CCNA Security Fundamentals: 255 practice questions

12 of the 255 Security Fundamentals questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. The enable secret protects privileged EXEC access after: What is the correct conclusion?

1. Service password-encryption converts the line password into an enable secret.

   Service password-encryption obscures eligible configuration passwords but does not change their authentication purpose.
2. The enable secret protects privileged EXEC access after line authentication. ✓

   The enable secret authenticates transition from user EXEC mode into privileged EXEC mode.
3. RSA host keys replace both passwords for privileged EXEC authentication.

   RSA keys support SSH server operation and do not replace enable-secret authorization for privileged EXEC mode.
4. The line password protects privileged EXEC access after login.

   A line password controls access to that console or VTY line, not entry into privileged EXEC mode.

The enable secret protects the transition into privileged EXEC; line passwords protect access to specific lines.

2. The password and phone approval provide two independent: Which conclusion correctly describes the observed aut

1. The password and PIN provide two independent authentication factors.

   Both password and PIN are knowledge factors, so using two secrets does not create MFA.
2. The PIN alone provides multifactor authentication because it has six digits.

   Length does not create another factor; a PIN remains a knowledge-based credential.
3. The phone approval is another knowledge factor because the user confirms it.

   The registered phone represents possession, regardless of the user’s confirmation action.
4. The password and phone approval provide two independent factors. ✓

   The password is knowledge, while approval through the registered phone represents possession of a separate factor.

A password supplies knowledge, while approval on the registered phone supplies possession.

3. WPA2-Enterprise using 802.1X/EAP with a RADIUS server: Which wireless security design meets these requirements

1. WPA2-Personal using one shared pre-shared key.

   WPA2-Personal uses a shared PSK and does not provide centralized per-user authentication records.
2. An open WLAN with a longer SSID and hidden broadcast.

   SSID naming and hiding do not authenticate employees or provide centralized accounting records.
3. WPA2-Enterprise using 802.1X/EAP with a RADIUS server. ✓

   WPA2-Enterprise provides per-user 802.1X/EAP authentication through centralized RADIUS services.
4. WPA3-Personal using one shared SAE password.

   WPA3-Personal improves password authentication but still does not provide centralized individual accounts.

WPA2-Enterprise uses 802.1X/EAP and RADIUS for centralized, individualized WLAN authentication.

4. Site-to-site VPN for branch connectivity and remote-access: Which classification correctly matches these requi

1. Remote-access VPN for branch connectivity and site-to-site VPN for traveling users.

   The classifications are reversed: branch LANs require network-to-network connectivity, while travelers use individual client access.
2. Site-to-site VPN for branch connectivity and remote-access VPN for traveling users. ✓

   Site-to-site VPNs join networks, while remote-access VPNs connect individual clients to organizational resources.
3. Two remote-access VPNs, one connecting each entire library network.

   A whole branch-to-headquarters connection is network-to-network and is classified as site-to-site.
4. Two site-to-site VPNs, one terminating on each traveling librarian’s laptop.

   Individual laptops require client-oriented remote access rather than network gateway site-to-site tunnels.

Site-to-site joins networks; remote access connects individual traveling clients.

5. Awareness applies broadly: Which statement correctly distinguishes the programs?

1. Awareness replaces technical training because recognizing phishing prevents configuration errors.

   General awareness cannot replace specialized instruction needed for secure network administration tasks.
2. Role-based training applies broadly; awareness is reserved for network administrators.

   Awareness is intended for broad organizational behavior, while specialized training is directed toward particular job roles.
3. Role-based training should teach every employee identical ACL and backup procedures.

   Role-based instruction varies by job responsibilities rather than requiring identical technical procedures for everyone.
4. Awareness applies broadly; role-based training provides deeper duties-specific technical instruction. ✓

   Awareness builds general behavior across personnel, while role-based training targets responsibilities and specialized technical actions.

Awareness teaches broad safe behavior; role training develops specialized responsibilities and technical skills.

6. DHCP server replies arriving on Gi1/0/24 can be accepted: Review the configuration and determine what the swit

1. Client ports become trusted when assigned to the snooped VLAN.

   Access VLAN membership does not change the default untrusted status of client ports.
2. All DHCP replies are accepted because VLAN 20 snooping is enabled.

   Enabling snooping does not trust every port carrying the selected VLAN.
3. DHCP replies are blocked because trunk ports cannot be trusted.

   IOS XE permits DHCP snooping trust on an appropriate trunk toward legitimate servers.
4. DHCP server replies arriving on Gi1/0/24 can be accepted. ✓

   The uplink is trusted for DHCP snooping, while client-facing ports remain untrusted by default.

