The CCIE Certification is the highest level of achievement for network professionals, certifying an individual as an expert or master. Cisco Systems has since become an unrivaled worldwide leader in networking for the Internet. Its networking solutions can easily connect users who work from diverse devices on disparate networks. Cisco products make it simple for people to access and transfer information without regard to differences in time, place, or platform.
The below listed questions are intended to help you continue on your exciting path toward obtaining your CCIE (Cisco Certified Internetwork Expert) certification. Before looking these questions, it is important to know the basic concepts of CCNA and CCNP.
- Cisco Certified Internetwork Expert – CCIE – Part 1
- Cisco Certified Internetwork Expert – CCIE – Part 2
- Cisco Certified Internetwork Expert – CCIE – Part 3
- Cisco Certified Internetwork Expert – CCIE – Part 4
- Cisco Certified Internetwork Expert – CCIE – Part 5
- Cisco Certified Internetwork Expert – CCIE – Part 6
- Cisco Certified Internetwork Expert – CCIE – Part 7
- Cisco Certified Internetwork Expert – CCIE – Part 8
- Cisco Certified Internetwork Expert – CCIE – Part 9
- Cisco Certified Internetwork Expert – CCIE – Part 10
- Cisco Certified Internetwork Expert – CCIE – Part 11
- Cisco Certified Internetwork Expert – CCIE – Part 12
- Cisco Certified Internetwork Expert – CCIE – Part 13
- Cisco Certified Internetwork Expert – CCIE – Part 14
- Cisco Certified Internetwork Expert – CCIE – Part 15
- Cisco Certified Internetwork Expert – CCIE – Part 16
- Cisco Certified Internetwork Expert – CCIE – Part 17
- Cisco Certified Internetwork Expert – CCIE – Part 18
- Cisco Certified Internetwork Expert – CCIE – Part 19
These articles covers everything you need to pass the CCIE Routing and Switching written exam. Each article contains a set of testing questions along with their answer and explanation.
This article covers: AAA authentication, Cisco PIX, and other advanced security information needed to secure your network.
1. Which component of AAA provides for the identification of users?
- Accounting
- Authorization
- Authentication
- Administration
Answer – C
Explanation – Authentication identifies a user, including login, password, messaging, and encryption.
2. Which of the following can AAA use for authenticating a user?
- NDS
- Primary domain controller
- SQL
- RADIUS
Answer – D
Explanation – RADIUS provides authentication for users.
3. What protocol does a Cisco router use for sending logging information?
- TCP
- UDP
- SYSLOG
- IPX
- LAT
Answer – B and C
Explanation – SYSLOG is a protocol defined for UDP on port 514.
4. Which of the following severity levels for logging is the most critical?
- Emergencies
- Alerts
- Critical
- Errors
- Abend
Answer – A
Explanation – An Emergency message indicates the system is unusable.
5. Which of the following products uses the Adaptive Security Algorithm (ASA)?
- Enterprise feature set for Cisco IOS
- Firewall feature set for Cisco IOS
- IP SEC feature set for Cisco IOS
- CiscoWorks 2000
- Cisco Secure PIX Firewall
Answer – E
Explanation – The Cisco Secure PIX Firewall (PIX) uses the ASA algorithm.
6. Which of the following provide URL filtering?
- Enterprise feature set for Cisco IOS
- Firewall feature set for Cisco IOS
- IP SEC feature set for Cisco IOS
- CiscoWorks 2000
- Cisco Secure PIX Firewall
Answer – E
Explanation – PIX provides URL filtering, network address translation, and user authentication.
7. Which component of AAA controls the privileges a user is granted?
- Accounting
- Authorization
- Authentication
- Administration
Answer – B
Explanation – Authorization determines what a user is permitted to do after logging on.
8. On which product is context-based access control (CBAC) implemented?
- Enterprise feature set for Cisco IOS
- Firewall feature set for Cisco IOS
- IP SEC feature set for Cisco IOS
- CiscoWorks 2000
- Private Internet Exchange
Answer – B
Explanation – The firewall feature set provides control of network traffic by using CBAC.
9. Which of the following access lists can filter on source IP address only?
- Standard access lists
- Extended access lists
- Dynamic access lists
- Reflexive access lists
- Enhanced access lists
Answer – A
Explanation – Standard access lists filter exclusively on the source IP address.
10. Which of the following can help prevent a TCP SYN attack?
- TCP Intercept
- NAT
- Access list
- PIX Firewall
Answer – A, B, C, and D
Explanation – All of these mechanisms can be used to help prevent a TCP SYN attack.
