2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network administrator is configuring an ACL on a router to restrict access to a management server (192.168.1.10) from the IT department subnet (192.168.10.0/24). The ACL should also allow the monitoring system (192.168.20.5) to reach the management server. All other traffic to the management server should be denied. Which ACL configuration is correct?

   • Adeny ip any any; permit tcp 192.168.10.0 0.0.0.255 host 192.168.1.10; permit tcp host 192.168.20.5 host 192.168.1.10
   • Bpermit ip any any; deny tcp 192.168.10.0 0.0.0.255 host 192.168.1.10; deny tcp host 192.168.20.5 host 192.168.1.10
   • Cpermit tcp 192.168.10.0 0.0.0.255 host 192.168.1.10; permit tcp host 192.168.20.5 host 192.168.1.10; deny ip any any
   • Dpermit tcp host 192.168.20.5 host 192.168.1.10; permit tcp 192.168.10.0 0.0.0.255 host 192.168.1.10; deny ip any any
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of Control Plane Policing (CoPP)?

   • ATo protect the device control plane from excessive traffic and DoS attacks
   • BTo encrypt control plane traffic
   • CTo authenticate users accessing the network
   • DTo filter traffic between VLANs
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which switch port security feature is specifically designed to prevent MAC flooding attacks?

   • AEnabling DHCP snooping
   • BApplying an IP access list to the port
   • CLimiting the number of MAC addresses allowed on a port
   • DConfiguring a static ARP entry
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network administrator is hardening a newly deployed switch. The switch currently has Telnet enabled, HTTP server enabled, and SNMPv2c with a community string 'public'. The administrator wants to secure management access and ensure data in transit is encrypted. Which set of actions should be taken?

   • ADisable SNMP entirely and rely on syslog for monitoring
   • BEnable SSH and keep HTTP enabled for web-based management
   • CDisable Telnet and HTTP, enable SSH and HTTPS, and configure SNMPv3 with authentication and privacy
   • DKeep Telnet but restrict it to a management VLAN and use a strong password
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A network administrator is configuring ACLs on a router to enforce security policies. The router has three interfaces: Gi0/0 (inside), Gi0/1 (outside), and Gi0/2 (DMZ). The administrator wants to allow HTTP/HTTPS traffic from the inside network to the DMZ web server, and allow SSH from the inside network to the DMZ server for management. The administrator also wants to allow return traffic from the DMZ to the inside network. Which ACL configuration is correct?

   • AApply a single ACL on Gi0/0 that permits all traffic from the inside network to the DMZ.
   • BApply an outbound ACL on Gi0/0 that permits TCP 80/443 and TCP 22 from the inside network to the DMZ server, and apply an outbound ACL on Gi0/2 that permits return traffic.
   • CApply an ACL on Gi0/2 that permits all traffic from the DMZ to the inside network.
   • DApply an inbound ACL on Gi0/0 that permits TCP 80/443 and TCP 22 from the inside network to the DMZ server, and apply an inbound ACL on Gi0/2 that permits return traffic from the DMZ server to the inside network.
   Reveal Solution Discussion Select an answer first