Cisco CCNA 200-301 Questions & Answers

• Question 1261:

  What are two protocols within the IPsec suite? (Choose two.)

  A. 3DES

  B. AES

  C. ESP

  D. TLS

  E. AH

  Correct Answer: CE

  IPsec (Internet Protocol Security) is a suite of protocols used for securing internet protocol (IP) communications. The two protocols within the IPsec suite are:

  Authentication Header (AH): AH provides data authentication and integrity protection for IP packets, but does not provide encryption. AH calculates a hash value over the IP packet and some additional data, and places the result in a new header that is added to the packet.

  Encapsulating Security Payload (ESP): ESP provides both encryption and data authentication for IP packets. ESP encrypts the original IP packet and places it inside a new packet, along with a new ESP header that provides data authentication and integrity protection. Both AH and ESP protocols can be used alone or in combination to provide secure communication between two network devices. AH and ESP are often used in conjunction with the Internet Key Exchange (IKE) protocol, which is used to

  negotiate and establish security associations (SAs) between devices. https://www.ibm.com/docs/en/i/7.1?topic=concepts-ip-security-protocols

• Question 1262:

  Refer to the exhibit.

  

  Local access for R4 must be established and these requirements must be met:

  1.

  Only Telnet access is allowed.

  2.

  The enable password must be stored securely.

  3.

  The enable password must be applied in plain text.

  4.

  Full access to R4 must be permitted upon successful login.

  Which configuration script meets the requirements?

  A. ! conf t ! username test1 password testpass1 enable secret level 15 0 Test123 ! line vty 0 15

  login local

  transport input telnet

  B. ! config t ! username test1 password testpass1 enable password level 15 0 Test123 ! line vty 0 15

  login local

  transport input all

  C. ! config t ! username test1 password testpass1 enable password level 1 7 Test123 ! line vty 0 15

  accounting exec default

  transport input all

  D. ! config t ! username test1 password testpass1 enable secret level 1 0 Test123 ! line vty 0 15

  login authentication

  password Test123

  transport input telnet

  Correct Answer: A

• Question 1263:

  What does WPA3 provide in wireless networking?

  A. backward compatibility with WPA and WPA2

  B. safeguards against brute force attacks with SAE

  C. increased security and requirement of a complex configuration

  D. optional Protected Management Frame negotiation

  Correct Answer: B

  https://www.swascan.com/wi-fi-security/

• Question 1264:

  Which global command encrypts all passwords in the running configuration?

  A. service password-encryption

  B. enable password-encryption

  C. enable secret

  D. password-encrypt

  Correct Answer: A

  https://community.cisco.com/t5/other-network-architecture-subjects/service-password-encryption-command/td-p/269324

• Question 1265:

  Refer to the exhibit.

  

  A network administrator is configuring a router for user access via SSH. The service-password encryption command has been issued. The configuration must meet these requirements:

  1.

  Create the username as CCUser.

  2.

  Create the password as NA!2$cc.

  3.

  Encrypt the user password.

  What must be configured to meet the requirements?

  A. username CCUser privilege 10 password NA!2$cc

  B. username CCUser privilege 15 password NA!2$cc enable secret 0 NA!2$cc

  C. username CCUser secret NA!2Sce

  D. username CCUser password NA!2$cc enable password level 5 NA!2$cc

  Correct Answer: C

  To create the username as CCUser, create the password as NA!2$cc, and encrypt the user password, option C is the correct configuration.

  Option A only creates the user and sets a plain-text password. Option B sets a privileged level password for enable mode, but it does not create the user or encrypt the password. Option D creates the user and sets a plain-text password but does not encrypt the password. Option C creates the user, sets an encrypted password, and meets all the specified requirements.

• Question 1266:

  Refer to the exhibit.

  

  How many arrays are present in the JSON data?

  A. one

  B. three

  C. six

  D. nine

  Correct Answer: B

• Question 1267:

  Which interface type enables an application running on a client to send data over an IP network to a server?

  A. northbound interface

  B. application programming interface

  C. southbound interface

  D. Representational State Transfer application programming interface

  Correct Answer: B

• Question 1268:

  Which type of encryption does WPA1 use for data protection?

  A. PEAP

  B. TKIP

  C. AES

  D. EAP

  Correct Answer: B

  WPA1 (Wi-Fi Protected Access 1) uses TKIP (Temporal Key Integrity Protocol) encryption for data protection. TKIP is an encryption protocol that was designed to provide stronger security than the previous WEP (Wired Equivalent Privacy) encryption standard, which was known to have vulnerabilities. TKIP uses a combination of encryption techniques, including a per-packet key mixing function, to provide data confidentiality and integrity. However, TKIP is now considered insecure and has been replaced by AES (Advanced Encryption Standard) in modern Wi-Fi security protocols such as WPA2 and WPA3.

• Question 1269:

  A network engineer must configure an access list on a new Cisco IOS router. The access list must deny HTTP traffic to network 10.125.128.32/27 from the 192.168.240.0/20 network, but it must allow the 192.168.240.0/20 network to reach the rest of the 10.0.0.0/8 network.

  Which configuration must the engineer apply?

  A. ip access-list extended deny_outbound 10 permit ip 192.168.240.0 255.255.240.0 10.0.0.0 255.0.0.0 20 deny tcp 192.168.240.0 255.255.240.0 10.125.128.32 255.255.255.224 eq 443 30 permit ip any any

  B. ip access-list extended deny_outbound 10 deny tcp 192.168.240.0 0.0.15.255 10.125.128.32 0.0.0.31 eq 80

  20 permit ip 192.168.240.0 0.0.15.255 10.0.0.0 0.255.255.255

  30 deny ip any any log

  C. ip access-list extended deny_outbound 10 deny tcp 10.125.128.32 255.255.255.224 192.168.240.0 255.255.240.0 eq 443 20 deny tcp 192.168.240.0 255.255.240.0 10.125.128.32 255.255.255.224 eq 443 30 permit ip 192.168.240.0 255.255.240.0 10.0.0.0 255.0.0.0

  D. ip access-list extended deny_outbound 10 deny tcp 192.168.240.0 0.0.15.255 any eq 80 20 deny tcp 192.168.240.0 0.0.15.255 10.125.128.32 0.0.0.31 eq 80 30 permit ip 192.168.240.0 0.0.15.255 10.0.0.0 0.255.255.255

  Correct Answer: B

• Question 1270:

  When is the PUT method used within HTTP?

  A. to update a DNS server

  B. when a nonidempotent operation is needed

  C. to display a web site

  D. when a read-only operation is required

  Correct Answer: A

  "Standard REST methods are supported on the API, which includes POST, GET, PUT, and DELETE operations through HTTP. The PUT methods are idempotent, meaning that there is no additional effect if they are called more than once with the same input parameters. The GET method is nullipotent, meaning that it can be called zero or more times without making any changes (or that it is a read-only operation)."

  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/aci_multi-site/sw/1x/rest_api_config/b_Cisco_ACI_Multi-Site_REST_Configuration_Guide/b_Cisco_ACI_Multi-Site_REST_Config_Guide_chapter_01.pdf