200-301 practice questions 921–930

1. Question 921 · 1334 in bank

   DRAG DROP - Drag and drop the Cisco Wireless LAN Controller security settings from the left onto the correct security mechanism categories on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Layer 2 Security Mechanism includes WPA+WPA2, 802.1X, Static WEP, CKIP while Layer 3 Security Mechanisms (for WLAN) includes IPSec, VPN Pass- Through, Web Passthrough ג€¦ Reference: https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/106082-wlc-compatibility-matrix.html

   Source: Adapted from community discussion — Tintin_06

   References

   • Cisco documentation

   

   Next question

2. Question 922 · 1334 in bank

   Which feature on the Cisco Wireless LAN Controller when enabled restricts management access from specific networks?

   • ATACACS
   • BCPU ACL
   • CFlex ACL
   • DRADIUS

   Show answer

   Answer: B

   Explanation

   ACLs can only be applied to dynamic interfaces. In WLC firmware version 4.0, there are CPU ACLs that can filter traffic destined for the management interface. (You can only configure CPU ACLs via GUI or CLI). https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71978-acl-wlc.html

   Source: Adapted from community discussion — dropspablo

   References

   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 923 · 1334 in bank

   Which set of actions satisfy the requirement for multifactor authentication?

   • AThe user enters a user name and password, and then re-enters the credentials on a second screen.
   • BThe user swipes a key fob, then clicks through an email link.
   • CThe user enters a user name and password, and then clicks a notification in an authentication app on a mobile device.
   • DThe user enters a PIN into an RSA token, and then enters the displayed RSA key on a login screen.

   Show answer

   Answer: C

   Explanation

   This is an example of how two-factor authentication (2FA) works: 1. The user logs in to the website or service with their username and password. 2. The password is validated by an authentication server and, if correct, the user becomes eligible for the second factor. 3. The authentication server sends a unique code to the user's second-factor method (such as a smartphone app). 4. The user confirms their identity by providing the additional authentication for their second-factor method.

   Source: Adapted from community discussion — welju

   Next question

4. Question 924 · 1334 in bank

   Refer to the exhibit. When PC1 sends a packet to PC2, the packet has which source and destination IP address when it arrives at interface Gi0/0 on router R2?

   

   • Asource 192.168.10.10 and destination 10.10.2.2
   • Bsource 192.168.20.10 and destination 192.168.20.1
   • Csource 192.168.10.10 and destination 192.168.20.10
   • Dsource 10.10.1.1 and destination 10.10.2.2

   Show answer

   Answer: C

   Next question

5. Question 925 · 1334 in bank

   Which configuration is needed to generate an RSA key for SSH on a router?

   • AConfigure VTY access.
   • BConfigure the version of SSH.
   • CAssign a DNS domain name.
   • DCreate a user with a password.

   Show answer

   Answer: C

   Explanation

   two conditions must be met before SSH can operate normally on a Cisco IOS switch The Cisco IOS image used must be a k9(crypto) image in order to support SSH. ""!--- Step 2: Configure the DNS domain of the router.

   Source: Adapted from community discussion — alexiro

   References

   • Cisco documentation
   • Cisco documentation

   Next question

6. Question 926 · 1334 in bank

   Select 2

   

   Refer to the exhibit. An extended ACL has been configured and applied to router R2. The configuration failed to work as intended. Which two changes stop outbound traffic on TCP ports 25 and 80 to 10.0.20.0/26 from the 10.0.10.0/26 subnet while still allowing all other traffic? (Choose two.)

   • AAdd a ג€permit ip any anyג€ statement at the end of ACL 101 for allowed traffic.
   • BAdd a ג€permit ip any anyג€ statement to the beginning of ACL 101 for allowed traffic.
   • CThe ACL must be moved to the Gi0/1 interface outbound on R2.
   • DThe source and destination IPs must be swapped in ACL 101.
   • EThe ACL must be configured the Gi0/2 interface inbound on R1.

   Show answer

   Answer: AD

   Explanation

   A and D are correct All ACLs have a implicit deny at the end which blocks all traffic so we need to add a permit to allow that traffic through The Source and destinations then need swapped. Using packet tracer the source has to be first... R1(config)#access-list 101 deny tcp ? A.B.C.D Source address any Any source host host A single source host and then the destination- R1(config)#access-list 101 deny tcp 10.0.10.0 0.0.0.63 ? A.B.C.D Destination address any Any destination host eq Match only packets on a given port number gt Match only packets with a greater port number host A single destination host lt Match only packets with a lower port number neq Match only packets not on a given port number range Match only packets in the range of port numbers

   Source: Adapted from community discussion — Terra_Nova

   Next question

7. Question 927 · 1334 in bank

   An engineer must configure a WLAN using the strongest encryption type for WPA2-PSK. Which cipher fulfills the configuration requirement?

   • AWEP
   • BAES
   • CRC4
   • DTKIP

   Show answer

   Answer: B

   Explanation

   Many routers provide WPA2-PSK (TKIP), WPA2-PSK (AES), and WPA2-PSK (TKIP/AES) as options. TKIP is actually an older encryption protocol introduced with WPA to replace the very-insecure WEP encryption at the time. TKIP is actually quite similar to WEP encryption. TKIP is no longer considered secure, and is now deprecated. In other words, you shouldn't be using it. AES is a more secure encryption protocol introduced with WPA2 and it is currently the strongest encryption type for WPA2-PSK/.

   Source: Adapted from community discussion — alexiro

   Next question

8. Question 928 · 1334 in bank

   DRAG DROP - Drag and drop the attack-mitigation techniques from the left onto the types of attack that they mitigate on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   change the default vlan id => prevents double tagging configure 802.1x authenticate => prevents MAC flooding enable DHCP Snooping => prevents MITM disable DTP => prevents switch spoofing

   Source: Adapted from community discussion — martco

   

   Next question

9. Question 929 · 1334 in bank

   Select 2

   While examining excessive traffic on the network, it is noted that all incoming packets on an interface appear to be allowed even though an IPv4 ACL is applied to the interface. Which two misconfigurations cause this behavior? (Choose two.)

   • AThe ACL is empty
   • BA matching permit statement is too broadly defined
   • CThe packets fail to match any permit statement
   • DA matching deny statement is too high in the access list
   • EA matching permit statement is too high in the access list

   Show answer

   Answer: BE

   Explanation

   A. not even sure what that means. B. is the answer because its too specific meaning its allowing everthing it shouldnt C. not the answer because if it was failing to match, then traffic would be getting denied D. not the answer because traffic would be getting denied. E. is the answer because it wouldnt matter how many deny commands if you are permitting it first at the top of the ACL

   Source: Adapted from community discussion — dave1992

   References

   • cisco.com documentation
   • Cisco documentation

   Next question

10. Question 930 · 1334 in bank

    The service password-encryption command is entered on a router. What is the effect of this configuration?

    • Arestricts unauthorized users from viewing clear-text passwords in the running configuration
    • Bprevents network administrators from configuring clear-text passwords
    • Cprotects the VLAN database from unauthorized PC connections on the switch
    • Dencrypts the password exchange when a VPN tunnel is established

    Show answer

    Answer: A

    Explanation

    I was flapping between A and B but, this cleared for me: "If the service password-encryption command is set, the encrypted form of the password you create is displayed when the more nvram:startup-config command is entered. "

    Source: Adapted from community discussion — sovafal192

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-301 practice, question 921. 1334 questions available.