Cisco CCNA Security Chapter 2 Exam

Cisco CCNA Security, chapter 2 Exam.

Questions and answers 100% correct.

1.

Refer to the exhibit. What two pieces ofgenerated message? (Choose two.)

This message is a level five notification message.

This message appeared because a minor error occurred requiring further investigation.

This message appeared because a major error occurred requiring immediate action.

This message indicates that service timestamps have been globally enabled.

This message indicates that enhanced security was configured on the vty ports.

2. By default, how many seconds of delay between virtual login attempts is invoked

when the login block-for

one

two

three

four

five

3.

Refer to the exhibit. Routers R1 and R2 are connected via a serial link. One router is configured as the NTP master, and the other is an NTP client. Which two pieces of information can be obtained from the partial output of the detail command on R2?

Both routers are configured to use NTPv2.

Router R1 is the master, and R2 is the

Router R2 is the master, and R1 is the client.

The IP address of R1 is 192.168.1.2.


4. What are two characteristics of the SDM Security Audit wizard?

It uses interactive dialogs and prompts to implement AAA.


Questions and answers 100% correct.

Refer to the exhibit. What two pieces of information can be gathered from the (Choose two.)

This message is a level five notification message.

This message appeared because a minor error occurred requiring further

This message appeared because a major error occurred requiring immediate



By default, how many seconds of delay between virtual login attempts is invoked for command is configured?

Refer to the exhibit. Routers R1 and R2 are connected via a serial link. One router is configured as the NTP master, and the other is an NTP client. Which two pieces of

on can be obtained from the partial output of the show ntp associations command on R2? (Choose two.)

Both routers are configured to use NTPv2.





What are two characteristics of the SDM Security Audit wizard? (Choose two.)

It uses interactive dialogs and prompts to implement AAA.


information can be gathered from the

This message appeared because a minor error occurred requiring further

This message appeared because a major error occurred requiring immediate



By default, how many seconds of delay between virtual login attempts is invoked

Refer to the exhibit. Routers R1 and R2 are connected via a serial link. One router is configured as the NTP master, and the other is an NTP client. Which two pieces of

show ntp associations

(Choose two.)

It automatically enables Cisco IOS firewall and implements Cisco IOS IPS security configurations to secure the router.

It displays a screen with Fixsecurity-related configuration changes to implement.

It requires users to first identify which router interfaces connect to the inside network and which connect to the outside network.

It is initiated from CLI and executes a script in which the managment plane functions and forwarding plane services are tested against known vulnerabilities.

5. If AAA is already enabled, which three CLI steps are required to configure a router

with a specific view? (Choose three.)

assign a secret password to the view

assign commands to the view

assign users who can use the view

associate the view with the root view

create a superview using the

create a view using the 6.

Refer to the exhibit. Which statement regarding the JR

JR-Admin can issue show

JR-Admin can issue ping

JR-Admin can issue only

JR-Admin can issue debug

JR-Admin cannot issue any command because the privilege level does not match one of those defined.

7. Which recommended security practice prevents attackers from performing password

recovery on a Cisco IOS router for the purpose of gaining access to the privileged EXEC mode?

Keep a secure copy of the router Cisco IOS image and router configuration fas a backup.

Disable all unused ports and interfaces to reduce the number of ways that the router can be accessed.

Configure secure administrative control to ensure that only authorized personnel can access the router.

Locate the router in a secure locked room that is accessible only to authorized personnel.

Provision the router with the maximum amount of memory possible.

8. Which three options can be configured by Cisco AutoSecure?

It automatically enables Cisco IOS firewall and implements Cisco IOS IPS security configurations to secure the router.

It displays a screen with Fix-it check boxes to let you choose which related configuration changes to implement.

It requires users to first identify which router interfaces connect to the inside network and which connect to the outside network.


If AAA is already enabled, which three CLI steps are required to configure a router (Choose three.)

assign a secret password to the view

assign commands to the view

assign users who can use the view

associate the view with the root view

create a superview using the parser view view-name command

create a view using the parser viewview-name command

Refer to the exhibit. Which statement regarding the JR-Admin account is true?

show, ping, and reload commands.

ping and reload commands.

Admin can issue only ping commands.

debug and reload commands.

Admin cannot issue any command because the privilege level does not match

Which recommended security practice prevents attackers from performing password recovery on a Cisco IOS router for the purpose of gaining access to the privileged

Keep a secure copy of the router Cisco IOS image and router configuration f

Disable all unused ports and interfaces to reduce the number of ways that the router can be accessed.

