CCNA3 v7 – ENSA – Modules 3 – 5: Network Security Exam Answers

CCNA3 v7 – ENSA – Modules 3 – 5: Network Security Exam Answers Full 100% 2020

  1. Which statement accurately characterizes the evolution of threats to network security?

    • Internal threats can cause even greater damage than external threats.
    • Internet architects planned for network security from the beginning.
    • Early Internet users often engaged in activities that would harm other users.
    • Threats have become less sophisticated while the technical knowledge needed by an attacker has grown.
      Answers Explanation & Hints:

      Internal threats can be intentional or accidental and cause greater damage than external threats because the internal user has direct access to the internal corporate network and corporate data.

  2. What commonly motivates cybercriminals to attack networks as compared to hacktivists or state-sponsored hackers?

    • fame seeking
    • financial gain
    • political reasons
    • status among peers
      Answers Explanation & Hints:

      Cybercriminals are commonly motivated by money. Hackers are known to hack for status. Cyberterrorists are motivated to commit cybercrimes for religious or political reasons.

  3. Which type of hacker is motivated to protest against political and social issues?

    • script kiddie
    • hacktivist
    • vulnerability broker
    • cybercriminal
      Answers Explanation & Hints:

      Hackers are categorized by motivating factors. Hacktivists are motivated by protesting political and social issues.

  4. What is the best description of Trojan horse malware?

    • It is the most easily detected form of malware.
    • It is malware that can only be distributed over the Internet.
    • It is software that causes annoying but not fatal computer problems.
    • It appears as useful software but hides malicious code.
      Answers Explanation & Hints:

      The best description of Trojan horse malware, and what distinguishes it from viruses and worms, is that it appears as useful software but hides malicious code. Trojan horse malware may cause annoying computer problems, but can also cause fatal problems. Some Trojan horses may be distributed over the Internet, but they can also be distributed by USB memory sticks and other means. Specifically targeted Trojan horse malware can be some of the most difficult malware to detect.

  5. A user receives a phone call from a person who claims to represent IT services and then asks that user for confirmation of username and password for auditing purposes. Which security threat does this phone call represent?

    • DDoS
    • spam
    • social engineering
    • anonymous keylogging
      Answers Explanation & Hints:

      Social engineering attempts to gain the confidence of an employee and convince that person to divulge confidential and sensitive information, such as usernames and passwords. DDoS attacks, spam, and keylogging are all examples of software based security threats, not social engineering.

  6. What is a ping sweep?

    • a network scanning technique that indicates the live hosts in a range of IP addresses.
    • a software application that enables the capture of all network packets that are sent across a LAN.
    • a scanning technique that examines a range of TCP or UDP port numbers on a host to detect listening services.
    • a query and response protocol that identifies information about a domain, including the addresses that are assigned to that domain.
      Answers Explanation & Hints:

      A ping sweep is a tool that is used during a reconnaissance attack. Other tools that might be used during this type of attack include a ping sweep, port scan, or Internet information query. A reconnaissance attack is used to gather information about a particular network, usually in preparation for another type of network attack.

  7. In what way are zombies used in security attacks?

    • They are maliciously formed code segments used to replace legitimate applications.
    • They target specific individuals to gain corporate or personal information.
    • They are infected machines that carry out a DDoS attack.
    • They probe a group of machines for open ports to learn which services are running.
      Answers Explanation & Hints:

      Zombies are infected computers that make up a botnet. The zombies are used to deploy a distributed denial of service (DDoS) attack.

  8. In what type of attack is a cybercriminal attempting to prevent legitimate users from accessing network services?

    • DoS
    • MITM
    • session hijacking
    • address spoofing
      Answers Explanation & Hints:

      In a DoS or denial-of-service attack, the goal of the attacker is to prevent legitimate users from accessing network services.

  9. Which attack involves threat actors positioning themselves between a source and destination with the intent of transparently monitoring, capturing, and controlling the communication?

    • DoS attack
    • ICMP attack
    • SYN flood attack
    • man-in-the-middle attack
      Answers Explanation & Hints:

      The man-in-the-middle attack is a common IP-related attack where threat actors position themselves between a source and destination to transparently monitor, capture, and control the communication.

  10. In which type of attack is falsified information used to redirect users to malicious Internet sites?

    • DNS cache poisoning
    • ARP cache poisoning
    • DNS amplification and reflection
    • domain generation
      Answers Explanation & Hints:

      In a DNS cache poisoning attack, falsified information is used to redirect users from legitimate to malicious internet sites.

  11. What is a feature of an IPS?

    • It can stop malicious packets.
    • It has no impact on latency.
    • It is deployed in offline mode.
    • It is primarily focused on identifying possible incidents.
      Answers Explanation & Hints:

      An advantage of an intrusion prevention systems (IPS) is that it can identify and stop malicious packets. However, because an IPS is deployed inline, it can add latency to the network.

  12. Which requirement of secure communications is ensured by the implementation of MD5 or SHA hash generating algorithms?​

    • confidentiality
    • authentication
    • integrity
    • nonrepudiation
      Answers Explanation & Hints:

      Integrity is ensured by implementing either MD5 or SHA hash generating algorithms. Many modern networks ensure authentication with protocols, such as HMAC. Data confidentiality is ensured through symmetric encryption algorithms, including DES, 3DES, and AES. Data confidentiality can also be ensured using asymmetric algorithms, including RSA and PKI.​

  13. If an asymmetric algorithm uses a public key to encrypt data, what is used to decrypt it?

    • DH
    • a private key
    • a digital certificate
    • a different public key
      Answers Explanation & Hints:

      When an asymmetric algorithm is used, public and private keys are used for the encryption. Either key can be used for encryption, but the complementary matched key must be used for the decryption. For example if the public key is used for encryption, then the private key must be used for the decryption.

  14. What wild card mask will match networks 172.16.0.0 through 172.19.0.0?

    • 0.0.3.255
    • 0.0.255.255
    • 0.252.255.255
    • 0.3.255.255
      Answers Explanation & Hints:

      The subnets 172.16.0.0 through 172.19.0.0 all share the same 14 high level bits. A wildcard mask in binary that matches 14 high order bits is 00000000.00000011.11111111.11111111. In dotted decimal this wild card mask is 0.3.255.255.

  15. Which two keywords can be used in an access control list to replace a wildcard mask or address and wildcard mask pair? (Choose two.)

    • most
    • host
    • all
    • any
    • some
    • gt
      Answers Explanation & Hints:

      The host keyword is used when using a specific device IP address in an ACL. For example, the deny host 192.168.5.5 command is the same is the deny 192.168.5.5 0.0.0.0 command. The any keyword is used to allow any mask through that meets the criteria. For example, the permit any command is the same as permit 0.0.0.0 255.255.255.255 command.

  16. Refer to the exhibit. Which two ACLs would permit only the two LAN networks attached to R1 to access the network that connects to R2 G0/1 interface? (Choose two.)

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 12

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 12

    • access-list 1 permit 192.168.10.0 0.0.0.127
    • access-list 2 permit host 192.168.10.9
      access-list 2 permit host 192.168.10.69
    • access-list 3 permit 192.168.10.128 0.0.0.63
    • access-list 4 permit 192.168.10.0 0.0.0.255
    • access-list 5 permit 192.168.10.0 0.0.0.63
      access-list 5 permit 192.168.10.64 0.0.0.63

      Answers Explanation & Hints:

      The permit 192.168.10.0 0.0.0.127 command ignores bit positions 1 through 7, which means that addresses 192.168.10.0 through 192.168.10.127 are allowed through. The two ACEs of permit 192.168.10.0 0.0.0.63 and permit 192.168.10.64 0.0.0.63 allow the same address range through the router.

  17. Which two packet filters could a network administrator use on an IPv4 extended ACL? (Choose two.)

    • destination MAC address
    • ICMP message type
    • computer type
    • source TCP hello address
    • destination UDP port number
      Answers Explanation & Hints:

      Extended access lists commonly filter on source and destination IPv4 addresses and TCP or UDP port numbers. Additional filtering can be provided for protocol types.

  18. Refer to the exhibit. The student on the H1 computer continues to launch an extended ping with expanded packets at the student on the H2 computer. The school network administrator wants to stop this behavior, but still allow both students access to web-based computer assignments. What would be the best plan for the network administrator?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 07

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 07

    • Apply an outbound extended ACL on R1 S0/0/1.
    • Apply an outbound standard ACL on R2 S0/0/1.
    • Apply an inbound standard ACL on R1 Gi0/0.
    • Apply an inbound extended ACL on R2 Gi0/1.
    • Apply an inbound extended ACL on R1 Gi0/0.
      Answers Explanation & Hints:

      This access list must be an extended ACL in order to filter on specific source and destination host addresses. Commonly, the best place for an extended ACL is closest to the source, which is H1. Traffic from H1 travels into the switch, then out of the switch into the R1 Gi0/0 interface. This Gi0/0 interface would be the best location for this type of extended ACL. The ACL would be applied on the inbound interface since the packets from H1 would be coming into the R1 router.

