Cisco Certified Network Associate (CCNA) 200-301 Practice Test 56
Question 550
An audit discovers reversible Type 7 values in configuration, while administrators had assumed service password-encryption made them securely hashed. The team should investigate which specific technical cause?
- Administrators incorrectly treated reversible Type 7 values created by `service password-encryption` as strong one-way hashes.
- Type 7 is always equivalent to a modern salted one-way `username secret` hash.
- The absence of visible plaintext proves all passwords are safe against offline recovery.
- SSH transport negotiation automatically replaces all Type 7 stored values with nonreversible hashes.
Explanation
Correct Answer
A:Type 7 conceals plaintext from casual viewing but is readily reversible. Replace sensitive local password storage with supported `secret` algorithms and protect backups and management access.
Incorrect Answers
B:Reversible obfuscation is not equivalent to modern password hashing.
C:Attackers can recover Type 7-encoded credentials from a leaked configuration.
D:Session transport and credential storage format are independent.
Question 551
A network acceptance test follows this reported failure: A configuration backup shows an enable password in plaintext after the administrator assumed it was protected like enable secret. Which verification most specifically demonstrates the repaired function rather than checking an unrelated feature?
- The backup still contains an exposed plaintext `enable password` and the operator calls it secure because it is not in the banner.
- Running configuration and a protected backup show a supported one-way `enable secret` value rather than a plaintext `enable password`, and privileged EXEC access still authenticates correctly.
- The device hostname and management IP have changed, but privilege credentials are stored the same way.
- Only `service password-encryption` Type 7 is enabled and the organization assumes this is a modern one-way secret hash.
Explanation
Correct Answer
B:The prior backup disclosed a plaintext privileged password. Inspect the specific credential type and storage representation, plus actual authentication, not only whether the device console is reachable.
Incorrect Answers
A:Credential exposure in configuration persists.
C:Renaming the device does not change password hashing.
D:Type 7 is reversible and may not meet the desired storage protection.
Question 552
A network security analyst is validating a repair. Earlier, a technician plugs in a serial console and obtains an EXEC prompt without credentials because the console line does not enforce login. Which postchange check most directly establishes the specific problem is resolved?
- The cable still drops into an unrestricted EXEC prompt without asking for user identity.
- SSH prompts for credentials on VTY lines but the console bypasses login.
- A direct physical console session now prompts for named credentials and grants EXEC only after valid `login local` or approved AAA authentication.
- A syslog message reports boot completion while console authentication remains untested.
Explanation
Correct Answer
C:The original fault was an immediate unauthenticated EXEC prompt. Test both rejected invalid login and accepted valid local user on the console, while inspecting `line console 0` method.
Incorrect Answers
A:The original missing console login control remains.
B:Remote SSH authentication does not prove console line security.
D:Device uptime logging is not evidence that physical console access is protected.
Question 553
The security baseline now requires each network VTY line to accept SSH but never Telnet. A previous audit showed TCP/23 still offered a Telnet prompt. Which acceptance evidence addresses the actual earlier failure?
- Review `line vty` for `transport input ssh` and demonstrate TCP/23 is refused while an authenticated SSH session succeeds.
- Check only whether the local username uses `secret` rather than a plaintext password.
- Display NTP association status and assume a synchronized clock forbids Telnet.
- Check that the enable secret is stored as a hash without testing VTY transport.
Explanation
Correct Answer
A:Transport configuration and the negative Telnet probe together prove that the earlier plaintext management path is removed. An SSH login independently confirms that the permitted replacement works.
Incorrect Answers
B:A strong local credential helps protect the login but does not disable Telnet if the VTY line still accepts the protocol.
C:Correct time supports logging and some authentication contexts, but does not configure the VTY management transport policy.
D:Enable secret handling is separate from the network protocol used to reach the VTY lines. A hashed secret is insufficient evidence that TCP/23 is blocked.
Question 554
A network security analyst is evaluating a deployment. Privileged network management requires a second independent factor beyond a memorized password when identity policy demands MFA. What approach correctly addresses the stated requirement?
- Ask for a second memorable password and describe that as an independent possession factor.
- Require a separate possession or inherence factor, such as a phishing-resistant hardware authenticator, in addition to the administrator password.
- Require only a longer username and no additional authentication step.
- Use a second IP route to the device and assume redundant paths authenticate the administrator.
Explanation
Correct Answer
B:MFA combines independent authentication-factor categories. A password plus another password is still one knowledge factor, whereas a hardware authenticator plus a memorized secret spans categories.
Incorrect Answers
A:Two memorized secrets are both knowledge factors.
C:Username length does not create another independent factor.
D:Network path redundancy is not a user identity factor.
