Security practice questions

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Trap 1: switchport port-security maximum 2 switchport port-security…

Err-disable is not a valid violation mode; the mode is shutdown that causes err-disable state.

Trap 2: switchport port-security maximum 2 switchport port-security…

Protect drops traffic silently but does not disable the interface.

Trap 3: switchport port-security maximum 2 switchport port-security…

Restrict does not disable the interface; it drops traffic and logs.

A
switchport port-security maximum 2 switchport port-security violation err-disable
Why wrong: Err-disable is not a valid violation mode; the mode is shutdown that causes err-disable state.
B
switchport port-security maximum 2 switchport port-security violation shutdown
Correct: sets max to 2 and violation shutdown disables interface.
C
switchport port-security maximum 2 switchport port-security violation protect
Why wrong: Protect drops traffic silently but does not disable the interface.
D
switchport port-security maximum 2 switchport port-security violation restrict
Why wrong: Restrict does not disable the interface; it drops traffic and logs.

Study the full AAA explanation →

Question 2easymultiple choice

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Trap 1: dot1x pae authenticator

This command is needed but only enables the PAE role; 'authentication port-control auto' is also required.

Trap 2: authentication port-control force-authorized

This command disables 802.1X and sets the port to authorized state.

Trap 3: authentication port-control force-unauthorized

This command forces the port to unauthorized state, blocking all traffic.

A
dot1x pae authenticator
Why wrong: This command is needed but only enables the PAE role; 'authentication port-control auto' is also required.
B
authentication port-control auto
Correct: this command enables 802.1X authentication on the interface.
C
authentication port-control force-authorized
Why wrong: This command disables 802.1X and sets the port to authorized state.
D
authentication port-control force-unauthorized
Why wrong: This command forces the port to unauthorized state, blocking all traffic.

Study the full ACL explanation →

Question 3hardmultiple choice

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Trap 1: class-map match-all SSH match protocol ssh policy-map COPP class…

Missing class-default to handle other traffic.

Trap 2: class-map match-all SSH match access-group name SSH_ACL policy-map…

Matching access-group is valid but uses ACL instead of protocol; also missing class-default definition.

Trap 3: class-map match-all SSH match protocol ssh policy-map COPP class…

Police parameters swapped: rate should be 1000000, burst 2000.

A
class-map match-all SSH match protocol ssh policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop
Why wrong: Missing class-default to handle other traffic.
B
class-map match-all SSH match access-group name SSH_ACL policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop class class-default police 8000 conform-action transmit exceed-action drop
Why wrong: Matching access-group is valid but uses ACL instead of protocol; also missing class-default definition.
C
class-map match-all SSH match protocol ssh policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop class class-default police 8000 conform-action transmit exceed-action drop
Correct: matches SSH protocol, police rate 1Mbps burst 2000, and default police for all other traffic.
D
class-map match-all SSH match protocol ssh policy-map COPP class SSH police 2000 1000000 conform-action transmit exceed-action drop
Why wrong: Police parameters swapped: rate should be 1000000, burst 2000.

Question 4mediummultiple choice

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Trap 1: access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0…

Transparent mode does not use interface access-groups; global access-list is used.

Trap 2: access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any

Permits all IP traffic, not just HTTPS.

Trap 3: access-list GLOBAL extended permit tcp any any eq 443

Permits HTTPS from any source, not specific to inside subnet.

A
access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443 access-group INSIDE in interface inside
Why wrong: Transparent mode does not use interface access-groups; global access-list is used.
B
access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any
Why wrong: Permits all IP traffic, not just HTTPS.
C
access-list GLOBAL extended permit tcp any any eq 443
Why wrong: Permits HTTPS from any source, not specific to inside subnet.
D
access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
Correct: global access-list permits traffic from inside subnet to any on port 443.

Question 5hardmultiple choice

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Trap 1: The switch has IP Source Guard enabled, blocking valid DHCP traffic.

IP Source Guard uses DHCP snooping binding table, but it would not block initial DHCP exchanges.

Trap 2: The DHCP server is on a different subnet and the switch lacks an IP…

If server is on same VLAN, no helper needed.

