Why are traditional network security perimeters not suitable for the latest consumer-based network endpoint devices?
a) These devices are not managed by the corporate IT department.
b) These devices pose no risk to security as they are not directly connected to the corporate network.
c) These devices connect to the corporate network through public wireless networks.
d) These devices are more varied in type and are portable.
Answer:
d) These devices are more varied in type and are portable.
Explanation:
Traditional network security has two major focuses: (1) end point protection using antivirus software and enabling the personal firewall, and (2) network border protection with firewalls, proxy servers, and network packet scanning devices or software. This type of protection is not suited for the new network devices that are mobile, frequently access cloud storage, and may be a personal device.
What two internal LAN elements need to be secured? (Choose two.)
a) edge routers
b) IP phones
c) fiber connections
d) switches
e) cloud-based hosts
Answer:
b) IP phones
d) switches
Explanation:
Internal network protection is just as important as securing the network perimeter. Internal LAN elements can be broken up into endpoints and network infrastructure devices. Common endpoints include laptops, desktops, servers, and IP phones. LAN infrastructure devices include switches and access points.
What are two examples of traditional host-based security measures? (Choose two.)
a) host-based IPS
b) NAS
c) 802.1X
d) antimalware software
e) host-based NAC
Answer:
a) host-based IPS
d) antimalware software
Explanation:
Traditional host-based security measures include antivirus/antimalware software, host-based IPS, and host-based firewall. Antivirus and antimalware software detects and mitigates viruses and malware. A host-based IPS is used to monitor and report on the system configuration and application activity, security events, policy enforcement, alerting, and rootkit detection. A host-based firewall restricts incoming and outgoing connections for a particular host.
In an 802.1x deployment, which device is a supplicant?
a) RADIUS server
b) access point
c) switch
d) end-user station
Answer:
d) end-user station
Explanation:
In 802.1x, a supplicant is the end-user device (such as a laptop) that is attempting to attach to the WLAN.
A company implements 802.1X security on the corporate network. A PC is attached to the network but has not authenticated yet. Which 802.1X state is associated with this PC?
a) err-disabled
b) disabled
c) unauthorized
d) forwarding
Answer:
c) unauthorized
Explanation:
When a port is configured for 802.1X, the port starts in the unauthorized state and stays that way until the client has successfully authenticated.
During 802.1X authentication, between which two devices is EAP data encapsulated into EAPOL frames? (Choose two.)
a) data nonrepudiation server
b) authentication server (TACACS)
c) supplicant (client)
d) authenticator (switch)
e) ASA Firewall
Answer:
c) supplicant (client); d) authenticator (switch)
Explanation:
When a client supplicant is starting the 802.1X message exchange, an EAPOL-Start message is sent between the supplicant and the authenticator, which is the switch. EAP data between the supplicant and the authenticator is encapsulated in EAPOL frames.
Which command is used as part of the 802.1X configuration to designate the authentication method that will be used?
a) dot1x system-auth-control
b) aaa authentication dot1x
c) aaa new-model
d) dot1x pae authenticator
Answer:
b) aaa authentication dot1x
Explanation:
The aaa authentication dot1x default group radius command specifies that RADIUS is used as the method for 802.1X port-based authentication.
What is involved in an IP address spoofing attack?
a) A rogue node replies to an ARP request with its own MAC address indicated for the target IP address.
b) Bogus DHCPDISCOVER messages are sent to consume all the available IP addresses on a DHCP server.
c) A rogue DHCP server provides false IP configuration parameters to legitimate DHCP clients.
d) A legitimate network IP address is hijacked by a rogue node.
Answer:
d) A legitimate network IP address is hijacked by a rogue node.
Explanation:
In an IP address spoofing attack, the IP address of a legitimate network host is hijacked and used by a rogue node. This allows the rogue node to pose as a valid node on the network.
At which layer of the OSI model does Spanning Tree Protocol operate?
a) Layer 1
b) Layer 2
c) Layer 3
d) Layer 4
Answer:
b) Layer 2
Explanation:
Spanning Tree Protocol (STP) is a Layer 2 technology for preventing Layer 2 loops between redundant switch paths.
What components in a LAN are protected with Loop Guard?
a) All Root Guard enabled ports.
b) All PortFast enabled ports.
c) All point-to-point links between switches.
d) All BPDU Guard enabled ports.
Answer:
c) All point-to-point links between switches.
