Infrastructure Security Flashcards

What is the main difference between TACACS+ and RADIUS regarding authorization?

Answer: TACACS+ separates authentication and authorization; RADIUS combines them

TACACS+ separates the AAA functions, allowing granular per-command authorization, while RADIUS combines authentication and authorization.

Which 802.1X component authenticates the supplicant and communicates with the authentication server?

Answer: Authenticator

The authenticator (typically a switch or wireless AP) intercepts the supplicant's credentials and forwards them to the authentication server.

What is the purpose of Dynamic ARP Inspection (DAI)?

Answer: Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table

DAI validates ARP packets by checking the IP-to-MAC binding against the DHCP Snooping table, preventing ARP poisoning attacks.

In a ZBF configuration, which zone do router interfaces belong to by default?

Answer: no zone (no default)

Router interfaces are not automatically placed in any zone; they must be explicitly assigned to a zone for ZBF to apply.

Which Cisco feature uses cryptographic hashes to verify that routing updates have not been tampered with?

Answer: HMAC-MD5 or SHA authentication on routing protocols

Routing protocols like OSPF and BGP support HMAC-MD5 or SHA-based neighbor authentication to ensure update integrity.

What type of ACL can filter traffic based on both source and destination IP, and also TCP/UDP port numbers?

Answer: Extended ACL

Extended ACLs filter traffic based on source IP, destination IP, protocol, and Layer 4 port numbers.