Cisco CCNA (200-301) — All Questions

How does FTP differ from TFTP in the way it establishes connections?

• a.FTP is connectionless while TFTP is connection-oriented and reliable
• b.FTP uses a single UDP port while TFTP uses two TCP ports
• c.FTP encrypts all traffic by default while TFTP never does
• d.FTP uses two TCP connections (control on 21, data on 20) and supports authentication, while TFTP uses one UDP port with none✓

FTP is connection-oriented, opening a control connection on TCP port 21 and a separate data connection (port 20 in active mode), and it supports username/password authentication. TFTP is far simpler, using a single UDP port 69 with no authentication. Neither encrypts data by default; FTPS or SFTP add security.

An administrator issues 'copy running-config tftp'. What does this command accomplish?

• a.It encrypts the running configuration before saving it locally to flash
• b.It merges a configuration downloaded from the TFTP server into NVRAM
• c.It reboots the device and loads a new IOS image from the TFTP server
• d.It uploads the current running configuration to a TFTP server as a backup✓

'copy running-config tftp' backs up the active configuration to a TFTP server, prompting for the server address and filename. This is a common way to archive configurations before making changes. Restoring works in reverse with 'copy tftp running-config', which merges the downloaded file into the running config.

With PAT configured, an internal host at 10.0.0.5 opens a web session. Which element does the router add to its translation table to track the return traffic?

• a.A static ARP entry mapping the host to the outside interface
• b.A new VLAN tag inserted into each returning frame
• c.A unique protocol and port pairing associated with the shared public address✓
• d.A dedicated public IP address reserved solely for that host

For each session, PAT records the inside address and port together with the shared public (inside global) address and a unique translated port. Return packets arriving for that public IP and port are matched to the entry and forwarded to 10.0.0.5. This port-level tracking is what lets one address serve many hosts.

Which statement about static NAT is accurate?

• a.It dynamically shares one public address among many hosts using port numbers
• b.It creates a fixed one-to-one mapping, allowing reliable inbound access to an internal server✓
• c.It requires an access list to select which pool addresses to use each session
• d.It only translates outbound traffic and never permits connections initiated from outside

Static NAT permanently maps one inside local address to one inside global address, so an internal server is always reachable at a predictable public address, including for connections initiated from outside. Dynamic NAT and PAT do not guarantee a fixed mapping. Static NAT is ideal for hosting services like web or mail servers behind NAT.

Which command verifies NTP synchronization status, including the stratum and the reference clock, on a Cisco device?

• a.show ntp servers configured, listing pool statements
• b.show clock detail, which only prints the local time and time zone
• c.show ntp status✓
• d.show running-config | include ntp, which shows configuration only

'show ntp status' reports whether the clock is synchronized, the stratum level, the reference clock address, and offset details. It is the fastest way to confirm that time synchronization is actually working, not just configured. 'show clock' displays the current time but does not indicate NTP sync state.

An engineer wants a Cisco router to also act as a DHCP server. Which sequence of pool commands is required at minimum?

• a.'ntp server' and 'logging host' inside the pool
• b.'ip dhcp pool NAME', then 'network', and 'default-router'✓
• c.'default-router' and 'dns-server' but no network statement
• d.Only 'ip dhcp excluded-address' with no pool defined

A functional IOS DHCP pool needs 'ip dhcp pool <name>' to enter pool config, a 'network' statement defining the subnet and mask to lease from, and a 'default-router' so clients receive a gateway. A 'dns-server' and 'lease' are common additions. Excluding static addresses with 'ip dhcp excluded-address' is done separately in global config.

What is the role of a DHCP relay agent (helper) in a routed network?

• a.It assigns IP addresses directly from a locally stored address pool It performs this inspection by comparing each reply against its locally cached lease database.
• b.It forwards DHCP broadcasts from clients to a DHCP server on a different subnet as unicast✓
• c.It blocks rogue DHCP servers by inspecting server-sourced replies
• d.It synchronizes the DHCP server's clock with an external NTP source

A DHCP relay agent, configured with 'ip helper-address', intercepts client DHCP broadcasts and relays them as unicast to a DHCP server located on another subnet, then relays the server's replies back. This lets a single central DHCP server serve many segments. It does not itself allocate addresses or filter rogue servers.

A network relies on a single DHCP server, and clients on a remote subnet stop receiving addresses after a router change. Which configuration should you verify first?

