200-301 practice questions 1,001–1,010

1. Question 1001 · 1334 in bank

   How are VLAN hopping attacks mitigated?

   • Amanually implement trunk ports and disable DTP
   • Bconfigure extended VLANs
   • Cactivate all ports and place in the default VLAN
   • Denable dynamic ARP inspection

   Show answer

   Answer: A

   Explanation

   To prevent VLAN hopping attacks, you should use the switchport mode trunk command to manually configure your trunk ports, and use the switchport nonegotiate command to disable the dynamic trunking protocol. LINK: https://www.linkedin.com/advice/0/what-security-risks-challenges-vlan-trunking#:~:text=To%20prevent%20VLAN%20hopping%20attacks,disable%20the%20dynamic%20trunking%20protocol.

   Source: Adapted from community discussion — RODCCN

   Next question

2. Question 1002 · 1334 in bank

   Which enhancements were implemented as part of WPA3?

   • AForward secrecy and SAE in personal mode for secure initial key exchange
   • B802.1x authentication and AES-128 encryption
   • CAES-64 in personal mode and AES-128 in enterprise mode
   • DTKIP encryption improving WEP and per-packet keying

   Show answer

   Answer: A

   Next question

3. Question 1003 · 1334 in bank

   When a site-to-site VPN is configured which IPsec mode provides encapsulation and encryption of the entire original IP packet?

   • AIPsec transport mode with AH
   • BIPsec tunnel mode with AH
   • CIPsec transport mode with ESP
   • DIPsec tunnel mode with ESP

   Show answer

   Answer: D

   Explanation

   When a site-to-site VPN is configured, IPsec tunnel mode with ESP (Encapsulating Security Payload) provides encapsulation and encryption of the entire original IP packet. In this mode, the entire IP packet, including the original IP header and payload, is encapsulated within a new IP packet with a new IP header added by the VPN gateway. The original packet is encrypted, ensuring confidentiality, and the new IP header allows the encrypted packet to be routed over the public internet securely to the other VPN gateway, where it is decrypted and forwarded to its final destination.

   Source: Adapted from community discussion — RODCCN

   Next question

4. Question 1004 · 1334 in bank

   An engineer is configuring remote access to a router from IP subnet 10.139.58.0/28. The domain name, crypto keys, and SSH have been configured. Which configuration enables the traffic on the destination router?

   • Aline vty 0 15 access-class 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22
   • Binterface FastEthernet0/0 ip address 10.122.49.1 255.255.255.252 ip access-group 10 in ! ip access-list standard 10 permit udp 10.139.58.0 0.0.0.7 host 10.122.49.1 eq 22
   • Cinterface FastEthernet0/0 ip address 10.122.49.1 255.255.255.252 ip access-group 110 in ! ip access-list standard 110 permit tcp 10.139.58.0 0.0.0.15 eq 22 host 10.122.49.1
   • Dline vty 0 15 access-group 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22

   Show answer

   Answer: A

   Explanation

   I disagree. In C you are allowing source port 22. Clients will never use port 22 as source port when connecting to a ssh device. They will use a randomly generate port, usually between the 49k-65k port range. The only options that correctly configured the ACL are A and D, but only A uses the correct command for VTY lines which is access-class. So correct answer is A.

   Source: Adapted from community discussion — EliasM

   Next question

5. Question 1005 · 1334 in bank

   In an SDN architecture, which function of a network node is centralized on a controller?

   • ACreates the IP routing table
   • BDiscards a message due filtering
   • CMakes a routing decision
   • DProvides protocol access for remote access devices

   Show answer

   Answer: C

   Explanation

   In the context of an SDN architecture, the function that is primarily centralized on a controller is indeed: C. Makes a routing decision While it's true that SDN controllers can have an impact on the overall IP routing table, the centralization of routing decisions is a more accurate and fundamental representation of the controller's role in an SDN environment. Option A ("Creates the IP routing table") involves the process of populating the routing table with routes and their associated information. While an SDN controller can influence routing decisions by programming forwarding rules in network devices, the creation of the IP routing table typically involves the management of routing protocols, which might still be distributed across the network devices. So, while both options A and C have connections to the controller's role in SDN, option C is a more direct and specific representation of how SDN controllers primarily centralize routing decisions.

