Cisco Certified Network Associate (CCNA) 200-301 Practice Test 53
Question 520
After the team removed Telnet access from the router VTY lines, they must demonstrate both that encrypted SSH management still works and that TCP/23 no longer accepts new sessions. Which verification proves the transport policy is enforced?
- Prove only that the SSH service responds on TCP/22; do not test TCP/23.
- Confirm local users have high privilege while leaving VTY transport input unchanged.
- Confirm VTY `transport input ssh`, establish an SSH session on TCP/22 and verify a Telnet connection to TCP/23 is refused.
- Verify the router DNS hostname resolves but do not test management transport.
Explanation
Correct Answer
C:The VTY configuration must permit SSH and exclude Telnet. Testing both a successful SSH login and a rejected TCP/23 connection shows the encrypted-only transport baseline is actually enforced.
Incorrect Answers
A:SSH success alone cannot prove Telnet is disabled, because IOS can allow both protocols simultaneously in its VTY transport list.
B:User privilege relates to authentication and authorization after transport; it does not restrict the plaintext Telnet protocol unless the VTY transport list does.
D:A resolvable management hostname does not indicate which CLI transports are accepted by the VTY lines.
Question 521
A trusted isolated lab uses a simple network boot/image service that supports only TFTP. The transfer does not require per-user login or encryption. Which protocol is compatible, with the appropriate security caveat?
- Use plain FTP because the lab server offers only TFTP and FTP requires no different server service.
- Use HTTPS and assert it is the same UDP-based request/reply format as TFTP.
- Use DNS AAAA queries as the transfer mechanism for a router image.
- Use TFTP for the lab transfer, recognizing that it is an unauthenticated/unencrypted UDP file-transfer protocol and should be isolated to trusted networks.
Explanation
Correct Answer
D:TFTP is deliberately small and commonly used in boot and basic device image transfer workflows. It does not provide FTP-style user authentication or transport encryption; those omissions make it unsuitable for untrusted networks without further protection.
Incorrect Answers
A:FTP and TFTP are distinct protocols; an FTP client cannot assume a TFTP-only server supports FTP.
B:HTTPS uses TLS over HTTP transport, not TFTP's simple UDP file-transfer protocol.
C:AAAA records resolve IPv6 hostnames; they do not transfer executable image files.
Question 522
A legacy isolated lab appliance supports only two file-transfer protocols: TFTP and FTP. The administrator must authenticate with a username and password before transferring a firmware image and can accept plaintext transport on this physically isolated lab network. Which of the two protocols meets the explicit login requirement?
- TFTP, because it performs username/password authentication over UDP port 69.
- TFTP with an invented password exchange in the initial read request.
- FTP with its TCP control connection and authenticated login, while acknowledging that classic FTP does not encrypt credentials.
- FTP without any control connection, using only a UDP data port for an authenticated session.
Explanation
Correct Answer
C:Classic FTP uses a TCP control channel, ordinarily port 21, with USER and PASS commands for login. It establishes a separate data connection to move files or listings. The appliance supports FTP and TFTP, and FTP is the option that meets the stated authentication requirement. However, classic FTP credentials and content are not encrypted; in a real production or untrusted network, prefer a supported secure alternative such as SFTP, SCP or FTPS, or restrict the service and transport. The question explicitly limits the appliance's options to an isolated lab, making this a protocol capability decision rather than a recommendation to expose plaintext FTP broadly. Confirm the control and data channels and image checksum after transfer.
Incorrect Answers
A:TFTP is a simple UDP-based file transfer protocol that generally has no built-in username/password login. Its read/write requests and file blocks do not provide the specified FTP-style authenticated session. It may be used for provisioning in controlled environments, but meeting the appliance's username/password requirement calls for its supported FTP mode, not TFTP.
B:Adding a password field to a normal TFTP read request is not a standard TFTP authentication mechanism. Even if a proprietary extension existed, the question states only normal TFTP and FTP support and asks for the protocol with conventional login semantics. Assume no undocumented extension or security wrapper. Select FTP and recognize the exposure of its plaintext control authentication.
D:FTP is TCP-based for its control connection and uses another TCP connection for data. It does not provide a standard authenticated file transfer through a lone UDP data port. Selecting this would misidentify the protocol's basic transport and session behavior. A valid FTP login occurs on the control channel before a directory listing or file transfer can be authorized.
Question 523
A Cisco device initiates a TFTP download to a trusted configuration server. The initial request to UDP port 69 reaches the server and a reply uses a new UDP transfer identifier, but a firewall rule allows only server destination UDP 69 and the transfer times out. Which fault best explains the failure after the request was accepted?
