CCNA Security Questions

The police rate of 8000 bps is too low for peak ARP traffic, causing legitimate ARP requests to be dropped. Increasing the rate to a value that matches normal peak traffic while still providing an upper bound protects the control plane without dropping legitimate traffic. This is the correct tuning approach for CoPP.

Phase 2 negotiation uses the transform set to define encryption and integrity algorithms for the IPsec SA. If the transform sets differ between peers, the quick mode negotiation fails even though Phase 1 succeeded. Matching transform sets on both routers is essential to complete Phase 2 and establish the data-protection tunnel.

CoPP operates by attaching a service policy to the control-plane interface (control-plane global configuration), which only sees traffic punted to the route processor. Matching ICMP echo requests destined to the router's own addresses in a class map, then applying the policy to control-plane, rate-limits only router-bound ICMP while transit traffic is untouched. This is the standard CoPP design pattern for protecting the route processor.

A single policer applied to a class that matches BGP, SSH, and SNMP treats all three protocols identically. During high CPU, BGP keepalives may exceed the 1000 pps rate along with other traffic, causing drops. BGP requires a separate class with a higher rate or priority to ensure keepalives are not dropped. The design flaw is the lack of granularity.

Correct. Without DHCP or a static IP-source binding, IPSG blocks the traffic.

SSH encrypts CLI sessions, SNMPv3 with authPriv provides both authentication and encryption for SNMP, and TACACS+ centralizes administrator authentication with per-command authorization. This combination meets the requirement to encrypt all management traffic and authenticate against a central server. It is the standard secure management baseline for Cisco IOS XE devices.

The 'crypto ipsec security-association lifetime seconds 3600' command sets the IPsec SA lifetime to 3600 seconds, after which the SA is rekeyed. This is the correct command to control the rekey interval for the IPsec (data) tunnel. The IKE SA lifetime is controlled separately with 'crypto isakmp policy' or 'crypto ikev2 policy' settings, but the IPsec SA lifetime is what governs data tunnel rekeying.

MDA allows both a voice device (phone) and a data device (PC) to authenticate independently on the same switch port. Each device is authenticated in its respective VLAN (voice and data), and the switch applies separate policies. This meets the requirement of authenticating both devices separately.

MACsec uses the MACsec Key Agreement (MKA) protocol, which relies on a Connectivity Association Key (CAK) and its name (CKN). When configured with a static pre-shared CAK/CKN, MKA derives the Secure Association Key (SAK) used to encrypt traffic. This is the standard, low-configuration deployment for a point-to-point uplink and meets the requirement for standards-based key agreement.

BGP keepalives are sent periodically (typically every 60 seconds) and matched by the CoPP BGP class because they are control-plane TCP traffic to/from port 179. If the policer's committed rate is exceeded—even briefly—the excess keepalives are dropped. After a few missed keepalives, the BGP hold timer (default 180 seconds) expires, causing the peer session to flap. The same policer can also drop BGP route updates, which may cause instability beyond just keepalives.

Certificate-based IKEv2 authentication requires a trustpoint that defines the CA, an enrolled identity certificate, and an RSA key pair on the router. The IKEv2 profile then references authentication local rsa-sig and the trustpoint so the router can present its certificate and validate the peer's certificate chain. Without a properly enrolled trustpoint, the router cannot perform RSA signature authentication, so this element is mandatory for the design.

IP Source Guard relies on the DHCP snooping binding table to validate IP-to-MAC bindings. Even with static entries, DHCP snooping must be enabled on the VLAN to maintain the binding table and allow IP Source Guard to function. Without it, the switch cannot validate traffic and may drop packets, causing the server to lose connectivity.

MACsec, defined in IEEE 802.1AE, provides hop-by-hop encryption and integrity checking at Layer 2 using GCM-AES. Enabling MACsec on the interfaces is what actually secures the wire between access and distribution. MKA alone negotiates keys but does not encrypt frames, so MACsec must be configured to satisfy the confidentiality and integrity requirement.

CoPP uses a modular QoS CLI structure in which class maps match traffic destined to the control plane. Matching combines the control-plane keyword with ACLs, protocol keywords, or NBAR to identify specific flows such as SSH. The matched traffic is then referenced by a policy map that applies a policer, which is attached to the control plane with the service-policy command.