Explanation:
Loop Guard can be enabled globally using the spanning-tree loopguard default global configuration command. This enables Loop Guard on all point-to-point links.
Which procedure is recommended to mitigate the chances of ARP spoofing?
a) Enable DHCP snooping on selected VLANs.
b) Enable IP Source Guard on trusted ports.
c) Enable DAI on the management VLAN.
d) Enable port security globally.
Answer:
a) Enable DHCP snooping on selected VLANs.
Explanation:
To mitigate the chances of ARP spoofing, these procedures are recommended:
– Implement protection against DHCP spoofing by enabling DHCP snooping globally.
– Enable DHCP snooping on selected VLANs.
– Enable DAI on selected VLANs.
– Configure trusted interfaces for DHCP snooping and ARP inspection. Untrusted ports are configured by default.
Which two ports can send and receive Layer 2 traffic from a community port on a PVLAN? (Choose two.)
a) community ports belonging to other communities
b) promiscuous ports
c) isolated ports within the same community
d) PVLAN edge protected ports
e) community ports belonging to the same community
Answer:
b) promiscuous ports; e) community ports belonging to the same community
Explanation:
Community ports can send and receive information with ports within the same community, or with a promiscuous port. Isolated ports can only communicate with promiscuous ports. Promiscuous ports can talk to all interfaces. PVLAN edge protected ports only forward traffic through a Layer 3 device to other protected ports.
Which protocol should be used to mitigate the vulnerability of using Telnet to remotely manage network devices?
a) SNMP
b) TFTP
c) SSH
d) SCP
Answer:
c) SSH
Explanation:
Telnet uses plain text to communicate in a network. The username and password can be captured if the data transmission is intercepted. SSH encrypts data communications between two network devices. TFTP and SCP are used for file transfer over the network. SNMP is used in network management solutions.
How can DHCP spoofing attacks be mitigated?
a) by disabling DTP negotiations on nontrunking ports
b) by implementing port security
c) by the application of the ip verify source command to untrusted ports
d) by implementing DHCP snooping on trusted ports
Answer:
d) by implementing DHCP snooping on trusted ports
Explanation:
One of the procedures to prevent a VLAN hopping attack is to disable DTP (auto trunking) negotiations on nontrunking ports. DHCP spoofing attacks can be mitigated by using DHCP snooping on trusted ports. The ip verify source interface configuration command is used to enable IP Source Guard on untrusted ports to protect against MAC and IP address spoofing.
Port-security verification on SWC fa0/2 — what can be concluded? (Choose three.)
a) Three security violations have been detected on this interface.
b) This port is currently up.
c) The port is configured as a trunk link.
d) Security violations will cause this port to shut down immediately.
e) There is no device currently connected to this port.
f) The switch port mode for this interface is access mode.
Answer:
b) This port is currently up.; d) Security violations will cause this port to shut down immediately.; f) The switch port mode for this interface is access mode.
Explanation:
Because the security violation count is at 0, no violation has occurred. The system shows that 3 MAC addresses are allowed on port fa0/2, but only one has been configured and no sticky MAC addresses have been learned.
The port is up because of the port status of secure-up. The violation mode is what happens when an unauthorized device is attached to the port. A port must be in access mode in order to activate and use port security.
Two devices on the same switch must be totally isolated. Which feature provides this isolation?
a) PVLAN Edge
b) DTP
c) SPAN
d) BPDU guard
Answer:
a) PVLAN Edge
Explanation:
The PVLAN Edge feature does not allow one device to see traffic that is generated by another device. Ports configured with the PVLAN Edge feature are also known as protected ports.
BPDU guard prevents unauthorized connectivity to a wired Layer 2 switch.
SPAN is port mirroring to capture data from one port or VLAN and send that data to another port.
DTP (Dynamic Trunking Protocol) is automatically enabled on some switch models to create a trunk if the attached device is configured for trunking. Cisco recommends disabling DTP as a best practice.
What is the behavior of a switch as a result of a successful CAM table attack?
a) The switch will drop all received frames.
b) The switch interfaces will transition to the error-disabled state.
c) The switch will forward all received frames to all other ports.
d) The switch will shut down.
Answer:
c) The switch will forward all received frames to all other ports.
Explanation:
As a result of a CAM table attack, a switch can run out of memory resources to store MAC addresses.
