehaving host on the LAN. The administrator wants to rate-limit ARP traffic without affecting OSPF and BGP. Which class-map match condition should be used in the CoPP policy to specifically match ARP traffic?

Question 39easymultiple choice

A network administrator is configuring 802.1X on a Cisco Catalyst switch port. The port must allow only one supplicant to authenticate, and after successful authentication the port should be placed in the data VLAN. The authentication server is Cisco ISE. Which command correctly enables 802.1X authentication on the access port?

Question 40mediummultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor. The router runs OSPF, BGP, SSH management, and SNMP monitoring. The engineer needs to apply a class-map that matches all management traffic and ensure that OSPF and BGP control traffic is not dropped during a DoS attack. Which CoPP action should be configured on the class-map for management traffic to rate-limit it while preserving routing protocol adjacencies?

Question 41easymultiple choice

A network technician is configuring a Cisco IOS router to act as a VPN headend. The security policy requires that all remote access VPN users be authenticated using digital certificates issued by a corporate PKI. Which command must be configured to enable certificate-based authentication for IKEv2?

Question 42easymultiple choice

A network engineer is configuring 802.1X authentication on a Cisco Catalyst switch port. The port is connected to a PC running the Cisco AnyConnect Network Access Manager supplicant. The authentication server is Cisco ISE. The engineer wants the port to authenticate the user and then dynamically assign the user to a specific VLAN based on the user's identity. Which feature must be enabled on the switch to allow the dynamic VLAN assignment?

Question 43easymultiple choice

A network administrator is configuring 802.1X authentication on a Cisco Catalyst switch port. The port is connected to a Cisco IP phone with a PC attached to the phone's PC port. The administrator wants to authenticate both the phone and the PC separately, allowing the phone to be authenticated via MAB and the PC via 802.1X. Which feature must be enabled on the switch port to support multiple devices and authentication methods?

Question 44hardmultiple choice

A network engineer is configuring a Zone-Based Firewall (ZBFW) on a Cisco IOS router. The internal network is in zone INSIDE, and the external network is in zone OUTSIDE. The engineer wants to allow HTTP traffic from INSIDE to OUTSIDE, but block all other traffic from INSIDE to OUTSIDE. Additionally, traffic from OUTSIDE to INSIDE should be blocked except for return traffic. Which configuration is required to achieve this?

Question 45mediummultiple choice

A network engineer is deploying 802.1X on a Cisco Catalyst switch. The authentication server is Cisco ISE. The engineer wants to ensure that if the ISE server becomes unreachable, endpoints already authenticated remain connected, but new endpoints are placed in a restricted VLAN. Which feature should be configured on the switch?

Question 46hardmulti select

A network engineer is implementing MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two switches. The engineer must ensure that the link is protected against eavesdropping and tampering, and that the switches authenticate each other before exchanging encrypted traffic. Which two statements about MACsec configuration on Cisco IOS XE are true? (Choose two.)

Question 47hardmultiple choice

A network security engineer is implementing Cisco TrustSec in a campus network. The engineer has configured security group tags (SGTs) and is using SGACL enforcement on Cisco Catalyst switches. A user in the 'Employees' SGT (tag 10) needs to access a server in the 'Servers' SGT (tag 20) on TCP port 443. The SGACL on the server switch currently denies all traffic from tag 10 to tag 20. Which command must be added to the SGACL policy to permit only HTTPS traffic from Employees to Servers?

Question 48hardmultiple choice

A network security administrator is configuring a Cisco IOS-XE router to act as a VPN headend using FlexVPN with IKEv2. The administrator wants to ensure that the router uses certificate-based authentication for IKEv2 peers and that the certificate is validated against a specific trustpoint. The administrator has already configured the trustpoint and imported the CA certificate. Which command must be applied under the IKEv2 profile to enforce certificate-based authentication and specify the trustpoint?

Question 49mediummultiple choice

A network engineer is deploying a new Cisco Catalyst 9300 switch at a branch office. The security policy requires that the switch prevent rogue DHCP servers from handing out IP addresses to clients on VLAN 20, while still allowing legitimate DHCP traffic from the corporate DHCP server at 10.10.10.5. The engineer enables DHCP snooping globally and on VLAN 20, then configures the uplink interface GigabitEthernet1/0/24 as trusted. Which additional configuration is required to enforce this policy on the access ports?

Question 50mediummulti select

A network engineer is configuring MACsec on a point-to-point link between two Cisco Catalyst 9300 switches to secure Layer 2 traffic. The engineer must ensure that the MACsec session is established and that data integrity and confidentiality are provided. Which two statements about MACsec configuration on Cisco IOS XE are true? (Choose two.)

Question 51hardmulti select

A network engineer is hardening a Cisco IOS XE router against control plane attacks. The engineer wants to protect the route processor from excessive ARP and IP options traffic while still allowing legitimate management and routing protocols. Which two mechanisms are appropriate to implement? (Choose two.)

Question 52easymultiple choice

A network administrator is configuring a Cisco ASA firewall for a new DMZ. The DMZ web server must be accessible from the internet on TCP port 80 and 443. The administrator wants to ensure that the web server can initiate outbound connections to the internet for updates but should not be able to initiate connections to the internal network. Which ASA security level configuration should be applied to the DMZ interface to meet these requirements?

Question 53mediummultiple choice

A network administrator is implementing MACsec on a Cisco Catalyst 9300 switch to secure Layer 2 traffic between two switches. The administrator wants to ensure that the MACsec session uses a pre-shared key (PSK) for authentication and that the key is rotated periodically. Which configuration step is required to enable MACsec with PSK on the switch port?

Question 54easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN endpoint for remote users. The requirement is to use a protocol that provides encryption and authentication at Layer 3 and supports dynamic routing protocols over the tunnel. Which technology should be implemented?

Question 55mediummulti select

A network engineer is configuring 802.1X authentication on a Cisco Catalyst switch. The switch will use RADIUS with Cisco ISE as the authentication server. The engineer wants to ensure that devices that do not support 802.1X, such as printers and legacy IP phones, can still access the network securely. Which two features should the engineer configure to achieve this? (Choose two.)

Question 56mediummultiple choice

A network administrator is securing OSPFv2 on a Cisco router. The requirement is to authenticate every OSPF packet exchanged on interface GigabitEthernet0/0 using a key chain that supports key rotation, with MD5 hashing. Which configuration accomplishes this?

Question 57hardmultiple choice

A network engineer is configuring MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches on a trunk link. The engineer wants to ensure that the MACsec session is established and that encryption is active. Which command should be used to verify the MACsec session status and encryption on the interface?

Question 58mediummulti select

A network administrator is deploying MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches. The administrator wants to ensure that the MACsec session is established correctly. Which two statements about MACsec configuration on Cisco IOS are true? (Choose two.)

Question 59mediummultiple choice

A network engineer is configuring a Cisco IOS router to authenticate management access using TACACS+ with a Cisco ISE server. The engineer wants to ensure that authorization is performed per-command and that accounting records are sent to the server. Which set of commands must be configured on the router?

Question 60hardmultiple choice

A network administrator is deploying MACsec on a Cisco Catalyst 9300 switch to secure traffic between two switches connected via a point-to-point link. The administrator configures the switchport with 'macsec' and 'dot1x' commands, but the link fails to come up. The administrator verifies that both switches support MACsec and are running compatible IOS XE versions. Which additional configuration is required to establish the MACsec session?

Question 61hardmultiple choice

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against a flood of malformed packets. After applying the policy, legitimate BGP keepalives from a directly connected peer are being dropped. The policy uses a class-map matching 'match access-group 101' where ACL 101 permits tcp any any eq 179. Which action should the engineer take to resolve the issue while preserving protection?

