Cisco CCNA Security 640-554 Training

The Implementing Cisco IOS Network Security (IINS) 640-554 exam is associated with the CCNA Security certification. This exam tests a candidate’s knowledge of securing Cisco routers and switches and their associated networks. It leads to validated skills for installation, troubleshooting and monitoring of network devices to maintain integrity, confidentiality and availability of data and devices and develops competency in the technologies that Cisco uses in its security infrastructure.

Candidates can prepare for this exam by taking the Implementing Cisco IOS Network Security (IINS) 640-554 course.

QUESTION NO: 1
Which two characteristics of the TACACS+ protocol are true? (Choose two.)
A. uses UDP ports 1645 or 1812
B. separates AAA functions
C. encrypts the body of every packet
D. offers extensive accounting capabilities
E. is an open RFC standard protocol
Answer: B,C

QUESTION NO: 2
Refer to the exhibit.

Which statement about this output is true?
A. The user logged into the router with the incorrect username and password.
B. The login failed because there was no default enable password.
C. The login failed because the password entered was incorrect.
D. The user logged in and was given privilege level 15.
Answer: C

QUESTION NO: 3
Refer to the exhibit.
Which traffic is permitted by this ACL?
A. TCP traffic sourced from any host in the 172.26.26.8/29 subnet on any port to host 192.168.1.2 port 80 or 443
B. TCP traffic sourced from host 172.26.26.21 on port 80 or 443 to host 192.168.1.2 on any port
C. any TCP traffic sourced from host 172.26.26.30 destined to host 192.168.1.1
D. any TCP traffic sourced from host 172.26.26.20 to host 192.168.1.2
Answer: C

QUESTION NO: 4
Refer to the exhibit.

Which statement about this partial CLI configuration of an access control list is true?
A. The access list accepts all traffic on the 10.0.0.0 subnets.
B. All traffic from the 10.10.0.0 subnets is denied.
C. Only traffic from 10.10.0.10 is allowed.
D. This configuration is invalid. It should be configured as an extended ACL to permit the
associated wildcard mask.
E. From the 10.10.0.0 subnet, only traffic sourced from 10.10.0.10 is allowed; traffic sourced from the other 10.0.0.0 subnets also is allowed.
F. The access list permits traffic destined to the 10.10.0.10 host on FastEthernet0/0 from any
source.
Answer: E

QUESTION NO: 5
Which type of Cisco ASA access list entry can be configured to match multiple entries in a single statement?
A. nested object-class
B. class-map
C. extended wildcard matching
D. object groups
Answer: D

QUESTION NO: 6
Which statement about an access control list that is applied to a router interface is true?
A. It only filters traffic that passes through the router.
B. It filters pass-through and router-generated traffic.
C. An empty ACL blocks all traffic.
D. It filters traffic in the inbound and outbound directions.
Answer: A

QUESTION NO: 7
You have been tasked by your manager to implement syslog in your network. Which option is an important factor to consider in your implementation?
A. Use SSH to access your syslog information.
B. Enable the highest level of syslog function available to ensure that all possible event messages are logged.
C. Log all messages to the system buffer so that they can be displayed when accessing the router.
D. Synchronize clocks on the network with a protocol such as Network Time Protocol.
Answer: D

QUESTION NO: 8
Which protocol secures router management session traffic?
A. SSTP
B. POP
C. Telnet
D. SSH
Answer: D

QUESTION NO: 9
Which two considerations about secure network management are important? (Choose two.)
A. log tampering
B. encryption algorithm strength
C. accurate time stamping
D. off-site storage
E. Use RADIUS for router commands authorization.
F. Do not use a loopback interface for device management access.
Answer: A,C

QUESTION NO: 10
Which command enables Cisco IOS image resilience?
A. secure boot-<IOS image filename>
B. secure boot-running-config
C. secure boot-start
D. secure boot-image
Answer: D

QUESTION NO: 11
Which router management feature provides for the ability to configure multiple administrative
views?
A. role-based CLI
B. virtual routing and forwarding
C. secure config privilege {level}
D. parser view view name
Answer: A

QUESTION NO: 12
You suspect that an attacker in your network has configured a rogue Layer 2 device to intercept traffic from multiple VLANs, which allows the attacker to capture potentially sensitive data.
Which two methods will help to mitigate this type of activity? (Choose two.)
A. Turn off all trunk ports and manually configure each VLAN as required on each port.
B. Place unused active ports in an unused VLAN.
C. Secure the native VLAN, VLAN 1, with encryption.
D. Set the native VLAN on the trunk ports to an unused VLAN.
E. Disable DTP on ports that require trunking.
Answer: D,E

QUESTION NO: 13
Which statement describes a best practice when configuring trunking on a switch port?
A. Disable double tagging by enabling DTP on the trunk port.
B. Enable encryption on the trunk port.
C. Enable authentication and encryption on the trunk port.
D. Limit the allowed VLAN(s) on the trunk to the native VLAN only.
E. Configure an unused VLAN as the native VLAN.
Answer: E

QUESTION NO: 14
Which type of Layer 2 attack causes a switch to flood all incoming traffic to all ports?
A. MAC spoofing attack
B. CAM overflow attack
C. VLAN hopping attack
D. STP attack
Answer: B

QUESTION NO: 15
What is the best way to prevent a VLAN hopping attack?
A. Encapsulate trunk ports with IEEE 802.1Q.
B. Physically secure data closets.
C. Disable DTP negotiations.
D. Enable BDPU guard.
Answer: C