200-301 CCNA practice questions: Security Fundamentals

B is correct. Topic 5.4. Cisco defines multi-factor authentication as a security method that requires users to verify their identity with two or more independent forms of evidence before access is granted, drawn from the categories something the user knows (password or PIN), something the user has (smartphone or security key) and something the user is (fingerprint or face scan), and states that even if a password is stolen, an attacker cannot complete the login without the additional factor. The word that decides this item is independent: an extra prompt that asks for another remembered secret stays inside the first category, so one phishing page can harvest both halves in a single sitting. Length, complexity and rotation are password management controls that raise the cost of guessing; they do not change what happens once the password itself has been handed to an attacker.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 5: Security Fundamentals

C is correct. Topic 5.1. RFC 4949, the Internet Security Glossary, defines a vulnerability as a flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy, and a threat as a potential for violation of security, which exists when there is an entity, circumstance, capability, action, or event that could cause harm. The two are independent, which the glossary makes explicit with two entries: a dangling threat is a threat to a system for which there is no corresponding vulnerability and, therefore, no implied risk, and a dangling vulnerability is a vulnerability for which there is no corresponding threat and, therefore, no implied risk. Installing the vendor patch eliminates the flaw in the implementation, so the vulnerability is gone; the group that hunts for that service is unaffected by anything done on the server, so the threat persists with nothing left to act on, and the risk it implied goes with the flaw. The attack code itself is the exploit, the technique that turns a vulnerability into a compromise, and the patch is the countermeasure that opposes it.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 5: Security Fundamentals

A is correct. Topic 5.7. Cisco describes DHCP snooping as a feature that filters untrusted DHCP messages and builds a DHCP snooping binding database, and documents that by default the switch considers all interfaces untrusted, so it must be configured to trust some interfaces. It also lists the drop conditions: a packet from a DHCP server, such as a DHCPOFFER, DHCPACK, DHCPNAK or DHCPLEASEQUERY packet, received on an untrusted interface is dropped. The correct design is therefore to trust only the ports toward legitimate servers or toward other switches, and to leave user-facing ports untrusted so that a rogue server on a desk cannot answer clients.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 5: Security Fundamentals

B is correct. Topic 5.8. The AAA framework splits three questions: authentication asks who the user is, authorization asks what that user may do at the moment of each request, and accounting reports what the user actually did. Cisco states that the network access server reports user activity to the TACACS+ or RADIUS security server in the form of accounting records, and that each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. The record types differ in what they cover: EXEC accounting provides information about user EXEC terminal sessions of the network access server, carrying the username, the date, the start and stop times and the address of the access server - that is, the boundaries of the session - while command accounting provides information about the EXEC mode commands that a user issues and generates accounting records for all EXEC mode commands, including global configuration commands, associated with a specific privilege level. Network accounting covers PPP, SLIP and ARAP sessions. The start-stop form sends a notice at the beginning and at the end of the process, while stop-only sends a single notice at the end.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 5: Security Fundamentals

C is correct. Topic 5.6. Cisco states that ACL entries are processed in order and that the first match determines whether the software accepts or rejects the packet, and that every access list ends with an implicit deny of everything not explicitly permitted. Tracing the packet (source 10.1.1.20, destination 10.2.2.50, TCP port 443): line 1 requires destination port 23, no match; line 2 requires port 80, no match; line 3 matches any IP protocol from any source to host 10.2.2.50 and denies it, so processing stops there and lines 4 and the implicit deny are never reached. The practical lesson is that a broad deny placed above a broad permit silently swallows everything the intermediate permits did not name.
↗ Cisco 200-301 CCNA v1.1 Exam Topics — Section 5: Security Fundamentals