Network Security Fundamentals

Which of the following is the MOST accurate definition of a 'threat' in network security?

Which of the following is NOT a typical vector for data loss?

A network consisting of interconnected LANs within a limited geographical area, such as a university campus or business park, is best described as a:

Which of the following is a key characteristic that differentiates a worm from a virus?

Which of the following attack types involves an attacker intercepting communications between two parties without their knowledge?

Which of the following professional roles is primarily responsible for overseeing an organization's security policies and procedures?

Which of the CIA triad components is best addressed by implementing network hardening mechanisms and backup systems?

What is the primary goal of 'Control Plane Policing' (CoPP)?

Which security measure is MOST effective in preventing eavesdropping attacks?

What is the function of a 'fuzzer' in the context of security tools?

An attacker is using social engineering to convince a user to provide their password over the phone. What type of social engineering attack is this?

Which security domain includes security breach alarms, fences, and gates?

An organization discovers it has been infected with a 'zero-day' exploit. Which course of action is the MOST appropriate?

An organization implements a new security protocol that mandates multi-factor authentication for all employees, regardless of their role or access level. This decision MOST directly supports which security principle?

A network administrator observes unusually high UDP traffic originating from a single internal host destined for random ports on multiple external servers. Further investigation reveals that the host is also attempting to resolve numerous nonexistent domain names. Which of the following is the MOST likely cause?

The primary goal of a network security vulnerability scan is to identify potential weaknesses before they can be exploited.

A worm requires a host program to execute and replicate.

A modern method to secure data in transit is to utilize the FTPS protocol.

Social Engineering attacks target the technical infrastructure of a network to gain unauthorized access.

The primary goal of a DDoS attack is to disrupt the availability of a service.

In the context of network security, the term 'integrity' refers to ensuring that data is only accessible to authorized individuals.

A 'script kiddie' is a highly skilled hacker who develops sophisticated exploits.

Implementing a DMZ (Demilitarized Zone) is unnecessary for a campus area network as internal threats are negligible.

'Grey hat' hackers exclusively use their skills for malicious purposes.

A keylogger is a type of malware that specifically targets web servers to steal sensitive data.

In network security, rate limiting on a firewall is an effective method to prevent brute-force attacks.

State-sponsored hackers only target military and governmental infrastructure.

The Common Vulnerability Scoring System (CVSS) is a proprietary framework exclusively used by Cisco for rating IT vulnerabilities.

Increasing the salt size to at least 256-bits is computationally guaranteed to prevent rainbow table attacks.

In the context of mitigating network attacks, perfect forward secrecy (PFS) makes past session keys invulnerable even if the private key of the server is compromised years later.

Which of the following is NOT a recommended guideline for creating strong passwords?

What is the primary purpose of the 'Cisco IOS Resilient Configuration' feature?

What is a key benefit of using 'Role-Based CLI Access'?

Which of the following best describes the use of banners in network device security?

What is the purpose of the login block-for command?

Which of the following is a potential consequence of routing protocol spoofing?

Which of the following describes the function of a 'Syslog' server in network security?

What is the recommendation regarding the configuration of secret passwords on network devices?

Which protocol is preferred for secure remote management of Cisco routers?

Which of the following describes the 'Defense in Depth' approach to securing a network perimeter?

What is the purpose of configuring NTP (Network Time Protocol) on network devices?

In the context of privilege levels on Cisco devices, what is the significance of level 15?

How is 'AutoSecure' best described regarding the topic of router hardening?

What is the most secure method for authenticating OSPF routing protocol updates, considering both computational overhead and resistance to collision attacks?

An organization is implementing role-based access control (RBAC) on their Cisco routers using CLI views. A junior network engineer requires access to only monitor interface status and check basic network connectivity. Which of the following view configurations is least appropriate, considering the principle of least privilege and minimizing potential for unintended configuration changes?

In a defense in depth approach to edge router security, only one router is used to protect the internal network.

Enabling service password-encryption is sufficient to protect against sophisticated password cracking techniques.

A strong password should be based on easily identifiable information such as names or birthdays.

The command login block-for 30 attempts 3 within 10 will block login attempts for 30 seconds if there are 3 failed login attempts within 10 seconds.

Configuring transport input ssh on the vty lines allows only SSH connections, enhancing the security of remote access.

Privilege levels on a Cisco router range from 1 to 32, allowing for fine-grained control over command availability.

Commands available at lower privilege levels are not executable at higher privilege levels.

The Cisco IOS Resilient Configuration feature can be disabled through any type of session, including Telnet or SSH.

In Syslog messages, a severity level of 0 indicates debugging messages.

The crypto key zeroize rsa command, when executed, will remove all RSA keys, including router certificates issued using those keys after prompting for confirmation.

In the context of AAA, what is the primary function of 'Authorization'?

Which of the following is the correct order of the primary AAA elements when a user attempts network access?

What is the purpose of 'Accounting' in the AAA framework?

When AAA is not implemented, what vulnerability commonly affects Telnet?

What is the initial step to enable local AAA on a Cisco router?

Which command configures local AAA authentication for console login?

What is the maximum number of authentication methods that can be defined in a single AAA authentication list?

Which command is used to set the maximum number of failed login attempts before a user account is locked locally?

What is the primary benefit of using server-based AAA compared to local AAA?

Which protocol is preferred for AAA because it encrypts the entire packet, providing greater security?

What is a key difference between TACACS+ and RADIUS protocols, in terms of authentication and authorization?

Which of the following protocols is commonly used to integrate AAA with Microsoft's Active Directory?

After configuring a router to use a RADIUS server for authentication, users are still being authenticated locally. What is the most likely cause?

A network administrator configures AAA with TACACS+ for device administration. However, they notice that command authorization is not functioning as expected; users are able to execute commands they should not have access to. What is the most probable cause?

An organization wants to implement the most secure method for verifying the integrity of their AAA accounting logs sent to a central server. They are particularly concerned about non-repudiation. Which of the of the following would provide the strongest guarantees, assuming all systems are properly configured?

AAA is a framework used to control user access to network resources.

Identification involves proving that you are that identity.

Authorization defines what a user can and cannot do on the network.

Accounting involves reviewing log files to check for compliance and hold subjects accountable for their actions.

When using local AAA authentication, the router uses a remote server to authenticate users.

TACACS+ encrypts only the password within its packets, providing limited security.

RADIUS combines authentication and authorization into a single process.

To configure server-based AAA, you must first enable AAA, specify the ACS server's IP address, configure the secret key and configure authentication to use either RADIUS or TACACS+.

In the context of AAA authorization with CLI, the command aaa authorization exec default group tacacs+ configures authorization to use the TACACS+ server group for network access.

AAA accounting with the stop-only parameter initiates the logging of user activities exclusively upon session inception.

Which of the following is the most accurate statement regarding the implicit deny?

What is the result of configuring an ACL with only deny statements and no permit statements?

What is the key differentiator between standard and extended IPv4 ACLs?

Which of the following ACL number ranges represents extended access lists?

What is the primary function of a wildcard mask in an ACL?

When configuring an ACL, what does a wildcard mask bit of '0' indicate?

Which keyword can be used in an ACL statement to match any IP address?

Which of the following is a best practice regarding ACL placement?

Which command is used to apply a named ACL to a router interface?

Considering the complexities of network security, which of these scenarios represents the most secure and efficient application of ACLs on a router with multiple interfaces?

By default, a router automatically filters all traffic.

The last statement of an ACL is an explicit permit statement.

Standard ACLs filter IP packets based on both the source and destination address.

Using a wildcard mask bit of 1 means 'match the corresponding bit value in the address'.

Extended ACLs should be located as close as reasonably possible to the destination of the traffic.

A single ACL can control traffic in both inbound and outbound directions simultaneously on an interface.

If an ACL does not have at least one permit statement, it will block all traffic due to the implicit deny.

When configuring numbered ACLs, numbers 1 to 99 and 2000 to 2699 are for standard IP ACLs and numbers from 100 to 199 and 1300 to 1999 are for extended IP ACLs.

The command access-list 101 deny tcp any eq telnet any will deny packets with a destination port of 23, from anywhere to anywhere.

What is the effect of the following configuration commands:

R1(config)# access-list 5 remark Block all traffic from 192.168.10.0/24 R1(config)# access-list 5 deny 192.168.10.0 0.0.0.255 R1(config)# access-list 5 permit any R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip access-group 5 in

Subsequently, hosts on the 192.168.10.0/24 network attempting to communicate outbound via GigabitEthernet0/1 will intermittently succeed due to the permit any statement.