CCNA Security Chapter 2
I love u
- 1.
An administrator needs to create a user account with custom access to most privileged EXEC commands. Which privilege command is used to create this custom account?
- A.
Privilege exec level 0
- B.
Privilege exec level 1
- C.
Privilege exec level 2
- D.
Privilege exec level 15
Correct Answer
C. Privilege exec level 2Explanation
The correct answer is "privilege exec level 2". This command is used to create a user account with custom access to most privileged EXEC commands. The "privilege exec level" command is used to specify the privilege level for a particular command. In this case, a privilege level of 2 is being set, which allows access to a subset of privileged EXEC commands.Rate this question:
-
- 2.
19. What is the minimum recommended modulus key length for keys generated to use with SSH?
- A.
256
- B.
512
- C.
768
- D.
1024
- E.
2048
Correct Answer
D. 1024Explanation
The minimum recommended modulus key length for keys generated to use with SSH is 1024. This means that the key should be at least 1024 bits long in order to provide sufficient security for SSH communication. A longer key length would provide even stronger security, but 1024 bits is considered the minimum acceptable length.Rate this question:
-
- 3.
Refer to the exhibit. Which information can be gathered based on the show login command output?
- A.
All logins from all sources are blocked for another 90 seconds.
- B.
The login block-for command is configured to block login hosts for 82 seconds.
- C.
Five or more login requests have failed within 90 seconds.
- D.
Any host is permitted to access the router in quiet mode via Telnet, SSH, and HTTP, because the Quiet-Mode access list has not been configured.
Correct Answer
C. Five or more login requests have failed within 90 seconds.Explanation
Based on the "show login" command output, the information that can be gathered is that five or more login requests have failed within 90 seconds. This can be inferred because the login block-for command is configured to block login hosts for 82 seconds, indicating that there have been failed login attempts. Additionally, the statement "All logins from all sources are blocked for another 90 seconds" suggests that there is a temporary block in place due to the failed login attempts.Rate this question:
-
- 4.
Refer to the exhibit. Based on the output of the show running-config command, which type of view is SUPPORT?
- A.
Secret view, with a level 5 encrypted password
- B.
Root view, with a level 5 encrypted secret password
- C.
Superview, containing SHOWVIEW and VERIFYVIEW views
- D.
CLI view, containing SHOWVIEW and VERIFYVIEW commands
Correct Answer
C. Superview, containing SHOWVIEW and VERIFYVIEW viewsExplanation
Based on the output of the show running-config command, the SUPPORT view is a superview. This is indicated by the fact that it contains the SHOWVIEW and VERIFYVIEW views.Rate this question:
-
- 5.
Refer to the exhibit. Which statement regarding the JR-Admin account is true?
- A.
JR-Admin can issue show, ping, and reload commands.
- B.
JR-Admin can issue ping and reload commands.
- C.
JR-Admin can issue only ping commands.
- D.
JR-Admin can issue debug and reload commands
- E.
R-Admin cannot issue any command because the privilege level does not match one of those defined.
Correct Answer
B. JR-Admin can issue ping and reload commands.Explanation
The correct answer is JR-Admin can issue ping and reload commands. This is because in the exhibit, the privilege level of the JR-Admin account is set to 5, which allows the user to issue both ping and reload commands.Rate this question:
-
- 6.
By default, how many seconds of delay between virtual login attempts is invoked when the login block-for command is configured?
- A.
One
- B.
Two
- C.
Three
- D.
Four
- E.
Five
Correct Answer
A. OneExplanation
When the login block-for command is configured, by default, there is a delay of one second between virtual login attempts.Rate this question:
-
- 7.
Which statement matches the CLI commands to the SDM wizard that performs similar configuration functions?
- A.
Aaa configuration commands and the SDM Basic Firewall wizard
- B.
Auto secure privileged EXEC command and the SDM One-Step Lockdown wizard
- C.
Class-maps, policy-maps, and service-policy configuration commands and the SDM IPS wizard
- D.
Setup privileged EXEC command and the SDM Security Audit wizard
Correct Answer
B. Auto secure privileged EXEC command and the SDM One-Step Lockdown wizardExplanation
The auto secure privileged EXEC command and the SDM One-Step Lockdown wizard both perform similar configuration functions. The auto secure command is used to automatically secure the router by applying a set of recommended security configurations. Similarly, the SDM One-Step Lockdown wizard in the Cisco Security Device Manager (SDM) provides a guided interface to quickly and easily apply a comprehensive set of security configurations to the router. Both options aim to enhance the security of the router by implementing recommended security measures.Rate this question:
-
- 8.
