CCNA Security Fundamentals Practice Questions (200-301)

How to work these questions

1. Name what is being attacked: a user (phishing, social engineering), a password (brute force, dictionary, credential stuffing), a service's availability (DoS, DDoS, reflection), a session or its data (man-in-the-middle, spoofing), or the software itself (buffer overflow, malware).
2. Place it on a layer: a spoofed source IP in flood traffic is Layer 3, a stolen credential is the application and the human, a tapped conversation is a Layer 2 or Layer 3 man-in-the-middle. The layer tells you which family of controls applies.
3. Match the control to the exact weakness: training stops social engineering, multifactor makes a stolen password insufficient, login block-for slows password guessing on the device, exec-timeout closes abandoned sessions, hashing protects stored passwords, IPsec or TLS protects data in transit.
4. For device-access questions, read the configuration top down and ask four things: how is the password stored (clear, type 7, type 5/8/9), how do the lines authenticate (line password, login local, AAA), what transport is allowed (Telnet or SSH only), and what limits sessions (exec-timeout, login block-for).
5. For AAA protocol questions, decide first whether the use case is device administration (per-command authorization, TACACS+) or network access (802.1X, RADIUS), then check the facts: TCP 49 versus UDP 1812/1813, full payload versus password-only encryption, separated versus combined authentication and authorization.
6. For VPN questions, ask who the endpoints are: two routers always on (site-to-site IPsec, GRE over IPsec if routing protocols must cross, DMVPN for many spokes) or a person on a laptop (remote-access VPN with a TLS or IPsec client).

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

1. Question 1 of 10Concept

   Your company is choosing the protocol between its routers and a central AAA server for administrator logins. Each engineer should be allowed to run only specific commands. Which characteristic of TACACS+ makes it a better fit than RADIUS?

   1. It runs over UDP 1812 and 1813, which keeps the exchange lightweight.
   2. It keeps authorization separate, so each command can be checked.
   3. It encrypts only the password field, so the rest of the packet is readable.
   4. It merges authentication and authorization into one request and reply.
   Show the answer

   Answer: B

   TACACS+ (TCP 49, full-payload encryption, separate authentication, authorization and accounting) is the protocol for device administration because it can authorize individual commands. RADIUS (UDP 1812/1813, password-only encryption, authentication and authorization combined) is the protocol for network access such as 802.1X.

   • A. UDP 1812 and 1813 are the RADIUS ports. TACACS+ uses TCP port 49, and the transport is not the reason it suits device administration.
   • B. TACACS+ treats authentication, authorization and accounting as separate exchanges, so after login the server can approve or reject every command the engineer types. That per-command authorization is why Cisco recommends it for device administration.
   • C. Encrypting only the password is a RADIUS limitation. TACACS+ encrypts the whole body of the packet, leaving only the header in clear text.
   • D. Combining authentication and authorization in one Access-Accept is RADIUS behavior, and it is exactly what makes per-command authorization awkward with RADIUS.

2. Question 2 of 10Concept

   In an 802.1X deployment, a laptop connects to access switch SW3. SW3 relays the laptop's credentials to a Cisco ISE server, which decides whether the port is opened. Which 802.1X role does SW3 play?

   1. The supplicant
   2. The authentication server
   3. The authenticator
   4. The identity store
   Show the answer

   Answer: C

   802.1X has three roles: the supplicant (client software on the endpoint), the authenticator (the switch or wireless LAN controller that controls the port) and the authentication server (RADIUS, such as ISE). EAPoL runs between supplicant and authenticator; RADIUS runs between authenticator and server.

   • A. The supplicant is the software on the endpoint, here the laptop, that presents the credentials over EAPoL.
   • B. The authentication server is the RADIUS server, here Cisco ISE, that checks the credentials and returns accept or reject.
   • C. The authenticator is the network device between the endpoint and the server: it blocks the port, relays EAP messages between the supplicant and the RADIUS server, and opens the port only after an Access-Accept. SW3 does exactly that.
   • D. An identity store is a database the authentication server may consult, such as Active Directory; it is not one of the three 802.1X roles and is not what the switch does.

