CCNP Infrastructure Security

8 Questions

Question 1

Which traffic does the following configuration allow ?

ipv6 access-list cisco
permit ipv6 host 2001:DB8:0:4::32 any eq ssh
line vty 0 4
ipv6 access-class cisco in

A) all traffic to vty 0 4 from source 2001:DB8:0:4::32

B) only ssh traffic to vty 0 4 from source all

C) only ssh traffic to vty 0 4 from source 2001:DB8:0:4::32

D) all traffic to vty 0 4 from source all

Question 2

For troubleshooting purposes, which method can you use in combination with the "debug ip packet" command to limit the amount of output data?

A) You can disable the IP route cache globally

B) You can use the KRON scheduler

C) You can use extended access list

D) You can use an IOS parser

E) You can use the RITE traffic exporter.

Question 3

Refer to the following access list.

access-list 100 permit ip any any log

After applying the access list on a Cisco router, the network engineer notices that the router CPU utilitzation has risen to 99 percent. What is the reaon for this?

A) A packet that matches access-list with the "log" keyword is Cisco Express Forwarding switched.

B) A packet that matches access-list with the "log" keyword is fast switched.

C) A packet that matches access-list with the "log" keyword is process switched.

D) A large amount of IP traffic is being permitted on the router.

Question 4

Which address is used by the Unicast Reverse Path Forwarding protocol to validate a packet against the router table ?

A) source address

B) destination address

C) router interface

D) default gateway

Question 5

What are the three modes of Unicast Reverse Path Forwarding?

A) strict mode, loose mode and VRF mode

B) strict mode, loose mode and broadcast mode

C) strict mode, broadcast mode and VRF mode

D) broadcast mode, loose mode and VRF mode.

Question 6

Refer to the following command:
router(config)# ip http secure-port 4433

Which statement is true?

A) The router will listen on port 4433 for HTTPS traffic

B) The router will listen on port 4433 for HTTP traffic.

C) The router will never accept any HTTP and HTTPS traffic.

D) The router will listen to HTTP and HTTPS traffic on port 4433.

Question 7

A network engineer is configuring a routed interface to forward broadcasts of UDP 69,53 and 49 to 172.20.14.225. Which command should be applied to the configuration to allow this? ?

A) router(config-if)# ip helper-address 172.20.14.225

B) router(config-if)# udp helper-address 172.20.14.225

C) router(config-if)# ip udp helper-address 172.20.14.225

D) router(config-if)# ip helper-address 172.20.14.225 69 53 49

Question 8

A) it prevents incoming traffic from IP address ranges 10.0.0.0-10.0.0.255, 172.16.0.0-172.31.255.255, 192.168.0.0-192.168.255.255 and logs any intrusion attempts.

B) it prevents the internal network from being used in spoofed denial of service attacks and logs any exit to the Internet.

C) it filters incoming traffic from private addresses in order to prevent spoofing and logs any intrusion attempts.

D) it prevents private internal addresses to be accessed directly from outside.