  19. Which statement describes a difference between the operation of inbound and outbound ACLs?

    • In contrast to outbound ALCs, inbound ACLs can be used to filter packets with multiple criteria.
    • Inbound ACLs can be used in both routers and switches but outbound ACLs can be used only on routers.
    • Inbound ACLs are processed before the packets are routed while outbound ACLs are processed after the routing is completed.
    • On a network interface, more than one inbound ACL can be configured but only one outbound ACL can be configured.
      Answers Explanation & Hints:

      With an inbound ACL, incoming packets are processed before they are routed. With an outbound ACL, packets are first routed to the outbound interface, then they are processed. Thus processing inbound is more efficient from the router perspective. The structure, filtering methods, and limitations (on an interface, only one inbound and one outbound ACL can be configured) are the same for both types of ACLs.

  20. What type of ACL offers greater flexibility and control over network access?

    • flexible
    • named standard
    • extended
    • numbered standard
      Answers Explanation & Hints:

      The two types of ACLs are standard and extended. Both types can be named or numbered, but extended ACLs offer greater flexibility.

  21. What is the quickest way to remove a single ACE from a named ACL?

    • Use the no keyword and the sequence number of the ACE to be removed.
    • Use the no access-list command to remove the entire ACL, then recreate it without the ACE.
    • Copy the ACL into a text editor, remove the ACE, then copy the ACL back into the router.
    • Create a new ACL with a different number and apply the new ACL to the router interface.
      Answers Explanation & Hints:

      Named ACL ACEs can be removed using the no command followed by the sequence number.

  22. Refer to the exhibit. A network administrator is configuring a standard IPv4 ACL. What is the effect after the command no access-list 10 is entered?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 02

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 02

    • ACL 10 is disabled on Fa0/1.
    • ACL 10 is removed from the running configuration.
    • ACL 10 will be disabled and removed after R1 restarts.
    • ACL 10 is removed from both the running configuration and the interface Fa0/1.
      Answers Explanation & Hints:

      The R1(config)# no access-list < access-list number > command removes the ACL from the running-config immediately. However, to disable an ACL on an interface, the command R1(config-if)# no ip access-group should be entered.

  23. Refer to the exhibit. A network administrator has configured ACL 9 as shown. Users on the 172.31.1.0 /24 network cannot forward traffic through router CiscoVille. What is the most likely cause of the traffic failure?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 05

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 05

    • The permit statement specifies an incorrect wildcard mask.
    • The sequence of the ACEs is incorrect.
    • The established keyword is not specified.
    • The port number for the traffic has not been identified with the eq keyword.
      Answers Explanation & Hints:

      When verifying an ACL, the statements are always listed in a sequential order. Even though there is an explicit permit for the traffic that is sourced from network 172.31.1.0 /24, it is being denied due to the previously implemented ACE of CiscoVille(config)# access-list 9 deny 172.31.0.0 0.0.255.255 . The sequence of the ACEs must be modified to permit the specific traffic that is sourced from network 172.31.1.0 /24 and then to deny 172.31.0.0 /16.

  24. A network administrator needs to configure a standard ACL so that only the workstation of the administrator with the IP address 192.168.15.23 can access the virtual terminal of the main router. Which two configuration commands can achieve the task? (Choose two.)

    • Router1(config)# access-list 10 permit host 192.168.15.23
    • Router1(config)# access-list 10 permit 192.168.15.23 0.0.0.0
    • Router1(config)# access-list 10 permit 192.168.15.23 0.0.0.255
    • Router1(config)# access-list 10 permit 192.168.15.23 255.255.255.0
    • Router1(config)# access-list 10 permit 192.168.15.23 255.255.255.255
      Answers Explanation & Hints:

      To permit or deny one specific IP address, either the wildcard mask 0.0.0.0 (used after the IP address) or the wildcard mask keyword host (used before the IP address) can be used.

  25. Refer to the exhibit. Which command would be used in a standard ACL to allow only devices on the network attached to R2 G0/0 interface to access the networks attached to R1?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 13

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 13

    • access-list 1 permit 192.168.10.0 0.0.0.63
    • access-list 1 permit 192.168.10.96 0.0.0.31
    • access-list 1 permit 192.168.10.0 0.0.0.255
    • access-list 1 permit 192.168.10.128 0.0.0.63
      Answers Explanation & Hints:

      Standard access lists only filter on the source IP address. In the design, the packets would be coming from the 192.168.10.96/27 network (the R2 G0/0 network). The correct ACL is access-list 1 permit 192.168.10.96 0.0.0.31 .