3. Question 3 of 10Exhibit

   A junior engineer deployed branch router BR-RTR1 with the configuration in the exhibit. Which statement about the device's password security is accurate?

   hostname BR-RTR1
   !
   enable password Branch2026
   !
   username netops password NetOps#1
   !
   line con 0
    password C0ns0le
    login
   line vty 0 4
    password Br@nchVty
    login
    transport input telnet ssh

   1. The enable password is stored as an MD5 hash, as enable secret would store it.
   2. The vty lines authenticate against the local netops account because login is set.
   3. Adding service password-encryption would hash the enable password irreversibly.
   4. All passwords can be read in clear text from the running configuration.
   Show the answer

   Answer: D

   enable password, username name password and line passwords are stored in clear text unless service password-encryption applies the weak type 7 encoding. Only enable secret and username name secret store a real hash. login uses the line password; login local uses the local user database.

   • A. enable password stores the string exactly as typed. Only enable secret produces a one-way hash (type 5, 8 or 9).
   • B. login by itself tells the line to prompt for the line password, Br@nchVty here. The netops account is never consulted; that would need login local.
   • C. service password-encryption applies the type 7 encoding, which is reversible in seconds with public tools. It never produces a hash.
   • D. Without service password-encryption and without any secret keyword, the enable password, the username password and both line passwords appear in clear text in show running-config, and Telnet also sends them in clear text on the wire.

4. Question 4 of 10Exhibit

   A security review of DC-SW1 finds one remaining weakness in the configuration shown. Which is it?

   hostname DC-SW1
   !
   service password-encryption
   !
   enable secret 9 $9$Rz3u8pQw1mL5kT$h0Yq9vXl2bNc7dMf4sWe6rTg8uJk1oPa3iZx5nVb9cE
   !
   username admin privilege 15 secret 9 $9$Kp7wN2sD4fG6hJ$t3Bv5xMz8qLc1rYw4nHe7uJa0oKi2pSd6gFl9bTq3mVx
   !
   ip ssh version 2
   !
   line con 0
    login local
    exec-timeout 5 0
   line vty 0 15
    login local
    transport input ssh
    exec-timeout 0 0

   1. Idle SSH sessions on the vty lines never time out.
   2. The enable secret uses a reversible type 7 encoding.
   3. The admin account's password can be recovered from the type 9 string.
   4. The vty lines accept Telnet because SSH is not the only transport.
   Show the answer

   Answer: A

   exec-timeout minutes seconds closes idle sessions; 0 0 turns the timer off and is a hardening failure. Type 9 (scrypt) and type 8 (PBKDF2-SHA-256) secrets are one-way hashes, type 5 is MD5, and type 7 is the reversible encoding produced by service password-encryption. transport input ssh is the correct way to shut Telnet off.

   • A. exec-timeout 0 0 disables the idle timeout entirely, so a session left open on an unattended workstation stays logged in indefinitely. The default is 10 minutes; something like exec-timeout 5 0 is the fix.
   • B. The string begins with 9, which is scrypt, a one-way hash. Type 7 strings appear after the password keyword, not after secret.
   • C. Type 9 is a salted scrypt hash; it cannot be reversed, only brute-forced offline at great cost. This is the strongest option IOS offers.
   • D. transport input ssh restricts the vty lines to SSH only. Telnet would require transport input telnet or transport input all.

5. Question 5 of 10Scenario

   An ISP's monitoring shows a customer's web server at 203.0.113.40 receiving several gigabits per second of DNS response traffic from thousands of public DNS resolvers. The server never sent any queries, and each response is many times larger than a typical query. Which attack is this?

   1. A man-in-the-middle attack against DNS
   2. A reflection and amplification attack
   3. A DNS cache poisoning attack
   4. A buffer overflow against the server
   Show the answer

   Answer: B

   A reflection attack spoofs the victim's address as the source of requests to third-party servers so the replies land on the victim; amplification means those replies are much larger than the requests. DNS, NTP and SSDP are the classic reflectors. The root enabler is source address spoofing, so filtering spoofed sources at the edge is the mitigation.

   • A. A man-in-the-middle attacker sits between two parties and reads or alters their traffic. Nobody is intercepting anything here; the server is simply being flooded.
   • B. The attacker sent queries to open resolvers with the source address spoofed to 203.0.113.40, so the resolvers reflect their replies to the victim, and because DNS answers are much larger than queries the traffic is amplified. This is a reflection and amplification DDoS.
   • C. Cache poisoning plants false records in a resolver so clients are sent to the wrong address. It does not generate a volumetric flood at a web server.
   • D. A buffer overflow exploits a programming flaw by feeding a process more data than its buffer holds. The symptom here is bandwidth exhaustion, not a crashed or hijacked process.

6. Question 6 of 10Scenario

   An accounts-payable clerk receives an email that uses her first name, refers to a real supplier and to last week's genuine invoice number, and asks her to confirm payment details through a link that leads to a page imitating the company's banking portal. Nobody else in the company received the message. Which attack is this?

