Ccna Security Chapter 3

Front 1

Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?

Back 1

Autherization

Front 2

What is an effect if AAA authorization on a device is not configured?

Back 2

it defaults to the vty line access password

Front 3

A global company is deploying Cisco Secure ACS to manage user access to its headquarters campus. The network administrator configures the ACS to use multiple external databases for users from different geographical regions. The administrator creates user groups to match these databases. What is a purpose of creating different groups of users to authenticate through the Cisco Secure ACS?

Back 3

to accommodate any difference in the authentication requirements between the ACS and an external database

Front 4

Which technology provides the framework to enable scalable access security?

Back 4

authentication, authorization, and accounting

Front 5

Because of implemented security controls, a user can only access a server with FTP. Which AAA component accomplishes this?

Back 5

authorization

Front 6

in the context of Cisco Secure ACS, what is a client device?

Back 6

router switch ect

Front 7

What is a characteristic of TACACS+?

Back 7

TACACS+ uses UDP port 1645 or 1812 for authentication, and UDP port 1646 or 1813 for accounting.

Front 8

Which two statements describe AAA access methods? (Choose two.)

Back 8

Packet mode provides users with administrative privilege EXEC access and requires use of the console, vty, or tty ports.

Character mode provides remote users with access to network resources and requires use of dialup or VPN.

Front 9

What type of AAA access method does character mode provide

Back 9

console vty, and aux
exec mode for administrative purposes.

Front 10

What type of AAA access does packet mode provide

Back 10

Access to network services
dial up, vpn

ppp

Front 11

Refer to the exhibit. In the network that is shown, which AAA command logs the use of EXEC session commands?

Back 11

aaa accounting exec start-stop group tacacs+

Front 12

Refer to the exhibit. Router R1 is configured as shown. An administrative user attempts to use Telnet from router R2 to router R1 using the interface IP address 10.10.10.1. However, Telnet access is denied. Which option corrects this problem?

Back 12

The administrative user should use the username Admin and password Str0ngPa55w0rd.

Front 13

Which two features are included by both TACACS+ and RADIUS protocols? (Choose two.)

Back 13

password encryption
802.1X support

Front 14

Refer to the exhibit. Router R1 has been configured as shown, with the resulting log message. On the basis of the information that is presented, which two statements describe the result of AAA authentication operation? (Choose two.)

Back 14

The locked-out user failed authentication

The locked-out user stays locked out until the clear aaa local user lockout username Admin command is issued.

Front 15

Refer to the exhibit. A network administrator configures AAA authentication on R1. When the administrator tests the configuration by telneting to R1 and no ACS servers can be contacted, which password should the administrator use in order to login successfully?

Back 15

Pa$$w0rD

Front 16

Refer to the exhibit. A network administrator configures AAA authentication on R1. Which statement describes the effect of the keyword single-connection in the configuration?

Back 16

The authentication performance is enhanced by keeping the connection to the TACACS+ server open.

Front 17

Which two statements describe AAA access methods? (Choose two.)

Back 17

Packet mode provides remote users with access to network resources and requires use of dialup or VPN.

Character mode provides users with administrative privilege EXEC access and requires use of the console, vty, or tty ports.

Front 18

What is a characteristic of TACACS+?

Back 18

TACACS+ provides authorization of router commands on a per-user or per-group basis.

The TACACS+ protocol provides flexibility in AAA services. For example, using TACACS+, administrators can select authorization policies to be applied on a per-user or per-group basis.

Front 19

When a method list for AAA authentication is being configured, what is the effect of the keywordlocal?

Back 19

It accepts a locally configured username, regardless of case.

In defining AAA authentication method list, one option is to use a preconfigured local database. There are two keywords, either of which enables local authentication via the preconfigured local database. The keyword local accepts a username regardless of case, and the keyword local-case is case-sensitive for both usernames and passwords.

Front 20

What is the result if an administrator uses the aaa authorization command prior to creating a user with full access rights?

Back 20

The administrator is immediately locked out of the system.

Front 21

How does a Cisco Secure ACS improve performance of the TACACS+ authorization process?

Back 21

Reducing delays in the authorization queries by using persistent TCP sessions

By default, when using a server-based AAA process, TACACS+ establishes a new TCP session for every authorization request, which can lead to delays when users enter commands. Cisco Secure ACS supports persistent TCP sessions to improve performance.

Front 22

What is an effect if AAA authorization on a device is not configured?

Back 22

Authenticated users are granted full access rights.

In AAA application, the user access restriction is determined by the AAA authorization process after a user is successfully authenticated. When AAA authorization is not enabled, all users are allowed full access.

Front 23

Which two features are included by both TACACS+ and RADIUS protocols? (Choose two.)

Back 23

password encryption

utilization of transport layer protocols


Both TACACS+ and RADIUS support password encryption (TACACS+ encrypts all communication) and use Layer 4 protocol (TACACS+ uses TCP and RADIUS uses UDP). TACACS+ supports separation of authentication and authorization processes, while RADIUS combines authentication and authorization as one process. RADIUS supports remote access technology, such as 802.1x and SIP; TACACS+ does not.