200-301 practice questions 1,011–1,020

1. Question 1011 · 1334 in bank

   DRAG DROP - Drag and drop the Cisco IOS attack mitigation features from the left onto the types of network attack they mitigate on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct me if I'm wrong, but this answer doesn't look right to me at all. Shouldn't it be: DHCP Snooping - Rogue server, Dynamic ARP Inspection - Cache poisoning, IP Source Guard - rogue clients, storm control - flood attacks

   Source: Adapted from community discussion — Anon1216

   References

   • Cisco documentation
   • Cisco documentation

   

   Next question

2. Question 1012 · 1334 in bank

   

   SW1 supports connectivity for a lobby conference room and must be secured. The engineer must limit the connectivity from PC1 to the SW1 and SW2 network. The MAC addresses allowed must be limited to two. Which configuration secures the conference room connectivity?

   • Ainterface gi1/0/15 switchport port-security switchport port-security maximum 2
   • Binterface gi1/0/15 switchport port-security switchport port-security mac-address 0000.abcd.0004vlan 100
   • Cinterface gi1/0/15 switchport port-security mac-address 0000.abcd.0004 vlan 100
   • Dinterface gi1/0/15 switchport port-security mac-address 0000.abcd.0004 vlan 100 interface switchport secure-mac limit 2

   Show answer

   Answer: A

   Explanation

   The key phrase is: "The MAC addresses allowed must be limited to two". So, a port-security with a maximum of 2 allowed MAC address in the "Secure Source MAC table" will be needed. Therefore, A is the answer. Configuration: Switch(config-if)# gi1/0/15 Switch(config-if)# switchport mode access Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security maximum 2

   Source: Adapted from community discussion — Elmasquentona963

   Next question

3. Question 1013 · 1334 in bank

   Select 2

   

   Refer to the exhibit. An engineer is updating the management access configuration of switch SW1 to allow secured, encrypted remote configuration. Which two commands or command sequences must the engineer apply to the switch? (Choose two.)

   • ASW1(config)#enable secret ccnaTest123
   • BSW1(config)#username NEW secret R3mote123
   • CSW1(config)#line vty 0 15 SW1(config-line)#transport input ssh
   • DSW1(config)# crypto key generate rsa
   • ESW1(config)# interface f0/1 SW1(confif-if)# switchport mode trunk

   Show answer

   Answer: AC

   Explanation

   Going with A and C. There is a username and password configured already. Configuring enable secret is a must when using SSH otherwise you cannot enter to enabled mode. Try it in packet tracer. Pls correct me if im wrong

   Source: Adapted from community discussion — joondale

   References

   • cisco.com documentation

   Next question

4. Question 1014 · 1334 in bank

   Which port security violation mode allows from valid MAC addresses to pass but blocks traffic from invalid MAC addresses?

   • Arestrict
   • Bshutdown
   • Cprotect
   • Dshutdown VLAN

   Show answer

   Answer: C

   Explanation

   I don't think it's a good question , because “protect” and “restrict” also allows traffic from passing with a valid https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.pdf

   Source: Adapted from community discussion — Tylosh

   References

   • Cisco documentation

   Next question

5. Question 1015 · 1334 in bank

   A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate error when they attempt to access the portal. Employees can access the portal without any errors. Which change must be implemented to allow the contractors and employees to access the portal?

   • AInstall an Internal CA signed certificate on the Cisco ISE.
   • BInstall a trusted third-party certificate on the Cisco ISE.
   • CInstall an internal CA signed certificate on the contractor devices.
   • DInstall a trusted third-party certificate on the contractor devices.

   Show answer

   Answer: B

   Explanation

   Do you want to install an internal CA-signed certificate on 1000 contractor devices? Isn't it easier and more practical to install a trusted third-party certificate on the Cisco ISE? It also works for everyone.

   Source: Adapted from community discussion — hamish88

   References

   • Cisco documentation

   Next question

6. Question 1016 · 1334 in bank

   Select 2

   Which two wireless security standards use counter mode cipher block chaining Message Authentication Code Protocol for encryption and data integrity? (Choose two.)

   • AWi-Fi 6
   • BWPA3
   • CWEP
   • DWPA2
   • EWPA

   Show answer

   Answer: BD

   References

   • cisco.com documentation

   Next question

7. Question 1017 · 1334 in bank

   A network engineer is implementing a corporate SSID for WPA3-Personal security with a PSK. Which encryption cipher must be configured?

   • ACCMP128
   • BGCMP256
   • CCCMP256
   • DGCMP128

   Show answer

   Answer: A

   Explanation

   It's A, because the other encryption ciphers are not supported for personal mode. The question mentions the use of a PSK, which implies personal mode is in use. Configuring WPA3 (GUI) ... Chose the Encryption Cipher from the following options: CCMP128(AES) CCMP256 (not available for Personal security type) GCMP128 (not available for Personal security type) GCMP256 (not available for Personal security type) Source: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/wlan_security.html

   Source: Adapted from community discussion — [Removed]

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 1018 · 1334 in bank

   An administrator must use the password complexity not manufacturer-name command to prevent users from adding `Cisco` as a password. Which command must be issued before this command?

   • Alogin authentication my-auth-list
   • Bservice password-encryption
   • Cpassword complexity enable
   • Dconfreg 0x2142

   Show answer

   Answer: C

   References

   • Cisco documentation

   Next question

9. Question 1019 · 1334 in bank

   DRAG DROP - Drag and drop the TCP/IP protocols from the left onto their primary transmission protocols on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   HTTP SMTP Telnet (can be used to test tcp connectivity not udp) DNS RTP SNMP DNS is mostly UDP Port 53, but as time progresses, DNS will rely on TCP Port 53 more heavily. DNS has always been designed to use both UDP and TCP port 53 from the start1 , with UDP being the default, and fall back to using TCP when it is unable to communicate on UDP, typically when the packet size is too large to push through in a single UDP packet.

   Source: Adapted from community discussion — splashy

   

   Next question

10. Question 1020 · 1334 in bank

    An organization has decided to start using cloud-provided services. Which cloud service allows the organization to install its own operating system on a virtual machine?

    • Aplatform-as-a-service
    • Bnetwork-as-a-service
    • Csoftware-as-a-service
    • Dinfrastructure-as-a-service

    Show answer

    Answer: D

    Explanation

    create a fault tolerant colocation site as a cloud provider, you would be searching for an Infrastructure as a Service provider. This would allow you to install your own operation system and applications

    Source: Adapted from community discussion — alexiro

    References

    • azure.microsoft.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-301 practice, question 1011. 1334 questions available.