Question 62mediummultiple choice

A network administrator configures an IPsec site-to-site VPN between two Cisco IOS routers using IKEv2. The administrator wants to ensure that the control plane traffic for the VPN is protected and that the routers can authenticate each other using certificates. Which statement correctly describes a characteristic of IKEv2 in this scenario?

Question 63mediummultiple choice

A network engineer is deploying a Cisco Catalyst 9300 switch stack at a branch office. The security policy requires that when an unauthorized device connects to an access port, the port must immediately stop forwarding traffic and generate a syslog message, but the port must automatically resume forwarding after the unauthorized device is removed without any manual intervention. Which port security violation mode should be configured on the interface?

Question 64easymultiple choice

A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco ISE server for authentication. The administrator wants to allow a device to authenticate using MAC Authentication Bypass (MAB) if 802.1X is not supported. Which command must be configured on the switch interface to enable MAB?

Question 65easymultiple choice

A network administrator is configuring 802.1X authentication on a Cisco Catalyst switch. The switch must authenticate users via RADIUS and, if the RADIUS server is unreachable, allow devices into a restricted VLAN. Which feature should be configured to meet this requirement?

Question 66mediummultiple choice

A network engineer is configuring IPsec VPN on a Cisco IOS router. The router must establish a site-to-site tunnel with a remote peer. The engineer configures IKEv2 with a pre-shared key, but the tunnel fails to establish. The engineer verifies that the pre-shared key matches on both peers and that IKEv2 proposals are compatible. Which additional configuration is required for the IPsec tunnel to come up?

Question 67mediummultiple choice

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that traffic from a specific subnet is encrypted and sent to a remote peer, while all other traffic is sent unencrypted. The engineer configures an extended ACL to match the interesting traffic and applies it to a crypto map. However, after applying the configuration, all traffic to the remote peer is being dropped. What is the most likely reason?

Question 68hardmultiple choice

A security team wants to inspect traffic between two VLANs on a Cisco Catalyst 9000 switch using a traffic mirroring session that copies packets to a monitoring appliance. The requirement is that the mirrored traffic preserve original VLAN tags and that only traffic matching a specific ACL is copied. Which configuration element is required to meet the ACL filtering requirement?

Question 69hardmultiple choice

A security architect is designing a campus network where endpoints must be authenticated before being placed into a VLAN. The design requires that the switch relay authentication requests to a Cisco ISE server and that the endpoint be dynamically assigned to a quarantine VLAN if posture assessment fails. The endpoint uses a supplicant that supports EAP-TLS. Which protocol combination should be configured on the switch port to meet these requirements?

Question 70mediummultiple choice

An engineer must secure a Cisco IOS-XE router that peers BGP with an ISP. The requirement is to cryptographically authenticate every BGP update so that a rogue peer cannot inject routes. The solution must not require an external AAA server. Which action accomplishes this?

Question 71hardmulti select

A network engineer is deploying MACsec (802.1AE) on a Cisco Catalyst 9000 series switch to secure Layer 2 traffic between two switches. The engineer wants to ensure that the MACsec session is established with strong encryption and that key management is handled by the switch without manual key entry. Which two statements are correct about MACsec configuration on Cisco Catalyst 9000 switches? (Choose two.)

Question 72easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote users. The administrator wants to use IKEv2 with certificate-based authentication. The router must validate client certificates against a trusted certificate authority (CA). Which command is required to specify the trustpoint that the router will use for certificate authentication?

Question 73easymultiple choice

An engineer is configuring a Cisco IOS XE router to secure SNMP access. The requirement is to use SNMPv3 with authentication and encryption, and to ensure that management stations can retrieve data but not modify configuration. Which SNMPv3 configuration element should the engineer set to enforce authentication and privacy?

Question 74mediummulti select

A network engineer is deploying a Cisco Identity Services Engine (ISE) for wired 802.1X authentication. The engineer needs to ensure that the switch port transitions to the authorized state only after successful authentication. Which two commands are required on the Cisco switch to enable 802.1X authentication and control the port state? (Choose two.)

Question 75easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN endpoint for remote users. The administrator wants to use IKEv2 for the VPN and needs to ensure that the router can authenticate users with certificates. Which command is required to specify the trustpoint that the router will use for certificate-based authentication?

Question 76easymultiple choice

A network administrator is configuring a Cisco ASA firewall to allow outside users to access an internal web server at 192.168.1.10 on port 443. The ASA is running software version 9.12. The administrator wants to use the modern NAT configuration that automatically creates the necessary access control list entry. Which command accomplishes this?

Question 77mediummultiple choice

A company uses Cisco ISE for 802.1X and wants to also authenticate corporate laptops when they are off-site and connected to public Wi-Fi. The security team requires that the same corporate credentials be used and that the authentication be resistant to credential theft over untrusted networks. Which Cisco solution should be deployed on the laptops?

Question 78hardmultiple choice

A network security engineer is configuring a Zone-Based Firewall (ZBFW) on a Cisco IOS router. The engineer defines a zone pair from the INSIDE zone to the OUTSIDE zone and applies a policy that inspects HTTP and HTTPS traffic. However, return traffic from the OUTSIDE to the INSIDE is being dropped. What is the most likely cause of this issue?

Question 79easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN endpoint for remote workers using Cisco AnyConnect. The administrator needs to enable a feature that allows the router to inspect application-layer traffic within the TLS tunnel and apply granular access policies based on user identity and group membership. Which Cisco IOS feature should be enabled?

Question 80mediummultiple choice

A network engineer is configuring IPsec VPN on a Cisco IOS router. The security policy requires that the data payload be encrypted and that the integrity of the packet be verified. The engineer wants to use the strongest available encryption algorithm supported by the platform and a hashing algorithm that provides strong integrity protection. Which combination of IPsec transform parameters should be configured?

Question 81hardmultiple choice

A network administrator is deploying 802.1X on a Cisco Catalyst switch with Cisco ISE as the RADIUS server. The switch ports must support both 802.1X-capable devices and non-supplicant devices such as printers. The requirement is to authenticate supplicants and allow non-supplicants into a restricted VLAN. Which feature should the administrator configure on the switch ports to meet this requirement?

Question 82hardmultiple choice

Review the full subnetting walkthrough →

A network engineer is deploying Cisco Identity Services Engine (ISE) for wired 802.1X authentication. The requirement is that endpoints which do not support 802.1X supplicants must still be authenticated and placed into a restricted VLAN until they can be remediated. The switches are Cisco Catalyst 9000 series running IOS-XE. Which combination of features on the switch and ISE is required to support this behavior?

Question 83easymultiple choice

A network administrator is configuring a Cisco IOS-XE router to protect against spoofed source addresses from the internal LAN. The goal is to drop packets entering the LAN interface whose source IP is not part of the internal subnet. Which feature should be enabled on the LAN interface?

Question 84easymultiple choice

A network engineer is configuringControl Plane Policing (CoPP) on a Cisco router to protect the route processor from excessive traffic. The engineer wants to rate-limit SSH traffic destined to the router's management IP address. Which CoPP action should be taken for traffic that exceeds the configured rate?

Question 85hardmulti select

A network security engineer is deploying 802.1X authentication on Cisco switches with Cisco Identity Services Engine (ISE) as the RADIUS server. The engineer must ensure that the switch dynamically assigns the appropriate VLAN to authenticated endpoints based on their identity group. Which two configurations are required on the switch to support dynamic VLAN assignment? (Choose two.)