The server-facing trunk is trusted, so DHCP replies arriving there are permitted by snooping.

7. Identity is verified: Which observed outcome is most accurate?

1. The switch grants privilege 15 because RADIUS accepted the credentials.

   Authentication success alone does not automatically grant the highest privilege level.
2. The connection falls back to console authentication after RADIUS succeeds.

   Console authentication is a separate access path and is not used for an established SSH session.
3. The SSH connection is rejected because authorization is missing.

   Successful authentication can establish a session even when separate authorization is not configured.
4. Identity is verified, but the session receives its default privilege level. ✓

   AAA authentication confirms identity; absent authorization, the device uses the applicable default privilege.

RADIUS authentication verifies identity, but missing authorization leaves the session at the applicable default privilege.

8. Move the subnet-specific permit before the broad HTTPS: Which change satisfies the requirement?

1. Apply the ACL outbound on the server-facing interface.

   Changing placement does not correct the broad HTTPS deny that precedes the permitted subnet.
2. Append a permit for 10.10.10.0/24 after sequence 30.

   Traffic already denied by sequence 30 cannot be permitted by a later ACE.
3. Replace sequence 20 with a permit for a different source subnet.

   Changing the permit to another subnet would not permit the required 10.10.10.0/24 source.
4. Move the subnet-specific permit before the broad HTTPS deny. ✓

   The permitted subnet must match before sequence 10 denies all HTTPS sources to the server.

The subnet-specific permit must precede the broad HTTPS deny.

9. Set the client to WPA2-Personal/PSK: Which GUI change meets the WLAN requirement?

1. Change the controller cipher to TKIP.

   The requirement specifies AES, and this does not correct the WPA3-versus-WPA2 mismatch.
2. Change the controller VLAN from 40.

   Both configurations already specify VLAN 40, so VLAN mapping is not the mismatch.
3. Replace the client passphrase.

   Changing the key does not make WPA3-SAE comply with the required WPA2-Personal method.
4. Set the client to WPA2-Personal/PSK. ✓

   The client must use WPA2-Personal with PSK while retaining the matching SSID, AES cipher, passphrase, and VLAN.

Set the client to WPA2-Personal/PSK.

10. The unpatched firmware weakness is a vulnerability: Which conclusion correctly distinguishes a threat from a v

1. The unpatched firmware weakness is a vulnerability. ✓

   A vulnerability is a weakness that could be used to cause harm or enable unauthorized activity.
2. The vendor update is an exploit against the application.

   The update reduces risk by fixing weakness; it does not use that weakness to attack.
3. The crafted input is a vulnerability because it targets the application.

   Crafted input represents an attack action or threat, while the weakness is the vulnerability.
4. The firewall rule is an attacker threat.

   The firewall rule is a mitigation, not a potential cause of harm against the application.

The known unpatched flaw is the weakness; the attacker and crafted input represent a threat.

11. SSH and Telnet sessions entering the VTY lines: What is the correct answer?

1. Only SSH sessions because login local implies encrypted transport.

   Authentication selection and transport encryption are separate; Telnet is also permitted on these VTY lines.
2. Console traffic and SSH sessions entering the VTY lines.

   The console line uses its own password configuration rather than login local authentication.
3. SSH and Telnet sessions entering the VTY lines. ✓

   The VTY lines use login local, so both permitted remote protocols consult the local username database.
4. Only Telnet sessions because SSH requires a separate AAA method.

   SSH can use local username authentication when the VTY lines specify login local.

Both permitted VTY protocols use local authentication; the console uses its separately configured line password.

12. Generate and store a different password for each: Which smallest change satisfies the goal?

1. Enable password history on the controller only.

   Password history on one device does not create unique secrets across all administrator accounts.
2. Replace the shared password with two memorable passwords used consistently.

   Using two repeated passwords still reuses secrets and fails the requirement for every account to be unique.
3. Store one shared password in the manager.

   A password manager protects storage but does not make a reused secret unique for each account.
4. Generate and store a different password for each administrator account. ✓

   Unique generated secrets stored in the manager directly eliminate reuse without changing services or adding factors.

Generate and store a distinct secret for each account; this directly removes reuse with no service change.

Other CCNA domains

• IP Connectivity — 425 questions →
• Network Access — 340 questions →
• Network Fundamentals — 339 questions →
• IP Services — 170 questions →
• Automation and Programmability — 170 questions →
• All 1699 CCNA questions →
• CCNA certification: requirements, cost and exam format →