CCNA Security Fundamentals: 68 practice questions

12 of the 68 Security Fundamentals questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. securepass — because enable secret always takes precedence: Which password will be required to enter privilege

1. cisco123 — because the enable password entry overrides the enable secret

   This is reversed. Enable secret overrides enable password, not the other way around, regardless of which command was entered first.
2. Either password works — because the router accepts whichever of the two values you type

   Only the enable secret password is accepted when both are configured. The enable password is effectively ignored while an enable secret exists.
3. Neither — because both configured passwords must both match before login is allowed

   There is no dual-password requirement. Enable secret takes sole precedence over enable password when both are present.
4. securepass — because enable secret always takes precedence over enable password ✓

   When both commands are configured, 'enable secret' always overrides 'enable password'. Enable secret uses a hashed value, while enable password is reversible, so secret is preferred and takes precedence.

Enable secret always takes precedence over enable password. When both are configured, only the secret password is used.

2. On the router interface closest to the destination server: Where should the standard ACL be applied?

1. On the router interface closest to the destination server at 192.168.10.100 ✓

   Standard ACLs filter by source IP only. Placing them near the source would block that source from reaching ALL destinations. Placing near the destination restricts access only to the intended target while allowing the source to reach other resources.
2. On the interface closest to source host 10.1.1.5, in the inbound direction

   Placing a standard ACL near the source blocks 10.1.1.5 from reaching ALL destinations on the network — not just 192.168.10.100. This is the classic standard ACL placement trap.
3. On every router positioned between the source host and the destination network

   Applying the ACL on every router is unnecessarily redundant and administratively expensive. One correctly placed ACL near the destination is sufficient.
4. On the router closest to source host 10.1.1.5, applied in the outbound direction

   Changing the direction to outbound does not fix the scope problem — the source will still be blocked from all outbound traffic, not just traffic to 192.168.10.100.

Standard ACLs (source-only) should be placed close to the destination. Placing near the source blocks the source from ALL destinations, causing collateral damage.

3. 0.0.3.255: Which wildcard mask should be used in the ACL statement?

1. 0.0.255.255

   0.0.255.255 is the wildcard for a /16 mask (255.255.0.0) — this would match the entire 172.16.0.0/16 range, which is far broader than the intended /22 subnet.
2. 0.0.3.255 ✓

   A /22 subnet mask is 255.255.252.0. The wildcard mask is the inverse: 0.0.3.255. This matches all addresses in 172.16.4.0 through 172.16.7.255.
3. 0.0.0.255

   0.0.0.255 is the wildcard for a /24 mask (255.255.255.0) — this would only match one /24 network (172.16.4.0/24), not the full /22 range.
4. 255.255.252.0

   255.255.252.0 is the subnet mask for /22 — not the wildcard mask. Wildcard masks are the bitwise inverse of subnet masks.

Wildcard mask = inverse of subnet mask. /22 = 255.255.252.0 → wildcard = 0.0.3.255. Used in ACL: 'permit ip 172.16.4.0 0.0.3.255 any'

4. On the interface closest to subnet 10.1.0.0/24: Where should this ACL be applied for most efficient traffic fi

1. On the interface closest to web server 192.168.5.10, in the inbound direction

   Applying the ACL near the destination works but is inefficient — blocked traffic still traverses the entire network before being dropped at the last hop.
2. On every router along the forwarding path, in the outbound direction

   Redundant multi-router placement is unnecessary and administratively expensive. One correctly placed ACL near the source is sufficient.
3. On the interface closest to subnet 10.1.0.0/24, in the inbound direction ✓

   Extended ACLs specify both source and destination — placing them near the source drops matching traffic immediately, preventing it from consuming bandwidth across the network before being dropped near the destination.
4. On the interface closest to subnet 10.1.0.0/24, in the outbound direction

   Outbound ACLs on the interface facing the source would not catch the traffic as it enters the router — inbound ACLs on the ingress interface are the correct and efficient placement.

Extended ACLs go near the SOURCE (inbound on ingress interface) to drop traffic as early as possible, saving bandwidth across the network.