Question 86mediummultiple choice

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Question 87easymultiple choice

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Question 88hardmultiple choice

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Question 89mediummultiple choice

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Question 90mediummulti select

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Question 91hardmulti select

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Question 92easymultiple choice

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Exhibit

Refer to the exhibit.

Switch# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1A:2B:3C:4D:5E  192.168.1.10     86400       dhcp-snooping   10    GigabitEthernet0/1
00:1A:2B:3C:4D:5F  192.168.1.11     86400       dhcp-snooping   10    GigabitEthernet0/2

Switch# show ip dhcp snooping statistics
Packets Processed by DHCP Snooping   = 100
Packets Dropped Because               = 5
  MAC Address Mismatch                 = 3
  Invalid Server Replies               = 2

Question 93hardmultiple choice

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip access-group ACL-IN in
 ip verify source port-security
!
ip access-list extended ACL-IN
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any

Question 94mediummultiple choice

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Question 95easymulti select

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Question 96mediummultiple choice

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Network Topology

Question 97mediumdrag order

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 98mediummultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP polling. A class-map named CLASS-MGMT matches SNMP and SSH traffic, and a policy-map named COPP-POLICY applies a police rate of 8000 bps with a conform-action transmit and exceed-action drop for that class. After the policy is attached to the control plane, SNMP polling intermittently fails while BGP remains stable. Which action should the engineer take to resolve the SNMP failures while still protecting the route processor?

Question 99hardmultiple choice

A Cisco Catalyst 9500 switch is configured for 802.1X with MAC Authentication Bypass (MAB) fallback on a port connected to an IP phone that has a PC daisy-chained behind it. The phone authenticates successfully using 802.1X, but the PC behind the phone fails authentication and is placed in the guest VLAN. The requirement is that the PC be authenticated individually and placed in the data VLAN, while the phone remains in the voice VLAN. Which feature should be configured on the switch port to meet this requirement?

Question 100mediummulti select

A network architect is designing a Cisco SD-Access fabric. The security team requires that endpoint traffic be segmented into separate virtual networks and that group-based policy be enforced without using traditional VLANs or ACLs between fabric edge nodes. Which two Cisco SD-Access fabric components or features support these requirements? (Choose two.)

Question 101mediummultiple choice

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that carries eBGP, OSPF, SSH management, and SNMP traffic. The engineer wants to ensure that BGP and OSPF routing updates are never dropped while still rate-limiting SSH and SNMP. Which CoPP configuration approach best meets this requirement?

Question 102mediummultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. After applying a new CoPP policy, BGP sessions flap intermittently while SSH and SNMP continue to work. The engineer wants to confirm which traffic class is being dropped. Which action should the engineer take?

Question 103hardmultiple choice

A network administrator is configuring IPsec VPN on a Cisco IOS router. The requirement is that the tunnel must support multicast traffic for OSPF neighbor adjacency across the VPN. Which IPsec configuration element is required to meet this requirement?

Question 104hardmulti select

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The router runs OSPF, BGP, SSH management, and NTP. The engineer wants to ensure that OSPF hello packets are always prioritized and that SSH traffic from the management subnet is rate-limited. Which two statements about the CoPP configuration are true? (Choose two.)

Question 105hardmultiple choice

A network security team deploys Cisco ISE for 802.1X wired authentication. The switches are configured with MAB as a fallback. A printer that does not support 802.1X is connected, but ISE rejects it even though the printer's MAC address is in the correct identity group. The switch port shows the authentication method as MAB and the status as unauthorized. Which configuration issue is the most likely cause?

Question 106hardmultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs OSPF, BGP, SSH management, and SNMP polling. After applying a CoPP policy, the administrator notices that OSPF adjacencies flap intermittently while BGP and SSH remain stable. Which action should the administrator take to resolve the flapping while maintaining control plane protection?

Question 107mediummultiple choice

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce access policy based on a device's role rather than its IP address, so that the enforced policy remains consistent even when endpoints move between VLANs or subnets. Which Cisco TrustSec component is responsible for assigning and carrying this role-based identity through the network?

Question 108mediummultiple choice

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs. After applying a policer to the control plane, the BGP sessions tear down repeatedly while OSPF adjacencies stay stable. The administrator confirms CPU utilization is low. Which action should be taken to resolve the issue?

Question 109easymultiple choice

A network administrator at a small company wants to prevent users from plugging unauthorized switches into wall jacks and creating loops or bypassing security controls. The administrator decides to implement BPDU Guard on all access ports on a Cisco Catalyst switch. Which statement accurately describes the behavior of BPDU Guard when configured on an access port?

Question 110mediummultiple choice

A network engineer is deploying Cisco TrustSec in a campus network. The security team requires that the Security Group Tag (SGT) be carried inside the Ethernet frame so that switches in the path can enforce group-based policy without inline tagging. Which Cisco-proprietary protocol should be enabled on the uplinks between the access and distribution switches to achieve this?

Question 111hardmultiple choice

A security team wants to protect a campus network from MAC flooding attacks that could overflow the CAM table on access switches. The requirement is to limit the number of source MAC addresses learned per switch port and to automatically err-disable a port when the limit is exceeded, while still allowing a VoIP phone and a PC on the same port. Which configuration approach meets these requirements?

Question 112hardmultiple choice

A network engineer is configuring control plane policing (CoPP) on a Cisco IOS XE router that peers BGP with two service providers and is managed over SSH from a jump host. After applying a new policy-map, the engineer notices that BGP sessions remain up but SSH logins intermittently time out during traffic spikes. Which action should the engineer take to resolve the SSH timeouts while preserving the CoPP protection model?

Question 113hardmultiple choice

A network security team is deploying Cisco TrustSec in a data center environment. They want to assign Security Group Tags (SGTs) to traffic based on user identity and device type without relying on IP addresses or VLANs. The team plans to use inline tagging on Cisco Nexus switches that support hardware-based SGACL enforcement. Which statement correctly describes how inline tagging propagates SGT information?

Question 114mediummultiple choice

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which configuration element is required to define this traffic?

Question 115easymultiple choice

A network engineer is configuring a site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. Which IPsec configuration component defines this traffic?

Question 116mediummulti select

A network engineer is implementing MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two campus distribution switches. Which two statements accurately describe MACsec operation on Cisco platforms? (Choose two.)

Question 117easymultiple choice

A network administrator is hardening a Cisco IOS switch that connects to user workstations. The security policy requires that when an unauthorized MAC address appears on an access port, the port must drop only the offending frames, generate a syslog message, and increment a counter, without shutting down the port or requiring administrative intervention. Which port security violation mode meets these requirements?

Question 118mediummultiple choice

A security architect is designing a campus network where all access-layer switch ports must authenticate endpoints before granting any Layer 2 connectivity. The design requires the switch to communicate with Cisco ISE using EAP over RADIUS, and the endpoint must be validated before any VLAN assignment occurs. Which 802.1X component role must the access-layer switch perform in this design?

Question 119hardmultiple choice

Study the full IPv6 explanation →

A network engineer is deploying 802.1X on a Cisco switch with Cisco ISE as the RADIUS server. The engineer wants to allow devices that do not support 802.1X supplicant to connect to a guest VLAN. Which feature should be configured on the switch port to accomplish this?

Question 120easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote users. The requirement is to use a protocol that supports both IKEv2 and native IPv6 transport, and that can provide per-user policy enforcement. Which technology should the administrator implement?

Question 121easymultiple choice

A network administrator must secure management access to a Cisco IOS XE router so that only SSH version 2 is accepted and Telnet is disabled on all VTY lines. Which configuration accomplishes this requirement?

