Cisco CCNA Network Security Fundamentals Flashcards
6 cards from real Cisco CCNA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Cisco CCNA Network Security Fundamentals flashcards as text
What is the minimum RSA key size recommended when generating SSH keys on a Cisco IOS device for SSHv2?
Answer: 2048 bits
SSHv2 requires a minimum RSA key modulus of 768 bits, but Cisco and industry best practices recommend at least 2048 bits for current deployments.
Which command prevents the 'enable' password from being stored in plaintext in the Cisco IOS configuration?
Answer: enable secret
'enable secret' stores the enable password as an MD5 (or stronger) hash, unlike 'enable password' which stores it in plaintext or weak Type 7.
What action should be taken to recover a Cisco switch port from an err-disabled state after a port security violation?
Answer: Shut down and then no shutdown the interface
To recover an err-disabled port, issue 'shutdown' followed by 'no shutdown' on the interface after resolving the cause of the violation.
Which command disables CDP on a specific Cisco router interface to prevent neighbor information disclosure?
Answer: no cdp enable
The interface-level command 'no cdp enable' disables CDP on that specific interface without affecting other interfaces.
What is the purpose of configuring an 'exec-timeout' on Cisco VTY lines?
Answer: Automatically disconnects idle management sessions after a specified time
'exec-timeout ' closes inactive VTY sessions automatically, reducing the risk of unauthorized access to unattended sessions.
Which AAA protocol encrypts only the password in the authentication packet, while the other encrypts the entire payload?
Answer: RADIUS encrypts only the password; TACACS+ encrypts the entire payload
RADIUS encrypts only the user's password in the Access-Request packet, while TACACS+ encrypts the entire body of every packet for greater security.