5. The packet is dropped by the implicit deny all at the end: What happens to the packet?

1. The packet is forwarded because there is no explicit deny for 10.0.0.9

   The absence of an explicit deny does not mean traffic is permitted. The implicit deny all at the end of every ACL denies any traffic not explicitly permitted.
2. The packet is dropped and a syslog alert is generated for the event

   The implicit deny does drop the packet, but it does not automatically generate syslog messages unless the ACL entry has the 'log' keyword — which this one does not.
3. The packet is held in a buffer until an administrator reviews it

   ACLs do not buffer packets for manual review — they make an immediate permit or deny decision based on the configured statements.
4. The packet is dropped by the implicit deny all at the end of the ACL ✓

   Every Cisco ACL has an invisible 'deny any' as the last statement. Since 10.0.0.9 does not match the only permit entry (10.0.0.5), the implicit deny discards the packet.

Every ACL ends with an implicit 'deny any'. Any traffic not explicitly permitted is silently dropped.

6. Drops the DHCPOFFER: What does the switch do with this message?

1. Drops the DHCPOFFER — server-to-client messages are blocked on untrusted ports ✓

   DHCP snooping blocks server-originated messages (DHCPOFFER and DHCPACK) on untrusted ports to prevent rogue DHCP servers. Only client-originated messages (DHCPDISCOVER and DHCPREQUEST) are allowed inbound on untrusted ports.
2. Forwards the DHCPOFFER — untrusted ports block only the DHCPDISCOVER message type

   DHCP snooping does not block DHCPDISCOVER — that is a client message that untrusted ports are allowed to send. DHCP snooping specifically blocks server-originated OFFER and ACK messages on untrusted ports.
3. Drops every DHCP message on untrusted ports regardless of the message type

   DHCP snooping allows client messages (DISCOVER and REQUEST) through untrusted ports — it selectively blocks server messages (OFFER and ACK) to stop rogue servers.
4. Forwards the DHCPOFFER and records the lease in the snooping binding table

   Binding table entries are created only when DHCPACK messages are seen on trusted ports — forwarding an unauthorized OFFER on an untrusted port would defeat the purpose of DHCP snooping.

DHCP snooping blocks DHCPOFFER and DHCPACK on untrusted ports (rogue server protection). DHCPDISCOVER and DHCPREQUEST are allowed through untrusted ports as they are client messages.

7. Dynamic ARP Inspection: Which feature should be configured, and what does it depend on?

1. DHCP snooping, which inspects inbound ARP replies and drops the spoofed ones on untrusted ports

   DHCP snooping blocks rogue DHCP SERVER messages — it does not inspect or validate ARP packets at all. ARP spoofing protection requires DAI.
2. Dynamic ARP Inspection (DAI), which relies on the DHCP snooping binding table to validate ARP packets ✓

   DAI validates ARP packets by checking the source IP-to-MAC mapping against entries in the DHCP snooping binding table. If the ARP does not match a known binding, it is dropped. DHCP snooping must be enabled first to build the binding table.
3. Port security, which blocks unknown source MAC addresses that could be used to spoof ARP entries

   Port security limits the number of MAC addresses on a port but does not validate ARP packet content — an attacker with a registered MAC can still perform ARP spoofing.
4. Dynamic ARP Inspection (DAI), which validates ARP packets on its own without any DHCP snooping binding table

   DAI requires the DHCP snooping binding table to function. Without DHCP snooping enabled (or manually configured ARP ACLs), DAI has no valid database to check against and will drop legitimate ARP traffic.

DAI prevents ARP spoofing by validating ARP packets against the DHCP snooping binding table. DHCP snooping must be enabled first to build that table.

8. protect: Which violation mode should be configured?

1. restrict

   Restrict mode also drops unauthorized frames but additionally sends a syslog message and increments the violation counter — the requirement specifies no syslog messages.
2. shutdown

   Shutdown mode (the default) places the port in an err-disabled state upon violation — the port is disabled, which contradicts the requirement that the port must continue operating.
3. protect ✓

   Protect mode silently drops frames from unauthorized MAC addresses without incrementing violation counters, sending syslog messages, or disabling the port — the legitimate traffic continues.
4. err-disable

   'err-disable' is the port state caused by shutdown violation mode — it is not itself a configurable violation mode option.

Port security violation modes: protect = drop silently; restrict = drop + syslog; shutdown = disable port (default). Protect is the silent drop mode.