Which set of commands are required to create a username of admin, hash the password using MD5, and force the router to access the internal username database when a user attempts to access the console?
- A.
R1(config)# username admin password Admin01pa55 R1(config)# line con 0 R1(config-line)# login local
- B.
R1(config)# username admin password Admin01pa55 R1(config)# line con 0 R1(config-line)# login internal
- C.
R1(config)# username admin Admin01pa55 encr md5 R1(config)# line con 0 R1(config-line)# login local
- D.
R1(config)# username admin secret Admin01pa55 R1(config)# line con 0 R1(config-line)# login local
- E.
R1(config)# username admin secret Admin01pa55 R1(config)# line con 0 R1(config-line)# login internal
Correct Answer
D. R1(config)# username admin secret Admin01pa55 R1(config)# line con 0 R1(config-line)# login localExplanation
The correct answer is R1(config)# username admin secret Admin01pa55 R1(config)# line con 0 R1(config-line)# login local. This set of commands creates a username of "admin" with a password of "Admin01pa55" and sets the login method to "local" for the console line. This means that when a user attempts to access the console, the router will check the internal username database for authentication.Rate this question:
-
- 9.
Which recommended security practice prevents attackers from performing password recovery on a Cisco IOS router for the purpose of gaining access to the privileged EXEC mode?
- A.
Keep a secure copy of the router Cisco IOS image and router configuration file as a backup.
- B.
Disable all unused ports and interfaces to reduce the number of ways that the router can be accessed.
- C.
Configure secure administrative control to ensure that only authorized personnel can access the router
- D.
Locate the router in a secure locked room that is accessible only to authorized personnel.
- E.
Provision the router with the maximum amount of memory possible.
Correct Answer
D. Locate the router in a secure locked room that is accessible only to authorized personnel. -
- 10.
Refer to the exhibit. What is the significance of secret 5 in the generated output?
- A.
The ADMIN password is encrypted using DH group 5.
- B.
The ADMIN password is encrypted via the service password-encryption command.
- C.
The ADMIN password is hashed using MD5.
- D.
The ADMIN password is hashed using SHA.
Correct Answer
C. The ADMIN password is hashed using MD5.Explanation
The significance of secret 5 in the generated output is that it indicates that the ADMIN password is hashed using MD5.Rate this question:
-
- 11.
Which two characteristics apply to Role-Based CLI Access superviews? (Choose two.)
- A.
CLI views have passwords, but superviews do not have passwords.
- B.
Users logged in to a superview can access all commands specified within the associated CLI views.
- C.
A single superview can be shared among multiple CLI views.
- D.
Commands cannot be configured for a specific superview.
- E.
Deleting a superview deletes all associated CLI views.
Correct Answer(s)
B. Users logged in to a superview can access all commands specified within the associated CLI views.
D. Commands cannot be configured for a specific superview.Explanation
Role-Based CLI Access superviews allow users logged in to a superview to access all commands specified within the associated CLI views. This means that users with the appropriate role and permissions can execute any command within the specified CLI views. Additionally, commands cannot be configured for a specific superview, meaning that the commands available within the superview are determined by the associated CLI views and cannot be customized for individual superviews.Rate this question:
-
- 12.
What are two characteristics of SNMP community strings? (Choose two.)
- A.
A vulnerability of SNMPv1, SNMPv2, and SNMPv3 is that they send the community strings in plaintext.
- B.
Commonly known community strings should be used when configuring secure SNMP.
- C.
If the manager sends one of the correct read-only community strings, it can get information and set information in an agent.
- D.
SNMP read-only community strings can be used to get information from an SNMP-enabled device.
- E.
SNMP read-write community strings can be used to set information on an SNMP-enabled device.
Correct Answer(s)
D. SNMP read-only community strings can be used to get information from an SNMP-enabled device.
E. SNMP read-write community strings can be used to set information on an SNMP-enabled device.Explanation
SNMP community strings are used for authentication and access control in SNMP-enabled devices. The first characteristic states that SNMPv1, SNMPv2, and SNMPv3 send community strings in plaintext, making them vulnerable to interception. The second characteristic suggests that commonly known community strings should not be used for secure SNMP configurations. The last two characteristics explain the functionality of SNMP read-only and read-write community strings. The read-only community strings allow the manager to retrieve information from the SNMP-enabled device, while the read-write community strings enable the manager to both retrieve and set information on the device.Rate this question:
-
- 13.
Refer to the exhibit. Routers R1 and R2 are connected via a serial link. One router is configured as the NTP master, and the other is an NTP client. Which two pieces of information can be obtained from the partial output of the show ntp associations detail command on R2? (Choose two.)