   1. A generic phishing campaign
   2. A pharming attack via DNS
   3. A spear phishing attack
   4. A watering hole attack
   Show the answer

   Answer: C

   Phishing is a social engineering attack by email; spear phishing is the targeted version, built with information about the specific victim; whaling is spear phishing aimed at executives. The technical controls (mail filtering, multifactor authentication) help, but user awareness training is the control that addresses the human weakness directly.

   • A. Generic phishing is sent in bulk with the same lure to many recipients. This message was researched and sent to one person.
   • B. Pharming redirects users to a fake site by tampering with DNS or hosts files; the user types the right address and still lands on the wrong site. Here the user is lured by an email link.
   • C. Spear phishing is phishing aimed at a specific person or small group, using details gathered beforehand (name, supplier, invoice number) to make the message convincing. The targeting and the personalization are the defining features.
   • D. A watering hole attack compromises a website the targets are known to visit and waits for them. No legitimate site was compromised here.

7. Question 7 of 10Scenario

   A user types his corporate username and password into a fake login page. Two hours later, the same credentials are used from another country to log in to the company's remote-access VPN successfully. Which control would most directly have stopped the second login?

   1. Multifactor authentication on the VPN
   2. A stricter password complexity rule
   3. Password encryption on the VPN gateway
   4. A shorter idle timeout on the VPN gateway
   Show the answer

   Answer: A

   A password is something you know; multifactor authentication adds something you have (token, phone, certificate) or something you are (biometrics). It is the control that makes a stolen or phished password insufficient. Password complexity rules defend against guessing, not against disclosure.

   • A. With multifactor authentication the attacker needs a second factor, such as a one-time code from the user's phone or a certificate on the user's laptop, that the phishing page did not capture. The stolen password alone is no longer enough.
   • B. The password was not guessed, it was handed over. A longer or more complex password is captured by a fake page just as easily.
   • C. Encrypting or hashing stored passwords protects them if the gateway's configuration is read; it does nothing against an attacker who already knows the password.
   • D. An idle timeout ends sessions that stay inactive. It does not prevent a new login with valid credentials.

8. Question 8 of 10Scenario

   The log of router R2 shows about 4,000 failed SSH logins for user admin within ten minutes, all from 203.0.113.77 and each with a different password. Which IOS feature slows this attack down directly on the router?

   1. the service password-encryption command
   2. enable algorithm-type scrypt secret
   3. exec-timeout 2 0 on the vty lines
   4. login block-for 120 attempts 3 within 60
   Show the answer

   Answer: D

   login block-for seconds attempts n within seconds is the IOS defense against brute-force and dictionary attacks on vty logins; login delay adds a pause between attempts and login on-failure log records them. Restricting management access with an access-class and using SSH only complete the picture. Password hashing and timeouts protect different things.

   • A. service password-encryption changes how passwords look in the configuration file. It has no effect on how many login attempts a remote host can make.
   • B. A scrypt enable secret makes the privileged-mode password harder to crack offline from a stolen configuration. It does not limit online guessing against the SSH login.
   • C. exec-timeout disconnects sessions that are already logged in and idle. The attacker never gets that far; each attempt fails at the password prompt.
   • D. login block-for 120 attempts 3 within 60 puts the router in quiet mode for 120 seconds after 3 failed attempts within 60 seconds, refusing further Telnet and SSH logins during that time (except from sources allowed by a login quiet-mode access-class). This cuts a dictionary attack from thousands of guesses to a handful per minute.

9. Question 9 of 10Config

   You must configure router R4 so that SSH logins are authenticated by the TACACS+ server at 10.10.10.5 with key S3cr3t, and by the local user database only if the server cannot be reached. Which configuration does this?

   1. aaa new-model tacacs server ISE1 address ipv4 10.10.10.5 key S3cr3t aaa authentication login default group tacacs+ local
   2. aaa new-model tacacs server ISE1 address ipv4 10.10.10.5 key S3cr3t aaa authentication login default local group tacacs+
   3. aaa new-model radius server ISE1 address ipv4 10.10.10.5 key S3cr3t aaa authentication login default group tacacs+ local
   4. tacacs server ISE1 address ipv4 10.10.10.5 key S3cr3t aaa authentication login default group tacacs+ local line vty 0 4 login local
   Show the answer

   Answer: A

   AAA on IOS starts with aaa new-model, then server definitions (tacacs server name with address ipv4 and key), then method lists such as aaa authentication login default group tacacs+ local. Methods run left to right, moving on only when a method fails to respond; put local last as the fallback for when the servers are unreachable.