- The SNMP agent is disabled, so monitoring polls cannot retrieve an interface counter.
- The firewall does not permit the negotiated TFTP data exchange on the server-selected UDP transfer port after the initial request to port 69.
- The router needs an additional NAT inside/outside designation for an unrelated private subnet.
- The client is missing a DHCP relay helper, even though it already reaches the TFTP server.
Explanation
Correct Answer
B:TFTP normally receives the initial read or write request on UDP port 69, then conducts the transfer using the transfer identifier (UDP port) chosen for that transaction. A firewall rule permitting only traffic destined to UDP 69 may admit the initial request while blocking the subsequent data or acknowledgment flow. A capture showing the server's new source port followed by dropped packets isolates this behavior. Permit the required stateful return traffic or scoped TFTP transfer ports according to the firewall's implementation, then retry a controlled file transfer and verify file integrity.
Incorrect Answers
A:SNMP monitoring can be useful for detecting interface errors and traffic volumes, but an absent SNMP agent does not explain a TFTP transaction that reaches the server and fails only after the server replies from a newly chosen UDP port. A monitoring gap can hide visibility; it does not necessarily block file data by itself. The stated firewall port restriction and timeout provide stronger evidence of a data-channel filtering problem. Examine a packet capture of the request, transfer identifier, and subsequent data/ACK datagrams instead of changing monitoring configuration.
C:NAT inside/outside roles affect address translation, especially when crossing routed boundaries. But the scenario confirms that the TFTP request reached the trusted server and that the reply attempted a new UDP transfer identifier. No translation-related address mismatch is provided, while a port-only firewall rule directly explains the stage at which the transfer stops. Changing a separate NAT policy could introduce new reachability issues without fixing blocked TFTP data packets. Trace the actual five-tuple and firewall session handling first.
D:A DHCP relay helper forwards DHCP client broadcasts toward a remote DHCP server; it is not part of TFTP's file-block acknowledgment exchange. The client has already reached the TFTP service on UDP 69, so a missing DHCP relay cannot explain why subsequent data fails after a server response. Address assignment may matter before a client can initiate TFTP, but this test begins after IP connectivity and the initial request are demonstrated. Investigate the new transfer UDP port rather than DHCP relay.
Question 524
An FTP client logs in successfully to TCP/21 on 203.0.113.20. The client negotiates passive mode and receives a passive data port of TCP/51024, but every directory listing hangs. A firewall log shows outgoing connections to 203.0.113.20:51024 denied. What is the fault?
- The username/password were rejected by the control connection, despite a successful login response.
- The DNS server cannot resolve 203.0.113.20 because it is an IPv4 literal.
- The firewall permits the FTP control session but blocks the separate passive-mode data connection to TCP/51024.
- The FTP server must originate a TCP/20 connection to the client during every passive-mode transfer.
Explanation
Correct Answer
C:FTP maintains a control session and a separate data session. In passive mode the server advertises a listening data port and the client initiates a second TCP connection to that server-side port. Here the control connection on TCP/21 succeeds, but the firewall denies 203.0.113.20:51024, which is required for the listing. Permit the documented passive port range to the authorized FTP server, ideally with stateful FTP inspection and narrow policy, then retest directory listing and file checksum. Do not blindly open all high ports to all servers. This is a data-channel connectivity issue, distinct from the separate item that asks which legacy protocol supports login.
Incorrect Answers
A:A completed successful FTP login demonstrates that the control connection accepted the account at least for that stage. The hang occurs when a directory listing requires a data connection, and the firewall explicitly denies that data-port connection. Retrying credentials will not permit a blocked TCP/51024 flow. Distinguish authentication on the control channel from transport of the actual directory contents.
B:A numeric IPv4 literal can be used directly as a destination without an ordinary hostname-to-address DNS lookup. The client already reached the same server on TCP/21 and authenticated. The new failure is on a different TCP port, with an explicit firewall deny event. Changing DNS cannot account for the observed data-channel block.
D:In active FTP, the server commonly initiates a data connection back toward the client using a source port such as TCP/20, depending on client negotiation. The scenario explicitly uses passive mode, in which the client connects to the server's advertised passive data port. Expecting a mandatory server-to-client TCP/20 connection reverses the mode described in the packet trace and would send firewall troubleshooting in the wrong direction.
Question 525
The firewall now permits the required TFTP return flow to a trusted image server. The network team must prove the Cisco device downloaded the intended configuration image completely and without alteration. What acceptance evidence is strongest?