  26. A network administrator is writing a standard ACL that will deny any traffic from the 172.16.0.0/16 network, but permit all other traffic. Which two commands should be used? (Choose two.)

    • Router(config)# access-list 95 deny any
    • Router(config)# access-list 95 deny 172.16.0.0 0.0.255.255
    • Router(config)# access-list 95 deny 172.16.0.0 255.255.0.0
    • Router(config)# access-list 95 permit any
    • Router(config)# access-list 95 host 172.16.0.0
    • Router(config)# access-list 95 172.16.0.0 255.255.255.255
      Answers Explanation & Hints:

      To deny traffic from the 172.16.0.0/16 network, the access-list 95 deny 172.16.0.0 0.0.255.255 command is used. To permit all other traffic, the access-list 95 permit any statement is added.

  27. Refer to the exhibit. An ACL was configured on R1 with the intention of denying traffic from subnet 172.16.4.0/24 into subnet 172.16.3.0/24. All other traffic into subnet 172.16.3.0/24 should be permitted. This standard ACL was then applied outbound on interface Fa0/0. Which conclusion can be drawn from this configuration?​

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 15

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 15

    • Only traffic from the 172.16.4.0/24 subnet is blocked, and all other traffic is allowed.​
    • An extended ACL must be used in this situation.
    • The ACL should be applied to the FastEthernet 0/0 interface of R1 inbound to accomplish the requirements.
    • All traffic will be blocked, not just traffic from the 172.16.4.0/24 subnet.
    • The ACL should be applied outbound on all interfaces of R1.
      Answers Explanation & Hints:

      Because of the implicit deny at the end of all ACLs, the access-list 1 permit any command must be included to ensure that only traffic from the 172.16.4.0/24 subnet is blocked and that all other traffic is allowed.​

  28. Refer to the exhibit. A network administrator needs to add an ACE to the TRAFFIC-CONTROL ACL that will deny IP traffic from the subnet 172.23.16.0/20. Which ACE will meet this requirement?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 14

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 14

    • 15 deny 172.23.16.0 0.0.15.255
    • 5 deny 172.23.16.0 0.0.15.255
    • 30 deny 172.23.16.0 0.0.15.255
    • 5 deny 172.23.16.0 0.0.255.255
      Answers Explanation & Hints:

      The only filtering criteria specified for a standard access list is the source IPv4 address. The wild card mask is written to identify what parts of the address to match, with a 0 bit, and what parts of the address should be ignored, which a 1 bit. The router will parse the ACE entries from lowest sequence number to highest. If an ACE must be added to an existing access list, the sequence number should be specified so that the ACE is in the correct place during the ACL evaluation process.

  29. Refer to the exhibit. A network administrator configures an ACL on the router. Which statement describes the result of the configuration?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 04

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 04

    • An SSH connection is allowed from a workstation with IP 172.16.45.16 to a device with IP 192.168.25.18.
    • An SSH connection is allowed from a workstation with IP 192.168.25.18 to a device with IP 172.16.45.16.
    • A Telnet connection is allowed from a workstation with IP 172.16.45.16 to a device with IP 192.168.25.18.
    • A Telnet connection is allowed from a workstation with IP 192.168.25.18 to a device with IP 172.16.45.16.
      Answers Explanation & Hints:

      In an extended ACL, the first address is the source IP address and the second one is the destination IP address. TCP port number 22 is a well-known port number reserved for SSH connections. Telnet connections use TCP port number 23.

  30. What effect would the Router1(config-ext-nacl)# permit tcp 172.16.4.0 0.0.0.255 any eq www command have when implemented inbound on the f0/0 interface?

    • All TCP traffic is permitted, and all other traffic is denied.
    • The command is rejected by the router because it is incomplete.
    • All traffic from 172.16.4.0/24 is permitted anywhere on any port.
    • Traffic originating from 172.16.4.0/24 is permitted to all TCP port 80 destinations.
  31. Refer to the exhibit. What can be determined from this output?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 03

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 03

    • The ACL is missing the deny ip any any ACE.
    • Because there are no matches for line 10, the ACL is not working.
    • The ACL is only monitoring traffic destined for 10.23.77.101 from three specific hosts.
    • The router has not had any Telnet packets from 10.35.80.22 that are destined for 10.23.77.101.
      Answers Explanation & Hints:

      ACL entry 10 in MyACL matches any Telnet packets between host 10.35.80.22 and 10.23.77.101. No matches have occurred on this ACE as evidenced by the lack of a “(xxx matches)” ACE. The deny ip any any ACE is not required because there is an implicit deny ACE added to every access control list. When no matches exist for an ACL, it only means that no traffic has matched the conditions that exist for that particular line. The ACL is monitoring traffic that matches three specific hosts going to very specific destination devices. All other traffic is not permitted by the implicit deny ip any any ACE.

