Quiz
CCNA Security Cp 3
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (28)
1Why is local database authentication preferred over a password-only login?
- AIt provides for authentication and accountability.
- BIt requires a login and password combination on console, vty lines, and aux ports.
- CIt specifies a different password for each line or port.
- DIt is more efficient for users who only need to enter a password to gain entry to a device.
2Which authentication method stores usernames and passwords in the router and is ideal for small networks?
- Alocal AAA
- Blocal AAA over RADIUS
- Clocal AAA over TACACS+
- Dserver-based AAA
- Eserver-based AAA over RADIUS
- Fserver-based AAA over TACACS+
3In regards to Cisco Secure ACS, what is a client device?
- Aweb server, email server, or FTP server
- Bhe computer used by a network administrator
- Cnetwork users who must access privileged EXEC commands
- Drouter, switch, firewall, or VPN concentrator
4When configuring a Cisco Secure ACS, how is the configuration interface accessed?
- AA Web browser is used to configure a Cisco Secure ACS.
- BThe Cisco Secure ACS can be accessed from the router console.
- CTelnet can be used to configure a Cisco Secure ACS server after an initial configuration is complete.
- DThe Cisco Secure ACS can be accessed remotely after installing
- EACS client software on the administrator workstation.
5What is a difference between using the login local command and using local AAA authentication for authenticating administrator access?
- ALocal AAA authentication supports encrypted passwords; login local does not.
- BLocal AAA provides a way to configure backup methods of authentication; login local does not.
- CA method list must be configured when using the login local command, but is optional when using local AAA authentication.
- DThe login local command supports the keyword none, which ensures that authentication succeeds, even if all methods return an error.
6Due to implemented security controls, a user can only access a server with FTP. Which AAA component accomplishes this?
- Aaccessibility
- Baccounting
- Cauditing
- Dauthentication
- Eauthorization
7Which two AAA access method statements are true? (Choose two.)
- ACharacter mode provides remote users with access to network resources and requires use of the console, vty, or tty ports.
- BCharacter mode provides remote users with access to network resources and requires use of dialup or VPN.
- CCharacter mode provides users with administrative privilege EXEC access and requires use of the console, vty, or tty ports.
- DPacket mode provides users with administrative privilege EXEC access and requires use of dialup or VPN.
- EPacket mode provides remote users with access to network resources and requires use of dialup or VPN.
- FPacket mode provides users with administrative privilege EXEC access and requires use of the console, vty, or tty ports.
8What is a characteristic of TACACS+?
- ATACACS+ is an open IETF standard.
- BTACACS+ is backward compatible with TACACS and XTACACS.
- CTACACS+ provides authorization of router commands on a per-user or per-group basis.
- DTACACS+ uses UDP port 1645 or 1812 for authentication, and UDP port 1646 or 1813 for accounting.
9When configuring a method list for AAA authentication, what is the effect of the keyword local?
- AIt accepts a locally configured username, regardless of case.
- BIt defaults to the vty line password for authentication.
- CThe login succeeds, even if all methods return an error.
- DIt uses the enable password for authentication.
10What is the result if an administrator configures the aaa authorization command prior to creating a user with full access rights?
- AThe administrator is immediately locked out of the system.
- BThe administrator is denied all access except to aaa authorization commands.
- CThe administrator is allowed full access using the enable secret password.
- DThe administrator is allowed full access until a router reboot, which is required to apply changes.
11Which statement identifies an important difference between TACACS+ and RADIUS?
- ATACACS+ provides extensive accounting capabilities when compared to RADIUS.
- BThe RADIUS protocol encrypts the entire packet transmission.
- CThe TACACS+ protocol allows for separation of authentication from authorization.
- DRADIUS can cause delays by establishing a new TCP session for each authorization request.
12Which two statements describe Cisco Secure ACS? (Choose two.)
- ACisco Secure ACS supports LDAP.
- BCisco Secure ACS is only supported on wired LAN connections.
- CCisco Secure ACS only supports the TACACS+ protocol.
- DCisco Secure ACS supports both TACACS+ and RADIUS protocols.
- ECisco Secure ACS Express is a rack-mountable unit intended for more than 350 users.
13How does a Cisco Secure ACS improve performance of the TACACS+ authorization process?
- Areduces overhead by using UDP for authorization queries
- Breduces delays in the authorization queries by using persistent TCP sessions
- Creduces bandwidth utilization of the authorization queries by allowing cached credentials
- Dreduces number of authorization queries by combining the authorization process with authentication
14How does a Cisco Secure ACS improve performance of the TACACS+ authorization process?
