Cisco Certified Network Associate (CCNA) 200-301 Practice Test 57
Question 560
The privileged portal's incorrect MFA exemption has been removed. The security team must prove that a password alone can no longer open an administrator session from a previously unknown device. Which acceptance evidence most directly demonstrates the corrected policy?
- The TACACS+ server returns a command-authorization permit for a logged-in operator, without recording an MFA challenge.
- The switch shows a standard ACL entry allowing TCP 22 toward a management address.
- The effective administrator sign-in policy requires MFA, and a controlled sign-in fails without the second factor but succeeds only after the enrolled factor is validated.
- The local switch VTY line uses `login local`, showing that the router knows the administrator username and password.
Explanation
Correct Answer
C:The corrected policy must apply to the specific privileged identity and produce a second-factor challenge during sign-in. Demonstrating that password-only access is rejected, then that access is granted only after successful enrolled-factor validation, directly tests the previously missing control. Record the effective policy evaluation and sign-in challenge outcomes for a controlled unfamiliar-device attempt, without exposing credentials. This is an acceptance-test decision, not a repeat of the earlier fault question that identified the mistaken exempt-group membership.
Incorrect Answers
A:TACACS+ can separate authentication, authorization, and accounting for device administration, and its authorization replies may indicate whether commands are permitted. A command authorization permit does not by itself prove that the upstream login required a second factor. The defect was an effective policy exemption before the login session began. A valid final test must inspect policy scope and demonstrate challenge enforcement at sign-in, not assume MFA from a post-login command authorization result.
B:An ACL permitting TCP 22 can be a reasonable transport-access control for SSH management, but it says nothing about which user factors the portal requires. A stolen password could still work through that permitted path if the identity policy remained exempt. Network reachability controls and application authentication policy need to be validated separately. Here the specific condition is the absence of a password-only privileged login, so an ACL line match or port status is not decisive acceptance evidence.
D:The Cisco `login local` command selects the device's local username database for VTY authentication, often with an SSH configuration. It does not inherently prove that a separate administrator portal enforces a second independent authentication factor. A local password can still be sufficient unless an additional identity control is integrated. Because this incident concerns a privileged portal's policy exemption, its effective MFA rule and challenge behavior are the necessary evidence rather than a router's unrelated local login setting.
Question 561
The earlier fault was recorded as follows: A client certificate is expired or untrusted, and the EAP-TLS handshake fails despite correct Wi-Fi coverage. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- After issuing a valid accepted client certificate, confirm its time validity, issuer/trust chain, intended usage and a successful EAP-TLS handshake in authentication logs.
- The WLAN signal remains strong while the client certificate is still expired and rejected by the authentication server.
- A self-signed untrusted client certificate is accepted by no configured server trust anchor, but the client can scan the SSID.
- Only the router default route is checked, with no EAP-TLS success or chain validation.
Explanation
Correct Answer
A:The earlier failure was certificate trust/expiration. Both certificate validation evidence and actual 802.1X authentication success demonstrate remediation; a beacon or DHCP lease alone does not.
Incorrect Answers
B:RF strength cannot validate an expired EAP-TLS certificate.
C:SSID discovery occurs before certificate trust is assessed.
D:Routing reachability does not establish acceptance of the client credential.
Question 562
A network security analyst is evaluating a deployment. Two gateway peers must negotiate IPsec policies and protect traffic between specified local and remote site subnets. What approach correctly addresses the stated requirement?
- Configure a separate user password VPN client for every office host and claim this is the only way to protect LAN-to-LAN traffic.
- Negotiate IKE identity successfully but omit the remote subnet from IPsec selectors and assume all traffic is encrypted.
- Configure only plaintext GRE over the Internet with no IPsec and claim it provides encryption and integrity.
- Build a site-to-site IPsec VPN between the two gateway peers with matching IKE/IPsec proposals and traffic selectors for the specified local and remote office subnets.
Explanation
Correct Answer
D:Site-to-site VPNs protect interoffice subnet traffic transparently to local hosts through security associations negotiated by peer gateways. Phase 2/Child SA selectors must cover the intended interesting traffic.
Incorrect Answers
A:Per-user remote access is different from gateway-to-gateway subnet protection.
B:IKE control connectivity alone does not establish appropriate data SAs for the desired protected prefixes.
C:GRE alone provides tunneling/encapsulation, not IPsec confidentiality and integrity.
Question 563
A proposed network design has this requirement: An authenticated roaming employee needs protected remote access to corporate networks through an IPsec-capable VPN client and gateway. Which choice is technically appropriate for that deployment?
- Use a fixed branch-to-branch site-to-site selector only and assume it automatically authenticates a roaming laptop user.