- The device receives all TFTP data blocks, the transfer ends normally, and the saved file has the expected byte count and verified checksum compared with the approved source.
- The device holds a DHCP lease and can ping its default gateway, without attempting the TFTP transfer.
- `show ntp associations` indicates the device clock synchronizes to a valid time source.
- The NAT translation table contains an entry for a different client's web connection.
Explanation
Correct Answer
A:A complete TFTP transfer should produce a normal end-of-file exchange and the intended artifact on the receiving device. Comparing the saved image length and an approved checksum gives confidence that all blocks arrived and the file content matches the expected source. This directly tests the service after the firewall change and detects silent truncation or wrong-file downloads that reachability tests would miss. TFTP itself lacks strong authentication and encryption, so perform such transfers only in an appropriately trusted context with independently verified artifact integrity.
Incorrect Answers
B:A valid DHCP lease and reachable default gateway show that basic Layer 3 configuration may be functional, but they do not prove that the TFTP server accepted a request, that a firewall permitted dynamic UDP data ports, or that any bytes were successfully written to the device. The prior failure could persist while DHCP and ping remain healthy. Acceptance must actually download the intended file and compare it against the approved source rather than infer data-transfer success from general network reachability.
C:Time synchronization is important for log correlation, certificates, and scheduled operations, but it cannot establish whether a TFTP image download completed correctly. The device might have an accurate clock while the data flow is still blocked after UDP port 69 or while the file is truncated. NTP association state is therefore unrelated to the file-transfer acceptance requirement. Check transfer logs or packets and verify the resulting image checksum instead of using an unrelated service-health indicator.
D:A NAT translation entry for an unrelated HTTP connection demonstrates that some address translation is active, not that the TFTP device's transaction succeeded. It provides no evidence about the initial TFTP request, subsequent UDP transfer identifiers, final block acknowledgment, or file content. Even a NAT table entry for the same client would need to be paired with transfer completion and integrity validation. The acceptance criterion concerns the exact retrieved artifact, so end-to-end file checks are decisive.
Question 526
A network security analyst is evaluating a deployment. A security assessment differentiates a threat actor/capability, a vulnerable condition and an exploit that uses that condition. What approach correctly addresses the stated requirement?
- The unpatched network service is the vulnerability; a threat actor sending code that uses it is an exploit/attack.
- Call the unpatched software version an exploit because it exists before an attacker acts.
- Call a threat actor a security patch because the actor can trigger malicious code.
- Conclude the absence of observed attacks means the unpatched service has no vulnerability.
Explanation
Correct Answer
A:A vulnerability is an exploitable weakness, a threat is a potential cause of harm, and an exploit is the action or technique that leverages the weakness. Patching removes known vulnerable conditions but does not by itself eliminate all threats.
Incorrect Answers
B:An installed weak version is the vulnerable condition; exploit describes the method that abuses it.
C:Threat source and remediation controls are opposite roles.
D:A vulnerability can exist even before any exploitation is detected.
Question 527
A branch router's `show version` reports an IOS XE build that Cisco's advisory identifies as vulnerable to a specific remotely exploitable feature. Firewall logs show attempts against that feature. Which action directly removes the known vulnerable software condition?
- Move an unrelated access ACL from inbound to outbound with no security review.
- Renumber an unrelated named ACL while leaving the vulnerable software version installed.
- Require office visitors to wear badges without changing any network device software.
- Install a vendor-supported fixed software release after compatibility testing and verify the vulnerable version is no longer running.
Explanation
Correct Answer
D:Use the Cisco advisory to identify the affected component and fixed software train for the specific hardware and features, then test the update against the branch configuration and maintenance plan. Install the supported fixed release, reboot or activate it as required, and verify the actual running version after the change, not merely the downloaded package. Confirm the affected feature behaves correctly and that exposure is no longer present. Filtering and service restriction may help during the maintenance window, but a documented fixed release is the action that directly removes the vulnerable version identified in the stem. Rollback, backup configuration and out-of-band access planning are essential if the maintenance affects remote connectivity.
Incorrect Answers
A:Changing ACL direction can alter packet exposure and may reduce reachability to a service if carefully designed, but arbitrarily moving an unrelated ACL does not remove the vulnerable software code. Network filtering can be a temporary compensating control where applicable, yet the question asks to eliminate a known vulnerable version. A software remediation plan must be tied to the affected advisory and platform.
B:Renumbering an ACL can preserve or repair policy evaluation order but cannot patch an IOS XE code vulnerability by itself. It leaves the affected feature and executable version present. An ACL may constrain attack paths when based on a documented workaround, but reordering unrelated rules is neither sufficient nor a version fix. Confirm the advisory's affected and fixed releases instead.
