CCNA Security Questions

CoPP policies that apply a blanket rate limit to all control plane traffic can inadvertently throttle essential routing protocol messages like BGP keepalives and updates. If the rate limit is too low or not exempting BGP, sessions may flap due to missed keepalives or delayed updates. The policy must be fine-tuned to allow sufficient bandwidth for routing protocols.

CoPP is implemented by attaching a policy-map to the control-plane interface using the service-policy command under the control-plane global configuration mode. This causes the policy to inspect only packets that are punted to the route processor, thereby protecting the control plane without affecting transit traffic on physical interfaces.

MAB allows devices without an 802.1X supplicant to be authenticated by their MAC address, which ISE validates against its identity store or profiling database. This lets printers and badge readers obtain limited access through the same port configuration that serves supplicant-capable laptops. MAB is the standard fallback for non-supplicant endpoints in Cisco 802.1X deployments.

SSH version 2 encrypts the entire management session, including authentication credentials and command output, using strong cryptography. Enabling SSHv2 on the switch and disabling Telnet ensures that remote CLI administration is confidential and integrity-protected. This directly satisfies the requirement that all management traffic between the administrator's workstation and the switch be encrypted, making SSHv2 the correct management protocol.

OSPF hello and LSA traffic to the route processor must be permitted at a sufficient rate to maintain adjacency. Creating a class-map for OSPF and assigning a policer with an adequate CIR ensures control plane protection remains in place while allowing legitimate routing protocol traffic, which resolves the flapping caused by the default policer dropping OSPF packets.

Cisco IOS IPS uses signatures to inspect traffic for known attack patterns and can be configured per signature or category to produce alerts rather than drops. This supports detection and logging of malicious traffic without blocking legitimate sessions, while malformed packets can still be dropped by specific signatures or by the IPS engine itself.

The authentication event server dead action authorize vlan command places the port into the specified restricted VLAN when the RADIUS server becomes unreachable. This allows the connected endpoint to send limited traffic instead of the port being placed in an unauthorized state, directly satisfying the requirement of continued but restricted access during a server outage.

CoPP leverages Modular QoS CLI to classify packets punted to the route processor, including IKE, SSH, and SNMP, and polices them in a dedicated control-plane host path. Because the policy is applied with 'service-policy input' under 'control-plane', it only affects traffic destined to the device itself, leaving hardware-forwarded transit traffic untouched. This matches the requirement to protect the CPU while preserving legitimate tunnel establishment.

Strict uRPF checks that the source address of an incoming packet is reachable via the same interface the packet arrived on, using the routing table. If the source is not reachable through that interface, the packet is dropped, which directly blocks spoofed source addresses from user subnets. This matches the requirement to validate source addresses against the routing table for the incoming interface.

This is the correct CoPP configuration: `class-map match-all SSH` with `match protocol ssh` classifies SSH control-plane traffic, and the policy map `COPP` applies a police rate of 1,000,000 bps with a burst of 2000 bytes, dropping exceeding traffic. The `class-default` then polices all other control-plane traffic at 8000 bps, ensuring that no unclassified protocol can flood the CPU. The syntax and parameters are correctly ordered (rate in bps, burst in bytes), providing comprehensive control-plane protection.

Cisco IOS Intrusion Prevention System inspects packet payloads against signatures and can detect and drop application-layer attacks such as cross-site scripting and SQL injection. Because it examines the content of HTTP requests, it can block malicious patterns without any change to the hosted application, matching the requirement to protect the web app transparently.

CoPP on IOS XE uses a modular QoS CLI structure: class maps identify control-plane traffic, a policy map defines policing actions, and the policy is attached to the control plane with service-policy under control-plane mode. Matching BGP via ACL or NBAR lets the administrator police keepalives while permitting other BGP flows, which satisfies the stated requirement.

Combining transport input ssh on the VTY lines with an access-class ACL that permits only 10.10.10.0/24 restricts remote management to SSH from the management subnet. Telnet and other line-based protocols are refused because transport input is limited to ssh, and non-permitted source addresses are dropped by the ACL before they reach the VTY lines, satisfying both requirements.

When the remote peer has an unknown or changing IP address, the headend uses a dynamic crypto map entry with no set peer address so it can accept IKE proposals from any source. A static crypto map references the dynamic map with the set crypto map dynamic command, allowing the router to learn the peer address from the incoming negotiation and apply the correct transform set and ACL.

