Infrastructure Security practice questions

Which IPv6 FHS feature uses a 'device tracking' database to maintain reachability information for hosts?

Trap 1: RA Guard

RA Guard does not maintain a device tracking database; it filters RAs.

Trap 2: DHCPv6 Guard

DHCPv6 Guard filters DHCPv6 messages and does not maintain a device tracking database.

Trap 3: PACL

PACL (Port ACL) is not a specific IPv6 FHS feature; it is a general ACL applied to a port.

A
RA Guard
Why wrong: RA Guard does not maintain a device tracking database; it filters RAs.
B
DHCPv6 Guard
Why wrong: DHCPv6 Guard filters DHCPv6 messages and does not maintain a device tracking database.
C
Device Tracking
Correct. Device Tracking maintains a database of IPv6 addresses and their reachability.
D
PACL
Why wrong: PACL (Port ACL) is not a specific IPv6 FHS feature; it is a general ACL applied to a port.

Read the full Infrastructure Security explanation →

Question 2hardmulti select

Which TWO statements about EEM environment variables and their scoping are true? (Choose TWO.)

Trap 1: Variables set within an applet using the 'action set' command are…

Incorrect. Variables set with 'action set' within an applet are scoped locally to that applet only.

Trap 2: The '$_cli_msg' variable, when used with 'event cli', contains the…

Incorrect. The '$_cli_msg' variable contains only the command keyword, not the full command line with parameters.

Trap 3: The '$_event_pub_sec' variable provides the priority and severity…

Incorrect. '$_event_pub_sec' is not a valid EEM variable; the correct variable for event publish security is '$_event_pub_sec_name' or similar.

A
Environment variables defined using the 'event manager environment' global configuration command are available to all EEM applets on the device.
Correct. Environment variables set globally are accessible by all applets on the device.
B
Variables set within an applet using the 'action set' command are automatically available to other applets running on the same device.
Why wrong: Incorrect. Variables set with 'action set' within an applet are scoped locally to that applet only.
C
The '$_cli_msg' variable, when used with 'event cli', contains the full command line that triggered the event, including any parameters.
Why wrong: Incorrect. The '$_cli_msg' variable contains only the command keyword, not the full command line with parameters.
D
The '$_event_pub_sec' variable provides the priority and severity of the event that triggered the applet.
Why wrong: Incorrect. '$_event_pub_sec' is not a valid EEM variable; the correct variable for event publish security is '$_event_pub_sec_name' or similar.
E
The '$_syslog_msg' variable is available only when the applet is triggered by a syslog event.
Correct. The '$_syslog_msg' variable is only available for applets triggered by syslog events.

Question 3mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show snmp user

User name: monitor Engine ID: 800000090300001122334455 storage-type: nonvolatile Authentication Protocol: MD5 Privacy Protocol: DES Group-name: readonly

User name: admin Engine ID: 800000090300AABBCCDDEEFF storage-type: nonvolatile Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: admin

Based on this output, which statement is correct?

Trap 1: The 'admin' user can only read MIB objects.

The group name 'admin' suggests read-write access, but the actual permissions depend on the group configuration, which is not shown.

Trap 2: Both users use the same engine ID.

The engine IDs are different: '800000090300001122334455' vs '800000090300AABBCCDDEEFF'.

Trap 3: The 'monitor' user cannot authenticate because MD5 is not supported.

MD5 is still supported, though deprecated; authentication will work.

A
The 'monitor' user uses deprecated authentication and privacy protocols.
MD5 and DES are deprecated in favor of SHA and AES due to security vulnerabilities.
B
The 'admin' user can only read MIB objects.
Why wrong: The group name 'admin' suggests read-write access, but the actual permissions depend on the group configuration, which is not shown.
C
Both users use the same engine ID.
Why wrong: The engine IDs are different: '800000090300001122334455' vs '800000090300AABBCCDDEEFF'.
D
The 'monitor' user cannot authenticate because MD5 is not supported.
Why wrong: MD5 is still supported, though deprecated; authentication will work.

Read the full VPN explanation →

Question 4hardmulti select

Which TWO statements about IPsec site-to-site VPN troubleshooting using 'show crypto session' and 'show crypto ipsec sa' are correct? (Choose TWO.)

Trap 1: 'show crypto isakmp sa' is the correct command to view IKEv2 SAs.

Incorrect. 'show crypto isakmp sa' is for IKEv1; for IKEv2 use 'show crypto ikev2 sa'.

Trap 2: The 'pkts encaps' counter in 'show crypto ipsec sa' increments on…

Incorrect. 'pkts encaps' increments on the outbound SA; inbound SA uses 'pkts decaps'.

