Chapter 8
how many bits in the modulus
after entering the "crypto key genereate rsa" command; what information does the CLI ask the user?
no
after the "no service password-encryption" command is used; will changes to existing passwords be encrypted?
ip domain-name (example.com) crypto key generate rsa
black commands
enable use of local usernames
blue what's happening
switchport port-security mac-address (mac-address) @interface subcommand
command to configure specific allowable MACs for an interface
global config mode
green mode
telnet or SSH
green protocols
Tells IOS to prompt for a password.
login purpose
Console and vty configuration mode
password (pass-value) mode
-a working IP configuration -login security on the vty lines
what is required to allow a vty (Telnet or SSH) session user to reach user mode
shutdown
what is the default action taken upon a security violation
"begin" shows the output starting at line vty "section" only shows the output for that section "include" only shows line that include the text
what is the difference in the out put of the three commands? show running-config | begin (line vty) show running-config | section (line vty) show running-config | include (line vty)
create an encryption key create usernames and passwords
what must a user do to configure a switch to support inbound SSH login
line vty 0 15 login local
when Configuring Switches how do you tell the switch to use local username login authentication
global config mode
when Configuring Switches to Use Local Username Login Authentication; in what mode do you enter the command "username wendell password odom"
@vty mode login local
when configuring a switch to support inbound SSH login; how do you Enable Use of Local Usernames
@ global config mode ip domain-name example.com crypto key generate rsa
when configuring a switch to support inbound SSH login; how do you create an encryption key
any character, then the banner login, then end with the same character from the beginning
when configuring the banner login with the "banner login" command what else do you need to type besides the banner login?
farts.example.com
when configuring the switch to support inbound SSH login; what will the name for the key be if the domain name is "example.com" and the switch's hostname is "farts"?
no
when viewing the results of the show running-config (or show startup-config if the configuration was saved to the startup) will you be able to read the password created by the "enable secret" global command?
yes
when viewing the results of the show running-config (or show startup-config if the configuration was saved to the startup) will you be able to read the password created by the "password (p/w)" command?
SSH, RADIUS and TACACS+
which protocols encrypt sent passwords
a d
An engineer had formerly configured a Cisco 2960 switch to allow Telnet access so that the switch expected a password of mypassword from the Telnet user. The engineer then changed the configuration to support Secure Shell. Which of the following commands could have been part of the new configuration? A. A login local vty mode subcommand B. A username (name) password (password) vty mode subcommand C. A transport input ssh global configuration command D. A username name password password global configuration command
b e f
An engineer's desktop PC connects to a switch at the main site. A router at the main site connects to each branch office through a serial link, with one small router and switch at each branch. Which of the following commands must be configured on the branch office switches, in the listed configuration mode, to allow the engineer to telnet to the branch office switches? A. The password command in console line configuration mode B. The ip default-gateway command in global configuration mode C. The ip default-gateway command in VLAN configuration mode D. The ip address command in global configuration mode E. The password command in vty line configuration mode F. The ip address command in interface configuration mode
Port channel misconfiguration BPDU (bridge protocol data unit) guard violation Late-collision detection Link-flap detection Security violation
An interface is placed in the error disabled state when the switch detects an error on the port. Some conditions that cause IOS to place a port in this state are:
c
Imagine that you have configured the enable secret command, followed by the enable password command, from the console. You log out of the switch and log back in at the console. Which command defines the password that you had to enter to access privileged mode? A. The password command, if it's configured B. enable password C. enable secret D. Neither
b
The following command was copied and pasted into configuration mode when a user was telnetted into a Cisco switch: banner login this is the login banner Which of the following is true about what occurs the next time a user logs in from the console? A. The banner text "this is the login banner" is displayed. B. The banner text "his is" is displayed. C. No banner text is displayed. D. The banner text "Login banner configured, no text defined" is displayed.
c
Which of the following is required when configuring port security with sticky learning? A. Defining the specific allowed MAC addresses using the switchport port-security mac-address interface subcommand B. All the other answers list required commands C. Enabling port security with the switchport port-security interface subcommand D. Setting the maximum number of allowed MAC addresses on the interface with the switchport port-security maximum interface subcommand
switchport port-security maximum (number) @ the interface subcommand
command to configure maximum number of allowed MAC addresses associated with the interface
switchport port-security mac-address sticky
command to configure sticky learning on a switch
switchport port-security violation {protect | restrict | shutdown} @interface subcommand
command to override the default action to take upon a security violation
delete
delete
no
do all varieties of port security define a maximum number of destination MAC addresses allowed for all frames coming in the interface.
yes
do all varieties of port security define a maximum number of source MAC addresses allowed for all frames coming in the interface.
no
do all varieties of port security define a minimum number of source MAC addresses allowed for all frames coming in the interface.
no
do all varieties of port security do nothing when attempting to add a new MAC address and it exceeds the configured maximum
no
do all varieties of port security take action when attempting to add a new IP address and it exceeds the configured maximum
yes
do all varieties of port security take action when attempting to add a new MAC address it exceeds the configured maximum
no
do all varieties of port security watch all incoming frames, and keep a list of all destination MAC addresses, plus a counter of the number of different destination IP addresses.
no
do all varieties of port security watch all incoming frames, and keep a list of all source IP addresses, plus a counter of the number of different source IP addresses.
yes
do all varieties of port security watch all incoming frames, and keep a list of all source MAC addresses, plus a counter of the number of different source MAC addresses.
yes
do the default console configuration settings allow a console user to reach both user mode and enable mode without supplying a password.
no
do the default vty (Telnet or SSH) configuration settings allow a console user to reach both user mode and enable mode without supplying a password.
no
do you need to predefine the specific MAC addresses with sticky learning
global mode
grey mode
switchport port-security @ the interface subcommand
how do you enable port security
@ global config or subcommand mode "interface vlan1"
how do you get into the vlan 1 interface?
"switchport mode {access|trunk}" @ the interface subcommand
how do you set a switch interface to be an access port or trunk port?
shutdown @ interface subcommand.
how does one Administratively disable an interface
switchport access vlan (number) @interface subcommand
how does one assign a port to an unused VLAN
switchport mode access @ interface subcommand
how does one make a port a nontrunking interface
switchport trunk native vlan (vlan-id) @ interface subcommand.
how does one set the native VLAN to not be VLAN 1, but to instead be an unused VLAN
yes
if a password is changed with the "service password-encryption" command in the configuration; will the new password still be encrypted?
no
if the "no service password-encryption" command is used; will existing passwords loose their encryption?
discards offending traffic
if the option on the switchport port-security violation command is "protect" what does it do?
-discards offending traffic -sends log and SNMP messages
if the option on the switchport port-security violation command is "restrict" what does it do?
-discards offending traffic -sends log and SNMP messages -disables the interface, discarding all traffic
if the option on the switchport port-security violation command is "shutdown" what does it do?
type out the command line for each MAC
if you have multiple MACs to configure to be the only allowable ones do you enter a range or do you have to type out the command line for each MAC
it requires a username
in configuration, how is SSH different from Telnet?
enable
in the CLI, the symbol "#" terminating the prompt denotes the user is in which mode?
user
in the CLI, the symbol ">" terminating the prompt denotes the user is in which mode?
no
is it necessary to use the "login local" command in the line vty 0 15 interface IF the password/username is not being stored locally
no
is the following command a global config mode command: "transport input ssh"?
no
is the ~transport input ssh~ command a global configuration command
global or any interface config
line console 0 mode
global or any interface config
line vty (1st-vty last-vty) mode
Changes the context to vty configuration mode for the range of vty lines listed in the command
line vty (1st-vty last-vty) purpose
Console and vty configuration mode.
login mode
"ip address" ip-address "no shutdown" @ global config mode"ip default-gateway" ip-address
once in the correct vlan interface, what further commands need to be issued to configure ipv4 on a switch
create encryption key
purple what's happening
create usernames and passwords
red what's happening
in a large network, storing pairs locally requires that every router and switch be configured
what advantage does securing access with external authentication servers present when compared to storing password/username pairs locally?
protect restrict shutdown
what are all the optional security violation actions
set maximum # allowed MACs Override default security violation action Predefine allowed source MACs "sticky learn"
what are four options for configuring port security
set the interface to trunk or access mode and enable port security
what are two things that need to be done to configure port security
status information about the SSH server itself
what does the "show ip ssh" command list
information about each SSH client currently connected into the switch
what does the "show ssh" command list
- a working IP configuration - login security on the vty lines - enable mode security
what is required to allow a vty (Telnet or SSH) session user to reach enable mode
yes
when viewing the results of the show running-config (or show startup-config if the configuration was saved to the startup) will you be able to read the password created by the "username (name) password (p/w)" global command?
VTY mode
yellow mode
global
"service password-encryption" mode
Changes the context to console configuration mode.
line console 0 purpose
global configuration mode
username "name" password "password"; mode?
enable secret
IOS accepts only the password as configured in which command if both the enable secret and the enable password passwords are configured?
b
In which of the following modes of the CLI could you configure the duplex setting for interface Fast Ethernet 0/5? A. Enable mode B. Interface configuration mode C. Global configuration mode D. User mode E. VLAN mode
stores username/password pairs
What does an AAA server do
authentication, authorization, and accounting
What does an AAA server stand for
1
What is the default setting for the maximum number of MAC addresses
e
Which of the following describes a way to disable IEEE standard autonegotiation on a 10/100 port on a Cisco switch? A. Configure the speed 100 interface subcommand B. Configure the no negotiate interface subcommand C. Configure the negotiate disable interface subcommand D. Configure the duplex half interface subcommand E. Configure the speed 100 and duplex full interface subcommands F. Configure the duplex full interface subcommand
improves the underlying security algorithms provides login banner support
advantages of SSH v2 over v1
AAA server
fuschia device
RADIUS or TACACS+
purple protocols
the "password" command, in both console and vty modes; the "username (name) password (p/w)" global command
the "service password-encryption" affects which passwords
example: show running-config | begin (line vty) show running-config | section (line vty) show running-config | include(line vty)
the show commands can list a lot of info, how can you skip to the desired area?
Administratively disable the interface make the port a nontrunking interface Assign the port to an unused VLAN Set the native VLAN to not be VLAN 1, but to instead be an unused VLAN,
to secure unused switch interfaces what do you do?
Emma(config-if)# ip address dhcp Emma(config-if)# no shutdown
to tell the switch to use DHCP on the interface, and enable the interface; which commands?
all - Supports SSH and Telnet none- supports neither telnet - supports Telnet SSH - supports SSH
transport input {all | none | telnet | ssh} meaning for each switch
vty subcommand
transport input {all | none | telnet | ssh} mode?
@ global config mode username (somename) password ( some p/w) username (somename2) password ( some p/w2)
when configuring a switch to support inbound SSH login; how do you create usernames and passwords
@global config ip ssh version 2
when configuring a switch to support inbound SSH login; how do you use SSH Version 2 rather than Version 1.
