| Question 1 | What are the three components of the CiscoSecure ACS? A. AAA server B. User database C. VPN D. AAA client
|
| A1: | Answers A, B, and D are correct. The three components are the AAA server, typically a TACACS+ or RADIUS server; the AAA client, such as a router or switch; and the user database, which is typically housed on the AAA server. Answer C is incorrect because VPN is not part of the CiscoSecure ACS. |
| Question 2 | What does AAA stand for? A. Authority B. Authorization C. Auditing D. Authentication E. Accounting
|
| A2: | Answers B, D, and E are correct. AAA stands for authentication, authorization, and accounting. Answers A and C are not part of AAA. |
| Question 3 | Which command starts AAA on a Cisco router? A. aaa-server B. aaa new-model C. tacacs D. aaa tacacs-server
|
| A3: | Answer B is correct. Answer A, aaa-server, starts the AAA process, but it does so on a PIX Firewall, so it is incorrect. The aaa new-model is not the most intuitive command, but it starts AAA on a router. Answers C and D are incorrect and do not work. |
| Question 4 | What are the two most common AAA protocols? A. TCP/IP B. RADIUS C. TACACS+ D. PPP
|
| A4: | Answers B and C are correct. Answer A, TCP/IP, is certainly a well used protocol, and is in fact used by TACACS+, but it is not an AAA protocol. Answer D is not an AAA protocol. |
| Question 5 | What are three characteristics of RADIUS? |
| A5: | Answers B, C, and E are correct. RADIUS is an open standard developed by the IETF; it uses UDP/IP and is only able to encrypt passwords. Answers A and D describe TACACS+; it is Cisco proprietary, uses TCP/IP, and encrypts all the data. |
| Question 6 | Which ports are used in character mode? (Choose three.) A. Serial 2/0 B. AUX C. BRI D. CON 0 E. VTY
|
| A6: | Answers B, D, and E are correct. Character mode is for data destined to the router. Serial 2/0, Answer A, and BRI, Answer C, represent interfaces; packets would travel into, out of, and through those interfaces. VTY, AUX, CON, and TTY typically represent character-mode ports. |
| Question 7 | Which aaa accounting keyword monitors outbound Telnet traffic? A. connection B. start-stop C. network D. telnet
|
| A7: | Answer A is correct. You use the keyword connection for all outbound connections. You use Answer B, start-stop, to record when a service or connection starts and stops, not just Telnet. Answer C is incorrect; network is for auditing service requests such as SLIP and PPP. There is no telnet keyword with accounting, so Answer D is wrong. |
| Question 8 | How do you set an encryption key of CISCO for your RADIUS server? A. tacas-server key CISCO B. aaa-server CISCO C. username RADIUS password CISCO D. radius-server key CISCO
|
| A8: | Answer D is correct. Answer A would be valid if the question was about a TACACS server. Answer B is made up and is incorrect. Answer C would create a local account called RADIUS with a password of CISCO, so it is also a wrong answer. |
| Question 9 | What command would you enter to set up authentication on your router to query the TACACS servers and, if unable to communicate to the servers, authenticate from the enable password? A. aaa authentication login default group radius enable B. aaa authentication login default group tacacs+ local C. aaa authentication login default group tacacs+ enable D. aaa authentication login default group tacacs+ none
|
| A9: | Answer C is correct; it tries TACACS first and then uses the enable password. All four of the commands are valid in some circumstances. Answer A is wrong because it goes to a RADIUS server. Answer B uses the local database if the TACACS server is down, so it is incorrect. Answer D is incorrect because it allows access if the TACACS server is unavailable because of the none option. |
| Question 10 | If you enable aaa authentication login default and do nothing else, what happens? A. The TACACS server will use a guest account. B. Nothing, because authentication has not been applied anywhere yet. C. When your session times out, you are locked out from the router. D. You need to set up authorization and accounting before any settings go into effect.
|
| A10: | Answer C is correct. Remember that when authentication is configured with the default option, it is applied everywhere. When you disconnect or your session times out, you cannot log in to your router. The router wants to authenticate you before allowing you access, and there is no way configured for the router to do that. You will be locked out. Answer A is incorrect because it does not use a guest account by default. Answer B is the exact opposite of the right answer; it is applied everywhere as soon as authentication is enabled. Answer D is wrong because each of the services is independent of the other. |