  32. What does the CLI prompt change to after entering the command ip access-list standard aaa from global configuration mode?

    • Router(config)#
    • Router(config-if)#
    • Router(config-router)#
    • Router(config-std-nacl)#
    • Router(config-line)#
  33. Refer to the exhibit. A network administrator wants to permit only host 192.168.1.1 /24 to be able to access the server 192.168.2.1 /24. Which three commands will achieve this using best ACL placement practices? (Choose three.)

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 08

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 08

    • R2(config)# access-list 101 permit ip host 192.168.1.1 host 192.168.2.1
    • R2(config)# access-list 101 permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    • R2(config)# interface fastethernet 0/0
    • R2(config-if)# ip access-group 101 out
    • R2(config)# access-list 101 permit ip any any
    • R2(config)# interface fastethernet 0/1
    • R2(config-if)# ip access-group 101 in
      Answers Explanation & Hints:

      An extended ACL is placed as close to the source of the traffic as possible. In this case.it is placed in an inbound direction on interface fa0/0 on R2 for traffic entering the router from host with the IP address192.168.1.1 bound for the server with the IP address192.168.2.1.

  34. Which ACE will permit a packet that originates from any network and is destined for a web server at 192.168.1.1?

    • access-list 101 permit tcp host 192.168.1.1 any eq 80
    • access-list 101 permit tcp host 192.168.1.1 eq 80 any
    • access-list 101 permit tcp any eq 80 host 192.168.1.1
    • access-list 101 permit tcp any host 192.168.1.1 eq 80
  35. Refer to the exhibit. A new network policy requires an ACL denying FTP and Telnet access to a Corp file server from all interns. The address of the file server is 172.16.1.15 and all interns are assigned addresses in the 172.18.200.0/24 network. After implementing the ACL, no one in the Corp network can access any of the servers. What is the problem?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 11

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 11

    • Inbound ACLs must be routed before they are processed.
    • The ACL is implicitly denying access to all the servers.
    • Named ACLs require the use of port numbers.
    • The ACL is applied to the interface using the wrong direction.
      Answers Explanation & Hints:

      Both named and numbered ACLs have an implicit deny ACE at the end of the list. This implicit deny blocks all traffic.

  36. Refer to the exhibit. The named ACL “Managers” already exists on the router. What will happen when the network administrator issues the commands that are shown in the exhibit?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 01

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 01

    • The commands overwrite the existing Managers ACL.
    • The commands are added at the end of the existing Managers ACL.
    • The commands are added at the beginning of the existing Managers ACL.
    • The network administrator receives an error that states that the ACL already exists.
  37. Consider the following access list.access-list 100 permit ip host 192.168.10.1 any

    access-list 100 deny icmp 192.168.10.0 0.0.0.255 any echo
    access-list 100 permit ip any any

    Which two actions are taken if the access list is placed inbound on a router Gigabit Ethernet port that has the IP address 192.168.10.254 assigned? (Choose two.)

    • A Telnet or SSH session is allowed from any device on the 192.168.10.0 into the router with this access list assigned.
    • Devices on the 192.168.10.0/24 network are allowed to reply to any ping requests.
    • Only Layer 3 connections are allowed to be made from the router to any other network device.
    • Only the network device assigned the IP address 192.168.10.1 is allowed to access the router.
    • Devices on the 192.168.10.0/24 network can sucessfully ping devices on the 192.168.11.0 network.
      Answers Explanation & Hints:

      The first ACE allows the 192.168.10.1 device to do any TCP/IP-based transactions with any other destination. The second ACE stops devices on the 192.168.10.0/24 network from issuing any pings to any other location. Everything else is permitted by the third ACE. Therefore, a Telnet/SSH session or ping reply is allowed from a device on the 192.168.10.0/24 network.

  38. In which TCP attack is the cybercriminal attempting to overwhelm a target host with half-open TCP connections?

    • reset attack
    • port scan attack
    • SYN flood attack
    • session hijacking attack
      Answers Explanation & Hints:

      In a TCP SYN flood attack, the attacker sends to the target host a continuous flood of TCP SYN session requests with a spoofed source IP address. The target host responds with a TCP-SYN-ACK to each of the SYN session requests and waits for a TCP ACK that will never arrive. Eventually the target is overwhelmed with half-open TCP connections.

