Title: ICND1 / 6. Network Device Security

Q: Which Cisco command will display the version and configuration data for Secure Shell (SSH)?
A: router#show ip ssh
SSH Enabled - version 1.5
Authentication timeout: 120 secs; Authentication retries: 2

Q: How would you disable CDP for a specific interface?
A: no cdp enable

Q: The ___________________ interface configuration command is used to configure private VLAN edge ports on a Cisco Catalyst 2950 switch. A VLAN edge port is another name given to a protected port. Protected ports do not forward any traffic to other protected ports on the same switch. All traffic passing between protected ports on the same switch must be routed through a Layer 3 device. Protected ports have no restrictions on forwarding to non-protected ports, and they forward as usual to all ports on other switches
A: switchport protected

Q: The following are limitations of the __________ command:
- It uses the Vigenere cipher algorithm, which is simple in nature.
- A cryptographer can easily crack the algorithm in a few hours.
- The algorithm used by this command cannot protect the configuration files against detailed analysis by attackers.
A: service password-encryption

Q: Which Cisco IOS command disables Cisco Discovery Protocol Version 2 (CDPv2) advertisements?
A: no cdp advertise-v2

Q: The conference room has a switch port available for use by the presenter during classes. You would like to prevent that port from hosting a hub or switch. Which of the following commands could be used to prevent that port from hosting a hub or switch?
A: The switchport port-security command would  prevent the port from hosting a hub or switch. This command enables port security on an interface. It does not specify a maximum number of MAC addresses, but in the default is 1 , therefore it would accomplish the goal.

Q: You are the network administrator for your company. You want to restrict incoming and outgoing connections between a VTY and the address in an access list. Which Cisco Internetwork Operating System (IOS) command should you use to accomplish the task?
A: The access-class command is used to restrict incoming and outgoing connections between a VTY and the address in an access list. This command is issued in line configuration mode. The syntax of the command is as follows:
Router(config-line)# access-class access-list-number {in | out}

Q: Which Cisco IOS command can be used to troubleshoot switch startup problems on a Cisco Catalyst 2950 switch?
A: "show post" is used on the 2900/3500XL, 2950/2955, 3550, 2970, and 3750 series switches to view and troubleshoot issues related to the Power On Self Test (POST) on the switch. This command will find the POST test that failed on startup.
Switch#show post
Stored system POST messages:
POST: CPU Buffer Tests : Begin
POST: CPU Buffer Tests : End, Status Passed
POST: CPU Interface Tests : Begin
POST: CPU Interface Tests : End, Status Passed
POST: Switch Core Tests : Begin
POST: Switch Core Tests : End, Status Passed
POST: CPU Interface 2nd Stage Tests : Begin
POST: CPU Interface 2nd Stage Tests : End, Status Passed
POST: CAM Subsystem Tests : Begin
POST: CAM Subsystem Tests : End, Status Passed
POST: Ethernet Controller Tests : Begin
POST: Ethernet Controller Tests : End, Status Passed
POST: Loopback Tests : Begin
POST: Loopback Tests : End, Status Passed

Q: What privilege level is granted to a user if the privilege level has not been explicitly configured in the enable password, enable secret, or username commands?
A: 15

Q: You issue the "show running-config" command on a Cisco device and see the following line of output:
username boson password 7 072033404F071D0A
What can you derive from this?
A: The service password-encryption command has been issued on this device.

Q: Which of the following commands should you use to encrypt the password that is required to access privilege level 7 on a router?
A: enable secret level 7 cisco

Q: After typing the following commands, what will you see when you login to the device with telnet?:
Switch(config)#banner login ^
Enter TEXT message.  End with the character '^'
this is the login
^
Switch(config)#banner exec ^
Enter TEXT message.  End with the character '^'
this is the exec
^
Switch(config)#banner motd ^
Enter TEXT message.  End with the character '^'
this is the motd
^
A: C:\>telnet 172.16.2.2
this is the motd
this is the login
User Access Verification
Password:
this is the exec

Q: How would you set up an ACL to allow pings to and from any hosts on an interface
A: ip access-list extended ALLOW_PING
permit icmp any any
int fa0/0
ip access-group ALLOW_PING in|out

Q: How would you apply an ACL to a vty interface?
A: access-class ACL_NAME in

Q: How would you telnet FROM a specific interface (Serial 0/1/0) on a router to host 10.1.1.4?
A: telnet 10.1.1.4 /source-interface s0/1/0