CCNA Plan

Security Fundamentals: practice questions

4 original questions · 0 editor-approved · every choice explained.

Practice this topic

Blueprint-mapped questions with full rationales for every choice.

Start practice
Security FundamentalsDifficulty 3/5

Which ACL entry permits only hosts in 10.1.2.0/24 to reach server 10.9.9.9 on HTTPS?

  1. Aaccess-list 110 permit ip host 10.9.9.9 10.1.2.0 0.0.0.255
  2. Baccess-list 110 permit tcp any host 10.9.9.9 eq 80
  3. Caccess-list 10 permit 10.1.2.0 0.0.0.255
  4. Daccess-list 110 permit tcp 10.1.2.0 0.0.0.255 host 10.9.9.9 eq 443
Show answer and rationale

Correct: D. An extended ACL matches protocol, source, destination and port. The wildcard 0.0.0.255 covers the /24 source, 'host 10.9.9.9' is the destination and 'eq 443' is HTTPS. The implicit deny drops everything else.

  • C — A standard ACL cannot match destination or port.
  • A — Source and destination are reversed, and 'ip' allows all protocols.
  • B — 'any' allows every source and 80 is HTTP.
Security FundamentalsDifficulty 2/5

Which feature prevents a rogue DHCP server on an access port from handing out addresses?

  1. ADHCP snooping
  2. BDynamic ARP inspection
  3. CBPDU Guard
  4. DPort security
Show answer and rationale

Correct: A. DHCP snooping drops DHCP server messages (Offer/Ack) arriving on untrusted ports and builds a binding table. Only ports toward the legitimate server are marked trusted.

  • D — Port security limits MAC addresses, not DHCP messages.
  • B — DAI validates ARP using the snooping binding table; it does not stop DHCP offers.
  • C — BPDU Guard protects against rogue switches sending BPDUs.
Security FundamentalsDifficulty 3/5

Which statement correctly contrasts RADIUS and TACACS+?

  1. ARADIUS uses TCP 49 and encrypts the entire packet body
  2. BTACACS+ uses TCP 49, encrypts the entire packet body and separates authorization from authentication
  3. CTACACS+ uses UDP 1812 and encrypts only the password
  4. DBoth use UDP and are functionally identical
Show answer and rationale

Correct: B. TACACS+ (Cisco) runs over TCP 49, encrypts the whole payload, and separates AAA functions, enabling per-command authorization. RADIUS uses UDP 1812/1813, encrypts only the password, and combines authentication and authorization.

  • A — Those are TACACS+ properties.
  • C — UDP 1812 and password-only encryption describe RADIUS.
  • D — They differ in transport, encryption and function separation.
Security FundamentalsDifficulty 2/5

Which wireless security protocol introduced Simultaneous Authentication of Equals (SAE) to replace the PSK four-way handshake's weakness?

  1. AWPA
  2. BWPA2
  3. CWPA3
  4. DWEP
Show answer and rationale

Correct: C. WPA3-Personal uses SAE (a Dragonfly key exchange) so an offline dictionary attack on a captured handshake no longer works. WPA2-Personal uses PSK with the four-way handshake.

  • D — WEP uses RC4 with static keys and is broken.
  • A — WPA introduced TKIP as an interim fix.
  • B — WPA2 uses AES-CCMP with PSK/802.1X but not SAE.

Primary references

  1. CCNA Exam v1.1 (200-301) Exam Topics — Cisco Systems · primary · retrieved 2026-09-21, verified 2026-09-21