Cisco CCNA (200-301) — All Questions

Which authentication approach significantly strengthens security by requiring two or more independent factors?

• a.Multi-factor authentication, combining something you know, have, or are✓
• b.Reusing the same strong password across all critical systems
• c.Disabling account lockout so users are never locked out
• d.Storing passwords in the configuration using Type 7 encoding

Multi-factor authentication requires two or more independent factors, such as a password (something you know) plus a token or phone (something you have) or a fingerprint (something you are), so a stolen password alone is insufficient. This dramatically reduces the risk of account compromise. It is a recommended control for administrative and remote access.

What is the security benefit of applying an 'access-class' ACL to the VTY lines?

• a.It automatically logs out idle administrators after a set timeout period
• b.It encrypts the remote-management session, replacing the need for SSH keys
• c.It increases the number of simultaneous administrators allowed to connect
• d.It restricts which source IP addresses are permitted to open remote-management sessions✓

An 'access-class' ACL applied to the VTY lines limits remote logins (Telnet/SSH) to a defined set of trusted source addresses, so connections from anywhere else are rejected. This narrows the attack surface for device management. It complements, rather than replaces, SSH encryption and strong authentication.

Which command begins configuration of a named extended IPv4 ACL called BLOCK_WEB?

• a.access-list BLOCK_WEB extended, with the keywords out of order
• b.ip access-list 101 BLOCK_WEB, mixing a number and a name
• c.access-list extended BLOCK_WEB, missing the 'ip' keyword
• d.ip access-list extended BLOCK_WEB✓

Named ACLs are created with 'ip access-list extended BLOCK_WEB', which enters a sub-mode where you add permit and deny statements. Named ACLs let you use descriptive names and edit individual sequence numbers.

Which range of numbers identifies extended IPv4 ACLs?

• a.200-299
• b.100-199 (and 2000-2699)✓
• c.1-99
• d.1300-1999, another block used for standard ACLs

Extended IPv4 ACLs use 100-199 with an expanded block of 2000-2699. Standard ACLs use 1-99 and 1300-1999. The number chosen tells IOS which ACL type is being configured.

How does a router process the entries within an ACL?

• a.It checks the entries in a random, unordered fashion
• b.It applies whichever entry is the most specific match
• c.Sequentially from top to bottom, acting on the first match✓
• d.It evaluates every entry and uses the last one that matches

An ACL is evaluated top-down, and the first matching statement determines whether the packet is permitted or denied; no later entries are checked. Because of this, more specific entries must be placed before broader ones.

In an ACL, the keyword 'host 10.1.1.1' is equivalent to which address and wildcard pair?

• a.any 10.1.1.1, which is not valid ACL syntax
• b.10.1.1.1 0.0.0.0✓
• c.10.1.1.1 255.255.255.255, which would match everything
• d.10.1.1.1 0.0.0.255, which would match a whole /24

The 'host' keyword is shorthand for an exact match, equal to the address followed by the wildcard 0.0.0.0, where every bit must match. This targets exactly one IP address.

In an ACL, the keyword 'any' is equivalent to which address and wildcard combination?

• a.0.0.0.0 0.0.0.255, which matches just one /24 network
• b.255.255.255.255 0.0.0.0, which matches a single host
• c.0.0.0.0 0.0.0.0, which matches only that one address
• d.0.0.0.0 255.255.255.255✓

The 'any' keyword matches all addresses, equal to 0.0.0.0 with a wildcard of 255.255.255.255 (all bits ignored). It is used when a rule should apply to every source or destination.

Which ACL statement blocks all ping (ICMP) traffic sourced from network 192.168.1.0/24 to any destination?

• a.deny icmp 192.168.1.0 255.255.255.0 any, using a mask not a wildcard
• b.deny tcp 192.168.1.0 0.0.0.255 any eq echo, referencing the wrong protocol
• c.deny ip 192.168.1.0 0.0.0.255 any, which blocks all IP, not just ICMP
• d.deny icmp 192.168.1.0 0.0.0.255 any✓

Blocking ping requires denying the ICMP protocol from the source /24 (wildcard 0.0.0.255) to any destination. Denying 'ip' would block far more than pings, and ICMP is not carried over TCP.