  39. Which protocol is attacked when a cybercriminal provides an invalid gateway in order to create a man-in-the-middle attack?

    • DNS
    • ICMP
    • HTTP or HTTPS
    • DHCP
      Answers Explanation & Hints:

      A cybercriminal could set up a rogue DHCP server that provides one or more of the following:Wrong default gateway that is used to create a man-in-the-middle attack and allow the attacker to intercept data
      Wrong DNS server that results in the user being sent to a malicious website
      Invalid default gateway IP address that results in a denial of service attack on the DHCP client

  40. Refer to the exhibit. An administrator has configured a standard ACL on R1 and applied it to interface serial 0/0/0 in the outbound direction. What happens to traffic leaving interface serial 0/0/0 that does not match the configured ACL statements?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 09

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 09

    • The resulting action is determined by the destination IP address.
    • The resulting action is determined by the destination IP address and port number.
    • The source IP address is checked and, if a match is not found, traffic is routed out interface serial 0/0/1.
    • The traffic is dropped.
      Answers Explanation & Hints:

      Any traffic that does not match one of the statements in an ACL has the implicit deny applied to it, which means the traffic is dropped.

  41. Refer to the exhibit. The Gigabit interfaces on both routers have been configured with subinterface numbers that match the VLAN numbers connected to them. PCs on VLAN 10 should be able to print to the P1 printer on VLAN 12. PCs on VLAN 20 should print to the printers on VLAN 22. What interface and in what direction should you place a standard ACL that allows printing to P1 from data VLAN 10, but stops the PCs on VLAN 20 from using the P1 printer? (Choose two.)

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 06

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 06

    • R1 Gi0/1.12
    • R1 S0/0/0
    • R2 S0/0/1
    • R2 Gi0/1.20
    • inbound
    • outbound
      Answers Explanation & Hints:

      A standard access list is commonly placed as close to the destination network as possible because access control expressions in a standard ACL do not include information about the destination network.
      The destination in this example is printer VLAN 12 which has router R1 Gigabit subinterface 0/1/.12 as its gateway. A sample standard ACL that only allows printing from data VLAN 10 (192.168.10.0/24), for example, and no other VLAN would be as follows:
      R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255
      R1(config)# access-list 1 deny any
      R1(config)# interface gigabitethernet 0/1.12
      R1(config-if)# ip access-group 1 out

  42. Which statement describes a characteristic of standard IPv4 ACLs?

    • They are configured in the interface configuration mode.
    • They filter traffic based on source IP addresses only.
    • They can be created with a number but not with a name.
    • They can be configured to filter traffic based on both source IP addresses and source ports.
      Answers Explanation & Hints:

      A standard IPv4 ACL can filter traffic based on source IP addresses only. Unlike an extended ACL, it cannot filter traffic based on Layer 4 ports. However, both standard and extended ACLs can be identified with either a number or a name, and both are configured in global configuration mode.

  43. What is considered a best practice when configuring ACLs on vty lines?

    • Use only extended access lists.
    • Place identical restrictions on all vty lines.
    • Apply the ip access-group command inbound.
    • Remove the vty password since the ACL restricts access to trusted users.
  44. Refer to the exhibit. An administrator first configured an extended ACL as shown by the output of the show access-lists command. The administrator then edited this access-list by issuing the commands below.

    Router(config)# ip access-list extended 101
    Router(config-ext-nacl)# no 20
    Router(config-ext-nacl)# 5 permit tcp any any eq 22
    Router(config-ext-nacl)# 20 deny udp any any

    Which two conclusions can be drawn from this new configuration?​ (Choose two.)

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 10

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 10

    • Ping packets will be permitted.
    • Telnet packets will be permitted.
    • All TCP and UDP packets will be denied.​
    • SSH packets will be permitted.
    • TFTP packets will be permitted.​
      Answers Explanation & Hints:

      After the editing, the final configuration is as follows:
      Router# show access-lists
      Extended IP access list 101
      5 permit tcp any any eq ssh
      10 deny tcp any any
      20 deny udp any any
      30 permit icmp any any
      So, only SSH packets and ICMP packets will be permitted.​

  45. Which set of access control entries would allow all users on the 192.168.10.0/24 network to access a web server that is located at 172.17.80.1, but would not allow them to use Telnet?

    • access-list 103 deny tcp host 192.168.10.0 any eq 23
      access-list 103 permit tcp host 192.168.10.1 eq 80
    • access-list 103 permit 192.168.10.0 0.0.0.255 host 172.17.80.1
      access-list 103 deny tcp 192.168.10.0 0.0.0.255 any eq telnet​​
    • access-list 103 permit tcp 192.168.10.0 0.0.0.255 host 172.17.80.1 eq 80
      access-list 103 deny tcp ​192.168.10.0 0.0.0.255 any eq 23
    • access-list 103 permit tcp 192.168.10.0 0.0.0.255 any eq 80
      access-list 103 deny tcp 192.168.10.0 0.0.0.255 any eq 23

      Answers Explanation & Hints:

      For an extended ACL to meet these requirements the following need to be included in the access control entries:identification number in the range 100-199 or 2000-2699
      permit or deny parameter
      protocol
      source address and wildcard
      destination address and wildcard
      port number or name

  46. What is the term used to describe unethical criminals who compromise computer and network security for personal gain, or for malicious reasons?

    • black hat hackers
    • vulnerability broker
    • hacktivists
    • script kiddies
  47. What is the term used to describe a mechanism that takes advantage of a vulnerability?

    • exploit
    • threat
    • vulnerability
    • mitigation
  48. What is the term used to describe the same pre-shared key or secret key, known by both the sender and receiver to encrypt and decrypt data?

    • symmetric encryption algorithm
    • data integrity
    • risk
    • mitigation
  49. What is the term used to describe the same pre-shared key or secret key, known by both the sender and receiver to encrypt and decrypt data?

    • symmetric encryption algorithm
    • data integrity
    • risk
    • exploit
  50. What is the term used to describe a guarantee that the message is not a forgery and does actually come from whom it states?

    • origin authentication
    • mitigation
    • exploit
    • risk
  51. What is the term used to describe a guarantee that the message is not a forgery and does actually come from whom it states?

    • origin authentication
    • mitigation
    • exploit
    • data non-repudiation
  52. What is the term used to describe gray hat hackers who publicly protest organizations or governments by posting articles, videos, leaking sensitive information, and performing network attacks?

    • hacktivists
    • grey hat hackers
    • white hat hackers
    • state-sponsored hacker
  53. What is the term used to describe gray hat hackers who publicly protest organizations or governments by posting articles, videos, leaking sensitive information, and performing network attacks?

    • hacktivists
    • grey hat hackers
    • white hat hackers
    • script kiddies
  54. What is the term used to describe a potential danger to a company’s assets, data, or network functionality?

    • threat
    • vulnerability
    • exploit
    • asset
  55. What is the term used to describe a potential danger to a company’s assets, data, or network functionality?

    • threat
    • vulnerability
    • exploit
    • asymmetric encryption algorithm
  56. Refer to the exhibit. Employees on 192.168.11.0/24 work on critically sensitive information and are not allowed access off their network. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • standard ACL inbound on R1 G0/1
    • extended ACL inbound on R2 S0/0/0
    • standard ACL inbound on R1 vty lines
    • standard ACL inbound on R2 WAN interface connecting to the internet
  57. Refer to the exhibit. Only authorized remote users are allowed remote access to the company server 192.168.30.10. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACL inbound on R2 WAN interface connected to the internet
    • extended ACLs inbound on R1 G0/0 and G0/1
    • extended ACL outbound on R2 WAN interface towards the internet
    • extended ACL inbound on R2 S0/0/0
  58. Refer to the exhibit. Many employees are wasting company time accessing social media on their work computers. The company wants to stop this access. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACLs inbound on R1 G0/0 and G0/1
    • standard ACL inbound on R1 G0/1
    • standard ACL inbound on R1 G0/0
    • standard ACL inbound on R2 WAN interface connecting to the internet
  59. Refer to the exhibit. The company has provided IP phones to employees on the 192.168.10.0/24 network and the voice traffic will need priority over data traffic. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACL inbound on R1 G0/0
    • extended ACL inbound on R3 S0/0/1
    • extended ACLs inbound on R1 G0/0 and G0/1
    • standard ACL outbound on R2 S0/0/0
  60. Refer to the exhibit. Network 192.168.30.0/24 contains all of the company servers. Policy dictates that traffic from the servers to both networks 192.168.10.0 and 192.168.11.0 be limited to replies for original requests. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACL inbound on R3 G0/0
    • extended ACLs inbound on R1 G0/0 and G0/1
    • standard ACL inbound on R1 vty lines
    • standard ACL inbound on R1 G0/0
  61. Refer to the exhibit. Network 192.168.30.0/24 contains all of the company servers. Policy dictates that traffic from the servers to both networks 192.168.10.0 and 192.168.11.0 be limited to replies for original requests. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACL inbound on R3 G0/0
    • extended ACL outbound on R2 S0/0/1
    • standard ACL inbound on R2 WAN interface connecting to the internet
    • extended ACL outbound on R2 WAN interface towards the internet
  62. Refer to the exhibit. Many employees are wasting company time accessing social media on their work computers. The company wants to stop this access. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACLs inbound on R1 G0/0 and G0/1
    • standard ACL outbound on R2 S0/0/0
    • extended ACL outbound on R2 S0/0/1
    • extended ACL inbound on R2 S0/0/0
  63. Refer to the exhibit. The company has provided IP phones to employees on the 192.168.10.0/24 network and the voice traffic will need priority over data traffic. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACL inbound on R1 G0/0
    • extended ACLs inbound on R1 G0/0 and G0/1
    • standard ACL inbound on R1 G0/1
    • standard ACL outbound on R1 G0/0
  64. Refer to the exhibit. The network administrator has an IP address of 192.168.11.10 and needs access to manage R1. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • standard ACL inbound on R1 vty lines
    • standard ACL outbound on R1 G0/0
    • standard ACL inbound on R2 WAN interface connecting to the internet
    • extended ACL inbound on R3 G0/0
  65. Refer to the exhibit. Network 192.168.30.0/24 contains all of the company servers. Policy dictates that traffic from the servers to both networks 192.168.10.0 and 192.168.11.0 be limited to replies for original requests. What is the best ACL type and placement to use in this situation?

