Security practice questions

Refer to the exhibit. A switch has IP Source Guard (IPSG) and port-security enabled on interface GigabitEthernet0/1. A host with IP 10.1.1.1 and MAC 00:1A:2B:3C:4D:5E is connected and tries to access a web server at 192.168.1.100. What will happen?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip access-group ACL-IN in
 ip verify source port-security
!
ip access-list extended ACL-IN
 permit tcp 10.0.0.0 0.255.255.255 any eq 80
 permit tcp 10.0.0.0 0.255.255.255 any eq 443
 deny ip any any

Trap 1: The traffic is blocked because the host is not using DHCP, so IPSG…

Incorrect. IPSG does not drop all non-DHCP traffic if a static binding is configured, but in this case no such binding exists.

Trap 2: The traffic is permitted only if the destination is also in the…

Incorrect. IPSG does not check the destination IP; it checks the source IP against bindings. Destination subnet is irrelevant.

Trap 3: The traffic is permitted because the host's IP is within the…

Incorrect. Port-security does not create an IPSG binding; without a valid IP-MAC binding, IPSG will drop the traffic even if the MAC is allowed.

A
The traffic is blocked because the host is not using DHCP, so IPSG drops all non-DHCP traffic.
Why wrong: Incorrect. IPSG does not drop all non-DHCP traffic if a static binding is configured, but in this case no such binding exists.
B
The traffic is permitted only if the destination is also in the 10.0.0.0/8 range.
Why wrong: Incorrect. IPSG does not check the destination IP; it checks the source IP against bindings. Destination subnet is irrelevant.
C
The traffic is blocked because IP Source Guard requires a static binding for the host.
Correct. Without DHCP or a static IP-source binding, IPSG blocks the traffic.
D
The traffic is permitted because the host's IP is within the allowed subnet and the MAC is valid according to port-security.
Why wrong: Incorrect. Port-security does not create an IPSG binding; without a valid IP-MAC binding, IPSG will drop the traffic even if the MAC is allowed.

Question 2mediummultiple choice

A network engineer is configuring port security on a Cisco switch to prevent unauthorized devices from connecting. The requirement is to allow only the first two MAC addresses learned on an interface, and to disable the interface if a violation occurs. Which configuration achieves this?

Trap 1: switchport port-security maximum 2 switchport port-security…

Err-disable is not a valid violation mode; the mode is shutdown that causes err-disable state.

Trap 2: switchport port-security maximum 2 switchport port-security…

Protect drops traffic silently but does not disable the interface.

Trap 3: switchport port-security maximum 2 switchport port-security…

Restrict does not disable the interface; it drops traffic and logs.

A
switchport port-security maximum 2 switchport port-security violation err-disable
Why wrong: Err-disable is not a valid violation mode; the mode is shutdown that causes err-disable state.
B
switchport port-security maximum 2 switchport port-security violation shutdown
Correct: sets max to 2 and violation shutdown disables interface.
C
switchport port-security maximum 2 switchport port-security violation protect
Why wrong: Protect drops traffic silently but does not disable the interface.
D
switchport port-security maximum 2 switchport port-security violation restrict
Why wrong: Restrict does not disable the interface; it drops traffic and logs.

Study the full AAA explanation →

Question 3easymultiple choice

An organization wants to implement 802.1X authentication on its wired network using Cisco ISE as the authentication server. The switches are configured with the necessary RADIUS settings. Which additional configuration is required on the switch interfaces to enable 802.1X?

Trap 1: dot1x pae authenticator

This command is needed but only enables the PAE role; 'authentication port-control auto' is also required.

Trap 2: authentication port-control force-authorized

This command disables 802.1X and sets the port to authorized state.

Trap 3: authentication port-control force-unauthorized

This command forces the port to unauthorized state, blocking all traffic.

