ICND1 Network Security Basics 5 — Questions and Answers
Question 1: Which command configures the maximum number of MAC addresses allowed on a port security-enabled interface?
- switchport port-security maximum 2 (Correct answer)
- port-security max-mac-address 2
- switchport security mac-limit 2
- ip port-security maximum-hosts 2
Correct answer: switchport port-security maximum 2
The 'switchport port-security maximum' command sets the number of MAC addresses allowed on the interface before a violation occurs.
Question 2: What distinguishes RADIUS from TACACS+ in terms of protocol and encryption?
- RADIUS uses UDP and encrypts only the password; TACACS+ uses TCP and encrypts the entire payload (Correct answer)
- RADIUS uses TCP and encrypts all data; TACACS+ uses UDP and encrypts only the password
- Both use UDP but RADIUS encrypts more of the packet
- Both use TCP but TACACS+ was developed by Cisco for RADIUS replacement
Correct answer: RADIUS uses UDP and encrypts only the password; TACACS+ uses TCP and encrypts the entire payload
RADIUS uses UDP (ports 1812/1813) and only encrypts the password field, while TACACS+ uses TCP port 49 and encrypts the entire authentication payload.
Question 3: What is the purpose of a DMZ (Demilitarized Zone) in network security architecture?
- A network segment that hosts public-facing services while isolating them from the internal network (Correct answer)
- A zone where all traffic is denied by default regardless of source
- A VLAN dedicated exclusively to management traffic
- A segment where VPN tunnels terminate before entering the LAN
Correct answer: A network segment that hosts public-facing services while isolating them from the internal network
A DMZ is a perimeter network segment that hosts public-accessible servers (web, email, DNS) while preventing direct access to the internal corporate network.
Question 4: Which type of IDS/IPS detection method identifies attacks by comparing traffic patterns against a database of known attack signatures?
- Signature-based detection (Correct answer)
- Anomaly-based detection
- Policy-based detection
- Heuristic detection
Correct answer: Signature-based detection
Signature-based detection compares network traffic or system behavior against a database of known attack patterns to identify threats.
Question 5: Which Cisco feature uses 802.1X to enforce authentication before allowing a device to access the network?
- Network Access Control (NAC) (Correct answer)
- Dynamic ARP Inspection (DAI)
- DHCP snooping
- Private VLANs
Correct answer: Network Access Control (NAC)
Cisco NAC leverages 802.1X port-based authentication to verify device identity and compliance before granting network access.
Question 6: What is a 'social engineering' attack in the context of network security?
- Manipulating people into revealing confidential information or performing actions that compromise security (Correct answer)
- Exploiting software vulnerabilities through automated scripts
- Intercepting network traffic to gather credentials
- Flooding a target with authentication requests
Correct answer: Manipulating people into revealing confidential information or performing actions that compromise security
Social engineering attacks exploit human psychology rather than technical vulnerabilities, tricking users into divulging passwords or granting unauthorized access.
Question 7: Which command verifies that SSH version 2 is configured on a Cisco device?
- show ip ssh (Correct answer)
- show ssh version
- show crypto ssh
- show service ssh
Correct answer: show ip ssh
The 'show ip ssh' command displays the SSH version, authentication timeout, and retry settings configured on the Cisco device.
ICND1 Network Security Basics 5
Which command configures the maximum number of MAC addresses allowed on a port security-enabled interface?