Trap 3: 'show crypto map' displays the current packet count for each IPsec…

Incorrect. 'show crypto map' shows the crypto map configuration, not packet counters.

A
'show crypto session' displays the IKEv2 SA status and the IPsec SA status.
Correct. This command shows both IKE and IPsec session information.
B
'show crypto ipsec sa' shows the number of packets that have been encrypted and decrypted.
Correct. The output includes 'pkts encaps' and 'pkts decaps' counters.
C
'show crypto isakmp sa' is the correct command to view IKEv2 SAs.
Why wrong: Incorrect. 'show crypto isakmp sa' is for IKEv1; for IKEv2 use 'show crypto ikev2 sa'.
D
The 'pkts encaps' counter in 'show crypto ipsec sa' increments on the inbound SA.
Why wrong: Incorrect. 'pkts encaps' increments on the outbound SA; inbound SA uses 'pkts decaps'.
E
'show crypto map' displays the current packet count for each IPsec SA.
Why wrong: Incorrect. 'show crypto map' shows the crypto map configuration, not packet counters.

Question 5mediummultiple choice

snmp-server community public RO\nsnmp-server community private RW\nsnmp-server community secret RW

What is wrong with this configuration?

Trap 1: The community strings must be at least 8 characters.

There is no such requirement.

Trap 2: Only one read-write community is allowed.

Multiple read-write communities are permitted.

Trap 3: The 'public' community should be read-write.

It is common to have a read-only 'public' community.

A
There is no access list to restrict SNMP access.
Without an ACL, any host can query the device using these community strings, which is a security concern.
B
The community strings must be at least 8 characters.
Why wrong: There is no such requirement.
C
Only one read-write community is allowed.
Why wrong: Multiple read-write communities are permitted.
D
The 'public' community should be read-write.
Why wrong: It is common to have a read-only 'public' community.

Question 6mediumdrag order

Drag and drop the steps to verify and validate IPv6 First Hop Security operational state into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 7mediummultiple choice

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

Trap 1: Enable DHCPv6 Guard to block DHCPv6 messages from the secondary…

Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.

Trap 2: Use IPv6 Source Guard to filter traffic from the secondary router.

Incorrect because IPv6 Source Guard filters data traffic, not RAs.

Trap 3: Configure the switch to act as a router and send its own RAs with a…

Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

A
Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.
Correct because RA Guard will drop RAs from any router not in the allowed list, preventing multiple routers from sending RAs.
B
Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.
Why wrong: Incorrect because DHCPv6 Guard does not affect RAs; it only blocks DHCPv6 server messages.
C
Use IPv6 Source Guard to filter traffic from the secondary router.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic, not RAs.
D
Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.
Why wrong: Incorrect because this would add another router sending RAs, potentially worsening the instability; RA Guard is the correct tool.

Question 8mediummultiple choice

In IPv6 First Hop Security, which feature is used to prevent duplicate address detection (DAD) attacks by snooping Neighbor Discovery (ND) messages?

Trap 1: RA Guard

RA Guard filters Router Advertisements to prevent rogue RA attacks, but it does not specifically prevent DAD attacks via snooping.

Trap 2: DHCPv6 Guard

DHCPv6 Guard filters DHCPv6 messages to prevent rogue DHCP servers, not DAD attacks.

Trap 3: Source Guard

Source Guard filters traffic based on the source address and binding table, but it is not specifically for DAD attack prevention.

A
RA Guard
Why wrong: RA Guard filters Router Advertisements to prevent rogue RA attacks, but it does not specifically prevent DAD attacks via snooping.
B
DHCPv6 Guard
Why wrong: DHCPv6 Guard filters DHCPv6 messages to prevent rogue DHCP servers, not DAD attacks.
C
ND Snooping
Correct. ND Snooping monitors ND messages to prevent DAD attacks and other ND-based threats.
D
Source Guard
Why wrong: Source Guard filters traffic based on the source address and binding table, but it is not specifically for DAD attack prevention.

Question 9mediumdrag order

Drag and drop the steps to configure SNMPv3 with auth-priv and verify traps into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10harddrag order

Open the full VLAN trunking answer →

Drag and drop the steps to troubleshoot SNMP adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 11mediummultiple choice

An engineer is troubleshooting a network where IPv6 hosts on VLAN 20 are unable to communicate with each other. The switch is configured with IPv6 First Hop Security features including Private VLAN (PVLAN) and IPv6 Source Guard. The hosts are in the same VLAN but cannot ping each other. What is the most likely cause?

Trap 1: IPv6 Source Guard is blocking inter-host traffic because the hosts'…

Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.

Trap 2: RA Guard is blocking Neighbor Advertisements between hosts.

Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.

Trap 3: DHCPv6 Guard is blocking DHCPv6 messages between hosts.

Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

A
The switch has Private VLAN configured on VLAN 20, and the hosts are on isolated ports, which prevents direct communication.
Correct because PVLAN isolates traffic between hosts on isolated ports within the same VLAN.
B
IPv6 Source Guard is blocking inter-host traffic because the hosts' bindings are not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters traffic based on source address to prevent spoofing, but it does not block all inter-host traffic; if both hosts have valid bindings, traffic should be allowed.
C
RA Guard is blocking Neighbor Advertisements between hosts.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirects, not Neighbor Advertisements between hosts.
D
DHCPv6 Guard is blocking DHCPv6 messages between hosts.
Why wrong: Incorrect because DHCPv6 Guard filters DHCPv6 server messages, not client-to-client traffic.

Read the full DHCP explanation →

Question 12mediummultiple choice

In IPv6 First Hop Security, what is the purpose of the 'device-role' command in a DHCP guard policy?

Trap 1: It sets the trust level for ND inspection.

That is for ND inspection, not DHCP guard.

Trap 2: It defines the VLAN membership for the interface.

VLAN membership is configured separately.

Trap 3: It enables IPv6 routing on the interface.

IPv6 routing is enabled with 'ipv6 unicast-routing'.

A
It specifies whether the interface is a server, client, or relay for DHCP filtering.
The role dictates the expected DHCP message types on that interface.
B
It sets the trust level for ND inspection.
Why wrong: That is for ND inspection, not DHCP guard.
C
It defines the VLAN membership for the interface.
Why wrong: VLAN membership is configured separately.
D
It enables IPv6 routing on the interface.
Why wrong: IPv6 routing is enabled with 'ipv6 unicast-routing'.

Read the full VPN explanation →

Question 13easymultiple choice

What is the default IKE (ISAKMP) lifetime value in Cisco IOS for IPsec Site-to-Site VPN?

Trap 1: 3600 seconds (1 hour)

This is the default IPsec security association lifetime, not IKE.

Trap 2: 28800 seconds (8 hours)

This value is not a default for IKE; it may appear in some vendor implementations.

Trap 3: 180 seconds (3 minutes)

This is too short and not a Cisco default for IKE lifetime.

A
3600 seconds (1 hour)
Why wrong: This is the default IPsec security association lifetime, not IKE.
B
86400 seconds (24 hours)
Cisco IOS defaults IKE lifetime to 86400 seconds.
C
28800 seconds (8 hours)
Why wrong: This value is not a default for IKE; it may appear in some vendor implementations.
D
180 seconds (3 minutes)
Why wrong: This is too short and not a Cisco default for IKE lifetime.

Read the full Infrastructure Security explanation →

Question 14mediummultiple choice

Which authentication type is the default when BFD authentication is enabled on Cisco IOS-XE?

Trap 1: Simple password (auth type 1)

Simple password is available but not the default; it is less secure.

Trap 2: Keyed MD5 (auth type 2)

Keyed MD5 is an option but not the default; SHA-1 is preferred.

Trap 3: Meticulous Keyed MD5 (auth type 3)

Meticulous MD5 is available but not the default; SHA-1 is the default.

A
Simple password (auth type 1)
Why wrong: Simple password is available but not the default; it is less secure.
B
Keyed MD5 (auth type 2)
Why wrong: Keyed MD5 is an option but not the default; SHA-1 is preferred.
C
Meticulous Keyed MD5 (auth type 3)
Why wrong: Meticulous MD5 is available but not the default; SHA-1 is the default.
D
Keyed SHA-1 (auth type 4)
Cisco IOS-XE defaults to keyed SHA-1 (auth type 4) when BFD authentication is enabled.

Question 15mediummultiple choice

What is the default SNMPv3 security level for a user configured with the "snmp-server user username groupname v3 auth sha password" command?

Trap 1: noAuthNoPriv

This level requires no authentication and no privacy; the command includes auth, so this is incorrect.

Trap 2: authPriv

authPriv requires both authentication and privacy; privacy is not configured here.

Trap 3: The command is invalid without specifying a security level.

The command is valid; the security level defaults to authNoPriv when only auth is specified.

A
noAuthNoPriv
Why wrong: This level requires no authentication and no privacy; the command includes auth, so this is incorrect.
B
authNoPriv
When only auth is configured without priv, the default security level is authNoPriv per RFC 3414.
C
authPriv
Why wrong: authPriv requires both authentication and privacy; privacy is not configured here.
D
The command is invalid without specifying a security level.
Why wrong: The command is valid; the security level defaults to authNoPriv when only auth is specified.