A
dot1x pae authenticator
Why wrong: This command is needed but only enables the PAE role; 'authentication port-control auto' is also required.
B
authentication port-control auto
Correct: this command enables 802.1X authentication on the interface.
C
authentication port-control force-authorized
Why wrong: This command disables 802.1X and sets the port to authorized state.
D
authentication port-control force-unauthorized
Why wrong: This command forces the port to unauthorized state, blocking all traffic.

Study the full ACL explanation →

Question 4hardmultiple choice

A security engineer is configuring CoPP (Control Plane Policing) on a Cisco router to protect the control plane from DoS attacks. The policy must rate-limit SSH traffic to 1 Mbps with a burst of 2000 bytes, and drop all other traffic destined to the control plane that exceeds a default rate. Which class-map and policy-map configuration is correct?

Trap 1: class-map match-all SSH match protocol ssh policy-map COPP class…

Missing class-default to handle other traffic.

Trap 2: class-map match-all SSH match access-group name SSH_ACL policy-map…

Matching access-group is valid but uses ACL instead of protocol; also missing class-default definition.

Trap 3: class-map match-all SSH match protocol ssh policy-map COPP class…

Police parameters swapped: rate should be 1000000, burst 2000.

A
class-map match-all SSH match protocol ssh policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop
Why wrong: Missing class-default to handle other traffic.
B
class-map match-all SSH match access-group name SSH_ACL policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop class class-default police 8000 conform-action transmit exceed-action drop
Why wrong: Matching access-group is valid but uses ACL instead of protocol; also missing class-default definition.
C
class-map match-all SSH match protocol ssh policy-map COPP class SSH police 1000000 2000 conform-action transmit exceed-action drop class class-default police 8000 conform-action transmit exceed-action drop
Correct: matches SSH protocol, police rate 1Mbps burst 2000, and default police for all other traffic.
D
class-map match-all SSH match protocol ssh policy-map COPP class SSH police 2000 1000000 conform-action transmit exceed-action drop
Why wrong: Police parameters swapped: rate should be 1000000, burst 2000.

Question 5mediummultiple choice

A company has deployed a Cisco ASA firewall in transparent mode. The internal network uses VLAN 10 and the external network uses VLAN 20. The ASA is configured with two bridge groups: BVI 10 for inside and BVI 20 for outside. The security policy must allow HTTPS traffic from inside to outside. Which access-list entry is correct?

Trap 1: access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0…

Transparent mode does not use interface access-groups; global access-list is used.

Trap 2: access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any

Permits all IP traffic, not just HTTPS.

Trap 3: access-list GLOBAL extended permit tcp any any eq 443

Permits HTTPS from any source, not specific to inside subnet.

A
access-list INSIDE extended permit tcp 192.168.1.0 255.255.255.0 any eq 443 access-group INSIDE in interface inside
Why wrong: Transparent mode does not use interface access-groups; global access-list is used.
B
access-list GLOBAL extended permit ip 192.168.1.0 255.255.255.0 any
Why wrong: Permits all IP traffic, not just HTTPS.
C
access-list GLOBAL extended permit tcp any any eq 443
Why wrong: Permits HTTPS from any source, not specific to inside subnet.
D
access-list GLOBAL extended permit tcp 192.168.1.0 255.255.255.0 any eq 443
Correct: global access-list permits traffic from inside subnet to any on port 443.

Question 6hardmultiple choice

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

Trap 1: The switch has IP Source Guard enabled, blocking valid DHCP traffic.

IP Source Guard uses DHCP snooping binding table, but it would not block initial DHCP exchanges.

Trap 2: The DHCP server is on a different subnet and the switch lacks an IP…

If server is on same VLAN, no helper needed.

Trap 3: The DHCP server is sending offers too quickly, exceeding the…

Rate-limit is on untrusted ports for client messages, not server responses.

A
The switch has IP Source Guard enabled, blocking valid DHCP traffic.
Why wrong: IP Source Guard uses DHCP snooping binding table, but it would not block initial DHCP exchanges.
B
The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.
Correct: Untrusted ports drop DHCP server messages; the server port must be trusted.
C
The DHCP server is on a different subnet and the switch lacks an IP helper address.
Why wrong: If server is on same VLAN, no helper needed.
D
The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.
Why wrong: Rate-limit is on untrusted ports for client messages, not server responses.