- Provide an HTTP sign-in page without a protected tunnel and call all internal packets encrypted.
- Allow all corporate subnets directly over the public Internet without encryption because the user has a valid username.
- Use a remote-access VPN client authenticated to the corporate IPsec-capable gateway with a permitted user identity and appropriate protected routes/policies.
Explanation
Correct Answer
D:Remote-access VPNs terminate individual users’ encrypted tunnels at a secure concentrator/gateway. The client may receive a virtual address and split/full-tunnel route policy; endpoint authentication is distinct from site-to-site selectors.
Incorrect Answers
A:Gateway-to-gateway tunnel policy is not the same as individual remote-access enrollment.
B:Authentication to a web page does not create an IPsec protected network path.
C:User identity alone does not supply network-traffic confidentiality/integrity.
Question 564
A network security analyst must implement a change. A site-to-site IPsec design needs encryption and integrity protection to prevent disclosure and undetected modification in transit. Which technical decision most directly meets these requirements?
- Use IPsec AH alone and claim it encrypts payloads against eavesdropping.
- Use only GRE encapsulation and assume wrapping an IP packet makes its payload confidential.
- Use IPsec ESP with an approved encryption-and-integrity construction (such as AES-GCM) under negotiated IKE security associations for the protected traffic.
- Use plaintext HTTP between sites and rely on an OSPF route to prevent modification.
Explanation
Correct Answer
C:IPsec ESP can provide confidentiality, integrity and origin authentication depending on algorithms and mode. IKE negotiates keys and SAs; integrity checking detects packet modification in transit.
Incorrect Answers
A:AH offers packet integrity/authentication but not encryption confidentiality.
B:GRE adds a tunnel header without providing encryption.
D:Routing availability does not provide cryptographic confidentiality or integrity.
Question 565
Troubleshooting report: The IKE peer is reachable but no protected packets appear because Phase 2 selectors for the remote subnet do not match. Which finding best accounts for the behavior?
- A successful IKE peer ping proves every arbitrary subnet is encrypted even when Phase 2 selectors mismatch.
- IKE reachability is not enough: the IPsec Phase 2/Child SA traffic selectors do not agree on protected local/remote prefixes, so expected data packets lack a matching SA.
- Change only the interface CDP neighbor name and expect Phase 2 selector negotiation to succeed.
- Assume the lack of protected packets means AES-GCM always failed even though the stated mismatch is subnet selectors.
Explanation
Correct Answer
B:Peer authentication and IKE exchange may succeed while protected subnets/ACLs disagree. Check security association selectors, packet encrypt/decrypt counters and NAT exemptions or policy interactions.
Incorrect Answers
A:IKE control-plane reachability does not guarantee matching IPsec data policy.
C:Discovery identity is unrelated to selectors for protected IP subnets.
D:Cryptographic algorithm mismatches are possible elsewhere, but the given observed selector discrepancy is decisive.
Question 566
An IPsec remote-access VPN gateway shows that three employees can authenticate and establish encrypted tunnels. A fourth employee receives an explicit AAA authorization-denied event immediately after entering valid credentials; their tunnel never establishes. Which issue should be investigated first?
- The denied user's group-based VPN authorization and allowed access policy on the gateway/AAA system.
- An IPsec traffic-selector mismatch on an already established tunnel for a different user.
- A spanning-tree root-bridge election on the corporate access switch.
- The DNS TTL of a public site that the employee has not yet tried to visit.
Explanation
Correct Answer
A:Valid credentials establish identity only if authentication completes, but authorization may still deny whether the user belongs to a permitted VPN group, profile or policy. The explicit AAA denial for this fourth user identifies a per-user entitlement or group-mapping issue before tunnel establishment. Compare permitted-user and failed-user authorization results and policies, then confirm a successful authorized session after the entitlement is corrected. Do not remove security controls or grant broad VPN access merely to make the test pass. The three working users demonstrate general gateway availability but do not prove the fourth user's assigned access rights. Keep authentication, authorization, and post-tunnel data-plane checks separate to avoid confusing the troubleshooting sequence.
Incorrect Answers
B:Traffic selectors determine which protected traffic matches an established IPsec security association or child SA. They may explain why packets fail after tunnel setup, or why an IKE/IPsec proposal is rejected for particular negotiated parameters. Here the gateway explicitly denies user authorization before a tunnel exists, so troubleshooting an established tunnel's selector addresses the wrong stage. Inspect AAA policy first.
C:Spanning tree affects Layer 2 loop-free forwarding in a switched LAN. It would not normally emit a specific AAA authorization denial for one user after that user's credentials were accepted, while three others successfully establish tunnels. A switch problem might prevent all clients reaching the gateway, but the recorded policy result is much more discriminating evidence. Do not alter the root bridge to work around account authorization.
