ICND1 Network Security Basics 2 — Questions and Answers
Question 1: Which command enables port security on a Cisco switch interface?
- switchport port-security (Correct answer)
- ip port-security enable
- security port-mode enable
- switchport security enable
Correct answer: switchport port-security
The command 'switchport port-security' enables port security on a switch interface after setting it to access mode.
Question 2: What does the 'restrict' violation mode do when a port security violation occurs?
- Drops packets from unknown MACs and increments a violation counter (Correct answer)
- Shuts down the port and sends SNMP trap
- Drops all traffic and disables the port
- Allows traffic but logs the event only
Correct answer: Drops packets from unknown MACs and increments a violation counter
The 'restrict' mode drops packets from unauthorized MAC addresses and increments the security violation counter without shutting down the port.
Question 3: Which AAA component is responsible for tracking the actions a user performs after being authenticated?
- Accounting (Correct answer)
- Authorization
- Authentication
- Auditing
Correct answer: Accounting
Accounting records what a user does after being authenticated, such as commands executed and duration of access.
Question 4: What is the default behavior of a Cisco router when an ACL is applied to an interface but a packet does not match any ACE?
- The packet is dropped (Correct answer)
- The packet is forwarded
- The packet is logged
- The packet is queued for inspection
Correct answer: The packet is dropped
Every Cisco ACL has an implicit 'deny any' at the end, so unmatched packets are dropped by default.
Question 5: Which type of attack involves sending frames with a spoofed source MAC address to overflow a switch's MAC address table?
- MAC flooding attack (Correct answer)
- ARP poisoning attack
- VLAN hopping attack
- STP manipulation attack
Correct answer: MAC flooding attack
A MAC flooding attack overwhelms the switch's CAM table with fake MAC addresses, causing the switch to behave like a hub and broadcast all traffic.
Question 6: Which protocol does SSH use for secure remote management of Cisco devices?
- TCP port 22 (Correct answer)
- UDP port 22
- TCP port 23
- UDP port 23
Correct answer: TCP port 22
SSH operates over TCP port 22 and provides encrypted remote access, replacing Telnet which uses TCP port 23.
Question 7: What is the purpose of the 'service password-encryption' command on a Cisco device?
- Encrypts all plaintext passwords in the running configuration (Correct answer)
- Enables MD5 hashing for the enable secret password
- Generates a public/private key pair for SSH
- Encrypts traffic between routers using IPsec
Correct answer: Encrypts all plaintext passwords in the running configuration
The 'service password-encryption' command applies Cisco's weak Type 7 encryption to all plaintext passwords stored in the configuration file.
ICND1 Network Security Basics 2
Which command enables port security on a Cisco switch interface?