A crypto ACL (also called an encryption ACL) defines the interesting traffic that should be protected by IPsec. It is referenced in the crypto map. Permitting traffic from 10.1.1.0/24 to 10.2.2.0/24 ensures that only this traffic is encrypted. Other traffic falls through the implicit deny and is sent unencrypted, as desired. This is the standard method to specify VPN traffic.

RadSec (RADIUS over TLS) encrypts RADIUS packets using TLS, providing secure communication between the WLC and the RADIUS server. This protects credentials and attributes from eavesdropping. It is the recommended method for securing RADIUS traffic in modern deployments.

ESP provides confidentiality through encryption and can also provide authentication and integrity for the payload. It is the standard choice for VPNs requiring encryption. ESP can operate in transport or tunnel mode; in tunnel mode, it encrypts the entire original IP packet. This meets the requirement for both confidentiality and integrity of the data payload.

Cisco TrustSec supports SGT propagation through Layer 2 trunks using either Cisco Metadata (CMD) or inline tagging (also known as SGT Exchange Protocol or SXP for Layer 3). Inline tagging embeds the SGT in the Ethernet frame, allowing switches to enforce policies based on the tag without needing to look up the source identity.

Zone-based firewall uses class-maps to identify traffic and policy-maps to define actions. The policy-map is applied to a zone pair (INSIDE to OUTSIDE) with the service-policy command, so only HTTP is permitted while other traffic is dropped by default.

An access port with a voice VLAN configured uses Cisco's multi-VLAN access behavior: untagged frames from the attached PC are placed in the access VLAN, while 802.1Q-tagged frames from the phone are placed in the voice VLAN. Setting the access VLAN to 200 and the voice VLAN to 100 satisfies the requirement that the PC sit in VLAN 200 and the phone in VLAN 100.

Zone-based firewall uses class maps to identify traffic and policy maps to apply actions such as inspect. To allow HTTP and HTTPS from LAN to Internet, a class map matching those protocols is required, and the policy map must apply the inspect action so that return traffic is permitted for established sessions.

Classes in a control-plane policy-map that have no police action applied are not rate-limited, so matching BGP traffic and simply referencing it in the policy-map exempts BGP from CoPP policing. The engineer can then apply 'police' actions to SSH and SNMP classes. This satisfies the requirement that BGP keepalives are never dropped while still rate-limiting other control-plane traffic.

This is the correct cause. DHCP snooping compares the source MAC address in the Ethernet frame header with the 'chaddr' field inside the DHCP packet itself. When the DHCP client inserts a different MAC address in the chaddr field than the actual source MAC of the frame, the switch flags this as a potential spoofing attempt and drops the packet, incrementing the 'MAC address mismatch' counter. This check prevents a client from impersonating another device's MAC address in DHCP requests.

This sequence generates a 2048-bit RSA key, restricts SSH to version 2, disables Telnet by allowing only SSH transport on the VTY lines, and enforces local authentication with a privilege 15 user. All three requirements—SSHv2, no Telnet, and netadmin-only access—are satisfied by this configuration.

To validate client certificates, the ASA must trust the issuing CA. A trustpoint holds the CA certificate and enables the ASA to verify the certificate chain presented by AnyConnect clients. Without this trustpoint, the ASA cannot confirm the client certificate is genuine, so it is the required configuration for certificate-based client authentication.

MACsec uses a secure connectivity association defined by a connectivity association key (CAK) and connectivity association key name (CKN), either pre-shared or negotiated via MKA. Both endpoints must support MACsec and agree on keys before encrypted frames can be exchanged. This matches the requirement to protect all Layer 2 traffic on the uplink between the two Catalyst switches.

Prevents trunk negotiation.

An IKEv2 proposal with aes-cbc-256, sha512, and DH group 19 (256-bit ECP) enforces cryptographically strong negotiation parameters. Only peers offering these algorithms can complete IKEv2 SA establishment, satisfying the strong-parameters half of the policy without weakening backward compatibility beyond the stated requirement.

SXP is a Cisco TrustSec protocol that propagates SGT-to-IP mappings to network devices that cannot natively tag packets with SGTs. It allows enforcement of security group ACLs (SGACLs) on devices that lack hardware SGT support by exchanging IP-to-SGT bindings with peer devices. This enables consistent policy enforcement across mixed hardware, which matches the scenario's requirement for propagation to non-SGT-capable devices.

OSPFv2 message-digest authentication uses MD5 to hash the key and packet contents, so the key is never sent in cleartext. Configuring ip ospf authentication message-digest enables cryptographic authentication on the interface, and ip ospf message-digest-key 1 md5 supplies the key material. Neighbors must share the same key ID and key string for the adjacency to form, which satisfies the requirement to protect against spoofed hellos.

CoPP policies are applied to the control plane by attaching the policy-map to the control-plane interface with service-policy input. This filters traffic destined to the route processor while allowing transit traffic to pass untouched, which preserves the BGP and SSH sessions.

This command displays the Control Plane policy-map configuration and the per-class packet statistics, including matched and dropped packets. It directly shows which traffic classes are being matched and how many packets are being dropped, which is exactly what the administrator needs to verify CoPP operation.

IKEv2 requires peer authentication before establishing the IPsec SA. A keyring with pre-shared keys or a PKI trustpoint with certificates provides that authentication. Without it, IKEv2 negotiation fails. This element is mandatory for strong authentication and directly supports the requirement. It is separate from the IPsec transform set, which protects the data plane, so both are needed in the overall configuration.

GRE tunnels can carry multicast traffic, and when combined with IPsec, the GRE packets are encrypted. This allows OSPF to form neighbor adjacencies over the tunnel because OSPF uses multicast (224.0.0.5/224.0.0.6). Native IPsec cannot carry multicast, so GRE over IPsec is the standard solution for dynamic routing protocols requiring multicast over a VPN.

Routing protocols are essential for network stability, so they should be matched in dedicated class maps and given sufficient policing rates to avoid dropping legitimate updates. This allows CoPP to protect the CPU while preventing disruption to OSPF and BGP adjacencies, which is a key requirement in the scenario.

Separate class-maps allow granular classification, and the policy-map can apply different police actions per class. Routing classes can be policed generously (or with conform-action transmit and exceed-action transmit for critical control traffic), while SSH and SNMP are rate-limited. This is the standard CoPP design pattern for differentiated control-plane protection.

TACACS+ authorization for EXEC sessions relies on AV pairs returned by the server. The cisco-av-pair shell:priv-lvl attribute tells the router which privilege level the user receives after authentication. Without it, the AAA client defaults to privilege level 1, so the user cannot enter privileged EXEC mode. Supplying the AV pair in the ISE authorization policy resolves the symptom directly.

The 'transport input ssh' command on the VTY lines restricts remote CLI access to SSH only, effectively disabling Telnet. Setting 'ip ssh version 2' globally forces the device to use only SSH version 2. Together, these commands meet the requirement to allow only SSHv2 and block Telnet, which is the standard hardening practice for management access.

A dynamic interface on the AireOS WLC is a user-defined VLAN interface that maps a WLAN to a specific VLAN and is commonly placed on a DMZ segment for guest traffic. Assigning the guest WLAN to a dynamic interface isolates guest clients from corporate clients on the management interface and allows traffic to be tunneled to a firewall in the DMZ.

MAB allows devices that do not support 802.1X to authenticate using their MAC address. When MAB is enabled, the switch sends the device's MAC address to the RADIUS server (ISE) as username and password. If the MAC address is known, the device can be authorized and assigned to a VLAN, such as a guest VLAN. This is the standard method to support non-supplicant devices.

CoPP uses a modular QoS CLI policy attached to the control-plane interface to rate-limit and classify traffic destined to the route processor. It allows the engineer to define class maps for protocols such as IKE, SSH, and SNMP, then apply policing actions so that a flood of tunnel negotiation packets cannot exhaust CPU resources. This directly addresses the hardening goal for the IPsec headend by protecting the control plane from abusive traffic.

A GRE tunnel interface can carry unicast, multicast, and broadcast traffic, which allows dynamic routing protocols such as OSPF or EIGRP to form adjacencies and exchange updates. Wrapping the GRE tunnel in IPsec protects the traffic. This combination meets both the routing and multicast requirements that plain IPsec tunnel mode cannot satisfy.

The transform-set with esp-aes 256 and esp-sha256-hmac specifies AES-256 encryption and SHA-256 HMAC for integrity. The set pfs group14 command in the crypto map enables perfect forward secrecy using Diffie-Hellman group 14 (2048-bit). This combination meets both requirements: AES-256 encryption and PFS. The transform-set and crypto map together define the IPsec policy for the tunnel.

