CCNA Security Questions

Denial of Service (DoS) attacks focus on exhausting system resources or bandwidth. By overwhelming a target, the attacker prevents legitimate traffic from reaching the intended service. Understanding this threat is crucial for engineers who must implement traffic shaping, rate limiting, and ACLs to mitigate the impact of such attacks, thereby preserving the availability and reliability of critical network services for authorized users.

Social engineering relies on psychological manipulation to trick individuals into divulging confidential information or performing actions that compromise security. Phishing is the most common form of this attack, often delivered via email. Training employees to recognize these deceptive tactics is a critical part of a modern security awareness program.

A firewall acts as the security boundary between an internal trusted network and an untrusted external network like the internet. By enforcing security policies based on traffic inspection, it prevents unauthorized access and limits potential threats. This is a crucial component of any security strategy, as it provides a centralized point to filter traffic, monitor for suspicious patterns, and maintain the integrity of the internal network infrastructure.

Confidentiality ensures that sensitive information is accessible only to those authorized to view it. In a networking context, this involves using access control lists, encryption, and strict authentication methods. Protecting financial data from unauthorized eyes is a fundamental security requirement for any organization to prevent data leaks and maintain privacy.

ARP spoofing allows attackers to associate their MAC address with the IP address of a default gateway, effectively intercepting traffic. Dynamic ARP Inspection (DAI) uses the DHCP snooping database to validate ARP packets, ensuring that only legitimate mappings are allowed. This is a critical security feature in modern switches to prevent internal traffic interception, ensuring data privacy and integrity between hosts on the same Layer 2 domain.

Dynamic ARP Inspection inspects ARP packets on untrusted ports and compares them to the DHCP snooping binding table. Forged ARP replies claiming the gateway IP with a different MAC are dropped, preventing ARP cache poisoning. IP Source Guard filters IP packets, port security limits MAC addresses, and Private VLANs segment traffic, but none of them validate ARP payloads against a trusted binding table.

Virtual Private Networks (VPNs) create secure, encrypted tunnels over untrusted networks like the internet. They are essential for protecting data in transit and extending the reach of a private network to distant locations or mobile users. Technicians must understand these types to select the appropriate solution for business requirements.

Multi-Factor Authentication (MFA) significantly improves security by requiring two or more independent credentials for identity verification. This makes it much harder for an attacker to gain access, as stealing a password alone is no longer sufficient. MFA is a standard requirement for protecting remote access and sensitive data.

MAC flooding works by sending frames with many different source MAC addresses so the switch's limited address table fills with bogus entries, forcing unknown unicast frames to be flooded. Port security caps the number of MAC addresses a port may learn and can take a protective action when the limit is exceeded, directly preventing this overflow.

Port security is a Layer 2 feature that limits the number of MAC addresses allowed on a switch port to prevent MAC flooding attacks. By defining specific violation actions, administrators can control how the switch reacts when an unauthorized device connects. Understanding these modes is essential for maintaining physical port integrity.

Malware comes in many forms, each with unique characteristics and objectives. Ransomware has become one of the most significant threats to organizations, often leading to total operational shutdown. Recognizing the behavior of different malware types allows technicians to implement better defense strategies and respond more effectively when an infection is detected.

Port security limits the number of MAC addresses per port, which directly counters MAC flooding and unauthorized device connections. The violation mode determines the enforcement action when the limit is exceeded, such as dropping frames or shutting the port. BPDU Guard, DTP hardening, and Root Guard protect the Spanning Tree topology but do not limit MAC addresses or prevent CAM table exhaustion.

A security policy defines the formal rules, procedures, and expectations for all users and systems within an organization. It provides the legal and operational framework for network security management. Establishing a policy is critical because it ensures that security practices are consistent, measurable, and enforceable across the enterprise, preventing ambiguity when handling sensitive data or responding to security incidents effectively.

DHCP snooping treats all ports as untrusted by default, dropping DHCP server messages such as OFFER and ACK. Marking the uplink with ip dhcp snooping trust allows replies from the legitimate DHCP server to reach clients while rogue servers on access ports remain blocked. This is the standard way to permit only the designated port to act as a DHCP server path.

Guests need internet access without any path to internal resources. Placing guest traffic on a dedicated VLAN and applying an ACL that denies access to internal subnets enforces that boundary at the network layer. Encryption, MAC lists, and SSID hiding all control who joins the wireless network, not what an already-connected guest can reach, so only proper segmentation solves the problem.