Native tagging, also known as inline tagging, inserts the SGT into the Ethernet frame using the Cisco TrustSec header. This allows switches and routers that support TrustSec hardware to read the SGT directly from the frame and enforce policies without needing an external mapping protocol. It is the preferred method for high-performance SGT propagation in the campus.

Cisco SSL VPN (WebVPN) allows clientless access through a browser. Enabling 'webvpn' and configuring a context with a gateway provides the entry point, while URL lists or port-forwarding define accessible resources. This meets the requirement for browser-based access without a client. It is the standard configuration for clientless SSL VPN on Cisco IOS.

MKA is the control protocol that establishes the secure association between MACsec peers, electing a key server and distributing the secure association key used for encryption. It runs over EAPOL frames and is fundamental to how MACsec maintains and refreshes cryptographic material on a link.

Inline tagging uses Cisco Metadata to carry the SGT value within the Ethernet frame itself. Downstream devices that support CMD can read the tag and enforce SGACLs directly, eliminating the need to reclassify traffic based on IP or user identity at each hop, which preserves the original classification throughout the path.

BGP sessions flapping indicate that the CoPP policy is dropping legitimate BGP keepalives or updates due to an overly restrictive rate limit. Increasing the rate limit for the BGP class-map allows sufficient BGP control traffic to reach the route processor while still protecting against excessive traffic. This balances protection with operational stability.

Setting access ports to access mode and disabling DTP prevents the port from negotiating a trunk, which is a primary vector for VLAN hopping attacks. Attackers can exploit DTP to form a trunk and gain access to all VLANs. By explicitly configuring the port as access and disabling DTP with 'switchport nonegotiate', the port will not trunk. This is a recommended best practice.

Cisco Meta Data (CMD) is the TrustSec inline tagging mechanism that inserts the SGT into a reserved field of the Ethernet frame. Enabling CMD on the inter-switch uplinks allows each hop to read the tag and apply Security Group ACLs without re-classifying based on IP address, which is exactly the inline tagging behaviour the scenario requires.

Zone-Based Firewall uses zone pairs to define directional policy between zones. Applying a service policy with the inspect action on the inside-to-outside zone pair creates stateful inspection, so return traffic from the outside zone is automatically permitted. Without this inspect action, the router treats the zones as separate and return traffic would be dropped by the default inter-zone deny.

OSPF hellos and LSAs are being dropped because the policer for the OSPF class is too restrictive. Increasing the CIR for that class allows more OSPF control traffic to reach the route processor, stabilizing adjacencies. This maintains protection for other protocols while addressing the specific queue that is over-policing legitimate OSPF packets during normal adjacency formation and maintenance.

CoPP on IOS XE requires classifying control-plane-bound traffic with a class-map of type control-plane, then applying policing in a policy-map that is attached globally with service-policy type control-plane. An ACL matching ARP and TTL-expired packets provides the specific match, and transit traffic is unaffected because CoPP only inspects packets punted to the route processor.

The crypto ACL defines the interesting traffic that will be encrypted and sent through the VPN tunnel. It specifies source and destination subnets that are permitted, and only matching traffic is protected. On Cisco ASA, this ACL is referenced in the crypto map entry. It is the correct element to control which subnets are encrypted, as required by the scenario.

Port security with a maximum MAC count enforces the learning limit, sticky learning dynamically records MACs into the running configuration, and the shutdown violation mode err-disables the port when the limit is exceeded. This directly satisfies the requirement to cap learned MAC addresses and automatically disable offending ports.

This is the fundamental ZBFW configuration. Interfaces must be assigned to zones, and zone pairs define the direction of traffic flow. For traffic to be allowed, a zone pair must exist with a policy that inspects or passes traffic. The default action for inter-zone traffic is drop, so explicit policies are needed. This step is essential to meet the requirements of inspecting inside-to-outside and allowing only HTTP/HTTPS from outside to DMZ.

Cisco TrustSec assigns Security Group Tags to users and devices based on identity and group membership determined by Cisco ISE, and enforcement uses those tags rather than IP addresses or VLANs. This allows consistent policy across wired and wireless domains. Because tags travel with the traffic, access control remains intact even when subnets or VLANs change.

This is the correct configuration for transparent mode. The global access-list is the only ACL applied to a transparent ASA, and it evaluates all traffic crossing the Layer 2 bridge. The rule precisely matches the requirement: source is the inside subnet 192.168.1.0/24, destination is any, and service is TCP 443 (HTTPS), thus permitting only outbound HTTPS from the inside network while implicitly denying everything else. This adheres to least-privilege access control and is applied globally so that traffic from any interface, including the inside, is filtered consistently.