Question 555
A network administrator wants managed devices to authenticate an internal service without storing one shared reusable password on every device. The service validates a signed identity, certificate expiry and revocation status. Which authentication design fits?
- Set port-security violation mode restrict on all user ports and treat MAC addresses as certificates.
- Enable SSH-only VTY logins but keep one shared password for the service on every device.
- Use a role-based authorization table alone without verifying the device's identity.
- Use a trusted PKI-issued device certificate with private-key proof of possession and certificate validation.
Explanation
Correct Answer
D:A PKI certificate binds a public key to a device identity under a trusted issuing authority. During a supported certificate-based protocol, the device demonstrates possession of the corresponding private key, while the service validates the certificate chain, expiry, intended use and revocation policy. This avoids distributing the same reusable shared password to every device and supports per-device credential lifecycle management. It does not automatically decide access rights: authorization must still apply appropriate roles or device policy after identity verification. Verify secure private-key storage, renewal procedures and trust-store updates so expired certificates do not become unexpected outages. Trusting any certificate without checking issuer and purpose is not equivalent to proper PKI authentication.
Incorrect Answers
A:Port security constrains which source MAC addresses may appear on a switchport. It does not establish a cryptographic PKI identity or prove possession of a private key. MAC addresses can be spoofed and lack signed certificate chains, expiry and revocation properties. Port-security behavior is a distinct Layer 2 access control and cannot replace service-to-device certificate authentication.
B:SSH secures remote CLI transport and can authenticate users or host keys, but simply enabling SSH on VTY lines does not eliminate the stated shared service password. It also does not implement a device certificate trust chain for the application protocol. Separate management access from service authentication; use a credential scheme specifically supported by the service and tied to each device identity.
C:Authorization determines what an already authenticated identity may access. A role lookup alone cannot prove that the presenting device is the claimed identity. Without a reliable authentication mechanism, assigning roles risks applying permissions to an impersonator. The stated design requires validating issuer signature, validity interval, revocation status and proof of possession before authorization decisions.
Question 556
A network security analyst must implement a change. A password policy should limit online guessing and define safe rotation, rate limits, and account lockout protections. Which technical decision most directly meets these requirements?
- Use strong unique passwords, modern MFA, throttling/temporary lockout against guessing, compromised-credential checks and risk-based rotation after exposure.
- Permit unlimited high-speed failed logins indefinitely because passwords are long.
- Force all users to use the same complex password and rotate it daily.
- Use a failed-login lockout that permanently disables all administrator access with no secure recovery path.
Explanation
Correct Answer
A:Online guessing can be reduced by failed-login rate limiting and defensible lockout logic, while unique secrets and MFA limit reuse impact. Forced arbitrary frequent rotation alone can encourage predictable passwords.
Incorrect Answers
B:Even strong credentials benefit from controls against automated online guessing and credential stuffing.
C:A shared secret defeats per-user accountability and can spread compromise quickly.
D:Protective throttling needs an operational recovery plan to avoid unnecessary denial of service.
Question 557
A privileged remote-management portal is supposed to require a password and an enrolled second factor. Security logs show a successful administrator login from a new device using a stolen password, but there is no MFA challenge record. Investigation shows the administrator was accidentally included in an exempt policy group. What is the principal control failure?
- A switch rejected an ARP reply because Dynamic ARP Inspection found no trusted IP/MAC binding.
- Users clicked phishing links because their security-awareness training had not been refreshed.
- An MFA policy exemption allowed password-only privileged access even though a second independent factor was required.
- The site-to-site IPsec tunnel did not apply an application-layer identity policy to every packet.
Explanation
Correct Answer
C:The system was intended to require two distinct factors for administrator sign-in. An exemption put this privileged account on a password-only path, allowing stolen credentials to succeed with no additional challenge. The absence of an MFA event combined with the effective exempt-group membership isolates an authentication-policy enforcement failure. Remove the improper exemption, review similarly scoped accounts, and verify a new-device privileged login generates and validates an independent MFA challenge before access is granted. Cisco's authentication-policy guidance includes MFA requirements for privileged and risky access.
Incorrect Answers
A:Dynamic ARP Inspection validates ARP traffic against binding or configured trust information to reduce local address-spoofing risks. A dropped ARP reply is an entirely different event from a completed administrator portal login. It cannot explain why the portal accepted a stolen password without a second factor, nor why no MFA challenge appears in sign-in logs. This case is about authentication policy enforcement for privileged access. Investigate the exempt group membership and effective sign-in policy, not Layer 2 ARP security.
B:Security-awareness training helps users recognize and report phishing, but the critical failure in this scenario is an enforced technical control that did not apply. A stolen password should not by itself satisfy an administrator login if the policy truly requires an independent factor. The account's exemption and the missing challenge log provide direct evidence of a policy gap. Training may reduce the chance of credential theft, but it is not a substitute for consistently requiring MFA during privileged sign-in.
