Cisco CCNA Cisco CCNA Network Security Fundamentals 2 — Questions and Answers
Question 1: Which command configures a Cisco router login banner that is displayed before authentication?
- banner login # message # (Correct answer)
- banner motd # message #
- banner exec # message #
- login banner text message
Correct answer: banner login # message #
The 'banner login' command displays a message specifically before the username/password prompt, intended for legal warnings.
Question 2: What does the 'login local' command on a Cisco VTY line configure?
- Authenticates users against the local username database (Correct answer)
- Uses TACACS+ for authentication
- Disables password authentication on VTY lines
- Enables SSH-only access to VTY lines
Correct answer: Authenticates users against the local username database
'login local' requires VTY connections to authenticate using username and password pairs stored in the device's local database.
Question 3: Which protocol encrypts the entire management session between an administrator and a Cisco device?
- SSH (Correct answer)
- Telnet
- TFTP
- SNMP v2c
Correct answer: SSH
SSH (Secure Shell) encrypts all traffic between the client and the network device, while Telnet transmits data in plaintext.
Question 4: What is the purpose of the 'ip dhcp snooping limit rate' command on a Cisco switch port?
- Limits the number of DHCP packets per second to prevent starvation attacks (Correct answer)
- Sets the maximum number of DHCP leases on a port
- Enables DHCP rate limiting globally
- Restricts DHCP traffic to trusted ports only
Correct answer: Limits the number of DHCP packets per second to prevent starvation attacks
'ip dhcp snooping limit rate' caps DHCP packet ingress rate on untrusted ports to mitigate DHCP starvation denial-of-service attacks.
Question 5: Which Cisco IOS command displays port security status including the number of secure MAC addresses on an interface?
- show port-security interface (Correct answer)
- show mac address-table secure
- show switchport security
- show interface port-security
Correct answer: show port-security interface
'show port-security interface <interface>' displays the port security configuration, violation count, and learned secure MAC addresses.
Question 6: Which feature protects against IP address spoofing by verifying that incoming packets match an entry in the DHCP snooping binding table?
- IP Source Guard (Correct answer)
- Dynamic ARP Inspection
- Port Security
- Unicast Reverse Path Forwarding
Correct answer: IP Source Guard
IP Source Guard filters packets on untrusted ports by comparing source IP and MAC against the DHCP snooping binding database.
Cisco CCNA Cisco CCNA Network Security Fundamentals 2
Which command configures a Cisco router login banner that is displayed before authentication?