Trap 3: The DHCP server is sending offers too quickly, exceeding the…

Rate-limit is on untrusted ports for client messages, not server responses.

A
The switch has IP Source Guard enabled, blocking valid DHCP traffic.
Why wrong: IP Source Guard uses DHCP snooping binding table, but it would not block initial DHCP exchanges.
B
The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.
Correct: Untrusted ports drop DHCP server messages; the server port must be trusted.
C
The DHCP server is on a different subnet and the switch lacks an IP helper address.
Why wrong: If server is on same VLAN, no helper needed.
D
The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.
Why wrong: Rate-limit is on untrusted ports for client messages, not server responses.

Question 6mediummulti select

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Trap 1: Configure switchport mode dynamic auto on all ports.

Dynamic auto can negotiate trunk.

Trap 2: Set the native VLAN to VLAN 1 on all trunk ports.

VLAN 1 is default and does not mitigate.

Trap 3: Use 802.1Q trunking instead of ISL.

Both are susceptible; switching encapsulation is not a mitigation.

A
Configure switchport mode dynamic auto on all ports.
Why wrong: Dynamic auto can negotiate trunk.
B
Disable Dynamic Trunking Protocol (DTP) on all access ports.
Prevents trunk negotiation.
C
Set the native VLAN to VLAN 1 on all trunk ports.
Why wrong: VLAN 1 is default and does not mitigate.
D
Set the native VLAN to an unused VLAN ID on all trunk ports.
Mitigates double-tagging VLAN hopping.
E
Use 802.1Q trunking instead of ISL.
Why wrong: Both are susceptible; switching encapsulation is not a mitigation.

Question 7hardmulti select

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Trap 1: It uses IPsec to encrypt traffic between network devices.

CTS uses MACsec, not IPsec.

Trap 2: It uses VLANs to segment traffic based on security roles.

Segmentation is via SGTs, not VLANs.

A
It uses IPsec to encrypt traffic between network devices.
Why wrong: CTS uses MACsec, not IPsec.
B
It uses VLANs to segment traffic based on security roles.
Why wrong: Segmentation is via SGTs, not VLANs.
C
It uses Security Group Tags (SGTs) to classify traffic.
SGTs are used for classification.
D
It provides data confidentiality using IEEE 802.1AE (MACsec) encryption.
MACsec provides link-layer encryption.
E
It uses Security Group Access Control Lists (SGACLs) to enforce policies.
SGACLs are enforced based on SGTs.

Read the full DHCP explanation →

Question 8easymultiple choice

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Exhibit

Refer to the exhibit.

Switch# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1A:2B:3C:4D:5E  192.168.1.10     86400       dhcp-snooping   10    GigabitEthernet0/1
00:1A:2B:3C:4D:5F  192.168.1.11     86400       dhcp-snooping   10    GigabitEthernet0/2

Switch# show ip dhcp snooping statistics
Packets Processed by DHCP Snooping   = 100
Packets Dropped Because               = 5
  MAC Address Mismatch                 = 3
  Invalid Server Replies               = 2

Trap 1: The DHCP server is sending packets with an incorrect server…

Server identifier mismatch would be an invalid server reply.

Trap 2: The DHCP client is sending a request with an incorrect transaction…

Transaction ID mismatch is not a DHCP snooping drop reason.

Trap 3: The DHCP offer packet is arriving on an untrusted port.

That would cause 'Invalid Server Replies' drop.

A
The DHCP server is sending packets with an incorrect server identifier option.
Why wrong: Server identifier mismatch would be an invalid server reply.
B
The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.
MAC address mismatch occurs when the chaddr field does not match the source MAC.
C
The DHCP client is sending a request with an incorrect transaction ID.
Why wrong: Transaction ID mismatch is not a DHCP snooping drop reason.
D
The DHCP offer packet is arriving on an untrusted port.
Why wrong: That would cause 'Invalid Server Replies' drop.

Question 9hardmultiple choice

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip access-group ACL-IN in
 ip verify source port-security
!
ip access-list extended ACL-IN
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any

Trap 1: The traffic is blocked because the host is not using DHCP, so IPSG…

IPSG can work with static bindings; not necessarily blocked.