D:DNS TTL affects how long a cached answer for a hostname can be reused. It does not decide whether the VPN gateway grants a user permission to establish an encrypted remote-access session. The client has not yet entered a usable tunnel, so a hypothetical public-site DNS lookup occurs later in the process. Debug the observed authorization denial at the actual control plane first.
Question 567
An IPsec site-to-site tunnel peer is reachable, but Phase 2 reports “transform proposal not supported”; the two devices have incompatible ESP encryption/integrity proposals. What is the specific negotiation defect?
- A user’s local login password expired after the tunnel was established.
- The peers agreed on Phase 2 selectors but a switch is dropping Ethernet BPDUs.
- The IPsec Phase 2 transform proposals do not match; configure mutually supported ESP encryption and integrity settings.
- The VPN must disable endpoint authentication because encryption replaces user identity checks.
Explanation
Correct Answer
C:The peer is reached, but its negotiated IPsec SA requires compatible transform proposals. Cisco debugs identify transform mismatch as a Phase 2 failure; align mutually supported algorithms on both peers.
Incorrect Answers
A:A local user account password problem happens at the endpoint identity layer and does not explain the peer’s explicit IPsec transform rejection.
B:Spanning-tree BPDUs are Layer 2 topology messages and do not explain a transform-proposal mismatch between reachable VPN peers.
D:Encryption does not eliminate endpoint authentication obligations; disabling it would not make incompatible IPsec transform sets negotiate.
Question 568
A network security analyst is validating a repair. Earlier, the IKE peer is reachable but no protected packets appear because Phase 2 selectors for the remote subnet do not match. Which postchange check most directly establishes the specific problem is resolved?
- A negotiated IPsec Child SA/Phase 2 entry has matching protected subnet selectors, its encrypt/decrypt packet counters increase during a test, and cross-site hosts reach the intended addresses.
- IKE peer status is up while Phase 2 selectors still omit the destination subnet and encap counters stay zero.
- A ping to the gateway public IP succeeds but no cross-site private flow is tested.
- Only the router hostname changes while the IPsec SA has no matching selectors for the tested subnets.
Explanation
Correct Answer
A:The original issue was selectors that failed to capture the remote subnet. Proper selectors and real protected data-plane counters verify more than merely a working IKE peer.
Incorrect Answers
B:The original protected-data failure persists despite control connectivity.
C:Public peer reachability is not proof of protected LAN-to-LAN traffic.
D:A name change cannot repair the data SA traffic policy.
Question 569
The earlier fault was recorded as follows: The VPN client establishes a tunnel but its split-tunnel protected-route list excludes the needed internal subnet. After corrective work, which observation provides direct evidence that the affected function now behaves correctly?
- The remote client receives an authorized VPN address and installs the intended split-tunnel route for the internal subnet; test packets use the VPN interface and reach the resource.
- The VPN client says Connected but its protected-route list still omits the needed internal subnet.
- The client obtains a public DNS answer while internal subnet packets still use the direct Internet gateway.
- A branch site-to-site SA has traffic while the individual roaming client lacks an internal VPN route.
Explanation
Correct Answer
A:A tunnel may be established yet route policy can exclude required internal prefixes. Inspect client route table and actual protected traffic, not just an authenticated connection indicator.
Incorrect Answers
B:Established IKE/IPsec session alone does not direct that destination into the tunnel.
C:Public DNS works independently of the missing split-tunnel route.
D:Another VPN’s success cannot validate this client’s route policy.
Question 570
An IPsec peer previously rejected the proposed Phase 2 ESP transform. The two gateways were reconfigured to support the same cipher/integrity proposal. Which result provides the strongest proof of the repaired tunnel negotiation and protected traffic?
- Confirm an IPsec Phase 2 security association using the agreed ESP proposal and increasing encrypt/decrypt counters for traffic between the protected subnets.
- Confirm ICMP can ping the public IKE peer without checking IPsec SAs.
- Verify that a local endpoint accepts a username/password for a separate application.
- Observe the outside interface up/up but no IPsec negotiation status or protected traffic.
Explanation
Correct Answer
A:The negotiated Phase 2 SA confirms proposal compatibility, and rising encapsulation/decapsulation counters for protected flows show that data actually uses the tunnel. This tests both the former negotiation fault and operational traffic.
Incorrect Answers
B:An IKE peer can be reachable at the public IP while Phase 2 proposal negotiation remains incompatible. A ping proves only basic reachability.
C:Application login is an independent identity function and does not establish that IPsec ESP transform sets now match on the gateway peers.
D:Physical interface carrier does not validate crypto policy agreement or the protected data-plane tunnel.
