200-301 CCNA practice questions: Security Fundamentals

Answer: B. Topic 5.4. Cisco defines multi-factor authentication as a security method that requires users to verify their identity with two or more independent forms of evidence before access is granted, drawn from the categories something the user knows (password or PIN), something the user has (smartphone or security key) and something the user is (fingerprint or face scan), and states that even if a password is stolen, an attacker cannot complete the login without the additional factor. The word that decides this item is independent: an extra prompt that asks for another remembered secret stays inside the first category, so one phishing page can harvest both halves in a single sitting. Length, complexity and rotation are password management controls that raise the cost of guessing; they do not change what happens once the password itself has been handed to an attacker. Source: Cisco 200-301 CCNA v1.1 Exam Topics - Section 5: Security Fundamentals

Answer: B. Topic 5.8. The AAA framework splits three questions: authentication asks who the user is, authorization asks what that user may do at the moment of each request, and accounting reports what the user actually did. Cisco states that the network access server reports user activity to the TACACS+ or RADIUS security server in the form of accounting records, and that each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. The record types differ in what they cover: EXEC accounting provides information about user EXEC terminal sessions of the network access server, carrying the username, the date, the start and stop times and the address of the access server - that is, the boundaries of the session - while command accounting provides information about the EXEC mode commands that a user issues and generates accounting records for all EXEC mode commands, including global configuration commands, associated with a specific privilege level. Network accounting covers PPP, SLIP and ARAP sessions. The start-stop form sends a notice at the beginning and at the end of the process, while stop-only sends a single notice at the end. Source: Cisco 200-301 CCNA v1.1 Exam Topics - Section 5: Security Fundamentals

Answer: D. Topic 5.7. Cisco documents the port security defaults as one secure MAC address per port and shutdown as the default violation mode, described as the port shutting down when the maximum number of secure MAC addresses is exceeded. In shutdown mode the port enters the error-disabled state, sends an SNMP trap, logs a syslog message and increments the violation counter; in restrict mode the frames are dropped and the counters and notifications still occur while the port stays up; in protect mode the frames are dropped with no notification. Recovery is documented as entering errdisable recovery cause psecure-violation globally, or manually re-enabling the port with shutdown followed by no shutdown. Source: Cisco 200-301 CCNA v1.1 Exam Topics - Section 5: Security Fundamentals

Answer: A. Topic 5.6. Named lists carry a sequence number on every entry, and Cisco's sequence numbering guide states the rule for a line typed without one: it is assigned a sequence number that is 10 greater than the last sequence number in that access list and is placed at the end of the list. The list is then tested one condition at a time and stops at the first match, so the new deny becomes entry 40 and sits behind entry 30, which permits everything. To make the deny effective it has to be entered with a number that places it before line 30, for example 25 deny tcp host 198.51.100.7 host 192.0.2.10 eq 22; the same guide notes that the user chooses the sequence number so that the entry is in the desired position. Source: Cisco 200-301 CCNA v1.1 Exam Topics - Section 5: Security Fundamentals; placement rule verified at Cisco Security Configuration Guide: Access Control Lists, 'IP Access List Entry Sequence Numbering' ('it is assigned a sequence number that is 10 greater than the last sequence number in that access list and is placed at the end of the list'), https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-e/sec-data-acl-15-e-book/sec-acl-seq-num.html

Answer: B. Topic 5.6 covers configuring and verifying access lists, including what an interface does while its list is still being built. Cisco's IOS XE ACL configuration guide, section 'Access List Rules', states: 'If an access list is referenced by a name, but the access list does not exist, all packets pass.' The same section adds: 'An interface or command with an empty access list applied to it permits all traffic into the network.' The implicit deny that every list ends with ('Although all access lists end with an implicit deny statement, we recommend use of an explicit deny statement') belongs to a list that exists; binding a name first therefore leaves the server LAN fully open until the entries are written, which is the opposite of what the engineer intends. Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-17/sec-data-acl-xe-17-book/sec-access-list-ov.html Source: Cisco Security and VPN Configuration Guide, Cisco IOS XE 17.x, 'IP Access List Overview' - section 'Access List Rules' ('If an access list is referenced by a name, but the access list does not exist, all packets pass.'), https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-17/sec-data-acl-xe-17-book/sec-access-list-ov.html