Configure secure administrative control to ensure that only authorized personnel can access the router.

Locate the router in a secure locked room that is accessible only to authorized


Which three options can be configured by Cisco AutoSecure? (Choose three.)

It automatically enables Cisco IOS firewall and implements Cisco IOS IPS

it check boxes to let you choose which potential

It requires users to first identify which router interfaces connect to the inside


If AAA is already enabled, which three CLI steps are required to configure a router

Admin account is true?

Admin cannot issue any command because the privilege level does not match

Which recommended security practice prevents attackers from performing password recovery on a Cisco IOS router for the purpose of gaining access to the privileged

Keep a secure copy of the router Cisco IOS image and router configuration file

Disable all unused ports and interfaces to reduce the number of ways that the

Configure secure administrative control to ensure that only authorized

Locate the router in a secure locked room that is accessible only to authorized


(Choose three.)

CBAC

SNMP

syslog

security banner

interface IP address

enable secret password 9.

Refer to the exhibit. Based on the output of the which type of view is SUPPORT?

secret view, with a level 5 encrypted password

root view, with a level 5 encrypted secret password

superview, containing SHOWVIEW and VERI

CLI view, containing SHOWVIEW and VERIFYVIEW commands

10. Which three services on a router does Cisco SDM One

(Choose three.)

SNMP

TCP intercepts

SSH access to the router

Cisco Discovery Protocol

password encryption service

firewall on all outside interfaces 11. An administrator defined a local user account with a secret password on router R1

for use with SSH. Which three additional accept only encrypted SSH connections?

configure the IP domain name on the router

enable inbound vty Telnet sessions

generate the SSH keys

configure DNS on the router

enable inbound vty SSH sessions

generate two-way pre

12. Which statement describes the operation of the Cisco SDM Security Audit wizard?

The wizard configures a router to prevent unauthorized access.

The wizard compares a router configuration against recommended settings.

interface IP address

enable secret password

Refer to the exhibit. Based on the output of the show running-configwhich type of view is SUPPORT?

secret view, with a level 5 encrypted password

root view, with a level 5 encrypted secret password

superview, containing SHOWVIEW and VERIFYVIEW views


Which three services on a router does Cisco SDM One-Step Lockdown enable?

SSH access to the router

Cisco Discovery Protocol

password encryption service

firewall on all outside interfaces

An administrator defined a local user account with a secret password on router R1 for use with SSH. Which three additional steps are required to configure R1 to accept only encrypted SSH connections? (Choose three.)

configure the IP domain name on the router

enable inbound vty Telnet sessions

e SSH keys

configure DNS on the router

enable inbound vty SSH sessions

way pre-shared keys

Which statement describes the operation of the Cisco SDM Security Audit wizard?

The wizard configures a router to prevent unauthorized access.


config command,


Step Lockdown enable?

An administrator defined a local user account with a secret password on router R1 steps are required to configure R1 to

Which statement describes the operation of the Cisco SDM Security Audit wizard?


The wizard monitors network data and logs possible unauthorized or malicious traffic.

The wizard logs the effectiveness of network security measures for baseline comparisons.

13. An administrator needs to create a user account with custom access to most

privileged EXEC commands. Which custom account?

privilege exec level 0




14. Which three areas of router security must be maintained to secure an edge router at

the network perimeter?

physical security

flash security

operating system security

remote access security

router hardening

zone isolation

15. Which service is enabled on a Cisco router by default that can reveal significant

information about the router and potentially make it more vulnerable to attack?

HTTP

CDP

FTP

NTP

TFTP

16. Which two operations are required to implement Cisco SDM One

(Choose two.)

Choose the One-Step Lockdown feature.

Apply the documented network policies.

Deliver the configuration changes to the router.

Compare the router configuration against recommended settings.

Select the Firewall and

17. Which statement matches the CLI commands to the SDM wizard that performs

similar configuration functions?

aaa configuration commands and the SDM Basic Firewall wizard

auto secure privileged EXEC command and the SDM Onewizard

The wizard monitors network data and logs possible unauthorized or malicious

The wizard logs the effectiveness of network security measures for baseline

An administrator needs to create a user account with custom access to most privileged EXEC commands. Which privilege command is used to create this




exec level 15

Which three areas of router security must be maintained to secure an edge router at the network perimeter? (Choose three.)

operating system security

remote access security

Which service is enabled on a Cisco router by default that can reveal significant information about the router and potentially make it more vulnerable to attack?

