ICND1 Network Security Basics 4 — Questions and Answers
Question 1: Which type of VPN creates an encrypted tunnel between two routers over the public internet to connect branch offices?
- Site-to-site VPN (Correct answer)
- Remote access VPN
- SSL VPN
- MPLS VPN
Correct answer: Site-to-site VPN
A site-to-site VPN establishes a persistent encrypted tunnel between two network endpoints, typically routers, to connect geographically separated offices.
Question 2: What does the 'enable secret' command do differently than the 'enable password' command?
- Stores the password as an MD5 hash instead of plaintext or weak Type 7 encryption (Correct answer)
- Enables a longer password length requirement
- Requires two-factor authentication to enter privileged mode
- Encrypts all subsequent passwords configured on the device
Correct answer: Stores the password as an MD5 hash instead of plaintext or weak Type 7 encryption
The 'enable secret' uses MD5 hashing, making it significantly more secure than 'enable password' which stores the password in a reversible format.
Question 3: Which attack exploits the IEEE 802.1Q trunking protocol to gain access to traffic on multiple VLANs?
- VLAN hopping (Correct answer)
- MAC flooding
- STP attack
- ARP spoofing
Correct answer: VLAN hopping
VLAN hopping attacks, such as switch spoofing or double tagging, allow an attacker to send traffic to VLANs they are not authorized to access.
Question 4: What is the recommended best practice for securing unused switch ports?
- Shut down the ports and assign them to an unused VLAN (Correct answer)
- Apply an extended ACL to each unused port
- Enable port security with maximum of 10 MAC addresses
- Configure the ports as trunk ports
Correct answer: Shut down the ports and assign them to an unused VLAN
Shutting down unused ports and assigning them to an unused VLAN prevents unauthorized devices from connecting to the network.
Question 5: Which IOS command displays the current port security settings and violation count for a specific interface?
- show port-security interface (Correct answer)
- show switchport security
- show interface security detail
- show security port interface
Correct answer: show port-security interface
The 'show port-security interface' command displays port security configuration, learned MAC addresses, and any violation statistics for the specified interface.
Question 6: What is a 'zero-day' vulnerability?
- A security flaw exploited before the vendor has released a patch (Correct answer)
- A vulnerability with no known exploits in the wild
- A bug that only affects systems that have been running for zero days
- A network attack that takes zero seconds to execute
Correct answer: A security flaw exploited before the vendor has released a patch
A zero-day vulnerability is a security flaw unknown to the vendor, meaning zero days have passed since the vendor became aware, giving no time to patch before exploitation.
Question 7: Which security protocol provides integrity, authentication, and optional encryption for IP packets at Layer 3?
- IPsec (Correct answer)
- SSL/TLS
- 802.1X
- RADIUS
Correct answer: IPsec
IPsec is a suite of protocols that operates at Layer 3 to provide authentication, integrity verification, and optional encryption for IP communications.
ICND1 Network Security Basics 4
Which type of VPN creates an encrypted tunnel between two routers over the public internet to connect branch offices?