Mutual authentication and protection of credentials over the air are satisfied by WPA2-Enterprise with 802.1X and EAP-TLS. The client verifies the RADIUS server certificate before proceeding, which exposes a rogue access point that cannot present a trusted certificate, and certificate-based authentication avoids transmitting a reusable secret. Personal mode, open authentication, and WEP all lack server-side authentication.

The clinic needs to stop unauthorized devices from gaining any network access through unused wall jacks. 802.1X enforces authentication at the switch port before any Layer 3 connectivity is granted, so a laptop without valid credentials cannot obtain an IP address on the internal VLAN. Port security, VLAN ACLs, and Dynamic ARP Inspection address different threats and do not authenticate the user or device identity.

The attacker used a telephone call, impersonated support staff, and leveraged previously gathered personal details to pressure the user into revealing a one-time password. That combination of voice channel plus pretexting plus credential harvesting is the textbook definition of vishing. The texted code was genuine, so no SMS link was clicked and no wireless or in-path manipulation occurred.

Protecting data when the storage device is physically removed requires encryption tied to hardware. Full-disk encryption with a TPM-sealed key means the volume cannot be unlocked on another machine, so stolen drives yield only ciphertext. Lock screens, firmware passwords, and file permissions all depend on the original system or operating system to enforce them and are bypassed once the disk is relocated.

The interface is in 'Secure-shutdown' because a violation occurred. The port security configuration allowed for a maximum of one MAC address, and a device with a different MAC address than the one learned or configured attempted to connect. The violation mode was set to 'shutdown', which forces the port to disable itself to protect the network from the unauthorized device, requiring manual intervention to restore connectivity to the interface.

Port security is the Cisco feature designed to control which source MAC addresses are permitted on a switch port. By configuring the maximum number of MAC addresses and using sticky learning or static entries, the administrator can ensure only authorized corporate devices communicate through conference room jacks, blocking rogue switches and access points from attaching to the network.

Accounting tracks the actions performed by users on the network, including the time they logged in and the commands they executed. This data is critical for auditing and compliance, providing a clear record of activity. By maintaining an audit trail, administrators can investigate security incidents, identify misuse, and ensure that individuals remain accountable for their actions during their network session, which is vital for forensic analysis.

The message arrived as an SMS text impersonating a bank, which is the defining characteristic of smishing. Vishing requires a voice call, whaling targets executives, and pharming relies on DNS or hosts file manipulation rather than a text lure. Recognizing the delivery channel is the key to correctly classifying the social engineering attack.

Limiting payroll access to the finance group enforces confidentiality by preventing unauthorized viewing of sensitive records. Logging every access provides accountability, since actions can be traced to specific users. These two objectives, implemented through access control lists, authentication, and audit logging, are what the policy describes at the network level, making them the best match for the requirement.

A browser certificate warning means the TLS certificate presented by the site could not be validated against a trusted certificate authority, the hostname did not match, or the certificate is expired or revoked. Because the user's system clock is correct, the failure points to the authenticity of the website's identity, which is the security property that digital certificates are designed to guarantee.

DHCP snooping is a security feature that acts like a firewall between untrusted hosts and trusted DHCP servers. It builds a binding database of leased IP addresses to prevent various attacks. Correctly identifying trusted versus untrusted ports is the most critical step in implementing this feature without disrupting legitimate network services.

Enabling WPA2 with AES on the access point encrypts the wireless frames so that only authorized clients with the correct pre-shared key or credentials can decrypt them. Neighbors capturing the radio signal see only ciphertext. The other listed measures either hide information or filter clients but leave the actual data readable.

Multi-factor authentication requires two different categories of proof, such as something the user knows (password) and something the user has (an authenticator app generating one-time codes). A stolen password alone is useless without the second factor. Password complexity, lockout, and expiration all strengthen a single factor but do not prevent misuse of a stolen password.

Port security limits the number of valid MAC addresses allowed on a port and binds a specific MAC address to a physical interface. This prevents unauthorized devices from spoofing addresses or connecting rogue hardware to the enterprise network. Implementing this feature is a fundamental step in securing the access layer against layer 2 attacks like MAC flooding or unauthorized device insertion, ensuring only authenticated hardware gains link connectivity.

WPA3 is the latest generation of Wi-Fi security, providing significant improvements over WPA2. It addresses several known vulnerabilities, such as offline dictionary attacks and the lack of forward secrecy. Understanding these enhancements is vital for technicians responsible for deploying modern, secure wireless networks that protect sensitive data from sophisticated threats.