SSH traffic must be explicitly classified so CoPP can rate-limit it separately instead of letting it fall into a default or catch-all class that may be policed aggressively. Adding a TCP port 22 class with a suitable rate and transmit action preserves protection while guaranteeing management access. This is the standard CoPP design practice for management protocols.

CoPP requires a policy map to be attached to the control plane with service-policy input under control-plane configuration mode. Without this attachment, the class maps and policy map exist but are not enforced on control-plane traffic, leaving the route processor unprotected.

SGTs carry group-based policy information in the VXLAN header, allowing the fabric to enforce scalable group-based access control across edge nodes without hop-by-hop ACLs. This satisfies the requirement for group-based policy enforcement that is independent of VLAN or IP subnet boundaries in the SD-Access fabric.

The 'authentication local rsa-sig' command specifies that the local router uses RSA signatures, which are derived from a certificate, for its own authentication. The 'authentication remote eap query-identity' command instructs the router to request the peer's identity and use EAP for remote authentication, which supports EAP-MSCHAPv2. This combination matches the policy requirements for certificate-based local auth and EAP-based remote auth.

Shutdown mode places the port into an error-disabled state when a violation occurs, effectively shutting it down. It also sends an SNMP trap and syslog message. This matches the requirement to shut down the port and send an SNMP trap. The port can be recovered manually or via errdisable recovery. This is the correct violation mode for the described policy.

MACsec on Cisco switches uses a key chain to store the connectivity association key (CAK) and its lifetime. The key chain is referenced under the interface with the mka key-chain command, and the lifetime controls key rotation. This satisfies the requirement for a preshared key and periodic rotation.

IP Source Guard uses the DHCP snooping database to validate source IP and MAC addresses. For static IP addresses, an IP source binding must be manually configured using the ip source binding command. Without this binding, the switch drops all traffic from the laptop because it cannot verify the source, causing complete loss of connectivity.

WPA2 Personal uses a pre-shared key (PSK) for authentication and AES for encryption. It does not require an external authentication server, meeting the requirement. This is suitable for small to medium networks where a shared key is acceptable and simplifies deployment.

Multi-authentication (also called multi-auth) allows multiple devices on a single port to be authenticated independently, each receiving its own authorization result. With a phone and a daisy-chained PC, the phone can authenticate via 802.1X into the voice VLAN and the PC can authenticate via MAB or 802.1X into the data VLAN. This is the Cisco feature designed for this exact topology.

Cisco ISE assigns an SGT to an endpoint as part of the authorization policy after successful authentication. This SGT represents the endpoint's role or group. The switch then uses this SGT in conjunction with SGACLs to enforce role-based access control. This is a fundamental part of Cisco TrustSec.

Hosts with static IP addresses do not appear in the DHCP snooping binding table, so DAI would drop their ARP packets. Creating a static ARP ACL and applying it to the DAI configuration with the arp access-list command allows those specific IP-to-MAC mappings to be validated. This ensures legitimate static hosts are not blocked while spoofing remains prevented.

This is the correct configuration. It sets the maximum number of secure MAC addresses to 2 and also specifies the violation action as 'shutdown'. When a third MAC address attempts to use the port, the switch places the interface in an err-disabled state, which completely disables the port and blocks all traffic, satisfying the requirement to disable the interface upon a violation.

Restricting VTY access with an ACL to trusted management subnets and disabling Telnet via transport input ssh prevents unauthenticated or cleartext management from untrusted networks. This directly addresses the goal of protecting the router's management plane from the internet and is a standard hardening step on Cisco IOS-XE edge devices.

BGP session teardown with low CPU indicates the policer is dropping BGP keepalives before they reach the control plane. Raising the committed information rate for the BGP class and explicitly permitting that class in the control-plane policy allows the protocol traffic to pass at the required rate, restoring adjacency stability without disabling CoPP for other traffic.

Granular classification lets the engineer allocate adequate bandwidth to OSPF, BGP, and SSH while policing less critical or malicious traffic more aggressively. The default class should be configured to not drop, or to drop only after all classified traffic is serviced, so that unclassified but legitimate control plane packets are not silently discarded and routing or management sessions remain stable.

Restrict mode drops the offending frames, sends a syslog message, and increments the violation counter, while keeping the port up. This matches every requirement: no shutdown, no admin intervention, and full auditing. It is the standard choice when visibility into violations is needed without disrupting the port.