9. Violation mode: What is the default violation mode and maximum number of allowed MAC addresses?

1. Violation mode: restrict; max MAC addresses allowed: 1

   Restrict is not the default violation mode — shutdown is the default. Restrict must be explicitly configured.
2. Violation mode: shutdown; maximum MAC addresses: 5

   The default maximum is 1 MAC address, not 5. Additional MAC addresses must be explicitly permitted with 'switchport port-security maximum <number>'.
3. Violation mode: protect; maximum MAC addresses: 1

   Protect is not the default — shutdown is. Protect must be explicitly configured with 'switchport port-security violation protect'.
4. Violation mode: shutdown; maximum MAC addresses: 1 ✓

   By default, port security allows 1 MAC address and uses shutdown violation mode — the port is placed in err-disabled state upon any violation.

Port security defaults: maximum 1 MAC address, violation mode = shutdown (err-disables the port on violation).

10. Site-to-site VPN: Which VPN type is most appropriate?

1. Site-to-site VPN, a persistent tunnel connecting two whole networks through their gateways ✓

   Site-to-site VPN creates a permanent encrypted tunnel between two network gateways (routers or firewalls), connecting two entire networks — endpoints on both sides communicate without installing VPN software on individual devices.
2. Remote access VPN, a tunnel connecting individual remote client devices to the corporate network

   Remote access VPN connects individual client devices to a corporate network — it is designed for individual users working from home or while traveling, not for connecting two office networks.
3. Clientless SSL VPN, a browser-based tunnel granting single users access to specific apps

   Clientless SSL VPN provides browser-based access to specific applications for individual users — it does not create a full network-to-network tunnel between two office sites.
4. MPLS L2 VPN, a service-provider tunnel that bridges remote sites across a shared core

   While MPLS L2 VPN can connect sites, it is a service-provider concept beyond the CCNA scope. IPsec site-to-site VPN is the standard CCNA answer for connecting two corporate networks.

Site-to-site VPN connects two entire networks via a gateway-to-gateway encrypted tunnel. Remote access VPN connects individual client devices to a network.

11. ESP , the IPsec protocol that encapsulates the packet: Which IPsec protocol satisfies both requirements?

1. AH (Authentication Header), the IPsec protocol that adds an integrity-check header to the packets

   AH provides authentication and integrity verification but does NOT encrypt the payload — data is authenticated but visible in cleartext. AH does not satisfy the encryption requirement.
2. ESP (Encapsulating Security Payload), the IPsec protocol that encapsulates the packet payload ✓

   ESP provides both payload encryption (confidentiality) and authentication/integrity. It is the IPsec protocol of choice when encryption is required.
3. IKE (Internet Key Exchange), the protocol that negotiates IPsec keys and associations

   IKE is the key negotiation protocol used to establish the IPsec security association — it does not directly encrypt or authenticate data payload traffic.
4. GRE (Generic Routing Encapsulation), a Cisco tunneling protocol that wraps other packets

   GRE is a tunneling protocol that encapsulates packets but provides no encryption or authentication on its own. GRE over IPsec is a common combination, but GRE alone does not encrypt.

IPsec ESP provides payload encryption + authentication. IPsec AH provides only authentication (no encryption). When encryption is required, ESP is the correct choice.

12. Accounting, one of the three components of the AAA: A network administrator asks: 'Which component of AAA trac

1. Authentication, one of the three components of the AAA security framework

   Authentication verifies identity — 'Who are you?' It validates credentials but does not log post-login activity.
2. Authorization, one of the three components of the AAA security framework

   Authorization determines what an authenticated user is permitted to do — 'What can you do?' It enforces access policies but does not record command history.
3. Accounting, one of the three components of the AAA security framework ✓

   Accounting records what actions an authenticated user performed — including commands executed, resources accessed, session duration, and start/stop times. It answers 'What did you do?'
4. Auditing, a broad security concept just outside the AAA framework

   Auditing is not a distinct component of AAA — it is a broader security concept. The AAA framework consists specifically of Authentication, Authorization, and Accounting.

AAA: Authentication = who are you? Authorization = what can you do? Accounting = what did you do? (tracks command history, session logs).

Other CCNA domains

• Network Fundamentals — 116 questions →
• IP Connectivity — 97 questions →
• Network Access — 96 questions →
• IP Services — 66 questions →
• Automation and Programmability — 51 questions →
• All 494 CCNA questions →