Trap 2: The traffic is permitted only if the destination is also in the…

ACL permits to any destination.

Trap 3: The traffic is blocked because IP Source Guard requires a static…

IPSG uses DHCP snooping bindings; static not required.

A
The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.
Why wrong: IPSG can work with static bindings; not necessarily blocked.
B
The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.
Why wrong: ACL permits to any destination.
C
The traffic is blocked because IP Source Guard requires a static binding for the host.
Why wrong: IPSG uses DHCP snooping bindings; static not required.
D
The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.
Correct: IP source guard checks that the source IP is in the binding table; if valid, traffic passes ACL.

Study the full AAA explanation →

Question 10mediummultiple choice

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Trap 1: The TACACS+ server is not reachable, so the device is using local…

If TACACS+ is unreachable, local authentication would prompt for enable password if configured, but it's not.

Trap 2: Command authorization is only configured for privilege level 15,…

Command authorization for level 15 should still apply if user enters enable mode; missing enable authentication is the root cause.

Trap 3: The 'privilege level' command is set to 15 on the VTY lines,…

Privilege level on VTY does not bypass enable authentication.

A
The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.
Why wrong: If TACACS+ is unreachable, local authentication would prompt for enable password if configured, but it's not.
B
The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.
Correct: Without enable authentication, users can enter enable mode without password; command authorization for level 15 may not be triggered if user already at level 15.
C
Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.
Why wrong: Command authorization for level 15 should still apply if user enters enable mode; missing enable authentication is the root cause.
D
The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.
Why wrong: Privilege level on VTY does not bypass enable authentication.

Question 11easymulti select

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Trap 1: Change of Authorization (CoA)

CoA is used for mid-session policy changes, not a core TrustSec feature.

Trap 2: 802.1X authentication

802.1X is an authentication protocol, not a TrustSec feature.

Trap 3: MACsec encryption

MACsec provides encryption, not access control.

A
Security Group Access Control Lists (SGACLs)
SGACLs enforce policies based on SGTs.
B
Change of Authorization (CoA)
Why wrong: CoA is used for mid-session policy changes, not a core TrustSec feature.
C
802.1X authentication
Why wrong: 802.1X is an authentication protocol, not a TrustSec feature.
D
Security Group Tags (SGTs)
SGTs are used to classify traffic based on user/device identity.
E
MACsec encryption
Why wrong: MACsec provides encryption, not access control.

Open the full BGP breakdown →

Question 12mediummultiple choice

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Network Topology

Trap 1: Data plane traffic will be dropped.

CoPP only applies to control-plane.

Trap 2: Only SSH sessions will be rate-limited.

SSH is matched but so are others.

Trap 3: SNMP and SSH will be unaffected because they are explicitly…

Permitted traffic is still rate-limited.

A
BGP sessions may flap due to dropped keepalives.
BGP keepalives are matched and subject to the policer.
B
Data plane traffic will be dropped.
Why wrong: CoPP only applies to control-plane.
C
Only SSH sessions will be rate-limited.
Why wrong: SSH is matched but so are others.
D
SNMP and SSH will be unaffected because they are explicitly permitted.
Why wrong: Permitted traffic is still rate-limited.

Question 13hardmultiple choice

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Trap 1: Manually shut down the access ports that have unknown MAC addresses…

This does not address the DHCP server response being dropped.

Trap 2: Disable Dynamic ARP Inspection on VLAN 10.

DAI validates ARP packets, not DHCP messages.

Trap 3: Disable IP Source Guard on all access ports in VLAN 10.

IPSG filters IP traffic based on binding table, not DHCP messages.

A
Manually shut down the access ports that have unknown MAC addresses in the binding table.
Why wrong: This does not address the DHCP server response being dropped.
B
Disable Dynamic ARP Inspection on VLAN 10.
Why wrong: DAI validates ARP packets, not DHCP messages.
C
Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.
DHCP snooping drops DHCP server responses on untrusted ports.
D
Disable IP Source Guard on all access ports in VLAN 10.
Why wrong: IPSG filters IP traffic based on binding table, not DHCP messages.

Question 14mediumdrag order