Security Fundamentals
Free Cisco Certified Network Associate (CCNA) practice — 6 questions on Security Fundamentals, with explanations. No sign-up. Full 12-question mixed test →
A company wants to prevent rogue DHCP servers from handing out addresses on the access layer and also prevent attackers from poisoning the ARP cache of hosts in the same VLAN. Which combination of switch features and trust configuration correctly addresses both requirements?
DHCP snooping builds a binding table of legitimate IP-to-MAC-to-port mappings by trusting only the uplink toward the real DHCP server. Dynamic ARP Inspection then uses that same binding table to validate ARP replies on untrusted (access) ports, blocking both rogue DHCP offers and spoofed ARP traffic.
A switch port is configured with 'switchport port-security maximum 1', 'switchport port-security violation restrict', and 'switchport port-security mac-address sticky'. The port learns MAC AAAA.AAAA.AAAA from the first connected PC. Later, a different device with a new MAC address is connected to the same port while the original device is still active. What happens?
The 'restrict' violation mode drops traffic from any MAC address that exceeds the configured maximum, increments the violation counter, and generates a syslog/SNMP message, but it does not disable the interface — the port stays operational for the already-learned address.
A network admin needs junior engineers to be limited to 'show' commands on routers while senior engineers retain full 'configure terminal' access, along with detailed per-command accounting logs for auditing. Which Cisco AAA protocol choice best meets this requirement?
TACACS+ separates the AAA functions and encrypts the entire packet body, and critically it supports per-command authorization — allowing granular control such as permitting 'show' commands to one group while restricting 'configure terminal' to another, with full command-level accounting.
A company needs to block only host 10.10.20.55 from reaching the web server 172.16.5.10 on any protocol/port, while allowing that host and all other hosts to reach every other destination normally. Which ACL configuration and placement correctly achieves this?
An extended numbered ACL can match both source and destination for any protocol. Using 'host' notation on both source and destination precisely targets only 10.10.20.55 talking to 172.16.5.10, and a trailing permit ip any any preserves all other traffic. Extended ACLs should be applied inbound as close to the source as possible for efficiency.
Which statement accurately differentiates WPA2-Personal from WPA3-Personal?
WPA3-Personal replaces the WPA2 4-way handshake with SAE (Simultaneous Authentication of Equals, based on Dragonfly key exchange), which provides forward secrecy and resists offline dictionary/brute-force attacks against captured handshake traffic — a well-known weakness of WPA2-PSK's 4-way handshake.
A company connects two branch offices over the internet and needs all inter-site traffic encrypted while also allowing OSPF to form a dynamic routing adjacency between the two branch routers. Which solution meets both requirements?
GRE supports multicast and broadcast traffic, which OSPF requires to form adjacencies (multicast to 224.0.0.5/224.0.0.6). Wrapping the GRE tunnel inside IPsec (GRE over IPsec) provides the needed encryption while still allowing OSPF to run over the GRE interface, satisfying both the security and dynamic-routing requirements.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →