200-301 practice questions 931–940

1. Question 931 · 1334 in bank

   Which WPA3 enhancement protects against hackers viewing traffic on the Wi-Fi network?

   • ASAE encryption
   • BTKIP encryption
   • Cscrambled encryption key
   • DAES encryption

   Show answer

   Answer: A

   Explanation

   This is a bad question because AES Is technically correct, SAE is the handshake mechanism WPA 3 uses, it protects against offline dictionary attacks, and by the way the question is worded it's probably A, but D is correct as the actual encryption is AES for WPA 2 AND WPA 3. Thus AES is what is protecting all the data, but SAE is an enhancement WPA 3 has over WPA.

   Source: Adapted from community discussion — DARKK

   References

   • Cisco documentation
   • Cisco documentation

   Next question

2. Question 932 · 1334 in bank

   Refer to the exhibit. If the network environment is operating normally, which type of device must be connected to interface fastethernet 0/1?

   

   • ADHCP client
   • Baccess point
   • Crouter
   • DPC

   Show answer

   Answer: C

   Explanation

   In a typical network configuration, you configure all switch ports connected to host ports as untrusted and configure all switch ports connected to switches as trusted. With this configuration, all ARP packets entering the network from a given switch bypass the security check. No other validation is needed at any other place in the VLAN or in the network. You configure the trust setting by using the ip arp inspection trust interface configuration command. LINK: https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/www.cisco.com/content/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SXF/native/configuration/guide/swcg/dynarp.html.xml

   Source: Adapted from community discussion — RODCCN

   References

   • cisco.com documentation
   • Cisco documentation
   • Cisco documentation

   Next question

3. Question 933 · 1334 in bank

   Refer to the exhibit. An administrator configures four switches for local authentication using passwords that are stored as a cryptographic hash. The four switches must also support SSH access for administrators to manage the network infrastructure. Which switch is configured correctly to meet these requirements?

   

   • ASW1
   • BSW2
   • CSW3
   • DSW4

   Show answer

   Answer: C

   Explanation

   Keyword local authentication: "login local" configuration Keyword cryptographic hash: "secret" configuration Keyword SSH access: "live vty 0 15" configuration --> Answer C is correct

   Source: Adapted from community discussion — vadiminski

   Next question

4. Question 934 · 1334 in bank

   What is the same for both copper and fiber interfaces when using SFP modules?

   • AThey support an inline optical attenuator to enhance signal strength
   • BThey accommodate single-mode and multi-mode in a single module
   • CThey provide minimal interruption to services by being hot-swappable
   • DThey offer reliable bandwidth up to 100 Mbps in half duplex mode

   Show answer

   Answer: C

   Explanation

   C. They provide minimal interruption to services by being hot-swappable. Explanation: SFP (Small Form-factor Pluggable) modules are used to provide flexibility in connecting networking equipment, such as switches and routers, to various types of network media, including both copper and fiber interfaces. One of the key features of SFP modules, whether they are used with copper or fiber connections, is their hot-swappable nature. Hot-swappability means that you can remove or replace the SFP module while the equipment is powered on, minimizing interruption to network services. This is a significant advantage for maintenance and upgrades in a network environment.

   Source: Adapted from community discussion — Utshav

   Next question

5. Question 935 · 1334 in bank

   

   Refer to the exhibit. What is the effect of this configuration?

   • AThe switch discards all ingress ARP traffic with invalid MAC-to-IP address bindings.
   • BAll ARP packets are dropped by the switch.
   • CEgress traffic is passed only if the destination is a DHCP server.
   • DAll ingress and egress traffic is dropped because the interface is untrusted.

   Show answer

   Answer: A

   Explanation

   Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings.

   Source: Adapted from community discussion — dicksonpwc

   Next question

6. Question 936 · 1334 in bank

   When a site-to-site VPN is used, which protocol is responsible for the transport of user data?

   • AIPsec
   • BIKEv1
   • CMD5
   • DIKEv2

   Show answer

   Answer: A

   Explanation

   A site-to-site VPN allows offices in multiple fixed locations to establish secure connections with each other over a public network such as the Internet. A site-to-site VPN means that two sites create a VPN tunnel by encrypting and sending data between two devices. One set of rules for creating a site-to-site VPN is defined by IPsec.

   Source: Adapted from community discussion — alexiro

   Next question

7. Question 937 · 1334 in bank

   Which type of wireless encryption is used for WPA2 in preshared key mode?

   • AAES-128
   • BTKIP with RC4
   • CAES-256
   • DRC4

   Show answer

   Answer: A

   Explanation

   WPA2 aes is always 128 bit key for both psk and enterprise. The number of characters from passphrase dont have anything to do with the key length. It is not even possible to select the key length. Always 128.

   Source: Adapted from community discussion — Rakeshch

   References

   • Cisco documentation
   • Cisco documentation

   Next question

8. Question 938 · 1334 in bank

   What is the difference between an IPv6 link-local address and a unique local address?

   • AThe scope of an IPv6 link-local address is limited to a directly attached interface, but an IPv6 unique local address is used throughout a company site or network.
   • BThe scope of an IPv6 link-local address is global, but the scope of an IPv6 unique local address is limited to a loopback address.
   • CThe scope of an IPv6 link-local address can be used throughout a company site or network, but an IPv6 unique local address is limited to a loopback address.
   • DThe scope of an IPv6 link-local address is limited to a loopback address, and an IPv6 unique local address is limited to a directly attached interface.

   Show answer

   Answer: A

   Next question

9. Question 939 · 1334 in bank

   Which command prevents passwords from being stored in the configuration as plain text on a router or switch?

   • Aenable secret
   • Benable password
   • Cservice password-encryption
   • Dusername cisco password encrypt

   Show answer

   Answer: C

   Explanation

   correct enable password - Sets the enable password, and stores that password in plaintext in the config. enable secret - Sets the enable password, and stores that password as an md5 hash in the config. service password-encryption - For any passwords in the config that are stored in plaintext, this command changes them to be stored as hashed values instead.

   Source: Adapted from community discussion — nakres64

   Next question

10. Question 940 · 1334 in bank

    Select 2

    In which two ways does a password manager reduce the chance of a hacker stealing a user's password? (Choose two.)

    • AIt encourages users to create stronger passwords
    • BIt uses an internal firewall to protect the password repository from unauthorized access
    • CIt stores the password repository on the local workstation with built-in antivirus and anti-malware functionality
    • DIt automatically provides a second authentication factor that is unknown to the original user
    • EIt protects against keystroke logging on a compromised device or web site

    Show answer

    Answer: AE

    Explanation

    Correct A E E Assumes that the Admin doesn't know there is a compromised device on network. If there is one it will prevent it from logging keyboard presses and stealing the password

    Source: Adapted from community discussion — Rakeshch

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-301 practice, question 931. 1334 questions available.