Cisco security chapter 2

What is the default privilege level of user accounts created on Cisco routers?

1*

What is a requirement to use the Secure Copy Protocol feature?

A command must be issued to enable the SCP server side functionality.*

What is a characteristic of the Cisco IOS Resilient Configuration feature?

A snapshot of the router running configuration can be taken and securely archived in persistent storage.*

Which two characteristics apply to role-based CLI access superviews? (Choose two.)

A specific superview cannot have commands added to it directly.* Users logged in to a superview can access all commands specified within the associated CLI views.*

If AAA is already enabled, which three CLI steps are required to configure a router with a specific view? (Choose three.)

Create a view using the parser view view-name command.* Assign a secret password to the view.* Assign commands to the view.*

Which three statements describe limitations in using privilege levels for assigning command authorization? (Choose three.)

Creating a user account that needs access to most but not all commands can be a tedious process.* Commands set on a higher privilege level are not available for lower privilege users.* There is no access control to specific interfaces on a router.*

An administrator defined a local user account with a secret password on router R1 for use with SSH. Which three additional steps are required to configure R1 to accept only encrypted SSH connections? (Choose three.)

Enable inbound vty SSH sessions.* Configure the IP domain name on the router.* Generate the SSH keys.*

Which recommended security practice prevents attackers from performing password recovery on a Cisco IOS router for the purpose of gaining access to the privileged EXEC mode?

Locate the router in a secure locked room that is accessible only to authorized personnel.*

A network administrator notices that unsuccessful login attempts have caused a router to enter quiet mode. How can the administrator maintain remote access to the networks even during quiet mode?

Quiet mode behavior can be overridden for specific networks by using an ACL.*

Which set of commands are required to create a username of admin, hash the password using MD5, and force the router to access the internal username database when a user attempts to access the console?

R1(config)# username admin secret Admin01pa55 R1(config)# line con 0 R1(config-line)# login local*

What is a characteristic of the MIB?

The OIDs are organized in a hierarchical structure.*

What occurs after RSA keys are generated on a Cisco router to prepare for secure device management?

The generated keys can be used by SSH.*

A network engineer is implementing security on all company routers. Which two commands must be issued to force authentication via the password 1A2b3C for all OSPF-enabled interfaces in the backbone area of the company network? (Choose two.)

area 0 authentication message-digest* ip ospf message-digest-key 1 md5 1A2b3C*

Which three items are prompted for a user response during interactive AutoSecure setup? (Choose three.)

content of a security banner* enable secret password* enable password*

Which three actions are produced by adding Cisco IOS login enhancements to the router login process? (Choose three.)

create syslog messages* slow down an active attack* disable logins from specified hosts*

Which two options can be configured by Cisco AutoSecure? (Choose two.)

enable secret password* security banner*

What command must be issued to enable login enhancements on a Cisco router?

login block-for*

What is the Control Plane Policing (CoPP) feature designed to accomplish?

prevent unnecessary traffic from overwhelming the route processor*

Which three areas of router security must be maintained to secure an edge router at the network perimeter? (Choose three.)

router hardening* operating system security* physical security*

Which three functions are provided by the syslog logging service? (Choose three.)

specifying where captured information is stored* gathering logging information* distinguishing between information to be captured and information to be ignored*

Which three types of views are available when configuring the role-based CLI access feature? (Choose three.)

superview* root view* CLI view*

What is the purpose of using the ip ospf message-digest-key key md5 password command and the area area-id authentication message-digest command on a router?

to configure OSPF MD5 authentication globally on the router*

What are two reasons to enable OSPF routing protocol authentication on a network? (Choose two.)

to prevent data traffic from being redirected and then discarded* to prevent redirection of data traffic to an insecure link*