   Source: Adapted from community discussion — Sant11

   Next question

6. Question 1006 · 1334 in bank

   Which management security process is invoked when a user logs in to a network device using their username and password?

   • Aauthentication
   • Bauditing
   • Caccounting
   • Dauthorization

   Show answer

   Answer: A

   Next question

7. Question 1007 · 1334 in bank

   Select 2

   

   Refer to the exhibit. What are the two steps an engineer must take to provide the highest encryption and authentication using domain credentials from LDAP? (Choose two.)

   • ASelect PSK under Authentication Key Management.
   • BSelect Static-WEP + 802.1X on Layer 2 Security.
   • CSelect WPA+WPA2 on Layer 2 Security.
   • DSelect 802.1X from under Authentication Key Management.
   • ESelect WPA Policy with TKIP Encryption.

   Show answer

   Answer: CD

   Explanation

   To provide the highest encryption and authentication using domain credentials from LDAP, the engineer must take the following two steps: C. Select WPA+WPA2 on Layer 2 Security. D. Select 802.1X from under Authentication Key Management. Explanation: Select WPA+WPA2 on Layer 2 Security: This step ensures the use of Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access 2 (WPA2) protocols for securing the wireless network. WPA and WPA2 provide robust encryption and authentication mechanisms to protect network communications. By selecting WPA+WPA2, the network supports both protocols, allowing compatibility with a wide range of client devices.

   Source: Adapted from community discussion — [Removed]

   References

   • Cisco documentation

   Next question

8. Question 1008 · 1334 in bank

   Which 802.11 frame type is Association Response?

   • Amanagement
   • Bprotected frame
   • Caction
   • Dcontrol

   Show answer

   Answer: A

   Explanation

   Answer is : A The Association Response frame is a type of management frame in the 802.11 wireless networking standard. It is used to respond to an Association Request frame that is sent by a client device during the association process. The Association Response frame is sent by the access point (AP) and contains information about the status of the association request, as well as any additional parameters that are required for the client to connect to the network. If the association request is successful, the Association Response frame will include the association ID (AID) that is assigned to the client device, as well as the supported rates and other relevant information. If the association request is unsuccessful, the Association Response frame will contain an error code indicating the reason for the failure. The Association Response frame is an important part of the 802.11 association process, which is used to establish a connection between a client device and an AP. It is used to confirm that the client device is allowed to join the network and to provide the necessary information for the client to communicate with the AP.

   Source: Adapted from community discussion — Alizadeh

   Next question

9. Question 1009 · 1334 in bank

   Select 2

   What are two functions of a Layer 2 switch? (Choose two.)

   • Aacts as a central point for association and authentication servers
   • Bselects the best route between networks on a WAN
   • Cmoves packets within a VLAN
   • Dmoves packets between different VLANs
   • Emakes forwarding decisions based on the MAC address of a packet

   Show answer

   Answer: CE

   Explanation

   C and E. Little confusion at first about E because of the use of the word "Packet" which is a layer 3 term rather than using "Frame" for a layer 2 concept. However, we need to remember that packet is a general term that is also used to replace other terms like a "frame" of other layers. CISCO questions like this tend to use it as well. Also, a L3 packet encapsulates a L2 frame which in turn embed a frame.

   Source: Adapted from community discussion — ismatdmour

   Next question

10. Question 1010 · 1334 in bank

    Which enhancement is implemented in WPA3?

    • Aemploys PKI to identify access points
    • Bapplies 802.1x authentication
    • Cuses TKIP
    • Dprotects against brute force attacks

    Show answer

    Answer: D

    Explanation

    WPA3-Personal: In WPA2-Personal, threat actors can listen in on the “handshake” between a wireless client and the AP and use brute-force attacks to try to guess the PSK. WPA3-Personal thwarts such attacks by using SAE.

    Source: Adapted from community discussion — Elmasquentona963

    References

    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-301 practice, question 1001. 1334 questions available.