The AAA framework (Authentication, Authorization, and Accounting) is the cornerstone of modern network security. Protocols like RADIUS and TACACS+ allow centralized management of user identity and access policies. By offloading authentication to a central server, administrators can ensure consistent security policies, audit trails for access, and rapid revocation of credentials, which is essential for scaling security across a complex enterprise network environment.

When port security is enabled with the default settings, the violation mode is restrict. A second MAC address on a port limited to one secure address triggers a violation, and the switch drops the frames from the offending device while keeping the port operational. The violation counter increments and logging may occur, but the interface is not disabled unless shutdown mode is explicitly configured.

Network security requires a multi-layered approach to protect against diverse threats. Firewalls and Intrusion Prevention Systems (IPS) are two fundamental components that work together to secure the perimeter and internal segments. Understanding the distinct roles these technologies play helps technicians design robust networks that can both block bad traffic and detect anomalies.

The attack is ARP cache poisoning, where forged replies redirect a victim's traffic. Dynamic ARP Inspection, which relies on the DHCP snooping binding table to validate ARP packets on untrusted ports, is designed specifically to drop such forgeries. Because DHCP snooping is already in place, DAI can be enabled on the user VLAN with minimal additional configuration, making it the correct mitigation.

The ACL permits HTTP traffic and implicitly denies everything else due to the 'deny ip any any' statement. This is a common 'whitelist' approach used to secure interfaces by allowing only necessary services. Understanding this logic is vital because every Cisco ACL has an implicit deny at the end; failing to explicitly permit required traffic will result in connectivity issues, making careful ACL planning essential for maintaining network functionality.

The strongest pairing couples host-level defense with network-level filtering. Endpoint antivirus catches payloads that reach the workstation, while a secure web gateway or DNS filtering service blocks the malicious domains that deliver those payloads. Together they cover both the email and web vectors named in the scenario without heavy administrative overhead, whereas disabling updates, permitting all outbound traffic, and sharing administrator accounts all increase exposure.

VLAN hopping via double-tagging occurs when an attacker sends a frame with two tags to a switch, tricking it into bypassing port restrictions. By explicitly configuring ports as access ports and disabling DTP negotiation, administrators prevent the switch from automatically forming trunks with unauthorized devices. This is a critical hardening step because it removes the possibility of a device negotiating a trunk link, which is required for VLAN hopping to succeed.

ACLs are essential tools for traffic filtering and network segmentation. By controlling which packets are permitted or denied based on source, destination, and protocol, administrators enforce security policies at the network edge or between VLANs. Understanding how ACLs manage traffic flow is critical for maintaining network integrity and preventing unauthorized data access, as they provide the fundamental mechanism for restricting communication between sensitive network segments in a controlled and highly audit-able manner.

Securing the control plane is essential to protect the CPU from resource exhaustion and unauthorized access. By limiting access to management interfaces and protecting the CPU from excessive traffic, administrators ensure the stability of the device routing and switching functions. These practices are critical because the control plane is the 'brain' of the network device; if it is compromised or overwhelmed, the entire network segment may experience service outages.

The AAA framework (Authentication, Authorization, and Accounting) provides a modular way to manage access control. Each component serves a distinct purpose in securing network devices. Understanding how these functions interact allows administrators to implement granular security policies that restrict user actions to only what is necessary for their job.

DHCP starvation attacks deplete the available IP address pool by requesting numerous leases. DHCP Snooping protects the network by acting as a firewall between untrusted hosts and DHCP servers, limiting the rate of DHCP messages. This is a critical enterprise security control, as DHCP is often an overlooked vector that can lead to DoS or man-in-the-middle attacks if left entirely unprotected on access-layer switches.

MAC address table overflow attacks are mitigated by port security, which caps the number of source MAC addresses a port can learn and takes a configured action on violation. ARP cache poisoning is mitigated by Dynamic ARP Inspection, which validates ARP packets against the DHCP snooping binding table and drops spoofed mappings. Together they address both attack types named in the scenario.

Secure Shell (SSH) provides a secure, encrypted tunnel for remote command-line access. Unlike Telnet, which transmits data in plaintext and exposes administrative credentials to sniffing attacks, SSH ensures that both the connection and the session data are encrypted. Using SSH is a mandatory security best practice for any modern network infrastructure to protect against unauthorized access and credential theft while managing network devices from remote locations.

Filtering by source IP address while leaving other VLANs untouched points to an IP access control list bound to the management switched virtual interface. The list permits only the designated management subnets and denies everything else, and log entries record rejected attempts. Layer 2 protections such as port security, Dynamic ARP Inspection, and BPDU Guard address different threats entirely.