For dynamic VLAN assignment, the RADIUS server must send specific attributes in the Access-Accept message: Tunnel-Type (VLAN), Tunnel-Medium-Type (802), and Tunnel-Private-Group-ID (the VLAN ID). These attributes tell the switch which VLAN to assign to the port. Without these attributes, the switch cannot dynamically place the user into the correct VLAN.

BGP peering drops during route churn because the policer for the BGP class is too aggressive and is dropping legitimate control plane traffic. Adjusting the rate for the BGP class preserves protection for other traffic while allowing BGP keepalives and updates to pass. SSH and SNMP are unaffected because their classes have separate policers, so the fix should target the BGP class specifically.

BGP keepalives are small but time-sensitive; if the policed rate for the BGP class is too low, drops cause peer resets. Increasing the conform rate for that class and ensuring BGP traffic matches its dedicated class before falling into the default class restores keepalive delivery while still rate-limiting other unwanted traffic. This preserves control-plane protection without harming BGP.

MACsec encryption is defined by IEEE 802.1AE, which specifies hop-by-hop encryption of Ethernet frames. Key agreement and mutual authentication are provided by MACsec Key Agreement (MKA), which is defined in IEEE 802.1X-2010. The two switches exchange MKPDUs to negotiate a secure association key, so no frames are forwarded in the clear before the session is established, satisfying the mutual authentication requirement.

The crypto ACL defines interesting traffic by permitting the specific source and destination subnets. Only traffic matching a permit statement is encrypted. An implicit deny at the end means other traffic is not matched and therefore not encrypted, which aligns with the requirement to send other traffic unencrypted. This is the correct way to define the VPN traffic selector.

DHCP snooping drops DHCP server messages (OFFER, ACK) received on untrusted ports. By default, all ports are untrusted. The port connected to the DHCP server must be explicitly configured with 'ip dhcp snooping trust' to allow server responses. Since the server is on GigabitEthernet1/0/5 and is not trusted, its offers are dropped, matching the symptom.

MDA allows both a data device and a voice device to authenticate independently on the same switch port. It places the phone in the voice VLAN and the PC in the data VLAN, each with its own authentication session. This matches the requirement to authenticate the phone via MAB and the PC via 802.1X. MDA is designed for this exact scenario.

FlexVPN is a Cisco IOS framework that uses IKEv2 and supports IPv6 transport. It allows per-user policy enforcement through authorization attributes such as IP address, DNS, and split tunnel ACLs. It is well suited for remote access VPN headends and can scale to many users while maintaining granular policy control.

In IKEv2 on Cisco IOS-XE, a proposal defines the encryption, integrity, and PRF algorithms, a policy binds proposals to a match criterion, a keyring holds the pre-shared keys, and a profile ties the keyring to the peer and local identities and references the policy. All four components are needed to negotiate the IKEv2 SA using PSK authentication, making this the correct set.

The ACL in an IPsec configuration defines the interesting traffic that will be encrypted. In this scenario, an ACL permitting IP from 10.1.1.0/24 to 10.2.2.0/24 would ensure only that traffic is encrypted. The crypto map references this ACL to match traffic. Other traffic not matching the ACL is sent unencrypted.

CoPP uses a modular QoS CLI structure: class maps define the traffic to be matched, policy maps define the actions, and the service-policy is applied to the control-plane interface. To rate-limit ARP and DHCP snooping traffic, the engineer must first create class maps that identify those protocols using ACLs or match protocol statements, then reference them in a policy map.

Within an IKEv2 profile, the 'pki trustpoint' command specifies which PKI trustpoint the router will use for certificate-based authentication. This is the correct way to bind a trustpoint to an IKEv2 profile. Both routers must have this configured to present and validate certificates during IKEv2 negotiation, satisfying the certificate-based authentication requirement.

The show policy-map control-plane command displays per-class packet and byte counters, including dropped packets, for the control plane policy. Since BGP is flapping while SSH and SNMP work, inspecting these counters reveals which class is exceeding its rate and dropping traffic, directly identifying the misconfigured class.

SGACLs are evaluated on the enforcement device using the source and destination SGTs carried in the Cisco Metadata header. This allows the fabric to deny Contractor-to-Finance while permitting Contractor-to-Printers based on the policy matrix defined on Cisco ISE, satisfying the requirement precisely.

The intermittent BGP flaps during convergence indicate that legitimate BGP control traffic is exceeding the 8,000 pps police rate and being dropped by the exceed-action. Increasing the police rate or changing the exceed-action to transmit for the BGP class restores session stability while still policing other control plane traffic. Verification of the offered rate is essential to size the policer correctly.