Question 122hardmulti select

A network administrator is configuring MACsec on a Cisco Catalyst switch to secure Layer 2 traffic between two switches. Which two statements about MACsec are true? (Choose two.)

Question 123mediummultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and runs SSH for management. The administrator wants to ensure that a sudden flood of BGP updates from a misbehaving peer does not starve the SSH management plane, while still allowing legitimate BGP traffic. Which CoPP configuration approach best meets this requirement?

Question 124mediummultiple choice

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The administrator wants to protect the route processor from excessive control-plane traffic while still allowing legitimate routing protocol and management traffic. The administrator creates a class map that matches BGP, OSPF, and SSH traffic and applies a police action with a committed information rate. Which additional configuration element is required to complete the CoPP implementation?

Question 125mediummulti select

A network engineer is deploying 802.1X on Catalyst access switches with Cisco ISE as the RADIUS server. Some endpoints, such as printers and badge readers, do not support 802.1X supplicants. The design must allow these devices onto a restricted VLAN while still requiring authentication for laptops. Which TWO mechanisms should the engineer configure to achieve this? (Choose two.)

Question 126hardmultiple choice

A company uses Cisco TrustSec in its campus network. Security policy requires that a user authenticated by 802.1X be assigned a Security Group Tag (SGT) based on the user's Active Directory group, and that the SGT be carried to downstream switches for enforcement. The access switch is configured for 802.1X with Cisco ISE. Which combination of features must be enabled to meet the requirement?

Question 127hardmultiple choice

A network administrator must protect the control plane of a Cisco IOS XE router that peers BGP with an ISP. The requirement is to rate-limit specifically ARP and IPv4 TTL-expired packets destined to the route processor while allowing all other transit traffic to be forwarded normally. Which CoPP implementation step is required to achieve this?

Question 128mediummultiple choice

A network security team deploys Cisco TrustSec on a Catalyst 9500 fabric. The team wants to enforce a policy where a user authenticated into the 'Contractor' security group tag (SGT) is denied access to servers tagged with the 'Finance' SGT, while remaining able to reach the 'Printers' SGT. Which enforcement mechanism applies the SGACL to traffic between the tagging devices?

Question 129mediummultiple choice

An engineer is configuring an IPsec site-to-site VPN between two Cisco IOS XE routers. Phase 1 completes successfully, but Phase 2 fails and no interesting traffic is encrypted. The engineer confirms that the ACLs on both peers mirror each other correctly. Which configuration element should be verified next to resolve the Phase 2 failure?

Question 130hardmultiple choice

A network security engineer is deploying MACsec on a Cisco Catalyst 9000 switch. The switch is connected to a Cisco IP phone that does not support MACsec, and a PC is connected to the phone. The engineer wants to encrypt traffic between the switch and the phone, but the phone does not support MACsec. What should the engineer do to secure the link?

Question 131hardmultiple choice

Review the full subnetting walkthrough →

A network engineer is deploying MACsec on a Cisco Catalyst 9300 switch to secure a point-to-point link between two access switches. The engineer configures the switchport with the macsec command and a pre-shared key. After applying the configuration, the link comes up but MACsec is not encrypting traffic. Which action should the engineer take to resolve the issue?

Question 132mediummultiple choice

An engineer is configuring a Cisco IOS XE switch to secure the management plane. The requirement is to allow SSH only from the management subnet 10.10.10.0/24 and block all other management protocols such as Telnet and HTTP. Which configuration approach best meets this requirement?

Question 133hardmulti select

A network engineer is hardening a Cisco IOS XE router that terminates IPsec site-to-site tunnels with remote branches. The security policy requires that the router only accept IKEv2 negotiations using cryptographically strong parameters and that it validate peer identity via certificates issued by the corporate PKI. Which two configuration elements must the engineer apply to meet these requirements? (Choose two.)

Question 134mediummultiple choice

A network administrator is deploying Cisco TrustSec in a campus network. The security team wants to enforce role-based access control between endpoints without relying on IP addresses or VLANs, and they need to ensure that access policies are consistently applied even when endpoints move between switches. The administrator has already configured Cisco ISE for authentication and authorization. Which technology should be used to propagate the security group tag (SGT) information to network devices that do not support SGT tagging natively?

Question 135mediummultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that peers BGP with two ISPs and is managed over SSH. The administrator needs to protect the route processor from excessive BGP and SSH traffic without breaking the existing sessions. Which action should be taken when applying the CoPP policy?

Question 136mediummultiple choice

A network engineer configures Control Plane Policing on a Cisco IOS XE router acting as the BGP speaker for an ISP edge. The policy must protect the route processor from CPU exhaustion while still allowing BGP keepalives, SSH management, and SNMP polling from the NOC. Which CoPP design element is required to ensure BGP, SSH, and SNMP traffic is matched and rate-limited separately from transit traffic?

Question 137mediummultiple choice

A network administrator is deploying a new Cisco Catalyst 9200 switch at a branch office. The security policy requires that when a device connected to a port is shut down or moved, the switch must immediately send a SNMP trap and place the port into an error-disabled state while also incrementing a violation counter. The administrator configures port security with the violation mode that meets these requirements. Which command must be applied to the interface to achieve this?

Question 138hardmulti select

A network engineer is deploying MACsec on a Cisco Catalyst switch to secure point-to-point links between the access and distribution layers. The design must ensure data confidentiality and integrity on the wire, and must use a key agreement mechanism that supports dynamic key exchange. Which TWO of the following are required to meet these requirements? (Choose two.)

Question 139easymultiple choice

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is that only SSH version 2 with a 2048-bit RSA key be accepted, that Telnet be disabled, and that only the 'netadmin' user with privilege level 15 be allowed to log in via VTY lines 0 through 4. Which configuration accomplishes this?

Question 140hardmultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has management SSH access, BGP peering, and SNMP monitoring. After applying a CoPP policy, the engineer notices that BGP sessions flap intermittently, but SSH and SNMP remain stable. Which action should the engineer take to resolve the BGP flapping while maintaining control plane protection?

Question 141mediummultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router. The router has management SSH access, SNMP monitoring, and BGP peering. After applying the CoPP policy shown in the exhibit, the engineer notices that SNMP polling from the management station fails, while SSH and BGP remain operational. Which action should be taken to restore SNMP polling while maintaining control plane protection?

Question 142mediummulti select

A network security team is evaluating Cisco TrustSec (CTS) for deployment in a campus network. The team wants to understand which components are essential for enforcing security group tags (SGTs) and providing role-based access control. Which two of the following are required to implement CTS with SGT enforcement? (Choose two.)

Question 143mediummultiple choice

A network administrator is deploying a Cisco IOS-XE router as the WAN edge. The security policy requires that the router itself be protected against brute-force SSH attacks originating from the untrusted internet, without affecting transit traffic forwarded through the router. The administrator wants to use a feature that automatically blocks the offending source IP after repeated failed login attempts. Which Cisco IOS-XE feature should be configured?

Question 144mediummultiple choice

A network administrator is deploying Cisco Identity Services Engine (ISE) for wired 802.1X authentication on a Cisco Catalyst 9200 switch. The RADIUS server is reachable at 10.10.10.50 with shared secret 'C1sco123'. The administrator wants the switch to authenticate users before granting access to the data VLAN, and to place unauthenticated devices into a restricted VLAN. Which command sequence correctly enables 802.1X on a switch port?

Question 145hardmulti select

A network security team is deploying MACsec on Cisco Catalyst switches to protect Layer 2 traffic between two distribution switches. They want to ensure that the link is encrypted and that only authorized devices can participate in the secured session. Which two statements about MACsec operation on Cisco platforms are correct? (Choose two.)

