CCNA Security v2.0 Chapter 3 Exam Answers 1. Because f implemented security cntrls, a user can nly access a server with FTP. Which AAA cmpnent accmplishes this? accunting accessibility auditing authrizatin authenticatin 2. Why is authenticatin with AAA preferred ver a lcal database methd? It prvides a fallback authenticatin methd if the administratr frgets the username r passwrd. It uses less netwrk bandwidth. It specifies a different passwrd fr each line r prt. It requires a lgin and passwrd cmbinatin n the cnsle, vty lines, and aux prts. 3. Which authenticatin methd stres usernames and passwrds in ther ruter and is ideal fr small netwrks. lcal AAA ver TACACS+ server-based AAA ver TACACS+ lcal AAA lcal AAA ver RADIUS server-based AAA ver RADIUS server-based AAA 4. Which cmpnent f AAA allws an administratr t track individuals wh access netwrk resurces and any changes that are made t thse resurces? accunting accessibility authenticatin authrizatin 5. Refer t the exhibit. Ruter R1 has been cnfigured as shwn, with the resulting lg message. On the basis f the infrmatin that is presented, which tw statements describe the result f AAA authenticatin peratin? (Chse tw.) CCNA 5 Page 1
CCNA Security Chapter 3 Exam Answer v2 001 The lcked-ut user stays lcked ut until the clear aaa lcal user lckut username Admin cmmand is issued. The lcked-ut user stays lcked ut until the interface is shut dwn then re-enabled. The lcked-ut user is lcked ut fr 10 minutes by default. The lcked-ut user shuld have used the username admin and passwrd Str0ngPa55w0rd. The lcked-ut user failed authenticatin. 6. A user cmplains abut being lcked ut f a device after t many unsuccessful AAA lgin attempts. What culd be used by the netwrk administratr t prvide a secure authenticatin access methd withut lcking a user ut f a device? Use the lgin delay cmmand fr authenticatin attempts. Use the lgin lcal cmmand fr authenticating user access. Use the aaa lcal authenticatin attempts max-fail glbal cnfiguratin mde cmmand with a higher number f acceptable failures. Use the nne keywrd when cnfiguring the authenticatin methd list. 7. A user cmplains abut nt being able t gain access t a netwrk device cnfigured with AAA. Hw wuld the netwrk administratr determine if lgin access fr the user accunt is disabled? Use the shw aaa lcal user lckut cmmand. Use the shw running-cnfiguratin cmmand. Use the shw aaa sessins cmmand. Use the shw aaa user cmmand. 8. When a methd list fr AAA authenticatin is being cnfigured, what is the effect f the keywrdlcal? CCNA 5 Page 2
The lgin succeeds, even if all methds return an errr. It uses the enable passwrd fr authenticatin. It accepts a lcally cnfigured username, regardless f case. It defaults t the vty line passwrd fr authenticatin. 9. Which slutin supprts AAA fr bth RADIUS and TACACS+ servers? Implement Cisc Secure Access Cntrl System (ACS) nly. RADIUS and TACACS+ servers cannt be supprted by a single slutin. Implement a lcal database. Implement bth a lcal database and Cisc Secure Access Cntrl System (ACS). 10. What difference exists when using Windws Server as an AAA server, rather than Cisc Secure ACS? Windws Server requires mre Cisc IOS cmmands t cnfigure. Windws Server nly supprts AAA using TACACS. Windws Server uses its wn Active Directry (AD) cntrller fr authenticatin and authrizatin. Windws Server cannt be used as an AAA server. 11. What is a characteristic f TACACS+? TACACS+ uses UDP prt 1645 r 1812 fr authenticatin, and UDP prt 1646 r 1813 fr accunting. TACACS+ is backward cmpatible with TACACS and XTACACS. TACACS+ is an pen IETF standard. TACACS+ prvides authrizatin f ruter cmmands n a per-user r per-grup basis. 12. Which tw features are included by bth TACACS+ and RADIUS prtcls? (Chse tw.) 802.1X supprt separate authenticatin and authrizatin prcesses SIP supprt passwrd encryptin utilizatin f transprt layer prtcls 13. Which server-based authenticatin prtcl wuld be best fr an rganizatin that wants t apply authrizatin plicies n a per-grup basis? SSH RADIUS CCNA 5 Page 3
ACS TACACS+ 14. Refer t the exhibit. Which statement describes the cnfiguratin f the prts fr Server1? CCNA Security Chapter 3 Exam Answer v2 002 The cnfiguratin using the default prts fr a Cisc ruter. The cnfiguratin f the prts requires 1812 be used fr the authenticatin and the authrizatin prts. The cnfiguratin will nt be active until it is saved and Rtr1 is rebted. The prts cnfigured fr Server1 n the ruter must be identical t thse cnfigured n the RADIUS server. 15. True r False? The single-cnnectin keywrd prevents the cnfiguratin f multiple TACACS+ servers n a AAA-enabled ruter. false true 16. Why wuld a netwrk administratr include a lcal username cnfiguratin, when the AAA-enabled ruter is als cnfigured t authenticate using several ACS servers? Because ACS servers nly supprt remte user access, lcal users can nly authenticate using a lcal username database. A lcal username database is required when cnfiguring authenticatin using ACS servers. The lcal username database will prvide a backup fr authenticatin in the event the ACS servers becme unreachable. Withut a lcal username database, the ruter will require successful authenticatin with each ACS server. 17. Which debug cmmand is used t fcus n the status f a TCP cnnectin when using TACACS+ fr authenticatin? CCNA 5 Page 4
debug tacacs events debug tacacs debug tacacs accunting debug aaa authenticatin 18. Which characteristic is an imprtant aspect f authrizatin in an AAA-enabled netwrk device? The authrizatin feature enhances netwrk perfrmance. User access is restricted t certain services. User actins are recrded fr use in audits and trubleshting events. A user must be identified befre netwrk access is granted. 19. What is the result f entering the aaa accunting netwrk cmmand n a ruter? The ruter cllects and reprts usage data related t netwrk-related service requests. The ruter utputs accunting data fr all EXEC shell sessins. The ruter prvides data fr nly internal service requests. The ruter utputs accunting data fr all utbund cnnectins such as SSH and Telnet. 20. What is a characteristic f AAA accunting? Pssible triggers fr the aaa accunting exec default cmmand include start-stp and stp-nly. Accunting can nly be enabled fr netwrk cnnectins. Accunting is cncerned with allwing and disallwing authenticated users access t certain areas and prgrams n the netwrk. Users are nt required t be authenticated befre AAA accunting lgs their activities n the netwrk. 21. When using 802.1X authenticatin, what device cntrls physical access t the netwrk, based n the authenticatin status f the client? the ruter that is serving as the default gateway the authenticatin server the switch that the client is cnnected t the supplicant 22. What device is cnsidered a supplicant during the 802.1X authenticatin prcess? the client that is requesting authenticatin the switch that is cntrlling netwrk access the ruter that is serving as the default gateway CCNA 5 Page 5
the authenticatin server that is perfrming client authenticatin 23. What prtcl is used t encapsulate the EAP data between the authenticatr and authenticatin server perfrming 802.1X authenticatin? SSH MD5 TACACS+ RADIUS CCNA 5 Page 6