CCNA v2.0 Practice Questions: Network Services and Security

Correct answer: B. Type 7 is a reversible encoding, so admin should use secret instead

B is correct because a type 7 string can be decoded back to the clear-text password, while the secret keyword stores a one-way hash such as type 9. A confuses type 7 with type 5, which is the MD5 hash; type 7 is not a hash at all. C is false; the account logs in with either keyword, and the risk is that its password can be recovered. D misreads the line, since the 7 marks an encoded value rather than clear text.

Correct answer: C. ip domain name example.com

C is correct because the RSA key pair is named from the hostname and domain name, and the hostname is already set, so only the domain name is missing. A is not needed, because the prompt already shows a non-default hostname and the error asks for a domain name. B selects the SSH version but cannot be used meaningfully until a key pair exists. D is a vty line command that restricts protocols and does not affect key generation.

Correct answer: D. Branch-New2, because the enable secret takes precedence

D is correct because when both commands exist, IOS uses the enable secret and ignores the enable password. A order of entry does not matter; the enable secret always wins when both are present. B is false, since only the enable secret is checked when it is configured. C misdescribes the command, which only encodes clear-text passwords as type 7 in the configuration.

Correct answer: D. The default list, which checks only the local user database

D is correct because line con 0 has no login authentication command, so it uses the default list, which is set to local. A ignores the default method list that aaa new-model applies to every line without a named list. B applies only to vty 0 4, where it is named; the console is not bound to it. C is false, since aaa new-model applies the default method list to the console as well.

Correct answer: B. ip tacacs source-interface Loopback0

B is correct because forces R7 to source TACACS+ packets from 10.255.0.7, the address the server has registered for this client. A addresses a shared-secret mismatch, but the log shows the client address itself is unknown. C keeps the current source of 10.20.0.1, which the server does not recognize. D would point R7 at its own loopback as the server instead of changing the source address.

Correct answer: B. Replace login with login local under line vty 0 4

B is correct because login local makes the vty lines check the local username database, which SSH needs to authenticate a named user. A only encodes the stored line password as type 7 and changes nothing about authentication. C protects privileged EXEC mode and does not change how the vty lines authenticate. D adds Telnet but leaves the lines checking only a shared line password.

Correct answer: C. R8 cannot open a TCP session to the server on port 49

C is correct because no sockets opened, 14 failed connects and zero packets sent mean the TCP connection never formed, so the cause is reachability or filtering rather than credentials. A is not possible here; a reject is a response, and no packets were received, while a reject would also stop fallback. B is false, because TACACS+ always uses TCP and the output tracks TCP connect attempts. D would still show sockets opening and packets exchanged before decryption failed.

Correct answer: B. Add aaa authorization exec default local

B is correct because with aaa new-model, the privilege level from the local account is applied only when exec authorization uses the local database. A would give every vty user level 15 regardless of account, which breaks the requirement that other users keep their own levels. C changes only how the password is stored, not how the privilege level is applied. D is the non-AAA method and is overridden once aaa new-model is enabled.

Correct answer: C. R10 sends to the legacy ports 1645 and 1646

C is correct because the address line shows the legacy ports that IOS uses when none are specified, so requests never reach a server listening on 1812 and 1813. A the type 7 encoding exists only in the configuration; R10 sends the real shared secret. B is not required; a loopback source works when the server has that address registered as the client. D has it backward, since listing local first would keep R10 from using RADIUS for local users, and the order is not why requests fail to arrive.

Correct answer: A. Reject it; with no local method, logins fail when the server is unreachable

A is correct because the default list names only group tacacs+, so an unreachable server leaves no method to try and the routers lock out console and vty users. B is false, because the default method list also applies to the console line. C key 7 is for pasting an already-encoded secret and has nothing to do with the lockout risk. D is false, since aaa new-model replaces line passwords with method lists and adds no hidden fallback.