Review the full routing breakdown →

Question 16mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show crypto isakmp sa

dst src state conn-id slot status

10.1.1.2        10.1.1.1        MM_ACTIVE      1       0     ACTIVE
10.1.1.3        10.1.1.1        MM_ACTIVE      2       0     ACTIVE

Based on this output, which statement is correct?

Trap 1: IKE phase 2 is complete for both peers.

This command only shows IKE phase 1 SA status.

Trap 2: The IPsec tunnels are established.

IPsec SA status is shown by show crypto ipsec sa.

Trap 3: The peers are not responding.

ACTIVE state indicates they are responding.

A
IKE phase 1 is complete for both peers.
MM_ACTIVE indicates successful IKE phase 1.
B
IKE phase 2 is complete for both peers.
Why wrong: This command only shows IKE phase 1 SA status.
C
The IPsec tunnels are established.
Why wrong: IPsec SA status is shown by show crypto ipsec sa.
D
The peers are not responding.
Why wrong: ACTIVE state indicates they are responding.

Question 17mediummultiple choice

In IPv6 FHS, what is the default action for 'RA Guard' when a rogue RA is detected on a switch port?

Trap 1: Forward the RA to the CPU for inspection

RA Guard does not forward the RA; it drops it by default.

Trap 2: Shut down the port

Shutting down the port is not the default action; it is a possible manual configuration.

Trap 3: Send a notification to the network management system

This is not the default action; RA Guard only drops and logs by default.

A
Forward the RA to the CPU for inspection
Why wrong: RA Guard does not forward the RA; it drops it by default.
B
Drop the RA and generate a syslog message
Correct. The default action is to drop the RA and log the event.
C
Shut down the port
Why wrong: Shutting down the port is not the default action; it is a possible manual configuration.
D
Send a notification to the network management system
Why wrong: This is not the default action; RA Guard only drops and logs by default.

Question 18hardmulti select

Which TWO commands are used to troubleshoot SNMPv3 authentication or encryption failures? (Choose TWO.)

Trap 1: show snmp group

Shows group-level settings, but not user authentication details.

Trap 2: show running-config | include snmp

Too broad; does not isolate authentication/encryption issues.

Trap 3: ping <NMS-IP>

Ping tests IP connectivity, not SNMPv3 authentication or encryption.

A
debug snmp packets
Shows detailed SNMP packet exchanges, including authentication failures.
B
show snmp user
Displays SNMPv3 users and their authentication/privacy configurations.
C
show snmp group
Why wrong: Shows group-level settings, but not user authentication details.
D
show running-config | include snmp
Why wrong: Too broad; does not isolate authentication/encryption issues.
E
ping <NMS-IP>
Why wrong: Ping tests IP connectivity, not SNMPv3 authentication or encryption.

Study the full AAA explanation →

Question 19mediumdrag order

Drag and drop the steps to configure SSH access with local AAA on a Cisco router into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20hardmultiple choice

A network engineer is troubleshooting an issue where IPv6 hosts are unable to perform Duplicate Address Detection (DAD) successfully. The switch is configured with IPv6 First Hop Security features including ND Inspection and ND Suppress. The engineer notices that Neighbor Solicitation messages for DAD are being dropped by the switch. What is the most likely cause?

Trap 1: RA Guard is configured to drop all multicast traffic, including…

Incorrect because RA Guard only filters Router Advertisements and Redirect messages, not Neighbor Solicitations.

Trap 2: DHCPv6 Guard is blocking the DAD messages because they are…

Incorrect because DHCPv6 Guard only filters DHCPv6 messages, not Neighbor Discovery messages.

Trap 3: IPv6 Source Guard is dropping the DAD messages because the source…

Incorrect because IPv6 Source Guard filters data traffic based on source address, but DAD messages are control plane and typically not filtered by Source Guard; ND Inspection is the correct feature.

A
ND Inspection is configured to drop Neighbor Solicitations with an unspecified source address (::) because it has no binding for that address.
Correct because ND Inspection typically requires a valid binding for the source address; DAD uses :: as source, which is not in the binding table, causing drops.
B
RA Guard is configured to drop all multicast traffic, including Neighbor Solicitations.
Why wrong: Incorrect because RA Guard only filters Router Advertisements and Redirect messages, not Neighbor Solicitations.
C
DHCPv6 Guard is blocking the DAD messages because they are considered DHCPv6 traffic.
Why wrong: Incorrect because DHCPv6 Guard only filters DHCPv6 messages, not Neighbor Discovery messages.
D
IPv6 Source Guard is dropping the DAD messages because the source address :: is not in the binding table.
Why wrong: Incorrect because IPv6 Source Guard filters data traffic based on source address, but DAD messages are control plane and typically not filtered by Source Guard; ND Inspection is the correct feature.