C:Physical visitor control is part of an organizational security program, yet it does not mitigate a remotely exploitable vulnerability in the router's running network operating system. Access badges may help restrict device rooms but do not change vulnerable management or packet-processing code. A technical weakness in a software feature requires an appropriate vendor-directed technical correction.
Question 528
A network security analyst must implement a change. An enterprise combines segmentation, patching, monitoring and identity controls so one failure does not expose all assets. Which technical decision most directly meets these requirements?
- Rely exclusively on a perimeter firewall and leave admin credentials unprotected after a breach.
- Apply defense in depth: patch the exposed service, restrict access/segments, enforce identity controls and monitor for exploitation across independent layers.
- Disable all security telemetry because segmentation guarantees no attacker can cross any boundary.
- Use only a long password while ignoring known remote-code-execution vulnerabilities on an exposed service.
Explanation
Correct Answer
B:Compromise should require bypassing multiple distinct controls. Patch management reduces known software weaknesses; segmentation reduces blast radius; authentication/authorization and detection provide additional protection.
Incorrect Answers
A:One firewall bypass would expose services and accounts without additional safeguards.
C:Segmentation lowers risk but does not make detection of misuse unnecessary.
D:Credential controls do not repair unauthenticated or other patchable software flaws.
Question 529
A vulnerability assessment finds that an edge appliance runs firmware with a published authentication-bypass defect. The incident report calls the firmware bug a "threat actor" and calls the person using a proof-of-concept "the vulnerability." Which review finding correctly identifies the documentation error?
- The report is mistaken because a defense-in-depth deployment cannot have individual component vulnerabilities.
- The report exchanges the actor and weakness concepts: the firmware flaw is a vulnerability, while the person exploiting it is a threat source.
- The report is wrong because every failed certificate validation is evidence of an exploitable firmware vulnerability.
- The report is inaccurate because an attack requires a successful Telnet login rather than exploitation of a security flaw.
Explanation
Correct Answer
B:The appliance's documented authentication-bypass flaw is the weakness that can be exploited; the person or process attempting to take advantage of it is a threat source. An exploit is a technique or code used to exercise the weakness, and the resulting risk depends on likelihood and impact in the actual deployment. NIST defines vulnerability as a weakness and threat in terms of potential adverse events or sources. Calling the firmware bug a threat actor and the attacker a vulnerability reverses the categories, impairing remediation decisions. Correct those labels before assessing the patch and any attack evidence.
Incorrect Answers
A:Defense in depth involves overlapping independent safeguards, but it does not make products invulnerable. A device may have a known firmware weakness despite segmentation, monitoring, and other controls; those layers can reduce likelihood or impact rather than erase the defect itself. The question describes a terminology error in the report, not a missing network zone or failed defensive layer. To assess this incident, identify the specific weakness and threat source, then map applicable mitigation and compensating controls separately.
C:An expired or untrusted certificate may be a separate configuration or trust problem, but the example provides a published authentication-bypass defect in installed firmware. A certificate-validation failure is not automatically proof that the firmware defect is exploitable or that an attacker used it. The report's terminology is already demonstrably wrong without invoking certificate chains. Appropriate vulnerability verification would instead establish the affected software version and test the relevant bypass preconditions using authorized techniques.
D:Telnet transmits management authentication data without SSH's encrypted transport, so permitting Telnet on an exposed VTY can certainly be a distinct security issue. But the scenario does not assert a Telnet session, and exploitation of an authentication-bypass vulnerability need not involve Telnet at all. Requiring a successful Telnet login confuses one possible attack path with the definition of an exploit. The task is to distinguish the weakness in firmware from the human or software threat source taking advantage of it.
Question 530
Repeated attack alerts continue against a router still running the affected release because the approved patch was never installed. The team should investigate which specific technical cause?
- The running firmware is already updated to a fixed version and the alert necessarily proves the patch failed.
- Changing the SNMP community string automatically updates the vulnerable service code.
- The affected device still runs a known vulnerable software release because the approved patch was not installed, so the exploit surface remains.
- Every security alert is proof of a successful compromise rather than attempted exploitation.
Explanation
Correct Answer
C:A ticket approval is not the same as deploying and verifying a fixed version. Check the actual running release and whether the relevant vulnerable service is exposed while prioritizing remediation.
Incorrect Answers
A:The evidence states the affected old release remains installed.
B:Configuration hardening does not install the security patch.
D:An alert may describe blocked attempts; the observed vulnerability and patch status are the main facts.