D:An IPsec VPN protects certain network traffic in transit and can authenticate tunnel endpoints, but it does not automatically enforce user-level second factors for a separate administrative portal. Even a perfectly healthy site-to-site tunnel would not fix a policy that exempts a privileged user from MFA. The decisive evidence concerns the portal's effective identity policy and sign-in challenge records. Focus on the account exemption instead of a hypothetical tunnel fault with no symptoms described.
Question 558
A client certificate is expired or untrusted, and the EAP-TLS handshake fails despite correct Wi-Fi coverage. The team should investigate which specific technical cause?
- EAP-TLS mutual authentication fails because the client certificate is expired or cannot build a trusted, acceptable certificate chain.
- Strong RF signal bypasses certificate expiration checking in EAP-TLS.
- The WLAN must be using WPA2-PSK because client certificates are presented.
- The client certificate issuer and validity are irrelevant if the access switch has an IP gateway.
Explanation
Correct Answer
A:EAP-TLS depends on certificate validity, trust anchors and applicable identity/usage checks. Good RSSI or association does not prove the client can authenticate cryptographically.
Incorrect Answers
B:Wireless link quality cannot make an expired credential valid.
C:EAP-TLS is certificate-based 802.1X authentication, not PSK-only personal mode.
D:A routed gateway does not replace the EAP-TLS trust validation process.
Question 559
After six incorrect SSH password submissions, a router’s configured `aaa local authentication attempts max-fail` threshold locks an administrative account. The operator enters the correct password next, but the account remains blocked until its lockout condition is cleared. What mechanism explains the temporary rejection?
- A revoked EAP-TLS client certificate caused an SSH password failure.
- A configured failed-login threshold locked the account after repeated incorrect authentication attempts.
- An IPsec Phase 2 transform mismatch prevented the router from validating local credentials.
- The user was successfully authenticated but denied only `configure terminal` authorization.
Explanation
Correct Answer
B:The account lockout control is triggered by excessive failed logins. The correct password does not automatically bypass an active lockout; examine the authentication failure counter and permitted unlock procedure.
Incorrect Answers
A:EAP-TLS client certificate validation is a separate network-access authentication mode, not the local SSH password lockout described.
C:IPsec SA negotiations protect tunnels and do not determine whether an IOS local account reached its configured failed-attempt threshold.
D:A post-authentication command privilege problem occurs after login succeeds; here the account is blocked at the authentication stage.
Question 560
The privileged portal's incorrect MFA exemption has been removed. The security team must prove that a password alone can no longer open an administrator session from a previously unknown device. Which acceptance evidence most directly demonstrates the corrected policy?
- The TACACS+ server returns a command-authorization permit for a logged-in operator, without recording an MFA challenge.
- The switch shows a standard ACL entry allowing TCP 22 toward a management address.
- The effective administrator sign-in policy requires MFA, and a controlled sign-in fails without the second factor but succeeds only after the enrolled factor is validated.
- The local switch VTY line uses `login local`, showing that the router knows the administrator username and password.
Explanation
Correct Answer
C:The corrected policy must apply to the specific privileged identity and produce a second-factor challenge during sign-in. Demonstrating that password-only access is rejected, then that access is granted only after successful enrolled-factor validation, directly tests the previously missing control. Record the effective policy evaluation and sign-in challenge outcomes for a controlled unfamiliar-device attempt, without exposing credentials. This is an acceptance-test decision, not a repeat of the earlier fault question that identified the mistaken exempt-group membership.
Incorrect Answers
A:TACACS+ can separate authentication, authorization, and accounting for device administration, and its authorization replies may indicate whether commands are permitted. A command authorization permit does not by itself prove that the upstream login required a second factor. The defect was an effective policy exemption before the login session began. A valid final test must inspect policy scope and demonstrate challenge enforcement at sign-in, not assume MFA from a post-login command authorization result.
B:An ACL permitting TCP 22 can be a reasonable transport-access control for SSH management, but it says nothing about which user factors the portal requires. A stolen password could still work through that permitted path if the identity policy remained exempt. Network reachability controls and application authentication policy need to be validated separately. Here the specific condition is the absence of a password-only privileged login, so an ACL line match or port status is not decisive acceptance evidence.
D:The Cisco `login local` command selects the device's local username database for VTY authentication, often with an SSH configuration. It does not inherently prove that a separate administrator portal enforces a second independent authentication factor. A local password can still be sufficient unless an additional identity control is integrated. Because this incident concerns a privileged portal's policy exemption, its effective MFA rule and challenge behavior are the necessary evidence rather than a router's unrelated local login setting.
