Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Infrastructure HardeningSwitch
All CCNP topics

5.0 Security

Infrastructure Hardening Practice Questions

Control Plane Policing, SSH hardening, and management-plane ACLs.

One solved question, so you can see how these are marked

What is the implicit default action at the end of every IPv4 Access Control List (ACL) in Cisco IOS?

deny ip any any

All Cisco IOS ACLs feature an invisible implicit deny ip any any rule appended to the bottom of the list.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 25 Infrastructure Hardening questions in this set

Answers and explanations appear when you work through the set above.

  1. Which service is recommended to keep switch clocks synchronized so that Time-Based Access Control Lists activate at the intended times?

    • Simple Network Management Protocol (SNMP)
    • Network Time Protocol (NTP)
    • Domain Name System (DNS)
    • Cisco Discovery Protocol (CDP)

  2. When creating Control Plane Policing (CoPP) policies, which MQC class-map traffic type typically matches protocol messages such as OSPF, BGP, EIGRP, and ARP?

    • Management plane traffic
    • Control plane traffic
    • Data plane transit traffic
    • Out-of-band console traffic

  3. Which Modular QoS CLI (MQC) command sequence applies a Control Plane Policing policy to protect the switch Route Processor?

    • control-plane -> service-policy input COPP
    • interface GigabitEthernet0/0 -> service-policy input COPP
    • line vty 0 15 -> access-class COPP in
    • ip access-list extended COPP -> permit ospf any any

  4. Which command syntax restricts SSH access to VTY management lines by applying an access control list?

    • ip access-group VTY-ALLOW in applied under line vty 0 15
    • access-class VTY-ALLOW in applied under line vty 0 15
    • ip policy route-map VTY-ALLOW under interface Vlan1
    • service-policy input VTY-ALLOW under line con 0

  5. Which command disables the legacy Telnet protocol on VTY lines while still permitting SSH access?

    • transport input ssh
    • no ip domain-lookup
    • login local
    • transport input telnet ssh

  6. What is the security risk of configuring exec-timeout 0 0 on console and VTY lines?

    • It stops the device from generating RSA keys, so SSH cannot be enabled until the timeout value is changed again.
    • An unattended, already-authenticated session never times out, so anyone at that terminal can take it over.
    • It prevents AAA method lists from being applied to the line, so local authentication is bypassed.
    • It forces the device to reload every night to clear idle sessions from the console and VTY lines.

  7. Which command generates the RSA key pair required before SSH can be enabled on a Cisco IOS device?

    • crypto key generate rsa
    • ip ssh version 2
    • aaa authentication login default local
    • service password-encryption

  8. Why does hardening guidance recommend explicitly configuring ip ssh version 2 rather than leaving SSH negotiable to version 1?

    • SSHv1 has known cryptographic and protocol design weaknesses that SSHv2 fixes.
    • SSHv1 is faster than SSHv2 because it skips key exchange, so it suits busy lab devices.
    • Forcing version 2 lets the device fall back to Telnet when a client does not support SSH.
    • SSHv1 is required for NETCONF, so version 2 must be set explicitly to disable NETCONF.

  9. What is the purpose of configuring service password-encryption on a Cisco IOS device?

    • It encrypts all data plane traffic transiting the device using a key derived from the enable secret password.
    • It hides config passwords with reversible Type 7 encoding, which stops casual viewing but not decoding.
    • It replaces enable secret entirely by hashing every password in the configuration with SHA-256.
    • It forces every user to authenticate via RADIUS so that no local passwords are kept in the configuration.

  10. Which AAA command configures a Cisco IOS device to authenticate management logins against a locally configured username database as a fallback when a RADIUS or TACACS+ server is unreachable?

    • aaa authentication login default group tacacs+ local
    • aaa authorization exec default group tacacs+
    • aaa accounting commands 15 default start-stop group tacacs+
    • ip tacacs source-interface Loopback0

  11. In a Control Plane Policing (CoPP) design, why is it important to classify and rate-limit traffic destined to the router's control plane rather than simply relying on interface-level ACLs?

    • Interface ACLs already protect the CPU from every kind of control plane flood, so CoPP only adds logging of drops.
    • CoPP protects the route processor itself from floods punted to the CPU, whichever interface they arrive on.
    • CoPP only tunes data plane forwarding performance and has no effect on how busy the route processor gets.
    • CoPP replaces every interface ACL on the device, so ingress filtering no longer needs to be configured.

  12. Which command displays the interface, protocol, and rate statistics for traffic being policed by a Control Plane Policing policy?

    • show policy-map control-plane
    • show ip interface brief
    • show spanning-tree summary
    • show interfaces counters errors

  13. Which best practice reduces the attack surface of an unused switch access port before it is ever connected to an end device?

    • Leave the port in VLAN 1 with no additional configuration so it is ready when needed.
    • Shut the port down and assign it to an unused, non-routed VLAN until it is needed.
    • Configure the port as a trunk carrying all VLANs so any device can be patched in later.
    • Enable DTP desirable mode so the port auto-negotiates a trunk with whatever connects.

  14. Why is VLAN 1 commonly avoided as the native VLAN on 802.1Q trunk links in a hardened switch design?

    • VLAN 1 cannot carry IPv4 traffic on a trunk, so management traffic would be lost on 802.1Q links.
    • VLAN 1 is the default VLAN everywhere, so using it as native VLAN makes double-tagging VLAN hopping easier.
    • VLAN 1 disables spanning tree by default, so leaving it native on trunks risks a bridging loop.
    • Switches stop forwarding tagged traffic on a trunk whenever VLAN 1 is also configured as the native VLAN.