Which two operations are required to implement Cisco SDM One-Step Lockdown?

Step Lockdown feature.

Apply the documented network policies.

Deliver the configuration changes to the router.


Select the Firewall and ACL task on the SDM Configuration screen.

Which statement matches the CLI commands to the SDM wizard that performs similar configuration functions?

configuration commands and the SDM Basic Firewall wizard

privileged EXEC command and the SDM One-Step Lockdown

The wizard monitors network data and logs possible unauthorized or malicious

The wizard logs the effectiveness of network security measures for baseline

An administrator needs to create a user account with custom access to most command is used to create this

Which three areas of router security must be maintained to secure an edge router at

Which service is enabled on a Cisco router by default that can reveal significant information about the router and potentially make it more vulnerable to attack?

Step Lockdown?


ACL task on the SDM Configuration screen.

Which statement matches the CLI commands to the SDM wizard that performs

configuration commands and the SDM Basic Firewall wizard

Step Lockdown

class-maps, policy-SDM IPS wizard

setup privileged EXEC command and the SDM Security Audit wizard

18.

Refer to the exhibit. What is the significance of secret 5 in the generated output?

The ADMIN password is encrypted using DH group 5.

The ADMIN password is encrypted via the command.

The ADMIN password is hashed using MD5.

The ADMIN password is hashed using SHA.

19. Which three commands are required to restore a primary bootset from a secure

archive on a router on which Cisco IOS resilience is enabled?

Restart the router in ROM monitor mode and display the secure bootset Cisco IOS image name using the

Restart the router, enter privileged EXEC mode, and display the secure bootset Cisco IOS image name using the

Boot the secure bootset Cisco IOS image using the filename.

Copy the secure bootset Cisco IOS image to flash using the image flash command.

Restore the secure configuration file using the command.

Restore the secure configuration file using the filename command.

20. Which set of commands are required to create a username of admin, hash the

password using MD5, and force the router to access the internal username database when a user attempts to access the console?

R1(config)# username admin password Admin01pa55R1(config)# line con 0R1(config-line)#

R1(config)# username admin password Admin01pa55R1(config)# line con 0R1(config-line)#

R1(config)# username admin Admin01pa55 encr md5R1(config)# line con 0R1(config-line)#

R1(config)# username admin secret Admin01pa55R1(config)# line con 0R1(config-line)#

R1(config)# username admin secret Admin01pa55

-maps, and service-policy configuration commands and the

privileged EXEC command and the SDM Security Audit wizard


The ADMIN password is encrypted using DH group 5.

The ADMIN password is encrypted via the service password-encryption

The ADMIN password is hashed using MD5.

The ADMIN password is hashed using SHA.

Which three commands are required to restore a primary bootset from a secure archive on a router on which Cisco IOS resilience is enabled? (Choose three.)

Restart the router in ROM monitor mode and display the secure bootset Cisco IOS image name using the dir command.

Restart the router, enter privileged EXEC mode, and display the secure bootset Cisco IOS image name using the show flash command.

Boot the secure bootset Cisco IOS image using the boot command with the

Copy the secure bootset Cisco IOS image to flash using the copy IOScommand.

Restore the secure configuration file using the copy config-backup flash

Restore the secure configuration file using the secure boot-config restorecommand.

Which set of commands are required to create a username of admin, hash the password using MD5, and force the router to access the internal username database when a user attempts to access the console?

username admin password Admin01pa55 line con 0

line)# login local username admin password Admin01pa55 line con 0

line)# login internal username admin Admin01pa55 encr md5 line con 0

line)# login local username admin secret Admin01pa55 line con 0

line)# login local username admin secret Admin01pa55

configuration commands and the

privileged EXEC command and the SDM Security Audit wizard


encryption

Which three commands are required to restore a primary bootset from a secure (Choose three.)

Restart the router in ROM monitor mode and display the secure bootset Cisco

Restart the router, enter privileged EXEC mode, and display the secure bootset

command with the

copy IOS-backup-

backup flash

config restore

Which set of commands are required to create a username of admin, hash the password using MD5, and force the router to access the internal username database

R1(config)# line con 0R1(config-line)#

21.

Refer to the exhibit. Which two statements describe the current SDM logging setup? (Choose two.)