• a.The 'ip helper-address' statement on the clients' gateway interface✓
• b.The Syslog severity level configured on the DHCP server
• c.The SNMP community string used to poll the router
• d.The reference bandwidth on the router's OSPF interfaces

When remote clients cannot obtain leases from a central server, the DHCP relay configuration is the prime suspect, so verify that 'ip helper-address' still points to the correct server on the clients' gateway interface. A router change could have removed or altered it. Without the helper, broadcast DHCP requests never reach the server.

Which QoS marking value is conventionally used for expedited-forwarding voice traffic?

• a.DSCP 63, the maximum possible value
• b.DSCP 0, best effort
• c.DSCP 46 (EF)✓
• d.DSCP 8, class selector 1

Voice bearer traffic is conventionally marked DSCP 46, the Expedited Forwarding (EF) code point, so it receives low-latency priority queuing during congestion. DSCP 0 is best effort with no guarantees, and CS1 (DSCP 8) is a low-priority scavenger-style class. Consistent EF marking end to end is key to protecting call quality.

What does 'trust boundary' mean in a QoS deployment?

• a.The list of SNMP managers permitted to change QoS markings remotely
• b.The maximum bandwidth a policy will permit before dropping packets
• c.The physical demarcation point between the LAN and the service provider's network
• d.The point in the network where incoming QoS markings are accepted rather than overwritten✓

The trust boundary is where the network begins honoring the DSCP or CoS markings on incoming traffic instead of re-marking them. Markings from untrusted devices (like user PCs) are typically reset, while markings from trusted devices (like IP phones) are accepted. Defining the boundary correctly ensures only legitimate traffic gets priority.

Which command on a Cisco device displays the current date and time from the system clock?

• a.show clock✓
• b.show ntp associations, which lists peers instead of local time
• c.show time zone offset only
• d.show calendar sync, which is not a standard IOS command

'show clock' prints the device's current date and time as maintained by the system clock. To see whether that clock is synchronized via NTP, use 'show ntp status'. Accurate local time underpins meaningful log timestamps, certificate validation, and time-based access controls.

Why should management protocols like SNMP and Syslog be sent over a dedicated or protected management path when possible?

• a.Because they require the highest OSPF cost to be reachable
• b.Because they only function correctly on point-to-point serial links
• c.To keep monitoring and log data secure and available even when the data plane is congested or attacked✓
• d.Because they consume more bandwidth than user data and would slow the network Assigning them that highest cost also guarantees they survive any spanning-tree recalculation.

Isolating management traffic (SNMP, Syslog, SSH) on a dedicated or protected path keeps device monitoring and control reachable even during congestion or attacks on the production network. It also limits exposure of sensitive management data. This separation is a core principle of secure network operations.

Which three goals make up the CIA triad that underpins information security?

• a.Cryptography, Identity, and Access management
• b.Compliance, Inspection, and Auditing of systems
• c.Control, Isolation, and Authorization of network resources
• d.Confidentiality, Integrity, and Availability✓

The CIA triad stands for Confidentiality (preventing unauthorized disclosure), Integrity (preventing unauthorized modification), and Availability (ensuring authorized access when needed). Nearly every security control maps to protecting one or more of these three properties. Understanding the triad frames how threats and countermeasures are evaluated.

What distinguishes a threat from a vulnerability in security terminology?

• a.A threat is always internal, while a vulnerability is always external
• b.They are identical terms describing any network attack
• c.A threat is a patch, while a vulnerability is the software that needs it Both words describe the same measurable event once a control has already been bypassed by it.
• d.A vulnerability is a weakness, while a threat is the potential danger that could exploit it✓

A vulnerability is a weakness or flaw in a system, and a threat is a potential event or actor that could exploit that weakness to cause harm. The likelihood and impact of a threat exploiting a vulnerability define the risk. Mitigations reduce risk by removing vulnerabilities or blocking threats.

On which single criterion can a standard IPv4 ACL filter traffic?

• a.Both the source and destination IP addresses plus port numbers
• b.The source IP address only✓
• c.The application-layer content of the packet
• d.The destination MAC address of each frame

Standard IPv4 ACLs (1-99 and 1300-1999) match only on the source IP address, making them coarse filters. To match on destination address, protocol, or port, an extended ACL is required. Because standard ACLs are so broad, they are generally placed close to the destination to avoid blocking unintended traffic.