Question 7mediummulti select

Which TWO of the following are valid methods to mitigate VLAN hopping attacks?

Trap 1: Configure switchport mode dynamic auto on all ports.

Dynamic auto can negotiate trunk.

Trap 2: Set the native VLAN to VLAN 1 on all trunk ports.

VLAN 1 is default and does not mitigate.

Trap 3: Use 802.1Q trunking instead of ISL.

Both are susceptible; switching encapsulation is not a mitigation.

A
Configure switchport mode dynamic auto on all ports.
Why wrong: Dynamic auto can negotiate trunk.
B
Disable Dynamic Trunking Protocol (DTP) on all access ports.
Prevents trunk negotiation.
C
Set the native VLAN to VLAN 1 on all trunk ports.
Why wrong: VLAN 1 is default and does not mitigate.
D
Set the native VLAN to an unused VLAN ID on all trunk ports.
Mitigates double-tagging VLAN hopping.
E
Use 802.1Q trunking instead of ISL.
Why wrong: Both are susceptible; switching encapsulation is not a mitigation.

Question 8hardmulti select

Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?

Trap 1: It uses IPsec to encrypt traffic between network devices.

CTS uses MACsec, not IPsec.

Trap 2: It uses VLANs to segment traffic based on security roles.

Segmentation is via SGTs, not VLANs.

A
It uses IPsec to encrypt traffic between network devices.
Why wrong: CTS uses MACsec, not IPsec.
B
It uses VLANs to segment traffic based on security roles.
Why wrong: Segmentation is via SGTs, not VLANs.
C
It uses Security Group Tags (SGTs) to classify traffic.
SGTs are used for classification.
D
It provides data confidentiality using IEEE 802.1AE (MACsec) encryption.
MACsec provides link-layer encryption.
E
It uses Security Group Access Control Lists (SGACLs) to enforce policies.
SGACLs are enforced based on SGTs.

Read the full DHCP explanation →

Question 9easymultiple choice

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Exhibit

Refer to the exhibit.

Switch# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1A:2B:3C:4D:5E  192.168.1.10     86400       dhcp-snooping   10    GigabitEthernet0/1
00:1A:2B:3C:4D:5F  192.168.1.11     86400       dhcp-snooping   10    GigabitEthernet0/2

Switch# show ip dhcp snooping statistics
Packets Processed by DHCP Snooping   = 100
Packets Dropped Because               = 5
  MAC Address Mismatch                 = 3
  Invalid Server Replies               = 2

Trap 1: The DHCP server is sending packets with an incorrect server…

Server identifier mismatch would be an invalid server reply.

Trap 2: The DHCP client is sending a request with an incorrect transaction…

Transaction ID mismatch is not a DHCP snooping drop reason.

Trap 3: The DHCP offer packet is arriving on an untrusted port.

That would cause 'Invalid Server Replies' drop.

A
The DHCP server is sending packets with an incorrect server identifier option.
Why wrong: Server identifier mismatch would be an invalid server reply.
B
The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.
MAC address mismatch occurs when the chaddr field does not match the source MAC.
C
The DHCP client is sending a request with an incorrect transaction ID.
Why wrong: Transaction ID mismatch is not a DHCP snooping drop reason.
D
The DHCP offer packet is arriving on an untrusted port.
Why wrong: That would cause 'Invalid Server Replies' drop.