Buffered logging will be enabled on the router for Logging Level 7 messages.

Buffered logging will be enabled on the syslog server for Logging Levmessages.

All messages with a trap level of 4 and higher (less critical) will be logged.

All messages with a trap level of 4 and

The router interface IP address that is connected to the syslog server is 192.168.1.3.

The syslog server IP address is 192.168 22. What are two characteristics of SNMP community strings?

A vulnerability of SNMPv1, SNMPv2, and SNMPv3 is that they send the community strings in plaintext.

Commonly known community strings should be used when configuring secure SNMP.

If the manager sends one of the correct readinformation and set information in an agent.

SNMP read-only community strings can be used to get information from an SNMP-enabled device.

SNMP read-write community strings can be used to set information on an SNMP-enabled device.

23. What is the minimum recommended modulus key length for keys generated to use

line con 0 line)# login internal

Refer to the exhibit. Which two statements describe the current SDM logging setup?


Buffered logging will be enabled on the syslog server for Logging Lev


All messages with a trap level of 4 and lower (more critical) will be logged.

The router interface IP address that is connected to the syslog server is

The syslog server IP address is 192.168.1.3.

What are two characteristics of SNMP community strings? (Choose two.)

A vulnerability of SNMPv1, SNMPv2, and SNMPv3 is that they send the community strings in plaintext.

Commonly known community strings should be used when configuring secure

If the manager sends one of the correct read-only community strings, it can get information and set information in an agent.

only community strings can be used to get information from an enabled device.

write community strings can be used to set information on an enabled device.

What is the minimum recommended modulus key length for keys generated to use

Refer to the exhibit. Which two statements describe the current SDM logging setup?


Buffered logging will be enabled on the syslog server for Logging Level 7


lower (more critical) will be logged.

The router interface IP address that is connected to the syslog server is

(Choose two.)

A vulnerability of SNMPv1, SNMPv2, and SNMPv3 is that they send the

Commonly known community strings should be used when configuring secure

only community strings, it can get

only community strings can be used to get information from an

write community strings can be used to set information on an

What is the minimum recommended modulus key length for keys generated to use

with SSH?

256

512

768

1024

2048

24. Which two characteristics apply to Role

two.)

CLI views have passwords, but superviews do not have passwords.

Users logged in to a superview can access all commands specified within the associated CLI views.

A single superview can be shared among multiple CLI views.

Commands cannot be configured for a specific superview.

Deleting a superview deletes all associated CLI views.

25.

Refer to the exhibit. What two facts can be determined from the output? two.)

The Cisco IOS image and configuration files have been properly secured.

ROMmon mode will be inaccessible upon entering the privileged EXEC command.

The Cisco IOS Resilient Configuration f

The Cisco IOS Resilient Configuration feature has detected an image version mismatch.

The Cisco IOS configuration files have been erased.

26. What are three requirements that must be met if an

device configurations via secure in

network devices configured to accommodate SSH

a separate network segment connecting all management devices

at least one router acting as a terminal server

encryption of all remote access management traffic

connection to network devices through a production network or the Internet

direct access to the console ports of all network devices

Which two characteristics apply to Role-Based CLI Access superviews?


Users logged in to a superview can access all commands specified within the associated CLI views.

A single superview can be shared among multiple CLI views.

Commands cannot be configured for a specific superview.

Deleting a superview deletes all associated CLI views.

Refer to the exhibit. What two facts can be determined from the output?

IOS image and configuration files have been properly secured.

ROMmon mode will be inaccessible upon entering the privileged EXEC

The Cisco IOS Resilient Configuration feature is enabled.

The Cisco IOS Resilient Configuration feature has detected an image version

The Cisco IOS configuration files have been erased.

What are three requirements that must be met if an administrator wants to maintain device configurations via secure in-band management? (Choose three.)

network devices configured to accommodate SSH


at least one router acting as a terminal server

encryption of all remote access management traffic


direct access to the console ports of all network devices

Based CLI Access superviews? (Choose


Users logged in to a superview can access all commands specified within the

Refer to the exhibit. What two facts can be determined from the output? (Choose

IOS image and configuration files have been properly secured.

ROMmon mode will be inaccessible upon entering the privileged EXEC reload

The Cisco IOS Resilient Configuration feature has detected an image version

administrator wants to maintain (Choose three.)



Documents

Cisco CCNA Security Chapter 2 Exam