Which wildcard mask should an ACL use to match exactly the single host 192.168.10.7?

• a.255.255.255.255, which would match every possible address
• b.255.255.255.0, the standard class C subnet mask
• c.0.0.0.255, which would match the entire 192.168.10.0 subnet
• d.0.0.0.0✓

A wildcard mask of 0.0.0.0 requires every bit of the address to match, so it selects exactly one host, 192.168.10.7. Equivalently, IOS accepts the 'host 192.168.10.7' keyword. A wildcard of 0.0.0.255 would match the whole /24, and 255.255.255.255 (the 'any' keyword) matches everything.

Which wildcard mask correctly matches the entire 172.16.0.0/16 network in an ACL statement?

• a.255.255.0.0, which is the subnet mask, not the wildcard
• b.0.0.15.255, which would match only a /20
• c.0.0.0.255, matching only the final octet range
• d.0.0.255.255✓

A /16 has 16 host bits, so the wildcard mask is the inverse of 255.255.0.0, which is 0.0.255.255. The two zero octets force the first 16 bits (172.16) to match while the last two octets are ignored. Remember that ACL wildcard masks are the bitwise inverse of subnet masks.

An ACL entry reads 'permit 10.1.4.0 0.0.1.255'. Which range of addresses does it match?

• a.Only the single subnet 10.1.4.0 through 10.1.4.255
• b.10.1.4.0 through 10.1.5.255 (a /23 block)✓
• c.The entire 10.1.0.0/16 network
• d.10.1.4.0 through 10.1.4.255 and 10.1.6.0 through 10.1.6.255 only

The wildcard 0.0.1.255 leaves the last nine bits free, covering a block of 512 addresses, which is a /23. Starting at 10.1.4.0, that spans 10.1.4.0 through 10.1.5.255. This is why wildcard masks are powerful: a single line can match two contiguous /24s at once.

Which wildcard mask matches all addresses in the 192.168.16.0/20 network?

• a.0.0.0.15, which covers only sixteen host addresses
• b.0.0.7.255, which corresponds to a /21
• c.0.0.15.255✓
• d.0.0.255.255, which would match a /16 instead

A /20 has 12 host bits, so its wildcard mask is the inverse of 255.255.240.0, which is 0.0.15.255. The third octet's low four bits and the entire fourth octet are wildcarded. Starting at 192.168.16.0, this matches through 192.168.31.255, a block of 4096 addresses.

What behavior applies to traffic that matches no explicit entry in a Cisco ACL?

• a.It is logged and then forwarded for administrative review
• b.It is denied, because every ACL ends with an implicit 'deny any'✓
• c.It is queued until a matching permit statement is added
• d.It is permitted, because ACLs allow anything not explicitly denied

Every Cisco ACL concludes with an invisible implicit 'deny any', so any packet not matched by a permit statement is dropped. This means an ACL containing only deny statements, or one with no matching permit, blocks all remaining traffic. Administrators must include an explicit permit for the traffic they intend to allow.

Where should a standard ACL generally be placed, and why?

• a.On the WAN link only, regardless of traffic direction
• b.Close to the destination, because it matches only source addresses and could otherwise block too much✓
• c.On a loopback interface, to centralize all filtering decisions
• d.Close to the source, so unwanted traffic is dropped before it travels On that link the direction keyword is ignored because the filter applies symmetrically anyway.

Because a standard ACL matches only the source address, placing it near the source risks blocking that source's legitimate traffic to other destinations too. Positioning it close to the destination limits its impact to just the intended flow. Extended ACLs, being more specific, are instead placed near the source to conserve bandwidth.

Which command applies the ACL numbered 101 to inbound traffic on interface GigabitEthernet0/1?

• a.ip access-list 101 apply inbound on Gi0/1
• b.access-class 101 in, under the interface configuration
• c.access-list 101 in directly in global configuration
• d.ip access-group 101 in✓

Under the interface, 'ip access-group 101 in' applies ACL 101 to traffic entering that interface. The 'in' or 'out' keyword sets the direction relative to the interface. The 'access-class' command is used instead to apply an ACL to VTY lines for remote-access control, which is a different context.

Which type of ACL is required to permit HTTP traffic to a specific server while denying all other traffic to it?