MACsec (802.1AE) provides hop-by-hop encryption and integrity check for Ethernet frames. It encrypts the payload and adds an integrity check value (ICV) to detect tampering. This is correct: it operates at Layer 2 and secures the data link between two directly connected devices.

SXP is a control-plane protocol that maps IP addresses to SGTs and is used to propagate SGT information to devices that cannot perform inline tagging, such as older switches or routers. It allows these devices to enforce SGACLs based on the SGT mapping. This is a key component of TrustSec for mixed environments.

Cisco Meta Data (CMD) is the inline tagging method that embeds the SGT directly into the Ethernet frame using a special EtherType. It allows SGT propagation across Layer 2 trunks without requiring SGACL enforcement on every switch. This is the correct technology for carrying SGT information inline in the frame, enabling TrustSec propagation across the campus.

The transport input ssh command on the VTY lines restricts inbound management sessions to SSH, effectively disabling Telnet. Setting the SSH version to 2 with ip ssh version 2 ensures only the stronger protocol version is negotiated. Together these commands satisfy the requirement to allow only SSHv2 and block Telnet.

CoPP is implemented using MQC constructs where a class map matches control plane traffic and a policy map defines policing actions. The policy map is then applied under the control-plane configuration mode using the service-policy command, which directs the policy to the route processor's traffic rather than to data plane interfaces.

The CoPP policy likely does not have a class-map for SNMP, so SNMP packets fall into the default class and may be dropped by the default policer. Adding a specific class-map for SNMP (UDP 161) with a suitable policer ensures SNMP traffic is permitted at the required rate while still protecting the control plane from excessive SNMP traffic.

MAB is enabled on an interface with the 'mab' command in interface configuration mode. This allows the switch to use the device's MAC address as the username and password for RADIUS authentication when 802.1X times out. It is the standard method to support non-802.1X devices like printers. The other commands do not enable MAB.

The transport input ssh command restricts VTY lines to SSH only, blocking Telnet, while ip ssh version 2 forces the router to negotiate only SSHv2 sessions. Together they satisfy both requirements. This is the canonical method on Cisco IOS XE for enforcing SSHv2-only management access.

MKA is a protocol defined in IEEE 802.1X-2010 that handles key agreement for MACsec. It elects a key server, distributes secure association keys (SAKs), and manages key rotation. On Cisco switches, MKA must be enabled with a pre-shared key or 802.1X-derived CAK. This statement correctly describes how MACsec establishes and maintains cryptographic keys between peers.

CoPP works by classifying traffic into distinct classes and applying individual policers. Creating separate class-maps for each protocol allows the engineer to set appropriate rates for BGP and OSPF while still policing SSH and SNMP. This targeted approach protects the control plane without starving routing protocols, resolving the flapping while maintaining security.

SGACLs enforce policies based on SGTs.

The authentication event fail action authorize vlan command on the switch port directs hosts that fail 802.1X authentication into a specified restricted VLAN. This exactly matches the requirement to isolate failed devices. It is the correct IOS configuration to define failure handling behavior for the port and is essential for the design described.

MACsec requires MKA to negotiate session keys between peers. If the CAK or key server priority does not match on both ends, MKA will not establish a secure association, and MACsec will not encrypt traffic even though the link is up. Configuring a matching CAK and designating a key server on both switches allows MKA to complete negotiation, after which MACsec encryption begins.

MAB allows non-802.1X-capable devices like printers to be authenticated by their MAC address. The switch learns the MAC address and sends it to ISE as the username and password. ISE can then apply an authorization policy, such as placing the device in a specific VLAN or applying an ACL. This maintains centralized control while supporting legacy devices.

ZBFW treats all interfaces in the same zone as a single trust domain, so intra-zone traffic is not inspected and is permitted by default. This design simplifies policy by letting administrators define inspection only for inter-zone flows. In this scenario, if two branch-facing interfaces were both in the VPN zone, traffic between them would bypass inspection, which is a key behavior to understand when designing zone membership.

Cisco ISE is the policy engine that assigns SGTs to users and devices during authentication. It also defines security group ACLs (SGACLs) that determine what traffic is permitted between groups. Without ISE, dynamic SGT assignment and centralized policy management are not possible, making it a fundamental component of CTS.