Separating BGP and SSH into distinct classes with independent policers allows the administrator to rate-limit BGP traffic tightly while guaranteeing SSH a separate, protected bandwidth allocation. Applying the policy-map globally under the control-plane configuration mode enforces policing on all control-plane traffic destined to the route processor, satisfying the requirement to prevent BGP floods from starving management access.

The MACsec Key Agreement protocol negotiates session keys between peers using a connectivity association key, which can be provided statically or derived through 802.1X. Without a successful MKA session, the link will not pass protected traffic. This key management layer distinguishes MACsec from simple link encryption and ensures both ends agree on cipher suites and key material.

The 'authentication rsa-sig' command within the ISAKMP policy specifies that RSA signatures should be used for authentication. This means the router will use digital certificates obtained from a CA to authenticate peers. This matches the requirement to use digital certificates issued by a corporate PKI. The command is configured under 'crypto isakmp policy' configuration mode.

The transport input ssh command on the VTY lines permits only SSH and implicitly rejects Telnet, so no additional access-class or ACL is required. This satisfies the requirement with a single line inside line configuration mode, assuming the device already has a hostname, domain name, and RSA key pair generated for SSH to function.

SNMP polling and SSH generate bursty traffic to the route processor. An 8000 bps police rate is far below the normal management traffic rate, so conforming packets are transmitted but excess packets are dropped, causing intermittent SNMP failures. Raising the rate for that class to match observed management traffic preserves CoPP protection while allowing legitimate management polling to reach the control plane.

The switch acts as the authenticator, controlling access to the port based on the outcome of EAP exchanges with the endpoint and RADIUS decisions from Cisco ISE. It relays EAP frames between the supplicant and authentication server, enforces port authorization state, and applies VLAN or ACL results. This matches the requirement that endpoints be authenticated before any Layer 2 connectivity is granted.

CoA lets ISE push new authorization results, such as a new SGT or VLAN, to the network access device when posture or identity changes. This enables dynamic enforcement without reconnecting the endpoint. Combined with SGTs, CoA ensures segmentation stays current as conditions change, which is essential for a Zero Trust model across wired and wireless.

This command set enables port security, sets the maximum number of MAC addresses to 2, and configures the violation action to shutdown the port. This meets the requirement of allowing only two MAC addresses and shutting down on violation. The shutdown violation mode places the port in an err-disabled state when a violation occurs.

CoPP on IOS XE requires a class-map to identify control-plane-destined traffic, typically using an ACL or 'match protocol', and a policy-map that assigns a policer. The policy-map is attached to the control-plane with 'service-policy input', which is exactly how BGP, SSH, and SNMP destined to the route processor are rate-limited without affecting transit forwarding.

This is the correct approach. 802.1X authentication allows the switch to authenticate endpoints using credentials (e.g., username/password or certificate) against a RADIUS server like Cisco ISE. The server can return attributes such as Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID to dynamically assign the endpoint to a specific VLAN. This meets the requirement of authenticating endpoints and placing unauthenticated devices into a restricted VLAN (e.g., a guest VLAN) if configured.

BGP flapping indicates that BGP control plane traffic is being dropped due to an overly restrictive policer. Increasing the rate limit for the BGP class allows legitimate BGP keepalives and updates to pass while still protecting the route processor from excessive BGP traffic. This is the targeted fix because SSH and SNMP are stable, confirming that only the BGP class needs adjustment.

CoPP applies a QoS policy to the control plane and can rate-limit specific punted traffic classes, such as ARP, using a class-map matching ARP and a policy-map with a policer. This directly limits how many ARP packets reach the CPU while leaving transit data-plane forwarding untouched. It is the intended tool for protecting the route processor from excessive exception traffic.

Sticky learning dynamically learns the MAC address of the first device and adds it to the running configuration. When the device is replaced, the old sticky entry can age out or be removed, and the new device is learned. With violation restrict, a syslog and counter increment occur on violation. This meets the requirement without manual intervention, unlike static configuration.

The crypto map must be applied to the interface that sends traffic to the remote peer, typically the WAN interface, using the crypto map <name> command. This enables the router to evaluate outbound packets against the ACL, match interesting traffic, and initiate the IPsec tunnel. Without applying the crypto map to an interface, the VPN configuration remains inactive.

In Cisco TrustSec, the ingress device classifies traffic and inserts the Security Group Tag into the packet, either inline in the Layer 2 frame or via a tag in the Ethernet header. This tagging at ingress allows downstream devices to enforce policy based on the SGT without reclassifying by IP. It is the correct component for assigning and inserting the SGT.