- Areduces overhead by using UDP for authorization queries
- Breduces delays in the authorization queries by using persistent TCP sessions
- Creduces bandwidth utilization of the authorization queries by allowing cached credentials
- Dreduces number of authorization queries by combining the authorization process with authentication
15What is an effect if AAA authorization on a device is not configured?
- AAuthenticated users are granted full access rights.
- BUser access to specific services is determined by the authentication process.
- CCharacter mode authorization is limited, and packet mode denies all requests.
- DAll authorization requests to the TACACS server receive a REJECT response.
16Refer to the exhibit. Router R1 has been configured as shown, with the resulting log message. On the basis of the information presented, which two AAA authentication statements are true? (Choose two.)
- AThe locked-out user failed authentication.
- BThe locked-out user is locked out for 10 minutes by default.
- CThe locked-out user should have used the username Admin and password Pa55w0rd.
- DThe locked-out user should have used the username admin and password Str0ngPa55w0rd.
- EThe locked-out user stays locked out until the clear aaa local user lockout username Admin command is issued.
17Which technology provides the framework to enable scalable access security?
- Arole-based CLI access
- BSimple Network Management Protocol
- CAutoSecure
- DCisco Configuration Professional communities
- Eauthentication, authorization, and accounting
18Which two modes are supported by AAA to authenticate users for accessing the network and devices? (Choose two.)
- Averbose mode
- Bcharacter mode
- Cquiet mode
- Dpacket mode
- Eancillary mode
19Which two features are included by both TACACS+ and RADIUS protocols? (Choose two.)
- Aseparate authentication and authorization processes
- Bpassword encryption
- Cutilization of transport layer protocols
- DSIP support
- E802.1X support
20After accounting is enabled on an IOS device, how is a default accounting method list applied?
- AAccounting method lists are applied only to the VTY interfaces.
- BA named accounting method list must be explicitly defined and applied to desired interfaces.
- CAccounting method lists are not applied to any interfaces until an interface is added to the server group.
- DThe default accounting method list is automatically applied to all interfaces, except those with named accounting method lists.
21A company is deploying user device access control through a NAC appliance as part of the Cisco TrustSec solution. Which device is needed to serve as the central management for the access control?
- ACisco Secure ACS
- BCisco NAC Profiler
- CCisco NAC Manager
- DCisco NAC Guest Server
22A global company is deploying Cisco Secure ACS to manage user access to its headquarters campus. The network administrator configures the ACS to use multiple external databases for users from different geographical regions. The administrator creates user groups to match these databases. What is a purpose of creating different groups of users to authenticate through the Cisco Secure ACS?
- Ato better manage the user database.
- Bto improve the performance of the authentication process.
- Cto accommodate any difference in the authorization process between the ACS and an external database.
- Dto accommodate any difference in the authentication requirements between the ACS and an external database.
23Refer to the exhibit. A network administrator configures AAA authentication on R1. When the administrator tests the configuration by telneting to R1 and no ACS servers can be contacted, which password should the administrator use in order to login successfully?
- ALetMe1n2
- BPa$$w0rD
- Cauthen-radius
- Dauthen-tacacs
24 Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?
- Aauthentication
- Bauthorization
- Caccounting
- Dauditing
25Because of implemented security controls, a user can only access a server with FTP. Which AAA component accomplishes this?
- Aauditing
- Bauthentication
- Cauthorization
- Daccounting
- Eaccessibility
26 Refer to the exhibit. Router R1 is configured as shown. An administrative user attempts to use Telnet from router R2 to router R1 using the interface IP address 10.10.10.1. However, Telnet access is denied. Which option corrects this problem?
- AThe R1 10.10.10.1 router interface must be enabled.
- BThe vty lines must be configured with the login authentication default command.
- CThe aaa local authentication attempts max-fail command must be set to 2 or higher.
- DThe administrative user should use the username Admin and password Str0ngPa55w0rd.
27Refer to the exhibit. In the network shown, which AAA command logs the use of EXEC session commands?
- Aaaa accounting connection start-stop group radius
- Baaa accounting connection start-stop group tacacs+
- Caaa accounting exec start-stop group radius
- Daaa accounting exec start-stop group tacacs+
- Eaaa accounting network start-stop group tacacs+
28Refer to the exhibit. A network administrator configures AAA authentication on R1. Which statement describes the effect of the keyword single-connection in the configuration?
- AThe TACACS+ server only accepts one successful try for a user to authenticate with it.
- BThe authentication performance is enhanced by keeping the connection to the TACACS+ server open.
- CR1 will open a separate connection to the TACACS+ server for each user authentication session.
- DR1 will open a separate connection to the TACACS server on a per source IP address basis for each authentication session.
Information
- Description
- CCNA Security Quiz on CCNA Security Cp 3, created by Thomas Rowsome on 03/04/2018.
- Author
- Thomas Rowsome
- Language
- English
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz