I85PREP
⌘ K
Cisco 300-220 CBRTHD study materials
Cisco 300-220 CBRTHD study resources

Cisco 300-220 CBRTHD practice questions

One question at a time. Build your Cisco 300-220 CBRTHD understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts

In a Cisco security architecture, which plane carries management traffic such as SSH, SNMP, and syslog to and from a router or switch?

  1. The control plane
  2. The forwarding plane
  3. The data plane
  4. The management plane Correct answer.

Explanation

The management plane handles traffic used to administer and monitor the device, including SSH, SNMP, NTP, and syslog. The control plane builds routing and topology state, while the data plane forwards user traffic; forwarding plane is another name for the data plane.

Question 2Security Concepts

Which statement best describes the principle of least privilege as applied to network device administration?

  1. Administrative access is granted to all staff during onboarding
  2. Privilege levels are identical for console and remote access
  3. Each administrator receives only the rights required for their assigned tasks Correct answer.
  4. Every administrator shares a single privileged account for simplicity

Explanation

Least privilege means granting an identity only the access needed to perform its function, nothing broader. Shared accounts, blanket onboarding access, and uniform privilege across access paths all violate this principle because they expand the blast radius of misuse or compromise.

Question 3Security Concepts

An engineer needs to authenticate administrators against a central identity store that supports group-based authorization and encrypted communication. Which solution meets this requirement?

  1. A shared enable secret
  2. Local username database on each device
  3. TACACS+ with a central server Correct answer.
  4. Console-only access with no authentication

Explanation

TACACS+ provides centralized AAA with per-command authorization and separates authentication, authorization, and accounting, and it encrypts the full payload. Local accounts do not centralize policy, and shared secrets provide no per-user identity or authorization granularity.

Question 4Security Concepts

Which Cisco feature verifies that only authorized endpoints connect to a switch port before granting network access?

  1. 802.1X port-based authentication Correct answer.
  2. EtherChannel
  3. Port mirroring
  4. Spanning Tree Protocol

Explanation

IEEE 802.1X performs port-based network access control, requiring the supplicant to authenticate through an authenticator before the port passes normal traffic. The other features concern monitoring, loop prevention, and link aggregation, not identity-based admission.

Question 5Security Concepts

Which protocol protects the confidentiality and integrity of web-based administrative sessions by using TLS?

  1. TFTP
  2. SNMPv1
  3. HTTPS Correct answer.
  4. Telnet

Explanation

HTTPS wraps HTTP inside TLS, providing encryption and integrity for management sessions such as device GUIs. TFTP and Telnet are cleartext, and SNMPv1 uses community strings without encryption or strong integrity.

Question 6Security Concepts

Which security concept describes reducing the exposed surface of a system by disabling unused services and closing unnecessary ports?

  1. Non-repudiation
  2. Attack surface reduction Correct answer.
  3. Defense in depth
  4. Separation of duties

Explanation

Attack surface reduction removes or disables unnecessary services, ports, and features so fewer entry points exist for an adversary. Defense in depth layers controls, separation of duties divides responsibilities, and non-repudiation ensures actions cannot be denied.

Question 7Security Concepts

What is the primary purpose of a DMZ in a network security design?

  1. To aggregate access-layer VLANs into a single broadcast domain
  2. To provide a redundant path for interior routing protocols
  3. To host externally reachable services while limiting their access to the internal network Correct answer.
  4. To store encrypted backups of configuration files

Explanation

A DMZ segments internet-facing services so that compromise of those hosts does not grant direct access to internal systems. It is a containment zone, not a routing redundancy mechanism, backup store, or VLAN aggregation design.

Question 8Security Concepts

Which statement correctly distinguishes authentication from authorization?

  1. Authentication applies only to devices, while authorization applies only to users
  2. Authentication verifies identity, while authorization determines what the identity may do Correct answer.
  3. Authentication and authorization are both performed only by the accounting server
  4. Authentication determines permissions, while authorization verifies credentials

Explanation

Authentication establishes who the subject is, and authorization decides which resources or commands that subject may use. Accounting is a separate function that records activity, and both authentication and authorization apply to users and devices.

Question 9Security Concepts

A company wants to enforce that only the finance VLAN can reach the payroll server. Which technology most directly implements this requirement?

  1. VLAN access control lists applied to the finance and server segments Correct answer.
  2. BPDU Guard on access ports
  3. Dynamic ARP Inspection on the user VLANs
  4. Port security limiting MAC addresses per port

Explanation

VLAN ACLs filter inter-VLAN traffic based on addresses and ports, which is exactly the control needed to restrict payroll access to finance. Port security, DAI, and BPDU Guard address Layer 2 spoofing or topology attacks and do not enforce inter-segment policy.

Question 10Security Concepts

Which characteristic makes TACACS+ preferable to RADIUS for device administration in many Cisco deployments?

  1. It cannot integrate with a central identity store
  2. It encrypts only the password field and uses UDP transport
  3. It is designed primarily for network access accounting of dial-in users
  4. It separates authentication, authorization, and accounting and supports per-command authorization Correct answer.

Explanation

TACACS+ separates the AAA functions and enables granular per-command authorization, which suits administrative access to network devices. RADIUS combines authentication and authorization, encrypts only the password, and is oriented toward network access services.

Question 11Security Concepts

An administrator wants to restrict SSH access to the management plane so that only the operations subnet can connect. Which configuration approach accomplishes this?

  1. Apply an ACL inbound on all user-facing data ports
  2. Configure port security with a sticky MAC address
  3. Apply an ACL to the VTY lines permitting only the operations subnet Correct answer.
  4. Enable CDP on all interfaces

Explanation

VTY access lists filter who may open remote management sessions to the device, which directly controls management-plane exposure. Data-port ACLs affect transit traffic, port security limits MAC addresses, and CDP discovery has no bearing on SSH admission.

Question 12Security Concepts

What is the security benefit of implementing private VLANs on a switch?

  1. Isolated ports cannot communicate with each other, limiting lateral movement within a subnet Correct answer.
  2. Traffic between ports is encrypted by the switch
  3. All ports share a single broadcast domain for simpler management
  4. Routing between VLANs is performed by the switch at line rate

Explanation

Private VLANs split a primary VLAN into isolated and community secondary VLANs, so hosts on isolated ports cannot reach one another even within the same subnet. This restricts east-west movement during an incident without requiring additional subnets.

Question 13Security Concepts

Which control best mitigates MAC flooding attacks on an access switch?

  1. Disabling Spanning Tree on access ports
  2. Increasing the CAM aging time
  3. Enabling proxy ARP on the SVI
  4. Port security limiting the number of learned MAC addresses per port Correct answer.

Explanation

MAC flooding attempts to overflow the CAM table so that unknown unicast is flooded and can be captured. Port security caps the number of MAC addresses per port, preventing a single host from filling the table.

Question 14Security Concepts

A DHCP snooping deployment is configured with the uplink trusted and user ports untrusted. What does this prevent?

  1. Users from resolving names through DNS
  2. Routers from forming OSPF adjacencies
  3. Switches from learning MAC addresses on trusted ports
  4. Rogue DHCP servers on user-facing ports from assigning addresses Correct answer.

Explanation

DHCP snooping classifies ports as trusted or untrusted; DHCP server messages arriving on untrusted ports are dropped, blocking rogue servers. It does not affect DNS resolution, MAC learning on trusted ports, or routing protocol adjacencies.

Question 15Security Concepts

Which statement about IPsec transport mode and tunnel mode is accurate?

  1. Both modes always encrypt the original IP header
  2. Transport mode protects the payload with the original IP header, while tunnel mode encapsulates the entire packet in a new IP header Correct answer.
  3. Transport mode encrypts the entire original packet including the IP header, while tunnel mode protects only the payload
  4. Tunnel mode is used only for host-to-host sessions on the same subnet

Explanation

In transport mode the original IP header is retained and the payload is protected, which suits host-to-host sessions. Tunnel mode wraps the whole original packet inside a new IP header, enabling site-to-site and gateway-to-gateway protection.

Question 16Security Concepts

Which IPsec component provides data origin authentication and integrity without encryption?

  1. Authentication Header Correct answer.
  2. Encapsulating Security Payload
  3. Internet Key Exchange phase 1
  4. Diffie-Hellman group 14

Explanation

The Authentication Header applies integrity and origin authentication to the packet but performs no encryption. ESP can provide confidentiality as well as integrity, while IKE and Diffie-Hellman are used for negotiation and key exchange.

Question 17Security Concepts

What is the role of a certificate authority in a PKI used for device and VPN authentication?

  1. It encrypts all traffic between VPN peers
  2. It signs certificates that bind a public key to an identity Correct answer.
  3. It assigns IP addresses to tunnel endpoints
  4. It stores private keys for all relying parties

Explanation

A certificate authority issues and signs certificates, vouching that a public key belongs to the named subject so relying parties can validate identity. Private keys remain with their owners, and encryption and address assignment are separate functions.

Question 18Security Concepts

An engineer must ensure that a compromise of a branch router does not expose credentials used to administer the hub. Which practice best supports this goal?

  1. Configure the same local administrator password on all devices for consistency
  2. Use unique per-device credentials and role-based accounts rather than shared administrative logins Correct answer.
  3. Store all device credentials in a plaintext file on a TFTP server
  4. Allow any administrator to use the enable secret for all devices

Explanation

Unique, role-based credentials limit lateral movement because a compromised device does not yield reusable passwords for other devices. Shared passwords, plaintext credential storage, and universal enable secrets all extend the impact of a single compromise.

Question 19Security Concepts

Which mechanism enables a switch to block traffic from an endpoint whose MAC address does not match an entry in the DHCP snooping binding table?

  1. Dynamic ARP Inspection Correct answer.
  2. Storm control
  3. Root Guard
  4. BPDU Guard

Explanation

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table and drops entries that do not match, preventing ARP spoofing. BPDU Guard and Root Guard protect the spanning-tree topology, and storm control limits broadcast or multicast rates.

Question 20Security Concepts

A security team wants to detect unauthorized configuration changes on a router. Which combination is most appropriate?

  1. Increasing the console baud rate
  2. Enabling CDP on all interfaces
  3. Disabling NTP to reduce external dependencies
  4. Centralized logging with timestamps plus configuration change notification and archive Correct answer.

Explanation

Accurate timestamps from NTP combined with configuration change notification and archived configurations create an auditable record of modifications. Console speed, CDP advertisements, and disabling time synchronization do not provide change detection and can hinder investigations.

Question 21Security Concepts

Which statement about control plane policing is correct?

  1. It encrypts routing protocol updates between peers
  2. It rate-limits traffic destined to the device CPU to protect routing and management processes Correct answer.
  3. It prioritizes user data traffic over management traffic
  4. It replaces ACL filtering on data-plane interfaces

Explanation

Control plane policing applies QoS policies to traffic punted to the CPU, protecting routing and management processes from overload or DoS. It does not encrypt routing updates, prioritize user data, or substitute for data-plane ACLs.

Question 22Security Concepts

A network uses 802.1X with MAC authentication bypass as a fallback. What risk does MAB introduce?

  1. A spoofed MAC address can be used to gain the access granted to the legitimate device Correct answer.
  2. RADIUS accounting is disabled automatically
  3. The authenticator stops forwarding all traffic
  4. Certificates are no longer validated on any port

Explanation

MAB authenticates a device by its MAC address, which can be spoofed, so an attacker may inherit the authorization of a legitimate device. It does not invalidate certificate checks globally, halt forwarding, or disable accounting.

Question 23Security Concepts

An organization requires that all management traffic to network devices be encrypted and that management access be restricted to a dedicated out-of-band segment. Which design best satisfies both requirements?

  1. Console access only, with no remote management path
  2. SNMPv1 read-write access from the production VLAN
  3. SSH and HTTPS access through a management VRF reachable only from the OOB segment, with ACLs limiting sources Correct answer.
  4. Telnet access from any internal subnet with strong passwords

Explanation

Combining encrypted management protocols with a dedicated management VRF and source ACLs delivers both confidentiality and reachability restriction. Telnet and SNMPv1 are cleartext, and console-only access sacrifices the remote management the requirement implies.

Question 24Security Concepts

Why does zone-based firewall policy design generally scale better than interface ACLs on a router with many interfaces?

  1. Zones eliminate the need for any access control entries
  2. Policies are applied between security zones, so interfaces added to a zone inherit the same policy Correct answer.
  3. Each interface must be configured with its own unique ACL
  4. Zone policies bypass all inspection of return traffic

Explanation

Zone-based policy groups interfaces into zones and applies policy to zone pairs, so new interfaces inherit existing rules instead of requiring per-interface ACL maintenance. It still uses access control entries and stateful inspection rather than bypassing them.

Question 25Security Concepts

Which scenario most clearly demonstrates a man-in-the-middle risk on a management network?

  1. An attacker on the same segment captures Telnet credentials and replays them to the device Correct answer.
  2. An attacker sends oversized ICMP packets to the router
  3. An attacker sends BPDUs to influence root bridge election
  4. An attacker floods the CAM table to disrupt forwarding

Explanation

Because Telnet is cleartext, an on-path attacker can read credentials and reuse them, which is a classic MITM outcome. ICMP flooding, CAM flooding, and BPDU injection are denial-of-service or topology attacks rather than credential interception.

Question 26Security Concepts

Which security principle limits each user or process to only the data and commands required to perform its assigned task?

  1. Least privilege Correct answer.
  2. Separation of duties
  3. Defense in depth
  4. Zero trust

Explanation

Least privilege grants the minimum access necessary for a role, reducing the blast radius of misuse or compromise. The other principles describe layered controls, split responsibilities, or continuous verification rather than scoping access to the minimum.

Question 27Security Concepts

What does the confidentiality service of a cryptographic system primarily protect against?

  1. Repudiation of a transaction
  2. Undetected modification of data
  3. Unauthorized disclosure of data Correct answer.
  4. Denial of service by flooding

Explanation

Confidentiality ensures data is not readable by parties lacking the proper key, typically through encryption. Integrity, non-repudiation, and availability are separate services addressed by hashing, digital signatures, and resilience controls.

Question 28Security Concepts

Which document type typically defines the high-level management intent and mandatory requirements that a security policy must satisfy?

  1. Baseline
  2. Security policy Correct answer.
  3. Standard
  4. Procedure

Explanation

A security policy states management intent and mandatory requirements at a high level. Standards, procedures, and baselines then specify mandatory specifics, step-by-step actions, and minimum configuration settings that implement the policy.

Question 29Security Concepts

Which threat is best described as an attacker positioning a device to intercept and relay traffic between two legitimate endpoints?

  1. Brute-force attack
  2. Phishing
  3. Replay attack
  4. On-path attack Correct answer.

Explanation

An on-path (man-in-the-middle) attacker inserts itself between endpoints to capture or alter traffic. Replay, brute force, and phishing describe reusing captured data, guessing credentials, and deceiving users, respectively.

Question 30Security Concepts

A design requires that a compromised web server in a DMZ cannot initiate sessions to internal database servers, while clients on the internet must still reach the web server. Which design element enforces this most directly?

  1. An ACL that permits all traffic from the DMZ to the internal zone but logs it
  2. A stateful firewall rule set that permits inbound web traffic and denies DMZ-initiated connections to the internal zone Correct answer.
  3. A VLAN spanning the DMZ and internal servers to simplify routing
  4. Host-based antivirus on the web server

Explanation

Zone-based stateful filtering that allows only the required inbound service and blocks DMZ-initiated flows to internal zones enforces the intended trust boundary. Spanning VLANs or permissive ACLs remove that boundary, and host antivirus does not control network reachability.

Question 31Security Concepts

An engineer is comparing symmetric and asymmetric cryptography for securing bulk VPN data. Which statement is accurate?

  1. Symmetric ciphers are used for bulk data because they are computationally cheaper, while asymmetric methods help establish or protect the symmetric keys Correct answer.
  2. Symmetric ciphers cannot provide confidentiality because both parties share the same key
  3. Asymmetric ciphers require no key distribution at all, so they replace symmetric ciphers entirely
  4. Asymmetric ciphers are used for bulk data because they are faster than symmetric ciphers at equal key sizes

Explanation

Symmetric algorithms process bulk data efficiently, while asymmetric operations are slower and are used for key exchange or signatures. Hybrid designs combine both, and shared symmetric keys still require secure distribution.

Question 32Security Concepts

Which hashing property makes it impractical to find two different inputs that produce the same digest?

  1. Cipher block chaining
  2. Perfect forward secrecy
  3. Key length
  4. Collision resistance Correct answer.

Explanation

Collision resistance means finding two distinct inputs with an identical hash output is computationally infeasible. Key length, forward secrecy, and chaining modes relate to encryption design rather than the collision property of a hash.

Question 33Security Concepts

A security architect wants to ensure that compromise of a long-term VPN key does not allow decryption of previously recorded sessions. Which property should the design provide?

  1. Perfect forward secrecy Correct answer.
  2. Certificate revocation
  3. Data at rest encryption
  4. Message integrity checking

Explanation

Perfect forward secrecy derives ephemeral session keys so that disclosure of a long-term key does not reveal past session traffic. Revocation, at-rest encryption, and integrity checks address different concerns and do not protect recorded sessions from later key compromise.

Question 34Security Concepts

Which statement best describes the security value of network device hardening baselines such as disabling unused services and enforcing strong management protocols?

  1. They replace the need for authentication on management interfaces
  2. They eliminate the need for logging because unused services are disabled
  3. They reduce the attack surface and enforce consistent, auditable configuration across devices Correct answer.
  4. They guarantee that no vulnerability will ever be exploited on the device

Explanation

Hardening baselines remove unnecessary exposure and make device configuration consistent and auditable. They reduce but do not eliminate risk, and they complement authentication and logging rather than replacing them.

Question 35Security Concepts

A company must prove which administrator changed a router configuration and when. Which control combination most directly supports this requirement?

  1. A shared local administrator account with a complex password
  2. SNMP read-only community strings on all devices
  3. Per-user authentication with centralized AAA and timestamped configuration change logging Correct answer.
  4. Disabling configuration logging to reduce disk usage

Explanation

Per-user AAA identifies each administrator, and timestamped change logging ties actions to a person and time, providing accountability. Shared accounts, read-only monitoring, and disabled logging undermine attribution.

Question 36Security Concepts

Which approach best reflects a defense-in-depth strategy for protecting management access to network infrastructure?

  1. Allowing management from any interface but requiring long passwords
  2. Combining dedicated management VLANs, AAA authentication, encrypted management protocols, and logging Correct answer.
  3. Relying solely on a strong enable secret on every device
  4. Using Telnet with an ACL that permits only the administrator subnet

Explanation

Defense in depth layers independent controls so one failure does not expose the management plane. A single password, unrestricted management access, or unencrypted Telnet each leaves a critical gap.

Question 37Security Concepts

What is the primary role of a security information and event management system in a network security operations context?

  1. Assigning IP addresses to endpoints dynamically
  2. Replacing firewalls at the network perimeter
  3. Encrypting all traffic between network devices
  4. Aggregating and correlating logs from multiple sources to detect and alert on suspicious activity Correct answer.

Explanation

SIEM platforms collect and correlate events across devices to surface patterns and generate alerts for investigation. They do not encrypt traffic, replace perimeter enforcement, or provide address assignment.

