200-301 practice questions 961–970

1. Question 961 · 1334 in bank

   A network engineer is asked to configure VLANS 2, 3, and 4 for a new implementation. Some ports must be assigned to the new VLANS with unused ports remaining. Which action should be taken for the unused ports?

   • Aconfigure in a nondefault native VLAN
   • Bconfigure ports in the native VLAN
   • Cconfigure ports in a black hole VLAN
   • Dconfigure ports as access ports

   Show answer

   Answer: C

   Explanation

   A black hole VLAN is a virtual LAN that is configured on a network switch, but it is not connected to any device or port. Traffic that is sent to a port in a black hole VLAN is discarded, effectively "sinking" into a "black hole." Black hole VLANs are sometimes used as a security measure to isolate or quarantine certain ports or devices, or to prevent unauthorized access or traffic on a network.

   Source: Adapted from community discussion — Phonon

   Next question

2. Question 962 · 1334 in bank

   When a WPA2-PSK WLAN is configured in the Wireless LAN Controller, what is the minimum number of characters that is required in ASCII format?

   • A6
   • B8
   • C12
   • D18

   Show answer

   Answer: B

   References

   • Cisco documentation

   Next question

3. Question 963 · 1334 in bank

   What mechanism carries multicast traffic between remote sites and supports encryption?

   • AISATAP
   • BIPsec over ISATAP
   • CGRE
   • DGRE over IPsec

   Show answer

   Answer: D

   Explanation

   CCNA security course Ipsec dosent support multicast, that is why GRE used with VPN, and as long as the GRE is not totally secure, the whole GRE. Encapsulation can be encapsulated in ipsec header so nlw we have both " mulitcast ability and security"

   Source: Adapted from community discussion — Raooff

   References

   • juniper.net documentation

   Next question

4. Question 964 · 1334 in bank

   

   Refer to the exhibit. An access-list is required to permit traffic from any host on interface Gi0/0 and deny traffic from interface Gi0/1. Which access list must be applied?

   • Aip access-list standard 99 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.0.255.255
   • Bip access-list standard 99 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.255.255.255
   • Cip access-list standard 199 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.255.255.255
   • Dip access-list standard 199 permit 10.100.100.0 0.0.0.255 deny 192.168.0.0 0.0.255.255

   Show answer

   Answer: A

   Explanation

   Standard ACLs: Standard ACLs are used to filter traffic based on the source IP address only. They are identified by numbers from 1 to 99 and 1300 to 1999. Extended ACLs: Extended ACLs allow filtering based on various criteria such as source and destination IP addresses, TCP/UDP ports, protocols, etc. They are identified by numbers from 100 to 199 and 2000 to 2699.

   Source: Adapted from community discussion — RODCCN

   Next question

5. Question 965 · 1334 in bank

   Select 2

   

   Refer to the exhibit. Which two commands must be configured on router R1 to enable the router to accept secure remote-access connections? (Choose two.)

   • Aip ssh pubkey-chain
   • Busername cisco password 0 cisco
   • Ccrypto key generate rsa
   • Dtransport input telnet
   • Elogin console

   Show answer

   Answer: AC

   Explanation

   The correct answers are: A. ip ssh pubkey-chain C. crypto key generate rsa These two commands are required to enable secure remote-access connections on router R1. Option A (ip ssh pubkey-chain) enables SSH connections using public key authentication, which is a more secure method compared to password-based authentication. Option C (crypto key generate rsa) generates an RSA key pair that is used for encryption and authentication purposes when establishing secure connections, such as SSH. The other options are not directly related to enabling secure remote-access connections: B. username cisco password 0 cisco - This command creates a local user account with the username "cisco" and a plaintext password. However, it does not enable secure remote-access connections. D. transport input telnet - This command allows telnet access to the router, but telnet is not a secure protocol. E. login console - This command enables console line authentication, but it is not specific to remote-access connections or providing security for them.

   Source: Adapted from community discussion — StingVN

   References

   • Cisco documentation

   Next question

6. Question 966 · 1334 in bank

   What is the primary function of a Layer 3 device?

   • Ato transmit wireless traffic between hosts
   • Bto analyze traffic and drop unauthorized traffic from the Internet
   • Cto forward traffic within the same broadcast domain
   • Dto pass traffic between different networks

   Show answer

   Answer: D

   Explanation

   You could be wrong answering A thinking about firewalls, but the primary function of layer 3 devices is precisely to forward traffic between networks.

   Source: Adapted from community discussion — Aie_7

   Next question

7. Question 967 · 1334 in bank

   Which service is missing when RADIUS is selected to provide management access to the WLC?

   • Aauthorization
   • Bauthentication
   • Caccounting
   • Dconfidentiality

   Show answer

   Answer: D

   Explanation

   Confidentiality means "the state of keeping or being kept secret or private". With RADIUS only the password is encrypted while the other information such as username, accounting information, etc are not encrypted. Encryption is "the process of converting information or data into a code, especially to prevent unauthorized access". So since RADIUS only encrypts the passwords, that means its the confidentiality is missing

   Source: Adapted from community discussion — martialstriker09

   Next question

8. Question 968 · 1334 in bank

   Which action implements physical access control as part of the security program of an organization?

   • Asetting up IP cameras to monitor key infrastructure
   • Bconfiguring a password for the console port
   • Cbacking up syslogs at a remote location
   • Dconfiguring enable passwords on network devices

   Show answer

   Answer: A

   Explanation

   A is the only answer that lists a 'Physical' measure to counter-act 'Physical' security vulnerabilities. Make all the passwords you want on all your console ports, but if someone who shouldn't have access gets to one your 'Physical' security has already failed.

   Source: Adapted from community discussion — highfivejohn

   References

   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 969 · 1334 in bank

   Which field within the access-request packet is encrypted by RADIUS?

   • Aauthorized services
   • Bpassword
   • Cauthenticator
   • Dusername

   Show answer

   Answer: B

   Explanation

   RADIUS by itself provides no encryption of all traffic. It protects only a small part of the traffic, notably the passwords.

   Source: Adapted from community discussion — iGlitch

   Next question

10. Question 970 · 1334 in bank

    A Cisco engineer is configuring a factory-default router with these three passwords: ✑ The user EXEC password for console access is p4ssw0rd1. ✑ The user EXEC password for Telnet access is s3cr3t2. ✑ The password for privileged EXEC mode is priv4t3p4ss. Which command sequence must the engineer configure?

    • Aenable secret priv4t3p4ss ! line con 0 password p4ssw0rd1 ! line vty 0 15 password s3cr3t2
    • Benable secret priv4t3p4ss ! line con 0 password p4ssw0rd1 login ! line vty 0 15 password s3cr3t2 login
    • Cenable secret priv4t3p4ss ! line con 0 password login p4ssw0rd1 ! line vty 0 15 password login s3cr3t2 login
    • Denable secret privilege 15 priv4t3p4ss ! line con 0 password p4ssw0rd1 login ! line vty 0 15 password s3cr3t2 login

    Show answer

    Answer: B

    Explanation

    The correct command sequence is: enable secret priv4t3p4ss line con 0 password p4ssw0rd1 login line vty 0 15 password s3cr3t2 login This will configure the password for privileged EXEC mode as "priv4t3p4ss", the user EXEC password for console access as "p4ssw0rd1", and the user EXEC password for Telnet access as "s3cr3t2". The "login" keyword is used to enable password authentication for the console and Telnet access.

    Source: Adapted from community discussion — Phonon

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-301 practice, question 961. 1334 questions available.