2.5 Describe CIS Benchmarks for Hardening Devices Such as Cisco Secure Firewall (FTD) and Cisco IOS XE 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Cisco IOS XE router is being hardened. The administrator needs to ensure that the device's configuration is protected from unauthorized changes. Which CIS-aligned configuration should be applied?

   • ADisable privilege levels and use only the enable password
   • BDisable password encryption to simplify troubleshooting
   • CUse the same password for all privilege levels
   • DEnable password encryption and configure privilege levels
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network administrator is configuring a Cisco FTD device. The administrator wants to ensure that the device is compliant with the CIS Benchmark for secure access. Which configuration should be applied?

   • AConfigure strong passwords and enable account lockout after failed attempts
   • BUse the default password for the admin account
   • CAllow unlimited login attempts to avoid locking out legitimate users
   • DDisable password authentication and use only certificates
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A network engineer is applying CIS Benchmark recommendations to a Cisco IOS XE router. Which command would be used to disable the legacy Telnet service?

   • Ano ip domain-lookup
   • Bno service tcp-small-servers
   • Cno transport input telnet
   • Dno ip http server
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security administrator is reviewing the CIS Benchmark for Cisco IOS XE to determine which recommendations to apply. The benchmark document contains multiple sections, including 'Level 1' and 'Level 2' profiles. The administrator wants to implement a baseline that provides a clear security improvement without causing significant operational impact. Which approach should the administrator take?

   • AApply the Level 2 profile, which contains all recommendations including those that may cause operational impact
   • BApply only the 'Introduction' section of the benchmark, which describes the scope
   • CApply the Level 1 profile, which contains recommendations that are practical and have a low impact on operations
   • DApply the 'Scoring' section, which provides a compliance score but no configuration guidance
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Cisco IOS XE device is being hardened. The administrator needs to ensure that passwords are not transmitted in clear text over the network. Which configuration aligns with the CIS Benchmark?

   • ADisable both SSH and Telnet and use only SNMP for management
   • BEnable SSH and disable Telnet on the VTY lines
   • CEnable Telnet but restrict access by ACL
   • DEnable Telnet and use a strong password
   Reveal Solution Discussion Select an answer first