Twenty questions on the whole course, each with an explanation.
Intermediate · 15 min read
Technical definition
A mitigation is a control that reduces the chance or the impact of a threat using a vulnerability. In this course that means port security, DHCP snooping and Dynamic ARP Inspection on switches, SSH and AAA for device access, ACLs on routers, and IPsec VPNs across the internet.
Twenty questions on the whole course, using the course lab networks. The access layer is SW1 with users in VLAN 10 (192.168.10.0/24) on Gi1/0/1 to Gi1/0/23 and the uplink Gi1/0/24 to R1 (192.168.10.1), the default gateway and DHCP server. The ACL lab has Sales (192.168.10.0/24, PC1 192.168.10.10) on R1 Gi0/0, Admin (192.168.20.0/24, Admin PC 192.168.20.10) on R1 Gi0/2, the link 10.0.12.0/30 to R2, and the web server SRV1 (192.168.30.10) on R2 Gi0/0. The VPN questions join R1 at HQ (203.0.113.1) to BR1 at the branch (198.51.100.1, LAN 192.168.50.0/24). If you get one wrong, the explanation names the lesson to go back to.
Predict · scenario 1
1. A visitor plugs a laptop into a meeting-room wall port and reaches internal file shares on the staff VLAN. Which of these fixes is a security program measure rather than a switch or server configuration?
Predict · scenario 2
2. show port-security interface GigabitEthernet1/0/1 shows Port Status: Secure-shutdown, Violation Mode: Shutdown, Last Source Address:Vlan: 00aa.bbcc.ddee:10 and Security Violation Count: 1. What happened?
Predict · scenario 3
3. A desk port has switchport port-security with the defaults. A user connects an IP phone with their PC plugged in behind it, and the port shuts down. What is the right fix?
Predict · scenario 4
4. PCs on VLAN 10 get 192.168.0.x addresses with gateway 192.168.0.1 from a home router on Gi1/0/5. Which configuration on SW1 stops this?
Predict · scenario 5
5. SW1 logs: %PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state. What caused it?
Predict · scenario 6
6. DAI is on for VLAN 10. The attacker on untrusted port Gi1/0/5 leased 192.168.10.66 and sends a reply saying 192.168.10.1 is at the attacker's MAC. What does the switch do?
Predict · scenario 7
7. show ip arp inspection statistics vlan 10 shows Forwarded 1532, Dropped 41, DHCP Drops 41, ACL Drops 0. What do the 41 DHCP Drops count?
Predict · scenario 8
8. A desk port on SW1 has one sticky MAC and violation shutdown. The user's PC is replaced, and the port goes err-disabled with reason psecure-violation. What is the right recovery?
Predict · scenario 9
9. On SW1, which already has hostname SW1, crypto key generate rsa modulus 2048 returns: % Please define a domain-name first. What do you enter?
Predict · scenario 10
10. show ip ssh on SW1 shows: SSH Enabled - version 1.99. What does this tell you?
Predict · scenario 11
11. SW1 has aaa authentication login default group TAC-SERVERS local. The TACACS+ server 192.168.20.50 is down and gives no answer. Can the local user admin log in over SSH?
Predict · scenario 12
12. SW1 must hold each laptop's port closed until Cisco ISE has checked the user with 802.1X. Which protocol carries the check between SW1 and ISE?
Predict · scenario 13
13. Which standard ACL entry matches exactly the hosts 172.16.4.0 to 172.16.7.255?
Predict · scenario 14
14. Sales can still reach SRV1 after the change. On R2, show access-lists lists PROTECT-SERVERS with no matches, and show ip interface GigabitEthernet0/0 shows: Outgoing access list is PROTECT-SERVRES. Why is nothing blocked?
Predict · scenario 15
15. To keep Sales off the server LAN, an engineer applies a standard ACL (deny 192.168.10.0 0.0.0.255, then permit any) inbound on R1 Gi0/0. What else happens?
Predict · scenario 16
16. SALES-IN, inbound on R1 Gi0/0, reads: 10 permit tcp 192.168.10.0 0.0.0.255 host 192.168.30.10 eq 443; 20 permit icmp 192.168.10.0 0.0.0.255 host 192.168.30.10 echo; 30 deny ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 log; 40 permit ip any any. PC1 opens a file share on SRV1 (TCP 445). What happens?
Predict · scenario 17
17. After adding 'permit tcp 192.168.10.0 0.0.0.255 eq 443 host 192.168.30.10' to an ACL, Sales still can't open the web app on SRV1. What is wrong with the entry?
Predict · scenario 18
18. In the ACL lab, SALES-IN ends with 40 deny ip 192.168.10.0 0.0.0.255 host 192.168.30.10 and 50 permit ip 192.168.10.0 0.0.0.255 any, and R2's VTY lines have access-class VTY-ADMIN in (permit host 192.168.20.10). PC1 tries to SSH to R2 (10.0.12.2). What happens?
Predict · scenario 19
19. Which statement about the site-to-site IPsec VPN between R1 and BR1 is true?
Predict · scenario 20
20. R1 also gives the HQ LAN internet access with PAT, using a NAT ACL that only has permit ip 192.168.10.0 0.0.0.255 any. HQ-to-branch traffic doesn't use the tunnel. What fixes it?