• a.A MAC address ACL applied at Layer 2 only
• b.An extended ACL, which can match destination address and TCP port 80✓
• c.A reflexive ACL, which is the only type able to match ports
• d.A standard ACL, which matches destination ports directly

Permitting a specific application (HTTP) to a specific destination requires matching destination IP and TCP port 80, which only an extended ACL can do. Standard ACLs match source address alone and cannot filter by port. Extended ACLs are numbered 100-199 (and 2000-2699) or named.

In an extended ACL statement 'permit tcp any host 10.0.0.5 eq 443', what does 'eq 443' specify?

• a.The maximum number of connections permitted to the host
• b.The source port that the client must use for the connection
• c.The administrative distance applied to matching packets
• d.The destination port (HTTPS) that the traffic must be headed to✓

The 'eq 443' keyword matches traffic whose destination port equals 443, the well-known port for HTTPS, allowing secure web traffic to the server at 10.0.0.5. Extended ACLs can match source and destination ports using operators like eq, gt, lt, and range. This granularity is why extended ACLs are used for application-level filtering.

What is a primary security purpose of port security on a switch access port?

• a.To limit which and how many MAC addresses can use the port, blocking unauthorized devices✓
• b.To encrypt all frames leaving the port toward the connected device
• c.To prioritize voice traffic over data traffic on the same port
• d.To automatically assign the port to the correct VLAN based on traffic It achieves this by tagging each authorized frame with a higher class-of-service value first.

Port security restricts a switch port to a maximum number of learned MAC addresses and can bind specific addresses, so an attacker who plugs in an unauthorized device or a hub triggers a violation. This defends against MAC flooding and rogue connections. Violations can protect, restrict, or shut down the port depending on the configured mode.

Under port security, which violation mode drops offending frames and increments the violation counter but does NOT shut the port down?

• a.Recover, which re-enables the port automatically
• b.Shutdown, the default mode
• c.Restrict✓
• d.Protect, which drops silently without any counter

In 'restrict' mode, frames from unauthorized MAC addresses are dropped, the violation counter increases, and an SNMP/Syslog notification is generated, but the port stays up. 'Protect' also drops the frames but silently, with no counter or alert. 'Shutdown', the default, err-disables the port entirely.

What does the port-security 'sticky' option accomplish?

• a.It encrypts the MAC address table so it cannot be read by 'show' commands This shutdown is triggered before the switch has learned even a single legitimate MAC address.
• b.It permanently blocks any MAC address that has ever caused a violation
• c.It forces the port into shutdown mode on the first frame received
• d.It dynamically learns connected MAC addresses and adds them to the running configuration as secure addresses✓

With 'switchport port-security mac-address sticky', the switch learns the currently connected MAC addresses and writes them into the running configuration as secure addresses, avoiding manual entry. Saving the config makes them persist across reloads. New, unlearned addresses beyond the maximum then trigger the configured violation action.

A port-security-enabled interface is in the err-disabled state after a violation. How can it be returned to service?

• a.Wait five minutes for it to clear itself with no intervention
• b.Delete and recreate the VLAN the port belongs to
• c.Issue 'shutdown' then 'no shutdown' on the interface (or configure errdisable recovery)✓
• d.Reload the entire switch, as no other method works

An err-disabled port must be manually recovered by shutting and re-enabling it with 'shutdown' followed by 'no shutdown', after removing the offending device. Alternatively, 'errdisable recovery cause psecure-violation' with a timer can auto-recover it. Simply waiting does nothing unless auto-recovery is configured.

DHCP snooping designates ports as trusted or untrusted. Which type of port should face a legitimate DHCP server?

• a.A port with PortFast disabled to slow down the handshake
• b.A trusted port, so the server's DHCPOFFER and DHCPACK replies are permitted✓
• c.An untrusted port, so the server's replies are inspected and dropped
• d.Any access port, since DHCP snooping does not distinguish ports

Ports connecting to legitimate DHCP servers (typically uplinks) are configured as trusted so server-sourced messages like DHCPOFFER and DHCPACK are allowed through. Ports facing end hosts stay untrusted, and server messages arriving there are dropped as rogue. This prevents attackers from running unauthorized DHCP servers.

Which attack does DHCP snooping primarily defend against?