   • A. aaa new-model enables AAA, the tacacs server block defines the server and its key, and the default login method list tries the TACACS+ group first and falls back to the local database only when no server answers. With aaa new-model, the vty lines use the default list automatically.
   • B. Method lists are tried in order, and the next method is used only when the previous one returns an error, not a reject. Here the local database is consulted first, so TACACS+ is used only when no local usernames exist at all; that is the opposite of the requirement.
   • C. The server is defined as a RADIUS server, so the tacacs+ group is empty. Every login errors out of the TACACS+ method and falls straight to local; the server is never contacted.
   • D. Without aaa new-model the router rejects the aaa authentication command, and login local on the line is the old non-AAA method. The TACACS+ server would never be consulted.

10. Question 10 of 10Concept

    Which two statements about VPN technologies are true? (Choose two.)

    1. A site-to-site IPsec VPN needs VPN client software on every user PC.
    2. GRE over IPsec lets routing-protocol multicasts cross an encrypted tunnel.
    3. A remote-access TLS VPN encrypts only the user's login exchange.
    4. DMVPN uses mGRE and NHRP to build spoke-to-spoke tunnels on demand.
    5. Plain IPsec tunnel mode carries IP multicast without any extra encapsulation.
    Show the answer

    Answer: B and D

    Site-to-site IPsec joins two networks router to router with no software on hosts; remote-access VPNs (TLS or IPsec client) join one user to the network and encrypt the whole session. GRE over IPsec adds routing protocols, multicast and non-IP support to IPsec. DMVPN scales hub-and-spoke designs with mGRE, NHRP and IPsec and builds spoke-to-spoke tunnels dynamically.

    • A. A site-to-site VPN terminates on the routers or firewalls at each site. Hosts behind them send ordinary traffic and need no client; the client belongs to remote-access VPNs.
    • B. IPsec alone protects unicast IP only, so OSPF or EIGRP hellos cannot cross it. Wrapping the traffic in GRE first turns everything, including multicast and non-IP traffic, into unicast GRE packets that IPsec can then encrypt.
    • C. A TLS (SSL) remote-access VPN encrypts the whole session between the client and the gateway, not just the authentication. Encrypting only the password is a RADIUS trait, not a VPN one.
    • D. Dynamic Multipoint VPN runs multipoint GRE on the hub with NHRP so spokes register their addresses and learn each other's, then build direct spoke-to-spoke tunnels when traffic needs them, protected by IPsec, without a static tunnel for each pair.
    • E. Standard IPsec does not support multicast or broadcast; that limitation is the reason GRE over IPsec and DMVPN exist.

Common mistakes

• Swapping the TACACS+ and RADIUS facts, especially encryption: TACACS+ encrypts the entire packet body, RADIUS encrypts only the password in the Access-Request.
• Believing service password-encryption protects passwords; it applies the reversible type 7 encoding, which any online decoder breaks in a second, while enable secret and username secret store a one-way hash.
• Calling the switch the authentication server in 802.1X; the switch or wireless LAN controller is the authenticator, the RADIUS server (such as ISE) is the authentication server and the endpoint software is the supplicant.
• Treating exec-timeout 0 0 as a short timeout; it disables the idle timeout completely, so a session left open at an unattended desk stays open.
• Picking a technical control for a human problem: if the user was tricked into giving away the password, the direct fix is awareness training plus multifactor authentication, not a longer password rule.

Questions people ask

More CCNA topics

• CCNA Subnetting Practice Questions
• CCNA OSPF Practice Questions: Single-Area OSPFv2
• CCNA VLANs and Trunking: Practice Questions
• CCNA ACL Practice Questions
• CCNA NAT, PAT and Port Forwarding Practice Questions
• CCNA Spanning Tree Protocol: Practice Questions
• CCNA IPv6 Practice Questions: Addressing, EUI-64, SLAAC and NDP
• CCNA EtherChannel: Practice Questions
• CCNA First-Hop Redundancy Practice Questions: HSRP, VRRP and GLBP
• CCNA Wireless Fundamentals Practice Questions
• CCNA Static Routing Practice Questions: ip route and the Routing Table
• CCNA IP Services Practice Questions
• CCNA Layer 2 Security Practice Questions
• CCNA QoS Practice Questions (200-301)
• CCNA Automation and Programmability Practice Questions
• CCNA practice test: all domains