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    CCNA3 v7 – ENSA – Modules 3 – 5 Network Security Exam Answers 16

    • extended ACL inbound on R3 G0/0
    • standard ACL inbound on R1 G0/1
    • standard ACL inbound on R2 WAN interface connecting to the internet
    • extended ACL outbound on R2 S0/0/1
  66. A technician is tasked with using ACLs to secure a router. When would the technician use the established configuration option or command?

    • to allow returning reply traffic to enter the internal network
    • to allow specified traffic through an interface
    • to display all restricted traffic
    • to add a text entry for documentation purposes
  67. A technician is tasked with using ACLs to secure a router. When would the technician use the any configuration option or command?

    • to identify any IP address
    • to insert a comment into the packet header
    • to identify one specific IP address
    • to restrict specific traffic access through an interface
  68. A technician is tasked with using ACLs to secure a router. When would the technician use the established configuration option or command?

    • to allow returning reply traffic to enter the internal network
    • to add a text entry for documentation purposes
    • to generate and send an informational message whenever the ACE is matched
    • to insert a comment into the packet header
  69. A technician is tasked with using ACLs to secure a router. When would the technician use the host configuration option or command?

    • to identify a single IP address
    • to allow specified traffic through an interface
    • to insert a comment into the packet header
    • to add a text entry for documentation purposes
  70. A technician is tasked with using ACLs to secure a router. When would the technician use the ip access-group 101 in configuration option or command?

    • to apply an extended ACL to an interface
    • to secure administrative access to the router
    • to display all restricted traffic
    • to verify the ACL applied on the interface
  71. A technician is tasked with using ACLs to secure a router. When would the technician use the access-class 20 in configuration option or command?

    • to secure remote administrative access to the router
    • to secure management traffic into the router
    • to remove a configured ACL
    • to apply a standard ACL to an interface
  72. A technician is tasked with using ACLs to secure a router. When would the technician use the established configuration option or command?

    • to allow returning reply traffic to enter the internal network
    • to insert a comment into the packet header
    • to identify one specific IP address
    • to generate and send an informational message whenever the ACE is matched
  73. A technician is tasked with using ACLs to secure a router. When would the technician use the deny configuration option or command?

    • to restrict specific traffic access through an interface
    • to generate and send an informational message whenever the ACE is matched
    • to display all restricted traffic
    • to identify one specific IP address
  74. A technician is tasked with using ACLs to secure a router. When would the technician use the 40 deny host 192.168.23.8 configuration option or command?

    • to create an entry in a numbered ACL
    • to secure management traffic into the router
    • to remove an ACL from an interface
    • to apply an extended ACL to an interface
  75. A technician is tasked with using ACLs to secure a router. When would the technician use the any configuration option or command?

    • to identify any IP address
    • to insert a comment into the packet header
    • to generate and send an informational message whenever the ACE is matched
    • to identify one specific IP address