By default, how many MAC addresses does an interface allow when port security is first enabled?

• a.an unlimited number until manually restricted
• b.2, to allow a phone and a PC automatically
• c.0, which would block every device on the port
• d.1✓

When port security is enabled, the default maximum is a single secure MAC address on the interface. Administrators raise the maximum (for example, to allow an IP phone plus a PC) with the 'switchport port-security maximum' command.

Which command allows a maximum of 3 learned MAC addresses on a port-security-enabled interface?

• a.switchport port-security maximum 3✓
• b.switchport port-security limit 3, using an incorrect keyword
• c.switchport security maximum 3, missing the 'port-' prefix
• d.switchport port-security mac-count 3, which is not valid syntax

The 'switchport port-security maximum 3' command sets the number of MAC addresses the port may learn or be assigned before a violation occurs. It is paired with the base 'switchport port-security' command.

In 802.1X port-based authentication, what is the role of the switch?

• a.The supplicant that requests access to the network
• b.The certificate authority that issues client certificates
• c.The authentication server that validates the credentials
• d.The authenticator that relays credentials between the supplicant and the authentication server✓

In 802.1X the switch is the authenticator: it controls port access and passes EAP messages between the client (supplicant) and a RADIUS authentication server. It does not itself decide whether the credentials are valid.

In 802.1X, which device is the supplicant?

• a.The switch controlling access to the port
• b.The RADIUS server validating the credentials
• c.The wireless LAN controller managing the APs
• d.The end-user client requesting access to the network✓

The supplicant is the endpoint (such as a PC with 802.1X client software) that submits credentials to gain network access. The switch is the authenticator, and the RADIUS server is the authentication server.

Which command enforces a minimum length of 10 characters for all locally configured passwords?

• a.service password min-length 10, which is not valid syntax
• b.enable secret min-length 10, which mixes two commands
• c.security passwords min-length 10✓
• d.password min-length 10, which omits the 'security' keyword

'security passwords min-length 10' sets a global minimum length that new passwords must meet, strengthening credentials against guessing. Existing shorter passwords remain until changed.

What is a security advantage of 'enable secret' over 'enable password'?

• a.It stores the password as a hash rather than as clear or weakly encrypted text✓
• b.It automatically disables Telnet on the VTY lines
• c.It encrypts the entire running configuration file
• d.It permits the use of much longer passwords only

'enable secret' stores the privileged-mode password as a one-way hash, which is far stronger than the reversible, weak encoding used by 'enable password'. If both are set, the secret takes precedence.

An unauthorized person follows an employee through a secured door without badging in. Which attack does this describe?

• a.Tailgating (piggybacking)✓
• b.Shoulder surfing, which observes credentials being entered
• c.Phishing, which uses deceptive electronic messages
• d.Pretexting, which invents a false scenario over the phone

Tailgating (piggybacking) is a physical social-engineering attack in which an attacker slips through a secured entry behind an authorized person. It bypasses badge controls without any technical exploit.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.A worm, which self-replicates across networks
• b.Spyware, which quietly harvests user information
• c.Ransomware✓
• d.A rootkit, which hides deep in the operating system

Ransomware encrypts data and extorts the victim for a decryption key. Worms spread by self-replication, rootkits conceal an attacker's presence, and spyware covertly gathers information, each with a different goal.

Besides double-tagging, VLAN hopping can occur through switch spoofing. Which configuration prevents it?

• a.Enabling PortFast globally across all switch ports
• b.Enabling DTP dynamic auto on all of the access ports
• c.Using VLAN 1 as the native VLAN on every trunk
• d.Disabling DTP and manually setting access or trunk mode on every port✓

Switch spoofing exploits DTP to trick a switch into forming a trunk, so disabling DTP with 'switchport nonegotiate' and hardcoding each port's mode stops it. Leaving ports in a dynamic DTP mode is exactly what enables the attack.