ICND1 Network Security Basics 3 — Questions and Answers
Question 1: Which feature prevents rogue DHCP servers from assigning IP addresses on a network?
- DHCP snooping (Correct answer)
- Dynamic ARP inspection
- IP source guard
- Port security
Correct answer: DHCP snooping
DHCP snooping filters DHCP messages and only allows DHCP server responses from trusted ports, blocking rogue DHCP servers.
Question 2: What type of ACL uses both source and destination IP address, port numbers, and protocol to filter traffic?
- Extended ACL (Correct answer)
- Standard ACL
- Named ACL
- Reflexive ACL
Correct answer: Extended ACL
Extended ACLs can filter traffic based on source/destination IP, protocol type, and source/destination port numbers for granular control.
Question 3: Which Cisco IOS command generates RSA keys needed for SSH operation?
- crypto key generate rsa (Correct answer)
- ip ssh rsa generate
- ssh-keygen rsa modulus
- service ssh rsa enable
Correct answer: crypto key generate rsa
The 'crypto key generate rsa' command creates the RSA key pair required before SSH can be enabled on a Cisco device.
Question 4: What is a 'man-in-the-middle' attack in the context of network security?
- An attacker intercepts and potentially alters communications between two parties (Correct answer)
- An attacker floods a device with requests to deny service
- An attacker guesses passwords using a dictionary
- An attacker gains physical access to network equipment
Correct answer: An attacker intercepts and potentially alters communications between two parties
In a man-in-the-middle attack, the attacker secretly relays and possibly modifies communications between two parties who believe they are communicating directly.
Question 5: Which command configures a Cisco router to use TACACS+ for login authentication?
- aaa authentication login default group tacacs+ (Correct answer)
- login authentication tacacs+ default
- aaa login authentication default tacacs+
- tacacs-server authentication default login
Correct answer: aaa authentication login default group tacacs+
The 'aaa authentication login default group tacacs+' command configures TACACS+ as the authentication method for console and VTY logins.
Question 6: Which statement correctly describes the difference between symmetric and asymmetric encryption?
- Symmetric uses one key for both encryption and decryption; asymmetric uses a key pair (Correct answer)
- Symmetric uses two keys; asymmetric uses one shared key
- Symmetric is slower than asymmetric encryption
- Asymmetric encryption cannot be used for authentication
Correct answer: Symmetric uses one key for both encryption and decryption; asymmetric uses a key pair
Symmetric encryption uses a single shared secret key for both operations, while asymmetric encryption uses mathematically related public and private key pairs.
Question 7: What is the function of Dynamic ARP Inspection (DAI) on a Cisco switch?
- Validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing (Correct answer)
- Blocks all ARP broadcasts on untrusted ports
- Assigns IP addresses dynamically using ARP
- Monitors ARP table entries for duplicate IPs
Correct answer: Validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing
DAI intercepts ARP packets on untrusted ports and validates them against the DHCP snooping binding table to prevent ARP spoofing and poisoning attacks.
ICND1 Network Security Basics 3
Which feature prevents rogue DHCP servers from assigning IP addresses on a network?