Question 146mediummulti select

Review the full subnetting walkthrough →

A network engineer is implementing 802.1X authentication on a Cisco switch. The engineer wants to ensure that the switch dynamically assigns a VLAN to the port based on the user's identity, and that the VLAN assignment is enforced by the authentication server. Which two components are required to achieve this? (Choose two.)

Question 147easymultiple choice

A network administrator is configuring a Cisco IOS XE router to protect against spoofed source addresses on an internal interface facing user subnets. The requirement is to drop packets whose source address does not match the routing table entry for the incoming interface. Which feature should be enabled?

Question 148easymultiple choice

A network administrator is configuring a Cisco Catalyst switch to prevent unauthorized devices from connecting to an access port. The administrator wants to ensure that only one MAC address is allowed on the port, and if a violation occurs, the port should be shut down and an SNMP trap sent. Which port security violation mode should be configured?

Question 149easymultiple choice

A network engineer is configuring an IPsec site-to-site VPN between two Cisco IOS-XE routers. The design requires that the data payload be encrypted and that the two peers authenticate each other using pre-shared keys without any certificate infrastructure. Which combination of IKEv2 parameters must be configured on both peers to establish the tunnel?

Question 150hardmultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against excessive ARP traffic. The engineer applies the following policy:

policy-map COPP-POLICY

class ARP-CLASS

police 8000 conform-action transmit exceed-action drop

After applying the service-policy to the control-plane, the engineer notices that legitimate ARP requests are being dropped during peak hours. Which action should the engineer take to resolve this issue while maintaining protection?

Question 151hardmultiple choice

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against control plane overload. The router has management traffic (SSH, SNMP) and routing protocol traffic (OSPF, BGP). After applying the CoPP policy, the engineer notices that OSPF adjacencies are flapping. Which action should the engineer take to resolve this issue while maintaining control plane protection?

Question 152easymultiple choice

A network administrator needs to secure management access to a Cisco IOS XE switch. The requirement is to ensure that only SSH version 2 is used for remote CLI access, and that Telnet is disabled. Which configuration achieves this?

Question 153mediummultiple choice

A network engineer configures a Cisco IOS router to authenticate administrative SSH logins against a Cisco ISE server using TACACS+. After applying the configuration, a valid ISE user can log in but receives no privilege level and cannot enter privileged EXEC mode. The relevant configuration is:

aaa new-model
 aaa authentication login default group tacacs+ local
 aaa authorization exec default group tacacs+ local

tacacs server ISE address ipv4 10.10.10.50 key Cisco123

Which action most directly resolves the problem?

Question 154mediummultiple choice

A network administrator is deploying a new branch office with a Cisco Catalyst 9200 switch. The security policy requires that any endpoint connecting to access ports must be authenticated before being granted network access, and unauthenticated devices must be placed into a restricted VLAN. The administrator wants to minimize configuration on the switch and rely on the authentication server to assign the VLAN dynamically. Which 802.1X feature should be configured on the switch to meet these requirements?

Question 155hardmultiple choice

A network security engineer is configuring an IPsec site-to-site VPN between two Cisco IOS routers. The engineer wants to ensure that the VPN tunnel uses perfect forward secrecy (PFS) and that the encryption is AES-256. Which combination of commands achieves this?

Question 156hardmultiple choice

A security architect is designing segmentation for a data center using Cisco TrustSec. The requirement is that classification of traffic into Security Group Tags (SGTs) occur at the access layer based on the identity of the user or device, and that enforcement occur at the data center core where the SGT-to-SGACL matrix is applied. Which statement describes the correct deployment approach?

Question 157hardmultiple choice

A campus switch connects to an IP phone that has a PC daisy-chained behind it. The engineer wants the phone to reside in VLAN 100 and the PC in VLAN 200, with the phone tagging its own voice traffic. Which interface configuration accomplishes this?

Question 158mediummultiple choice

A network engineer is implementing IPsec VPN on a Cisco IOS XE router. The design requires that traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet be encrypted, while all other traffic should be sent unencrypted. The engineer creates a crypto ACL. Which action must be taken to ensure the crypto ACL correctly identifies the traffic to protect?

Question 159easymultiple choice

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on the port and to automatically shut down the port if a violation occurs. Which command set should be used?

Question 160mediummultiple choice

A network administrator is configuring 802.1X on a Cisco Catalyst switch. The switch is connected to a Cisco IP phone with a PC attached to the phone's data port. The requirement is to authenticate both the phone and the PC separately, with the phone in the voice VLAN and the PC in the data VLAN. Which 802.1X feature should be enabled?

Question 161hardmultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect against DoS attacks. The router has a management plane that includes SSH and SNMP, and a control plane that includes routing protocols like OSPF and BGP. The engineer wants to rate-limit traffic destined to the route processor while ensuring that management traffic is not dropped during high CPU load. Which CoPP configuration approach is most appropriate?

Question 162easymultiple choice

A network administrator is configuring a zone-based firewall on a Cisco IOS XE router. The requirement is to allow HTTP traffic from the INSIDE zone to the OUTSIDE zone while blocking all other traffic initiated from INSIDE. Which action must be taken to define the traffic that is permitted?

Question 163mediummultiple choice

A network administrator is implementing Control Plane Policing on a Cisco IOS-XE router to protect the route processor from excessive BGP, SSH, and SNMP traffic. After applying the policy, legitimate BGP keepalives are being dropped, causing peer resets. Which action should the administrator take to resolve this while still protecting the control plane?

Question 164easymultiple choice

A security team wants to protect a web application hosted behind a Cisco IOS router from cross-site scripting and SQL injection attacks without modifying the application itself. Which Cisco IOS feature is designed for this purpose?

Question 165easymultiple choice

A network administrator must secure management access to a Cisco Catalyst 9300 switch so that only encrypted sessions are accepted and any Telnet attempt is refused. The administrator wants to enforce this with the fewest configuration lines on the VTY lines. Which configuration accomplishes this?

Question 166easymultiple choice

A network administrator is configuring a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the data transmitted between the sites is encrypted and authenticated. Which IPsec protocol should be used to provide both confidentiality and integrity for the data payload?

Question 167hardmultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH management, and SNMP. After applying a CoPP policy, BGP peering drops intermittently during route churn, but SSH and SNMP remain reachable. Which action should be taken to correct the issue while preserving control plane protection?

Question 168hardmultiple choice

A network administrator is configuring a Cisco IOS XE router to act as a VPN headend with IKEv2. The security policy requires that the router authenticate to peers using a certificate from a corporate PKI, and that peers authenticate using EAP-MSCHAPv2. Which IKEv2 authentication configuration on the headend meets these requirements?

Question 169hardmulti select

A network security team is hardening a Cisco IOS-XE router that terminates a site-to-site VPN to the internet. They want to ensure that the router itself cannot be managed from untrusted networks and that its management protocols are protected. Which two configuration actions achieve these goals? (Choose two.)

Question 170mediummultiple choice

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive traffic. The router has a single physical interface Gi0/0/0 that carries both management SSH traffic and transit data traffic. The administrator wants the CoPP policy to apply only to traffic destined to the router's control plane, not to transit traffic. Which CoPP configuration element must be applied to achieve this?

Question 171mediummultiple choice

A company runs a Cisco IOS router as the WAN edge. The security team wants to detect and log traffic that matches a set of known malicious signatures without blocking legitimate traffic, while still dropping clearly malformed packets. Which technology should be deployed on the router?