• a.ARP cache poisoning between two hosts on the same VLAN
• b.MAC address table overflow caused by flooding random source MACs
• c.Spanning-tree manipulation using forged superior BPDUs
• d.A rogue DHCP server handing out bogus addresses and gateway information✓

DHCP snooping stops a rogue DHCP server from responding to clients by dropping server messages on untrusted ports, preventing attackers from assigning malicious default gateways or DNS servers. It also builds a binding table used by Dynamic ARP Inspection and IP Source Guard. ARP poisoning and STP attacks are addressed by other features.

Dynamic ARP Inspection relies on which data structure to validate ARP packets on untrusted ports?

• a.The DHCP snooping binding table✓
• b.The switch's spanning-tree topology database
• c.The CDP neighbor table maintained per interface
• d.The router's OSPF link-state database

DAI checks each ARP packet on untrusted ports against the DHCP snooping binding table, which records valid IP-to-MAC-to-port bindings learned during DHCP. ARP messages that do not match a legitimate binding are dropped, defeating ARP spoofing and man-in-the-middle attacks. Because of this dependency, DHCP snooping must be enabled for DAI to function.

Which Layer 2 attack involves an attacker sending gratuitous ARP replies to associate their MAC with the default gateway's IP?

• a.CAM table overflow through MAC flooding
• b.DHCP starvation by exhausting the address pool
• c.ARP spoofing (ARP poisoning)✓
• d.VLAN hopping using double-tagged 802.1Q frames

In ARP spoofing, the attacker sends forged ARP replies claiming the gateway's IP maps to the attacker's MAC, so victims send their traffic to the attacker, enabling interception. Dynamic ARP Inspection, backed by DHCP snooping, blocks these forged replies. VLAN hopping, CAM overflow, and DHCP starvation are distinct Layer 2 attacks.

How does a MAC address (CAM) table overflow attack degrade switch behavior?

• a.It reprograms the switch to route packets at Layer 3 incorrectly
• b.It floods the switch with bogus source MACs until the table fills, causing the switch to flood frames out all ports✓
• c.It forces the switch to elect the attacker as the spanning-tree root The attacker then advertises a superior bridge ID so every port transitions to the blocking state, letting the traffic be quietly captured.
• d.It disables the switch's management interface via repeated logins

By flooding the switch with countless frames using random source MAC addresses, an attacker fills the finite CAM table so legitimate entries cannot be learned. The switch then floods unknown-unicast frames out all ports, letting the attacker capture traffic. Port security, which limits MACs per port, is the standard defense.

Which feature protects against VLAN hopping via the double-tagging technique?

• a.Applying an extended ACL to the native VLAN interface
• b.Enabling DHCP snooping on all access ports
• c.Turning on BPDU Guard for every trunk link
• d.Changing the native VLAN to an unused VLAN and not using VLAN 1✓

Double-tagging VLAN hopping abuses the native VLAN, which is sent untagged, so setting the native VLAN to a dedicated unused VLAN (and explicitly tagging it) removes the opening. Disabling dynamic trunking (DTP) on access ports and pruning unused VLANs from trunks further hardens against hopping. VLAN 1 should be avoided for user or native use.

What are the three core services provided by AAA?

• a.Authentication, Authorization, and Accounting✓
• b.Authorization, Auditing, and Acknowledgment
• c.Access, Auditing, and Alerting
• d.Authentication, Availability, and Assurance

AAA stands for Authentication (verifying identity), Authorization (determining what an authenticated user may do), and Accounting (recording what the user did). Centralizing these on a server improves security and auditing across many devices. Cisco supports AAA using RADIUS or TACACS+ back-end servers.

Which AAA protocol is Cisco-proprietary, uses TCP port 49, and encrypts the entire packet payload?

• a.RADIUS, an open standard using UDP
• b.LDAP, which queries a directory over TCP 389
• c.TACACS+✓
• d.Kerberos, which issues time-limited tickets

TACACS+ is Cisco-developed, runs over TCP port 49, and encrypts the whole payload, and it separates authentication, authorization, and accounting into independent functions, which suits granular device-administration control. RADIUS is an open standard over UDP that encrypts only the password and combines authentication with authorization. Both centralize AAA but serve different emphases.

Which statement about RADIUS is correct?