Study the full AAA explanation →

Question 10mediummultiple choice

A medium-sized enterprise is migrating to a Cisco DNA Center-managed network. The security policy requires that all administrative access to network devices be authenticated via TACACS+ and that authorization for commands be enforced per user role. The network team has configured ISE as the AAA server and integrated it with DNA Center. After configuration, engineers report that they can log in to devices via SSH but are not prompted for a password when entering 'enable' mode; instead, they are granted full privileges immediately. Additionally, while in configuration mode, some engineers can issue 'debug' commands that they should not have access to. The configuration on the devices includes 'aaa new-model', 'aaa authentication login default group tacacs+ local', 'aaa authorization exec default group tacacs+ local', and 'aaa authorization commands 15 default group tacacs+ local'. What is the most likely cause of the privilege escalation and missing authorization?

Trap 1: The TACACS+ server is not reachable, so the device is using local…

If TACACS+ is unreachable, local authentication would prompt for enable password if configured, but it's not.

Trap 2: Command authorization is only configured for privilege level 15,…

Command authorization for level 15 should still apply if user enters enable mode; missing enable authentication is the root cause.

Trap 3: The 'privilege level' command is set to 15 on the VTY lines,…

Privilege level on VTY does not bypass enable authentication.

A
The TACACS+ server is not reachable, so the device is using local authentication, but the local database has all users at privilege level 15.
Why wrong: If TACACS+ is unreachable, local authentication would prompt for enable password if configured, but it's not.
B
The 'aaa authentication enable default' command is missing, so the device is not requiring authentication to enter enable mode, and command authorization is not being enforced because the user is already at privilege 15.
Correct: Without enable authentication, users can enter enable mode without password; command authorization for level 15 may not be triggered if user already at level 15.
C
Command authorization is only configured for privilege level 15, but users are logging in at level 1; they need 'aaa authorization commands 1 default' as well.
Why wrong: Command authorization for level 15 should still apply if user enters enable mode; missing enable authentication is the root cause.
D
The 'privilege level' command is set to 15 on the VTY lines, bypassing AAA authorization.
Why wrong: Privilege level on VTY does not bypass enable authentication.

Question 11easymulti select

Which TWO features are part of Cisco TrustSec for providing role-based access control?

Trap 1: Change of Authorization (CoA)

CoA is used for mid-session policy changes, not a core TrustSec feature.

Trap 2: 802.1X authentication

802.1X is an authentication protocol, not a TrustSec feature.

Trap 3: MACsec encryption

MACsec provides encryption, not access control.

A
Security Group Access Control Lists (SGACLs)
SGACLs enforce policies based on SGTs.
B
Change of Authorization (CoA)
Why wrong: CoA is used for mid-session policy changes, not a core TrustSec feature.
C
802.1X authentication
Why wrong: 802.1X is an authentication protocol, not a TrustSec feature.
D
Security Group Tags (SGTs)
SGTs are used to classify traffic based on user/device identity.
E
MACsec encryption
Why wrong: MACsec provides encryption, not access control.

Open the full BGP breakdown →

Question 12mediummultiple choice

A network engineer applies the above CoPP policy on a router. The router has BGP peers, SSH management, and SNMP monitoring. After applying this policy, which traffic will be affected?

Network Topology

Trap 1: Data plane traffic will be dropped.

CoPP only applies to control-plane.

Trap 2: Only SSH sessions will be rate-limited.

SSH is matched but so are others.

Trap 3: SNMP and SSH will be unaffected because they are explicitly…

Permitted traffic is still rate-limited.

A
BGP sessions may flap due to dropped keepalives.
BGP keepalives are matched and subject to the policer.
B
Data plane traffic will be dropped.
Why wrong: CoPP only applies to control-plane.
C
Only SSH sessions will be rate-limited.
Why wrong: SSH is matched but so are others.
D
SNMP and SSH will be unaffected because they are explicitly permitted.
Why wrong: Permitted traffic is still rate-limited.

Question 13hardmultiple choice

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

Trap 1: Manually shut down the access ports that have unknown MAC addresses…

This does not address the DHCP server response being dropped.

Trap 2: Disable Dynamic ARP Inspection on VLAN 10.

DAI validates ARP packets, not DHCP messages.

Trap 3: Disable IP Source Guard on all access ports in VLAN 10.