Question 172mediummultiple choice

A network administrator is configuring 802.1X authentication on a Cisco switch port. The port is connected to a VoIP phone that then connects to a PC. The administrator wants to authenticate both the phone and the PC separately, with the phone using MAB and the PC using 802.1X. Which feature should be configured on the switch port to support this?

Question 173mediummultiple choice

A network engineer is implementing a Zone-Based Firewall (ZBFW) on a Cisco IOS XE router. The router has three interfaces: inside (GigabitEthernet0/0), outside (GigabitEthernet0/1), and DMZ (GigabitEthernet0/2). The security policy requires that traffic from the inside zone to the outside zone be inspected, traffic from the outside zone to the DMZ be allowed only for HTTP and HTTPS, and all other traffic between zones be denied by default. Which configuration step is essential to achieve this policy?

Question 174mediummulti select

A network administrator is implementing Dynamic ARP Inspection (DAI) on a Cisco Catalyst switch. The network uses DHCP for most endpoints, but a few servers have static IP addresses. Which two actions are required to ensure DAI allows legitimate traffic while blocking ARP spoofing? (Choose two.)

Question 175mediummultiple choice

A network engineer is deploying Control Plane Policing on a Cisco IOS XE router that runs BGP, SSH management, and SNMP monitoring. The engineer must ensure that BGP keepalives are never dropped even during a control-plane flood, while SSH and SNMP traffic should be rate-limited. Which CoPP configuration element accomplishes this requirement?

Question 176hardmulti select

A network engineer is deploying MACsec on a Catalyst switch uplink between two buildings to protect Layer 2 traffic. Which two statements about MACsec operation on Cisco Catalyst switches are true? (Choose two.)

Question 177mediummulti select

A network engineer is implementing IPsec VPN on a Cisco IOS XE router to connect a branch office to headquarters. The engineer must ensure that the IKEv2 negotiation uses strong authentication and that the data plane is protected with integrity and encryption. Which two configuration elements are required to achieve this? (Choose two.)

Question 178hardmultiple choice

A network engineer is configuring IPsec VPN on a Cisco IOS router. The requirement is to encrypt traffic between two sites using IKEv2. The engineer wants to ensure that the IKEv2 proposal uses AES-256 for encryption, SHA-256 for integrity, and Diffie-Hellman group 14. Which command correctly defines the IKEv2 proposal with these parameters?

Question 179mediummultiple choice

A network engineer must protect the Cisco IOS control plane from an excessive volume of ARP traffic generated by a compromised host in VLAN 20. The engineer wants to limit ARP packets that are punted to the CPU, while allowing normal data forwarding to continue unaffected. Which feature should be configured to accomplish this goal?

Question 180easymultiple choice

A network engineer needs to secure management access to a Cisco IOS XE router. The requirement is to encrypt all management traffic, including SNMP, and to authenticate administrators against a centralized server. Which combination of features should be implemented?

Question 181mediummultiple choice

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The requirement is that the VPN must support dynamic routing protocol updates across the tunnel and allow multicast traffic between the sites. Which IPsec configuration mode should be used?

Question 182easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote access using SSL VPN. The requirement is to allow users to connect via a web browser and access internal web applications without installing a client. Which feature should the administrator configure?

Question 183hardmultiple choice

An engineer is configuring 802.1X on a Cisco Catalyst switch port where a PC is connected. The requirement is that if the authentication server becomes unreachable, the port should still allow the PC to send traffic in a restricted VLAN rather than being shut down. Which configuration meets this requirement?

Question 184hardmultiple choice

A security architect is designing a network where endpoint identity and group membership must follow users and devices across both wired and wireless networks, and policy enforcement must be consistent regardless of VLAN or IP subnet. Which Cisco solution provides this identity-based, group-based access control?

Question 185hardmultiple choice

A network security architect is designing a Zero Trust architecture for a campus network using Cisco Identity Services Engine (ISE) and Cisco TrustSec. The requirement is to enforce segmentation based on user identity and device posture, and to apply policy dynamically as users move between wired and wireless access points. Which Cisco TrustSec component is responsible for tagging packets with a Security Group Tag (SGT) at the access layer?

Question 186hardmultiple choice

A security architect is evaluating MACsec on a Cisco Catalyst switch uplink between two buildings. The requirement is to encrypt all Layer 2 traffic on the link with minimal configuration and use a standards-based key agreement. Which statement correctly describes how MACsec should be deployed on this link?

Question 187hardmultiple choice

A network security engineer is configuring 802.1X on a Cisco Catalyst switch with Cisco ISE as the RADIUS server. The switch is configured with 'dot1x system-auth-control' and the interface is set to 'authentication port-control auto'. The engineer wants to allow a printer that does not support 802.1X to connect to the network by using MAC Authentication Bypass (MAB). Which additional configuration is required on the switch interface to enable MAB?

Question 188mediummultiple choice

A network administrator is configuring a Cisco IOS router to support IPsec VPN for remote workers. The security policy requires that the router authenticate users via digital certificates issued by a corporate PKI. The administrator has already configured the CA trustpoint and obtained a certificate. Which command must be used in the ISAKMP policy to specify that RSA signatures (digital certificates) should be used for authentication?

Question 189mediummulti select

A network administrator is deploying 802.1X on Cisco Catalyst access switches with Cisco ISE as the RADIUS server. The design requires that devices failing authentication be placed into a restricted VLAN, and that IP phones be authenticated before the attached PC. Which two features must be configured to meet these requirements? (Choose two.)

Question 190easymultiple choice

A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote access. The requirement is to use IKEv2 with certificate-based authentication. The administrator has installed a valid identity certificate on the router and configured the IKEv2 profile. However, remote clients are unable to establish the VPN tunnel, and the router logs show 'IKEv2 certificate authentication failed'. What is the most likely cause?

Question 191hardmultiple choice

A network engineer is configuring IPsec VPN on a Cisco IOS XE router. The requirement is to protect traffic between two sites using ESP with AES-256 encryption and SHA-256 authentication, and to ensure that the tunnel is rekeyed every 3600 seconds. Which configuration element directly controls the rekey interval?

Question 192easymultiple choice

A network engineer is configuring a Cisco Catalyst switch to mitigate VLAN hopping attacks. The switch has multiple access ports assigned to VLAN 10 and trunk ports connecting to other switches. The engineer wants to ensure that an attacker cannot send double-tagged frames to hop into another VLAN. Which action should the engineer take on all access ports?

Question 193easymultiple choice

A network engineer needs to provide secure remote-access VPN connectivity for employees using Cisco AnyConnect. The requirement is to use digital certificates issued by the corporate PKI for both server and client authentication. Which component must be configured on the Cisco ASA to validate client certificates presented during the VPN session?

Question 194mediummultiple choice

A network administrator is deploying a Cisco Catalyst switch with DHCP snooping. The switch is configured with DHCP snooping globally and on VLAN 10. A DHCP server is connected to GigabitEthernet1/0/5, and client devices are connected to GigabitEthernet1/0/6 through 1/0/20. The administrator notices that DHCP offers from the server are being dropped. What is the most likely cause?

Question 195mediummultiple choice

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, OSPF, and SSH management. The engineer applies a CoPP policy-map to the control plane with a class that matches BGP traffic and sets police rate 8000 conform-action transmit exceed-action drop. After applying the policy, BGP sessions intermittently flap during route convergence. Which action should the engineer take to resolve the issue while maintaining control plane protection?

Question 196hardmultiple choice

A network security team is implementing Cisco TrustSec in a campus network. The team wants to enforce access based on a tag carried in the packet rather than by IP address, and wants the tag to be propagated across the network without per-hop reclassification. Which Cisco TrustSec component assigns and inserts the Security Group Tag (SGT) at the ingress point?