  15. What does the login block-for command accomplish when configured alongside login delay and login on-failure log?

    • It permanently disables the local username database after the configured number of failed logins.
    • After too many failed logins within a window, it blocks further login attempts for a set quiet period.
    • It encrypts the enable secret with AES-256 and blocks logins until the new hash is written to NVRAM.
    • It forces all VTY sessions to use IPv6 only, blocking every IPv4 login attempt for the configured period.

  16. Which management-plane hardening practice restricts which source IP addresses are allowed to reach SNMP, HTTP(S), SSH, or NETCONF services on a device?

    • Service ACLs (access-class on VTY lines, ACLs on SNMP and HTTP) that permit only trusted management subnets
    • Increasing the SNMP community string length, which makes SNMP, HTTP, and SSH sessions harder to brute force online
    • Disabling CDP on all interfaces so that attackers cannot discover the management IP addresses
    • Setting the enable secret to a numeric-only value, which every management service checks first

  17. Why is SNMPv3 preferred over SNMPv1/v2c in a hardened infrastructure design?

    • SNMPv3 removes the need for a MIB, so the manager no longer has to compile vendor MIB files to poll devices.
    • SNMPv3 adds message authentication and optional encryption (authPriv) in place of community strings.
    • SNMPv3 runs only over IPv6, which keeps management polling off the IPv4 networks users can reach.
    • SNMPv3 disables all SNMP traps by default, so devices cannot leak information to unknown receivers.

  18. What risk does disabling unused CDP and LLDP advertisements on externally facing or untrusted interfaces address?

    • It limits reconnaissance, since CDP and LLDP advertise the model, software, and management IP on the link.
    • Disabling CDP and LLDP is required before SSH can be enabled, since they share the same management process.
    • It increases the switch's forwarding rate, because discovery advertisements are sent from the data plane.
    • It stops spanning tree BPDU processing on the port, so a rogue switch cannot become the root bridge.

  19. Which command configures AAA accounting so that every privilege level 15 command entered by an administrator is logged to a TACACS+ server?

    • aaa accounting commands 15 default start-stop group tacacs+
    • aaa authorization commands 15 default group tacacs+ local
    • aaa authentication login default group tacacs+ local
    • aaa accounting exec default start-stop group tacacs+

  20. Why does hardening guidance recommend disabling ip http server (and enabling ip http secure-server only if web management is required) on Cisco IOS devices?

    • HTTP sends login credentials in cleartext while HTTPS encrypts them; unused web access is extra attack surface.
    • The HTTP server must be disabled before SSH can start, because both services listen on the same TCP port.
    • Disabling the HTTP server also disables SNMP, which removes the most common source of management attacks.
    • The ip http server command controls NTP synchronization, so leaving it enabled lets clocks be spoofed.

  21. In an infrastructure ACL (iACL) design protecting the management and control planes, what traffic pattern should typically be explicitly denied near the top of the ACL, before any permit statements for legitimate management traffic?

    • Return traffic for sessions the device itself opened, such as replies to its own NTP and DNS queries.
    • Spoofed packets claiming internal, loopback, or bogon source addresses that arrive on an external interface.
    • All ICMP echo-reply traffic under any circumstance, including replies to the device's own pings.
    • All traffic destined to any TCP port above 1024, since management services only listen on low ports.

  22. What is the benefit of a dedicated out-of-band (OOB) management network, physically separate from the production data plane, on a hardened network device?

    • Management stays reachable even if the production data path is congested, misconfigured, or under attack.
    • Sessions on the OOB interface no longer need any authentication, because only administrators can reach it.
    • An OOB management interface or VRF must exist before CoPP can be configured on the control plane.
    • It automatically disables in-band SSH, so attackers on production VLANs can no longer reach the CLI.

  23. Which command displays the login method list, transport input, access-class, and exec-timeout configured on the VTY lines, useful when auditing AAA hardening configuration?

    • show running-config | section line vty
    • show ip protocols
    • show version | include Configuration register
    • show cdp neighbors detail

  24. In a defense-in-depth hardening strategy for network infrastructure, what is the relationship between Control Plane Policing (CoPP), Management Plane Protection (MPP), and infrastructure ACLs (iACLs)?

    • They are mutually exclusive, so only one of them can be configured on a device at a time without conflicting policies.
    • They complement each other: iACLs filter at the edge, MPP limits which interfaces accept management traffic, CoPP polices the CPU.
    • CoPP replaces AAA authentication entirely, while MPP and iACLs are only needed on devices that have no CoPP policy configured.
    • MPP applies only to wireless LAN controllers, while CoPP and iACLs apply only to routers and never to Catalyst switches.

  25. What is the correct sequence of steps for configuring Control Plane Policing (CoPP) using Modular QoS CLI (MQC) on a Cisco IOS XE router?

    • 1. Apply a service policy to each physical interface, 2. Create the policy-map, 3. Create the class-maps it uses.
    • 1. Match traffic in class-maps, 2. Set police actions in a policy-map, 3. Apply it under control-plane with service-policy.
    • 1. Enable IP Source Guard, 2. Bind static ARP entries for the CPU, 3. Configure TACACS+ command authorization.
    • 1. Generate SSH keys, 2. Create a CoPP access list, 3. Reload the line cards so the policy takes effect in hardware.