• a.It is an open standard, uses UDP, and encrypts only the password portion of the packet✓
• b.It uses TCP and encrypts the entire packet including the username
• c.It is Cisco-proprietary and separates all three AAA functions
• d.It operates exclusively on port 49 and cannot perform accounting

RADIUS is an IETF open standard that runs over UDP and encrypts only the user's password, leaving other attributes in clear text. It combines authentication and authorization into one exchange, which is well suited to network access scenarios like 802.1X. TACACS+, by contrast, is Cisco's TCP-based protocol that encrypts the full payload.

For which use case is TACACS+ typically preferred over RADIUS?

• a.Authenticating thousands of wireless clients joining via 802.1X
• b.Granular device administration, where per-command authorization is valuable✓
• c.Providing a lightweight UDP-based option for high-speed access ports
• d.Handing out IP addresses to hosts as they connect to the network

TACACS+ separates authorization from authentication and can authorize individual CLI commands, making it ideal for controlling what administrators may do on network devices. RADIUS, combining authentication and authorization, is more common for network access (802.1X, VPN). The choice depends on whether fine-grained command control or high-volume access authentication is the priority.

Why is 'enable secret' preferred over 'enable password' for protecting privileged EXEC mode?

• a.'enable secret' disables the console port entirely for extra safety
• b.'enable password' uses AES encryption, which is slower and less secure Because the two commands compute the identical hash internally, administrators may freely use either one interchangeably in production.
• c.'enable secret' stores the password as a strong one-way hash, while 'enable password' may be clear text or weakly reversible✓
• d.They are identical, so the choice is purely a matter of preference

'enable secret' hashes the privileged-mode password with a strong one-way algorithm, so it cannot be trivially reversed, whereas 'enable password' is either clear text or protected only by the weak, reversible Type 7 encoding. When both are configured, the secret takes precedence. Best practice is to use enable secret and omit enable password.

What does the global command 'service password-encryption' do?

• a.It hashes all passwords with a strong irreversible algorithm equivalent to enable secret
• b.It forces every user to change their password at next login
• c.It encrypts the entire running configuration file stored in NVRAM
• d.It applies weak, reversible Type 7 encryption to clear-text passwords in the configuration✓

'service password-encryption' obscures clear-text passwords (such as line and enable passwords) using the weak, reversible Type 7 algorithm, which merely prevents shoulder-surfing, not determined attackers. It is not equivalent to the strong hashing of 'enable secret'. It should be seen as a minor hardening step, not real cryptographic protection.

Which practice most effectively secures the VTY lines against unauthorized remote access?

• a.Requiring SSH only, using local or AAA login, and applying an access-class ACL to restrict source addresses✓
• b.Enabling PortFast and BPDU Guard on the uplink
• c.Configuring the native VLAN to match on both trunk ends
• d.Setting the OSPF reference bandwidth higher on management interfaces These two features together are what most hardening guides list as the primary control for restricting who may reach the VTY lines.

Hardening VTY access combines allowing only SSH ('transport input ssh'), authenticating users via local accounts or AAA, and restricting which source IPs may connect using an 'access-class' ACL. Together these limit both how and from where administrators log in. Telnet and unrestricted VTY access should be eliminated.

What is the security advantage of the 'login local' command combined with individual user accounts over a single shared line password?

• a.It provides per-user authentication and accountability instead of one anonymous shared credential✓
• b.It automatically rotates the shared password every 24 hours
• c.It encrypts the management session end to end, replacing the need for SSH
• d.It removes the need for any password by trusting the source IP address

'login local' authenticates against individual username/password accounts, so each administrator has a distinct credential and their actions can be attributed to them. A single shared line password offers no accountability and is harder to revoke for one person. Combining local (or AAA) authentication with SSH is a baseline for secure device management.

What is the fundamental purpose of an IPsec VPN?

• a.To compress traffic so it consumes less WAN bandwidth
• b.To provide confidentiality, integrity, and authentication for IP traffic across an untrusted network✓
• c.To accelerate routing convergence between distant sites
• d.To assign private IP addresses to remote hosts automatically It performs this compression before handing the frames to the interface queue for transmission across the provider link.

IPsec secures IP communications over untrusted networks (like the Internet) by encrypting data for confidentiality, hashing it for integrity, and authenticating the peers. It is widely used for site-to-site and remote-access VPNs. IPsec operates at the network layer, protecting all traffic above it transparently.

Which two IPsec protocols provide the security services, and what does each offer?