11. When a hacker starts a large number of conversations using TCP, this s known as which of the following?
- IP spoofing
- Smurf attack
- SYN-flooding
- NAT attack
- Enable attack
Answer – C
Explanation – TCP SYN-flooding opens up a large number of conversations with a server.
12. Which of the following will best prevent a TCP SYN-flooding attack?
- Standard access list
- Extended access list
- NAT
- TCP Intercept
- AAA
Answer – D
Explanation – TCP Intercept is specifically designed to prevent SYN-flooding attacks.
13. Which of the following can be used to control telnet logins into the router?
- Logging
- PIX
- Reverse telnet
- AAA
Answer – D
Explanation – The Authentication portion of AAA can control access to the router.
14. A company wishes to bill clients based on network usage. Which technology would be the best solution?
- Authentication
- Authorization
- Accounting
- Logging
- NDS
Answer – C
Explanation – Accounting allows for collecting information such as network usage.
15. Which of the following can provide authentication services?
- PIX
- Logging
- RADIUS
- TACACS+
- Firewall feature set
Answer – C and D
Explanation – RADIUS and TACACS+ provide the authentication services that others use.
16. An administrator wishes to allow SYSLOG messages to pass through the router. Which of the following lines should be added to the access list to allow this to happen?
- Access-list 100 permit ip any any eq 514
- Access-list 100 permit tcp any any eq 514
- Access-list 100 permit udp any any eq 514
- Access-list 10 permit tcp any any eq 514
- Access-list 100 permit tcp any any eq SYSLOG
Answer – C
Explanation – SYSLOG uses UDP.
17. Which of the following static access lists can filter on source address, destination address, protocol and port?
- Standard access lists
- Extended access lists
- Dynamic access lists
- Reflexive access lists
- Enhanced access lists
Answer – B
Explanation – Standard and extended are the only static access lists shown. Extended access lists can filter on the listed attributes.
18. Which of the following is a piece of hardware?
- IOS firewall feature set
- CiscoWorks 2000
- CBAC
- AAA
- PIX
Answer – E
Explanation – PIX is a hardware/software security solution.
19. Which of the following encryption mechanisms can be implemented on a Cisco router?
- DSS
- DES
- IPSec
- IKE
- Certificate Authority
Answer – A, B, C, D, and E
Explanation – Cisco routers can support all of the technologies listed.
20. Which of the following access lists require the user to login before the access list is active?
- Standard access lists
- Extended access lists
- Dynamic access lists
- Reflexive access lists
- Enhanced access lists
Answer – C
Explanation – Dynamic access lists (lock-and-key) require authentication before the access list is temporarily activated.
21. Which of the following is technology that can be implemented on a Cisco router to provide the strongest encryption?
- DSS
- DES
- RADIUS
- TACACS+
- 3DES
Answer – E
Explanation – Triple DES provides 168 bit encryption.
22. In an encrypted environment, what is the name of the trusted entity that stores digital signatures?
- Certificate Authority
- RADIUS
- TACACS+
- Kerberos
- DES
Answer – A
Explanation – A Certificate Authority (CA) stores digital signatures that include public keys.
23. Which component of AAA collects security information?
- Accounting
- Authorization
- Authentication
- Administration
Answer – A
Explanation – Accounting collects security information that can be used for reporting, auditing, and billing.
24. Which of the following can provide an encrypted telnet session?
- RADIUS
- Kerberos
- TACACS+
- Local
Answer – B
Explanation – Kerberos can provide for encrypted logins and encrypted services such as telnet and rsh.
25. Which of the following access lists dynamically create a reciprocal inbound access list based on outbound traffic?
- Standard access lists
- Extended access lists
- Dynamic access lists
- Reflexive access lists
- Enhanced access lists
Answer – D
Explanation – Reflexive access lists monitor outbound traffic and create a corresponding inbound access list.
- Top 10 React JS Interview Theory Questions and Answers
- CISSP – Practice Test Questions – 2024 – Set 20 (53 Questions)
- Part 2: Exploring Deeper into CCNA – Wireless (145 Practice Test Questions)
- Part 1: Mastering CCNA – Wireless (145 Practice Test Questions)
- [1z0-1085-20] Oracle Cloud Infrastructure Foundations 2020 Associate MCQ Questions – Part 3
- [1z0-1085-20] Oracle Cloud Infrastructure Foundations 2020 Associate MCQ Questions – Part 2
- [1z0-1085-20] Oracle Cloud Infrastructure Foundations 2020 Associate MCQ Questions – Part 1
- 1Z0-931 – Oracle Autonomous Database Cloud Specialist Questions – Part 2
- 1Z0-931 – Oracle Autonomous Database Cloud Specialist Questions – Part 1
- CCNA Practice Test Questions with Answers