When this happens, no new MAC addresses can be added to the CAM table and the switch will forward all received frames to all other ports. This would allow an attacker to capture all traffic that is flooded by the switch.
Which protocol defines port-based authentication to restrict unauthorized hosts from connecting to the LAN through publicly accessible switch ports?
a) RADIUS
b) TACACS+
c) 802.1x
d) SSH
Answer:
c) 802.1x
Explanation:
802.1x is an IEEE standard that defines port-based access control. By authenticating each client that attempts to connect to the LAN, 802.1x provides protection from unauthorized clients.
What device is considered a supplicant during the 802.1X authentication process?
a) the router that is serving as the default gateway
b) the authentication server that is performing client authentication
c) the client that is requesting authentication
d) the switch that is controlling network access
Answer:
c) the client that is requesting authentication
Explanation:
The devices involved in the 802.1X authentication process are as follows:
The supplicant, which is the client that is requesting network access
The authenticator, which is the switch that the client is connecting to and that is actually controlling physical network access
The authentication server, which performs the actual authentication
Which term describes the role of a Cisco switch in the 802.1X port-based access control?
a) agent
b) supplicant
c) authenticator
d) authentication server
Answer:
c) authenticator
Explanation:
802.1X port-based authentication defines specific roles for the devices in the network:
Client (Supplicant) – The device that requests access to LAN and switch services
Switch (Authenticator) – Controls physical access to the network based on the authentication status of the client
Authentication server – Performs the actual authentication of the client
What type of data does the DLP feature of Cisco ESA scan to prevent leaks?
a) inbound messages
b) outbound messages
c) messages stored on a client device
d) messages stored on the email server
Answer:
b) outbound messages
Explanation:
Cisco ESAs control outbound messages through data-loss prevention (DLP), email encryption, and optional integration with the RSA Enterprise Manager. This control helps ensure that the outbound messages comply with industry standards and are protected in transit.
What is the goal of the Cisco NAC framework and the Cisco NAC appliance?
a) to ensure that only hosts that are authenticated and have had their security posture examined and approved are permitted onto the network
b) to monitor data from the company to the ISP in order to build a real-time database of current spam threats from both internal and external sources
c) to provide anti-malware scanning at the network perimeter for both authenticated and non-authenticated devices
d) to provide protection against a wide variety of web-based threats, including adware, phishing attacks, Trojan horses, and worms
Answer:
a) to ensure that only hosts that are authenticated and have had their security posture examined and approved are permitted onto the network
Explanation:
The NAC framework uses the Cisco network infrastructure and third-party software to ensure the wired and wireless endpoints that want to gain access to the network adheres to the requirements defined by the security policy.
The Cisco NAC Appliance is the device that enforces security policy compliance.
Which Cisco solution helps prevent MAC and IP address spoofing attacks?
a) Port Security
b) DHCP Snooping
c) IP Source Guard
d) Dynamic ARP Inspection
Answer:
c) IP Source Guard
Explanation:
Cisco provides solutions to help mitigate Layer 2 attacks including:
IP Source Guard (IPSG) – prevents MAC and IP address spoofing attacks
Dynamic ARP Inspection (DAI) – prevents ARP spoofing and ARP poisoning attacks
DHCP Snooping – prevents DHCP starvation and SHCP spoofing attacks
Port Security – prevents many types of attacks including MAC table overflow attacks and DHCP starvation attacks.
What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?
a) VLAN hopping
b) DHCP spoofing
c) ARP poisoning
d) ARP spoofing
Answer:
a) VLAN hopping
Explanation:
Mitigating a VLAN hopping attack can be done by disabling Dynamic Trunking Protocol (DTP) and by setting the native VLAN of trunk links to VLANs not in use.
-
Questions58
-
Chapter 1 Questions24
-
Chapter 2 Questions25
-
Chapter 3 Questions23
-
Chapter 4 Questions25
-
Module 1-4 Questions73
-
Modules 5-765
-
Modules 8-1049
-
Modules 13-1452
-
Firewalls47
-
Tutorial 611
-
Modules 11-1222
-
Modules 15-1724
-
Modules 18-1922
-
Modules 20-2221
-
Network Security Practice Final64
-
Tutorial Week 913
-
Tutorial 824
-
Tutorial 710
-
Mock Theory A14
-
Internet Security Theory Exam 22/2315
-
Internet Secuirty Theory Exam 25-2615