• a.AH, which provides authentication and integrity, and ESP, which additionally provides encryption✓
• b.GRE and PPTP, providing tunneling without any cryptography
• c.RADIUS and TACACS+, providing authentication of VPN users
• d.SSL and TLS, both providing encryption for web sessions only These two servers negotiate the tunnel keys directly between themselves without any separate key-exchange protocol involved.

IPsec uses the Authentication Header (AH), which offers data integrity and authentication but no encryption, and the Encapsulating Security Payload (ESP), which adds confidentiality through encryption in addition to integrity and authentication. ESP is by far the more commonly deployed because it protects the payload's contents. IKE negotiates the keys and security associations for them.

What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

• a.It compresses the encrypted payload to save bandwidth on the tunnel
• b.It negotiates security associations and securely exchanges the keys used to protect the tunnel✓
• c.It performs NAT translation for traffic entering the VPN
• d.It assigns DSCP markings so VPN traffic receives QoS priority

IKE handles the negotiation of IPsec security associations and the secure exchange of cryptographic keys between peers, typically in two phases. Phase 1 establishes a secure management channel, and Phase 2 negotiates the parameters for protecting user data. Without IKE, keys would have to be configured manually and could not be refreshed dynamically.

What is the difference between symmetric and asymmetric encryption?

• a.Symmetric encryption uses a public/private key pair, while asymmetric uses one shared key The public and private halves are mathematically unrelated, so either one may be published safely without weakening the cipher at all.
• b.Symmetric encryption uses a single shared key for both encryption and decryption, while asymmetric uses a public/private key pair✓
• c.Asymmetric encryption uses no keys, relying instead on hashing algorithms
• d.Symmetric encryption is always weaker and is never used in modern VPNs

Symmetric encryption uses the same secret key to encrypt and decrypt, making it fast and suited to bulk data. Asymmetric encryption uses a mathematically linked public/private key pair, where one key encrypts and the other decrypts, enabling secure key exchange and digital signatures. VPNs often combine both: asymmetric to exchange keys, symmetric for the bulk traffic.

Which wireless security element uses SAE to resist offline dictionary attacks even when a weak passphrase is chosen?

• a.WPA with TKIP
• b.WPA2 with AES-CCMP
• c.WEP with a 128-bit key
• d.WPA3✓

WPA3 introduces Simultaneous Authentication of Equals (SAE), a handshake that resists offline dictionary attacks and provides forward secrecy, even if users pick weak passphrases. WPA2 relies on a four-way handshake vulnerable to offline attacks, and WPA/WEP are older and cryptographically broken. WPA3 is the current recommended standard for Wi-Fi security.

What is the security purpose of a DMZ (demilitarized zone) in a network design?

• a.To provide a high-speed backbone connecting internal core switches
• b.To synchronize time between internal and external NTP servers
• c.To host publicly accessible servers in a segmented zone isolated from the internal LAN✓
• d.To encrypt all traffic between two branch offices over the Internet This synchronization keeps the certificates on both sides valid so the encrypted sessions never expire unexpectedly.

A DMZ is a separate network segment that hosts services meant to be reachable from the Internet (web, mail, DNS) while isolating them from the trusted internal LAN. If a DMZ server is compromised, the segmentation limits the attacker's reach into internal systems. Firewalls control traffic among the Internet, DMZ, and inside zones.

Which principle recommends granting users and devices only the access strictly necessary to perform their function?

• a.Separation of duties across multiple administrators
• b.Defense in depth, layering multiple independent controls
• c.Implicit trust of all internal network segments
• d.The principle of least privilege✓

The principle of least privilege limits each user, process, or device to the minimum permissions needed for its role, reducing the damage that a compromise or mistake can cause. It complements defense in depth and separation of duties. Applying least privilege to accounts, ACLs, and device roles is a foundational security practice.

A phishing email tricks an employee into revealing their password. Which category of threat does this represent?

• a.A man-in-the-middle interception of encrypted traffic
• b.A social engineering attack that exploits human trust rather than a technical flaw✓
• c.A brute-force attack against the authentication database This flood of traffic exhausts the mail server's connection table until legitimate users can no longer log in.
• d.A denial-of-service attack against the mail server

Phishing is a social engineering attack that manipulates people into divulging credentials or clicking malicious links, bypassing technical controls by exploiting human trust. User awareness training and multi-factor authentication are key mitigations. Unlike brute-force or DoS attacks, it targets the human element rather than a system vulnerability directly.