Question 38Security Concepts

An organization classifies data and requires that only encrypted, authenticated channels carry confidential records between sites. Which combination of controls satisfies both confidentiality and authenticity of the channel?

  1. Plain GRE tunnels between sites
  2. IPsec ESP with integrity protection and peer authentication Correct answer.
  3. Static routes with ACLs on the transit links
  4. IPsec AH without any encryption

Explanation

IPsec ESP can encrypt payloads and, together with integrity and peer authentication, ensures data is confidential and comes from an authenticated peer. GRE and ACLs do not encrypt, and AH alone provides integrity and origin authentication without confidentiality.

Question 39Security Concepts

A branch office uses a firewall that permits outbound sessions and allows return traffic only for established flows. An attacker on the internet attempts to reach an internal server that has no inbound rule. What is the expected outcome and why?

  1. The connection succeeds because return traffic rules implicitly allow any inbound session
  2. The connection is blocked only if the server has antivirus installed
  3. The connection is blocked because stateful inspection permits only return traffic for flows initiated from inside Correct answer.
  4. The connection succeeds if the attacker uses the same source port as an existing session

Explanation

Stateful firewalls track session state and allow inbound packets only when they match an established flow initiated from the trusted side. Unsolicited inbound sessions are dropped regardless of host software, and matching a source port does not create valid state.

Question 40Security Concepts

A security team must choose between an appliance-based intrusion prevention system inline in the traffic path and a passive monitoring sensor. Which consideration most strongly favors the inline IPS?

  1. It can inspect encrypted traffic without any key material
  2. It requires no tuning and produces no false positives
  3. It eliminates the need for firewall rules on the same segment
  4. It can drop malicious traffic in real time before it reaches the protected hosts Correct answer.

Explanation

An inline IPS sits in the forwarding path and can block offending packets immediately, whereas a passive sensor can only alert. It still requires tuning, cannot read encrypted payloads without keys, and does not replace firewall policy.

Question 41Security Monitoring

In a Cisco Secure Network Analytics (Stealthwatch) deployment, which component is responsible for collecting flow data such as NetFlow, IPFIX, and sFlow from network infrastructure and forwarding it to the Flow Collector?

  1. The Data Store
  2. The Flow Rate License Server
  3. The Management Console
  4. The Flow Sensor Correct answer.

Explanation

The Flow Sensor is the telemetry component that receives exported flow records from routers and switches and forwards them to the Flow Collector for analysis. It is typically deployed as a virtual or physical appliance and can also generate its own flow records from a SPAN or TAP.

Question 42Security Monitoring

Which Cisco Secure Network Analytics detection method baselines each host's normal traffic volume and then raises an alarm when a host's outbound byte count deviates sharply from that baseline?

  1. Host grouping enforcement
  2. Concern Index alarming Correct answer.
  3. Access control policy matching
  4. Flow replication to the Data Store

Explanation

Concern Index alarming continuously learns each host's behavior and scores deviations from the baseline, surfacing suspected exfiltration or scanning activity. The index is derived from multiple behavioral metrics rather than a single static threshold.

Question 43Security Monitoring

An analyst wants to identify which internal host initiated the most outbound connections to a suspicious external IP over the past 24 hours in Cisco Secure Network Analytics. Which workflow is the most direct?

  1. Export the appliance syslog and grep for the destination address
  2. Reset the Concern Index baseline and observe new alarms
  3. Open the Data Store and read raw binary flow records
  4. Run a flow query filtered by the external IP and peer, then sort by host and inspect initiator direction Correct answer.

Explanation

Flow queries in the Management Console let you filter on specific IPs, peers, time range, and direction, then aggregate by host to see who initiated the traffic. The initiator/responder direction fields distinguish client-side from server-side behavior.

Question 44Security Monitoring

In Cisco Secure Network Analytics, what is the primary purpose of defining host groups?