IPSG filters IP traffic based on binding table, not DHCP messages.

A
Manually shut down the access ports that have unknown MAC addresses in the binding table.
Why wrong: This does not address the DHCP server response being dropped.
B
Disable Dynamic ARP Inspection on VLAN 10.
Why wrong: DAI validates ARP packets, not DHCP messages.
C
Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.
DHCP snooping drops DHCP server responses on untrusted ports.
D
Disable IP Source Guard on all access ports in VLAN 10.
Why wrong: IPSG filters IP traffic based on binding table, not DHCP messages.

Question 14mediumdrag order

Drag and drop the steps to configure port security on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Step 1: Set maximum MAC addresses, Step 2: Enable port security,…

Setting the maximum before enabling port security is invalid because the port-security feature must be active to apply limits.

Trap 2: Step 1: Configure violation mode, Step 2: Enable port security,…

Configuring the violation mode before enabling port security is not allowed; the mode only takes effect after port security is enabled.

Trap 3: Step 1: Enable port security, Step 2: Define secure MAC addresses,…

Defining specific MAC addresses before setting the maximum count can cause conflicts if the number of defined addresses exceeds the default maximum.

A
Step 1: Enable port security (switchport port-security), Step 2: Set maximum MAC addresses (switchport port-security maximum), Step 3: Define secure MAC addresses (switchport port-security mac-address sticky or static), Step 4: Configure violation mode (switchport port-security violation shutdown/restrict/protect)
This order ensures port security is enabled first, then limits are set, followed by defining specific addresses if needed, and finally setting the action on violation.
B
Step 1: Set maximum MAC addresses, Step 2: Enable port security, Step 3: Define secure MAC addresses, Step 4: Configure violation mode
Why wrong: Setting the maximum before enabling port security is invalid because the port-security feature must be active to apply limits.
C
Step 1: Configure violation mode, Step 2: Enable port security, Step 3: Set maximum MAC addresses, Step 4: Define secure MAC addresses
Why wrong: Configuring the violation mode before enabling port security is not allowed; the mode only takes effect after port security is enabled.
D
Step 1: Enable port security, Step 2: Define secure MAC addresses, Step 3: Set maximum MAC addresses, Step 4: Configure violation mode
Why wrong: Defining specific MAC addresses before setting the maximum count can cause conflicts if the number of defined addresses exceeds the default maximum.

Open the full STP breakdown →

Question 15mediummatching

Match each Spanning Tree Protocol (STP) variant to its key characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Original standard, slow convergence

Fast convergence, backward compatible

Multiple spanning trees per VLAN group

Cisco proprietary, per-VLAN STP

Cisco proprietary, per-VLAN RSTP

Trap 1: STP (802.1D): Per-VLAN spanning tree

Incorrect — STP is a single spanning tree for all VLANs; per-VLAN is PVST+.

Trap 2: RSTP (802.1w): Multiple spanning tree instances

Incorrect — RSTP runs a single instance; multiple instances are provided by MSTP.

A
STP (802.1D): Original standard with slow convergence (30-50 seconds)
STP is the original Spanning Tree Protocol defined in IEEE 802.1D with slow convergence.
B
RSTP (802.1w): Rapid convergence, backward compatible with STP
RSTP improves convergence time to a few seconds and is backward compatible with STP.
C
MSTP (802.1s): Maps multiple VLANs to a single spanning tree instance
MSTP allows grouping VLANs into instances to reduce the number of spanning trees.
D
PVST+: Per-VLAN Spanning Tree, each VLAN has its own STP instance
PVST+ is Cisco's proprietary implementation that runs a separate STP instance per VLAN.
E
STP (802.1D): Per-VLAN spanning tree
Why wrong: Incorrect — STP is a single spanning tree for all VLANs; per-VLAN is PVST+.
F
RSTP (802.1w): Multiple spanning tree instances
Why wrong: Incorrect — RSTP runs a single instance; multiple instances are provided by MSTP.