Question 197hardmultiple choice

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch uplink between two buildings to protect Layer 2 traffic. The team wants to ensure that the link encrypts traffic and that the peer is authenticated before secure communication begins. Which configuration approach meets these requirements?

Question 198hardmultiple choice

A security team is deploying Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. They notice that after applying a CoPP policy, OSPF adjacency with a directly connected neighbor flaps intermittently. Which action should the engineer take to resolve the issue while maintaining control plane protection?

Question 199mediummultiple choice

A network administrator is configuring a Cisco IOS router to terminate a site-to-site IPsec VPN with a remote peer that uses dynamic public IP addressing. The administrator wants the router to accept IKE negotiations from any peer that presents a valid pre-shared key and matches a specific protected subnet. Which configuration element is required to support this?

Question 200hardmulti select

A network security team is implementing Cisco TrustSec in a campus network. They need to deploy Security Group Tags (SGTs) and enforce policies using Security Group ACLs (SGACLs). Which two statements are true regarding SGT propagation and enforcement in this environment? (Choose two.)

Question 201hardmultiple choice

A network administrator is implementing Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect against DoS attacks. The router has a management plane that must remain accessible via SSH and SNMP, and a control plane that must process BGP and OSPF routing updates. The administrator applies a CoPP policy that rate-limits all traffic destined to the control plane to 1000 pps, except for traffic from trusted management subnets. After applying the policy, BGP sessions flap intermittently. What is the most likely cause?

Question 202mediummultiple choice

A network administrator is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The administrator needs to verify which traffic classes are being matched and how many packets are being dropped by the policy. Which command should be used to display the CoPP policy statistics and class-map information?

Question 203hardmultiple choice

A Cisco Catalyst 9500 switch in a data center is configured with IP Source Guard on an access port where a server is connected. The server has a static IP address of 10.10.10.50 and MAC address 00:11:22:33:44:55. The network administrator has configured a static IP source binding using the command 'ip source binding 0011.2233.4455 vlan 10 10.10.10.50 interface GigabitEthernet1/0/1'. However, the server cannot communicate through the switch. What is the most likely cause?

Question 204mediummultiple choice

A network security administrator is configuring a Cisco IOS Zone-Based Firewall on a branch router. The inside zone and outside zone are defined, and the administrator wants to allow inside hosts to initiate sessions to outside servers while preventing outside hosts from initiating sessions to inside hosts. Which configuration accomplishes this?

Question 205hardmulti select

A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tagging (SGT) and enforce policies based on SGTs. Which two mechanisms can be used to propagate SGTs between network devices? (Choose two.)

Question 206mediummultiple choice

A network administrator is deploying a Cisco Wireless LAN Controller (WLC) running AireOS in a branch office. The security policy requires that guest wireless clients be isolated from internal corporate clients and that guest traffic be tunneled back to a DMZ interface on the WLC. Which WLAN configuration element should the administrator use to meet these requirements?

Question 207easymultiple choice

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to secure wireless client traffic. The requirement is to encrypt all wireless traffic between the client and the access point using a pre-shared key, without requiring a separate authentication server. Which security policy should the administrator configure on the WLC?

Question 208mediummultiple choice

A network engineer is deploying Control Plane Policing on a Cisco IOS-XE router that runs OSPF, BGP, and SSH management. The engineer wants to rate-limit routing protocol traffic while ensuring that SSH management traffic is never dropped, even during a routing protocol flood. The router uses a single physical interface for all control plane traffic. Which CoPP design approach best meets these requirements?

Question 209mediummultiple choice

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an unauthorized device connects to an access port, the port must immediately stop forwarding traffic, generate a syslog message, and increment the violation counter, while allowing the administrator to manually re-enable the port after investigation. Which port security violation mode should be configured?

Question 210mediummultiple choice

A network administrator is deploying a Cisco Catalyst 9300 switch stack at the access layer. The security policy requires that when an endpoint device is connected to a port and later replaced by a different device, the port must automatically learn the new MAC address without administrative intervention, but a violation must generate a syslog message and increment a counter. The administrator configures the interface with the command 'switchport port-security violation restrict'. Which additional command is required to meet the requirement that the new device is learned automatically?

Question 211hardmultiple choice

A network engineer is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router. The router runs BGP, OSPF, SSH management, and SNMP. After applying a CoPP policy that rate-limits all control-plane traffic to 1000 pps, BGP sessions flap and OSPF adjacencies reset during peak traffic. Which action should the engineer take to resolve the problem while maintaining control-plane protection?

Question 212hardmultiple choice

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive control-plane traffic. The engineer wants to rate-limit ARP and DHCP snooping-related traffic destined to the control plane while allowing routing protocol traffic without restriction. Which CoPP component must the engineer configure to classify and match this traffic before applying the policy?

Question 213easymultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor from excessive SSH traffic. The engineer wants to classify SSH traffic destined to the router itself and apply a policer to it. Which mechanism is used by CoPP to classify traffic before the policer is applied?

Question 214mediummulti select

A network administrator is configuring IPsec VPN on a Cisco IOS router. The administrator needs to ensure that the VPN traffic is encrypted and authenticated. Which two protocols are used in IPsec to provide encryption and authentication? (Choose two.)

Question 215hardmultiple choice

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router to protect the route processor. The engineer wants to rate-limit ICMP echo requests destined to the router itself while ensuring that transit traffic passing through the router is not affected. Which classification approach should the engineer use in the CoPP policy?

Question 216hardmultiple choice

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and SNMP. The engineer wants to ensure that BGP keepalives are not dropped during a control plane overload, while still rate-limiting SSH and SNMP. The engineer creates a class-map matching BGP, SSH, and SNMP traffic, then applies a policy-map with a single policer of 1000 pps to that class. After applying the service-policy to the control plane, BGP sessions flap during high CPU utilization. What is the most likely cause?

Question 217hardmultiple choice

A security architect is designing a Cisco TrustSec deployment for a campus network. The architect needs to ensure that security group tags (SGTs) are propagated across a Layer 2 trunk between two Catalyst switches that do not support SGACL enforcement. Which technology should be used to carry SGT information inline within the Ethernet frame?

Question 218easymultiple choice

A network administrator is configuring a site-to-site VPN between two Cisco IOS routers using IPsec. The security policy requires that the VPN use IKEv2 with certificate-based authentication. Which command must be configured on both routers to specify the trustpoint that will be used for IKEv2 authentication?

Question 219mediummultiple choice

A network administrator is configuring a site-to-site IPsec VPN between two Cisco IOS routers. The design requires that only traffic from specific subnets be encrypted and that the routers use a preshared key for authentication. Which combination of configuration elements must the administrator define to match the interesting traffic and establish the tunnel?

Question 220hardmultiple choice

A network security team is deploying MACsec on a Cisco Catalyst 9300 switch connecting to a partner's Catalyst 9200 over a metro Ethernet link. The team wants to encrypt all traffic on the link and ensure that the switches mutually authenticate before any frames are forwarded. Which IEEE standard defines the key agreement and encryption used by MACsec, and which component performs the key exchange?

Question 221mediummulti select

A network security team is hardening a Cisco IOS XE router that terminates IPsec tunnels to remote branch offices. The team wants to use zone-based firewall (ZBFW) to inspect traffic between the inside, outside, and VPN zones. Which two statements correctly describe zone-based firewall behavior on this platform? (Choose two.)

Question 222mediummulti select

A network security team is deploying MACsec on a Cisco Catalyst 9000 switch series to secure Layer 2 traffic between two switches. Which two statements about MACsec operation are true? (Choose two.)

Question 223hardmultiple choice

A network engineer is configuring MACsec on a point-to-point link between two Cisco Catalyst switches to provide Layer 2 encryption. The engineer wants to use a pre-shared key for authentication and ensure that the key is rotated periodically. Which MACsec component must be configured to specify the pre-shared key and the key rotation timer?

Question 224hardmultiple choice

A network engineer is configuring a Zone-Based Firewall on a Cisco IOS XE router. The design requires that traffic from the inside zone to the outside zone be inspected, that return traffic be permitted, and that traffic from the outside zone to the inside zone be dropped unless it matches an existing session. Which configuration element is required to achieve this behavior?

Question 225mediummultiple choice

A network engineer is configuring Control Plane Policing (CoPP) on a Cisco IOS-XE router that also runs OSPF, BGP, and SSH management. The engineer needs to protect the control plane while ensuring that routing protocol traffic and management sessions are not disrupted. Which CoPP design approach best meets these requirements?

Question 226easymultiple choice

A network administrator needs to securely manage a Cisco Catalyst switch remotely. The requirement is to encrypt all management traffic, including username and password, between the administrator's workstation and the switch. Which management protocol should be enabled on the switch to meet this requirement?

Question 227mediummultiple choice

An engineer must secure the management plane of a Cisco IOS XE router so that only SSH version 2 is accepted for remote administration, while Telnet and SSHv1 are rejected. Which set of commands accomplishes this?

Question 228hardmultiple choice

A network security engineer is configuring Control Plane Policing (CoPP) on a Cisco ASR 1000 router to protect the route processor from excessive traffic. The engineer wants to rate-limit SSH traffic to 100 kbps with a burst of 8000 bytes, and ensure that any traffic exceeding the rate is dropped. The engineer applies the following policy:

policy-map COPP-POLICY

class SSH-CLASS

police 100000 8000 exceed-action drop

After applying the service-policy to the control plane, the engineer notices that SSH sessions intermittently disconnect during large file transfers over SCP. What is the most likely cause?

Question 229mediummultiple choice

A network administrator is deploying Control Plane Policing (CoPP) on a Cisco IOS XE router that runs BGP, SSH, and NTP. The requirement is to protect the route processor from excessive BGP keepalive traffic while still allowing all legitimate BGP peering. Which CoPP module should the administrator use to classify and police this traffic before the policy is applied to the control plane?

Question 230hardmultiple choice

A network engineer is implementing Control Plane Policing (CoPP) on a Cisco IOS router to protect the route processor from excessive CPU utilization due to malicious traffic. The engineer wants to ensure that BGP, SSH, and SNMP traffic are rate-limited appropriately. After applying the CoPP policy, the engineer notices that BGP sessions are flapping. Which action should the engineer take to resolve the issue while maintaining protection?

Question 231mediummulti select

A network administrator is configuring a Cisco IOS zone-based firewall (ZBFW) on a router that connects a LAN zone to an Internet zone. The administrator wants to allow outbound HTTP and HTTPS from the LAN to the Internet while blocking all other outbound traffic, and to allow return traffic for established sessions. Which two configuration elements are required to accomplish this? (Choose two.)

Question 232hardmultiple choice

A network engineer is configuring a Cisco ASA firewall with a site-to-site VPN to a remote peer. The engineer wants to ensure that only specific subnets are encrypted and that traffic from other subnets is not sent through the tunnel. Which configuration element defines the traffic that will be protected by the VPN?

Question 233mediummultiple choice

A network administrator is deploying 802.1X on Cisco Catalyst switches with Cisco ISE as the RADIUS server. The administrator wants to allow devices that do not support 802.1X, such as printers, to connect to the network. Which feature should be configured on the switch ports to support these devices while maintaining security?

Question 234hardmultiple choice

A network security team is hardening a Cisco IOS-XE router that terminates IPsec VPN tunnels. They want to protect the control plane from CPU-intensive IKE and management traffic without dropping legitimate tunnel establishment packets. They decide to apply a Control Plane Policing (CoPP) policy. Which statement best describes how CoPP interacts with the forwarding plane and the control plane on this router?

Question 235hardmultiple choice

A security team wants to deploy MACsec on a Cisco Catalyst switch uplink between two buildings to protect Layer 2 traffic. The switches are Cisco Catalyst 9300 series running IOS XE, and the link must encrypt all frames between them. Which statement accurately describes a requirement for this deployment?

Question 236mediummultiple choice

A network administrator is implementing IP Source Guard (IPSG) on a Cisco Catalyst 3850 switch to prevent IP spoofing. The administrator enables DHCP snooping and IPSG on VLAN 10. A user connects a laptop with a statically assigned IP address 10.10.10.50/24 and gateway 10.10.10.1. The laptop cannot reach any network resources. What is the most likely reason?

Question 237hardmultiple choice

A network engineer is configuring IPsec site-to-site VPNs on a Cisco IOS XE router. The design requires that the router authenticate peers using certificates issued by an internal PKI rather than pre-shared keys, and that IKEv2 be used for the key exchange. Which configuration element is required to support certificate-based authentication for IKEv2 on this router?

Question 238easymultiple choice

A network administrator is configuring a Cisco Wireless LAN Controller (WLC) to use 802.1X authentication for wireless clients. The administrator wants to ensure that the WLC communicates with the RADIUS server securely. Which protocol should be used to encrypt the RADIUS communication between the WLC and the RADIUS server?

Question 239hardmultiple choice

A network engineer is configuring IPsec VPN on a Cisco IOS router. The engineer wants to ensure that traffic from a specific subnet is encrypted and sent to a remote peer, while all other traffic is sent unencrypted. The engineer has configured an extended ACL for the crypto map. Which additional configuration is required to ensure that the crypto map is applied to the correct interface and that the VPN tunnel is established?

Question 240mediummultiple choice

A network engineer must protect the OSPF adjacency between two Cisco routers from spoofed hello packets injected by a rogue device on the same broadcast segment. The engineer wants to use a cryptographic authentication method that is natively supported by OSPFv2 and does not rely on plain-text key exchange. Which configuration should be applied to the interfaces?

Question 241hardmulti select

A security team is hardening a Cisco IOS router that terminates IPsec site-to-site tunnels to several branch offices. The team wants to protect the control plane by rate-limiting and filtering traffic destined to the router's own CPU. Which two mechanisms are designed specifically for control plane protection on Cisco IOS? (Choose two.)

Question 242hardmulti select

A network security engineer is deploying Cisco TrustSec in a campus network. The engineer wants to implement Security Group Tags (SGTs) and enforce policies using a Cisco Catalyst switch as an enforcement point. Which two statements are true regarding SGT propagation and enforcement in this scenario? (Choose two.)

Question 243easymultiple choice

A network administrator is configuring a Cisco IOS router to protect the control plane from excessive CPU utilization caused by malicious traffic. The administrator wants to rate-limit specific types of traffic destined to the route processor while allowing all other traffic to pass without restriction. Which feature should be configured?

Question 244mediummulti select

A network engineer is hardening a Cisco IOS XE router against control plane attacks. The router runs OSPF, BGP, and SSH management. The engineer wants to apply Control Plane Policing (CoPP) to rate-limit nonessential traffic while ensuring routing protocols are not disrupted. Which two actions should the engineer take? (Choose two.)

Question 245mediummulti select

A network engineer is implementing Cisco TrustSec in a campus network. The engineer needs to configure the enforcement of security group tags (SGTs) on Cisco Catalyst switches. Which two statements are true regarding SGT enforcement and propagation? (Choose two.)

Question 246hardmulti select