The SGT is a 16-bit value inserted into the frame or packet at the ingress device, which then enforces policy at egress based on the tag instead of IP. Propagation via inline tagging or the SGT Exchange Protocol (SXP) keeps role identity intact across VLAN and subnet boundaries, which is exactly what the security team requires.

ISE matches MAB requests against endpoint MAC addresses in its database using a specific format. If the endpoint was added with a different delimiter or case than what the switch sends in the Calling-Station-Id, ISE will not match the identity group and will reject the request, causing the unauthorized state.

A classic site-to-site IPsec VPN on Cisco IOS requires an extended ACL to identify interesting traffic, an ISAKMP (IKE) policy to define Phase 1 parameters, a preshared key for peer authentication, and a crypto map that references the ACL and transform set and is applied to the WAN interface. Together these elements establish and encrypt the tunnel.

Creating separate class-maps allows the engineer to apply distinct policers to each traffic type. By giving SSH a higher rate limit or configuring it to always transmit, management access is protected. OSPF and BGP can be rate-limited independently to prevent control plane overload. This granular approach is the recommended CoPP design for protecting critical management traffic.

This command sets the port's authentication mode to auto, meaning the port will be unauthorized until the client successfully authenticates via 802.1X. It triggers the authentication process and is the required command to enable 802.1X on an interface. This is the correct answer because it directly controls the port's state based on authentication.

Shutdown mode causes the port to go into an error-disabled state immediately upon a violation, sends an SNMP trap, and increments the violation counter. This exactly matches the stated security policy. The port must be manually re-enabled with a shutdown/no shutdown sequence after the violation is resolved.

In IKEv2, the profile must specify the trustpoint that contains the router's identity certificate and the CA certificate for verifying peer certificates. If the trustpoint is not referenced or is incorrect, the router cannot validate client certificates, leading to authentication failure. This is a common misconfiguration when setting up certificate-based IKEv2. The logs indicating certificate authentication failed point to a trustpoint or PKI issue.

ISE can return an SGT in the authorization result based on Active Directory group membership, and the access switch applies it to the session. To carry the tag to downstream devices, either inline tagging on the link or SXP propagation must be configured, enabling enforcement of group-based policy across the network.

Since the phone does not support MACsec, link-layer encryption cannot be established. The engineer must either upgrade to a MACsec-capable phone or use a higher-layer encryption method like IPsec, which can encrypt traffic end-to-end regardless of link-layer capabilities. This is the only viable way to secure the traffic.

BPDU Guard is designed to protect access ports from receiving BPDUs. When a BPDU is detected on a port with BPDU Guard enabled, the switch immediately places that port into err-disabled state, preventing the unauthorized device from participating in spanning tree and potentially causing loops or topology changes.

This is the best practice. By creating separate classes, the engineer can apply different rate limits. Management traffic should have a higher rate limit to ensure administrators can always access the device, while control plane protocols can have lower limits to protect the route processor. This granularity ensures that critical management access is not starved during an attack, and routing protocols are still protected but not at the expense of management access.

This sequence enables AAA with 'aaa new-model', configures the ISE RADIUS server with the correct ports and key, then on the interface enables 802.1X port-based authentication with 'authentication port-control auto' and designates the switch port as an authenticator with 'dot1x pae authenticator'. This is the correct method to authenticate before granting access and to use an auth-fail VLAN if configured.

In Cisco TrustSec, the access layer device, such as a Catalyst switch or wireless controller, is responsible for classifying and tagging packets with an SGT after the endpoint is authenticated. This tagging enables enforcement throughout the network based on the Security Group Tag, allowing dynamic segmentation as users move between wired and wireless access points.

The absence of 'aaa authentication enable default' leaves the default behavior of no authentication for enable mode, allowing any user to switch to privileged EXEC without a password. Once in enable mode, the user is at privilege level 15, and if command authorization is configured for level 15, the device may not trigger an authorization check because the user already holds full privilege, or the check may occur but without prior authentication it is ineffective. This configuration flaw directly explains why no credentials are prompted and why authorization seems bypassed.

Zone-Based Firewall uses zone pairs to define directional policy. Creating a zone pair from inside to outside with an inspect action permits inside-initiated sessions and automatically allows return traffic. Because there is no zone pair from outside to inside, traffic initiated from the outside zone to the inside zone is denied by default, which matches the requirement exactly.