  1. To encrypt flow records between the Flow Sensor and Flow Collector
  2. To assign IP addresses to endpoints via DHCP
  3. To replace the need for NetFlow export on routers
  4. To apply behavioral policies and reporting scope to logical sets of hosts such as servers or subnets Correct answer.

Explanation

Host groups let you classify hosts by role or subnet so that behavioral policies, alarms, and reports can be scoped appropriately. They are logical constructs used for analysis, not for data-plane functions like encryption or addressing.

Question 45Security Monitoring

A Flow Collector reports that it is receiving flows but alarms are not appearing in the Management Console. Which area should you verify first?

  1. Whether the switch ports are configured as trunk rather than access
  2. Whether the endpoint antivirus signatures are current
  3. Whether the Flow Sensor is successfully registered and communicating with the Management Console and Data Store Correct answer.
  4. Whether the routers have NTP configured to a public time source

Explanation

Alarm generation depends on the pipeline from Flow Sensor to Flow Collector to Data Store to Management Console, and on the sensor being properly registered with the management layer. A registration or connectivity break in that chain lets flows be collected while suppressing alarms.

Question 46Security Monitoring

Which Cisco product provides network visibility and enforcement by integrating with identity and context sources to segment traffic and apply policy based on user, device, and application?

  1. Cisco Identity Services Engine Correct answer.
  2. Cisco Umbrella SIG
  3. Cisco Secure Network Analytics Flow Sensor
  4. Cisco Secure Firewall Management Center

Explanation

Cisco Identity Services Engine (ISE) is the policy platform that combines identity, device posture, and network context to authorize and segment access. It integrates with infrastructure via RADIUS, TACACS+, and platform exchange to enforce policy.

Question 47Security Monitoring

An ISE deployment uses 802.1X with EAP-TLS. Which element is required on the endpoint for the supplicant to complete certificate-based authentication?

  1. An SNMP community string on the access switch
  2. A client certificate issued by a CA that ISE trusts Correct answer.
  3. A TACACS+ key matching the ISE policy node
  4. A shared secret configured identically on the switch and endpoint

Explanation

EAP-TLS is mutual certificate authentication, so the supplicant must present a client certificate chaining to a CA trusted by ISE. The server side also presents a certificate, and no shared secret replaces the certificate exchange.

Question 48Security Monitoring

In ISE, an authorization policy returns a dACL and a VLAN assignment for a group of contractor endpoints. What must be true on the network access device for this result to be enforced?

  1. The dACL must be defined locally on every endpoint
  2. The endpoint must have the ISE posture agent disabled
  3. The switch must run TACACS+ for endpoint authentication
  4. The switch must support and be configured for downloadable ACL and VLAN authorization via RADIUS Correct answer.

Explanation

Authorization results such as dACL and VLAN are delivered as RADIUS attributes, so the NAD must support and be configured to honor them. Without that support the attributes are ignored and the session falls back to default behavior.

Question 49Security Monitoring

Which statement best describes a Cisco TrustSec security group tag (SGT)?

  1. A DNS record type used to classify external domains
  2. A VLAN identifier that replaces the 802.1Q tag on trunk links
  3. A label carried with a packet that identifies the source's security classification for policy enforcement Correct answer.
  4. A cryptographic key used to encrypt the payload of every frame

Explanation

An SGT is a metadata tag representing the security classification of the traffic source, and security group ACLs enforce policy based on tag pairs. It is not a cryptographic key, a VLAN replacement, or a DNS construct.

Question 50Security Monitoring

A security team wants DNS-layer protection that blocks requests to malicious domains for roaming users without requiring traffic to backhaul to headquarters. Which Cisco solution best fits?

  1. Cisco Secure Firewall Management Center
  2. Cisco Identity Services Engine
  3. Cisco Secure Network Analytics Flow Collector
  4. Cisco Umbrella Correct answer.

Explanation

Cisco Umbrella is a cloud-delivered DNS-layer security service that resolves and blocks malicious domains for users wherever they are, without backhauling traffic. It uses the Umbrella roaming client or network-level DNS redirection to enforce policy.