- A.
Both routers are configured to use NTPv2.
- B.
Router R1 is the master, and R2 is the client.
- C.
Router R2 is the master, and R1 is the client.
- D.
The IP address of R1 is 192.168.1.2.
- E.
The IP address of R2 is 192.168.1.2.
Correct Answer(s)
B. Router R1 is the master, and R2 is the client.
D. The IP address of R1 is 192.168.1.2.Explanation
From the partial output of the show ntp associations detail command on R2, we can determine that R1 is configured as the NTP master and R2 is configured as the NTP client. Additionally, we can obtain the information that the IP address of R1 is 192.168.1.2.Rate this question:
-
- 14.
Refer to the exhibit. What two facts can be determined from the output? (Choose two.)
- A.
The Cisco IOS image and configuration files have been properly secured.
- B.
ROMmon mode will be inaccessible upon entering the privileged EXEC reload command.
- C.
The Cisco IOS Resilient Configuration feature is enabled.
- D.
The Cisco IOS Resilient Configuration feature has detected an image version mismatch.
- E.
The Cisco IOS configuration files have been erased.
Correct Answer(s)
A. The Cisco IOS image and configuration files have been properly secured.
C. The Cisco IOS Resilient Configuration feature is enabled.Explanation
The two facts that can be determined from the output are: The Cisco IOS image and configuration files have been properly secured, and The Cisco IOS Resilient Configuration feature is enabled.Rate this question:
-
- 15.
What are two characteristics of the SDM Security Audit wizard? (Choose two.)
- A.
It uses interactive dialogs and prompts to implement AAA.
- B.
It automatically enables Cisco IOS firewall and implements Cisco IOS IPS security configurations to secure the router.
- C.
It displays a screen with Fix-it check boxes to let you choose which potential security-related configuration changes to implement.
- D.
It requires users to first identify which router interfaces connect to the inside network and which connect to the outside network.
- E.
It is initiated from CLI and executes a script in which the managment plane functions and forwarding plane services are tested against known vulnerabilities.
Correct Answer(s)
C. It displays a screen with Fix-it check boxes to let you choose which potential security-related configuration changes to implement.
D. It requires users to first identify which router interfaces connect to the inside network and which connect to the outside network.Explanation
The SDM Security Audit wizard offers two characteristics. Firstly, it presents a screen with Fix-it check boxes, allowing the user to select which security-related configuration changes they want to implement. This provides flexibility and control over the changes made. Secondly, it requires users to identify the router interfaces connecting to the inside and outside networks. This step ensures that the appropriate security measures are applied to the correct interfaces, enhancing network security.Rate this question:
-
- 16.
An administrator defined a local user account with a secret password on router R1 for use with SSH. Which three additional steps are required to configure R1 to accept only encrypted SSH connections? (Choose three.)
- A.
Configure the IP domain name on the router
- B.
Enable inbound vty Telnet sessions
- C.
Generate the SSH keys
- D.
Configure DNS on the router
- E.
Enable inbound vty SSH sessions
Correct Answer(s)
A. Configure the IP domain name on the router
C. Generate the SSH keys
E. Enable inbound vty SSH sessionsExplanation
To configure R1 to accept only encrypted SSH connections, the administrator needs to perform the following three additional steps:
1. Configure the IP domain name on the router: This step is necessary to generate the RSA key pair used for SSH encryption.
2. Generate the SSH keys: This step involves generating the RSA key pair that will be used for encryption and authentication during SSH connections.
3. Enable inbound vty SSH sessions: This step allows the router to accept incoming SSH connections on the virtual terminal lines (vtys). By enabling SSH sessions, the router will only accept encrypted SSH connections, ensuring secure communications.Rate this question:
-
- 17.
Refer to the exhibit.what two pieces of information can be gathered from the generated message? choose two
- A.
This message is a level five notification message
- B.
This message appeared beacuse a minor error occured requiring further investigation
- C.
This message appeared because a major error occured requiring immediate action
- D.
This message indicates that service timestamps have been globally enabled
- E.
This message indicates that enhanced security was configured on the vty ports
Correct Answer(s)
A. This message is a level five notification message
D. This message indicates that service timestamps have been globally enabledExplanation
The two pieces of information that can be gathered from the generated message are that the message is a level five notification message and that service timestamps have been globally enabled.Rate this question:
-
Quiz Review Timeline +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Mar 21, 2023Quiz Edited by
ProProfs Editorial Team -
Jul 16, 2010Quiz Created by
Man04