CCNA 3 v7 Modules 3-5: Network Security Exam Answers
Checkpoint Exam: Network Security. This comprehensive study guide covers Modules 3-5 of the CCNA3 Enterprise Networking, Security, and Automation v7.0 (ENSA), including network security concepts, ACLs, cryptography, and threat mitigation.
1. The IT department is reporting that a company web server is receiving an abnormally high number of web page requests from different locations simultaneously. Which type of security attack is occurring?
Explanation: Topic 3.5.9 – A DDoS attack uses multiple compromised systems to target a single system, causing denial of service.
2. What causes a buffer overflow?
Explanation: Topic 3.5.5 – A buffer overflow occurs when a program attempts to store more data in a buffer than it was designed to hold.
3. Which objective of secure communications is achieved by encrypting data?
Explanation: Topic 3.10.2 – Encryption ensures confidentiality by scrambling data so only authorized parties can read it.
4. What type of malware has the primary objective of spreading across the network?
Explanation: Topic 3.4.3 – Worms are self-replicating malware that spread across networks.
5. What commonly motivates cybercriminals to attack networks as compared to hactivists or state-sponsored hackers?
Explanation: Topic 3.2.3 – Cybercriminals are primarily motivated by financial gain.
6. Which type of hacker is motivated to protest against political and social issues?
Explanation: Topic 3.2.4 – Hacktivists are motivated by political and social issues.
7. What is a ping sweep?
Explanation: Topic 3.5.3 – A ping sweep is a tool that is used during a reconnaissance attack. Other tools that might be used during this type of attack include a ping sweep, port scan, or Internet information query. A reconnaissance attack is used to gather information about a particular network, usually in preparation for another type of network attack.
8. In what type of attack is a cybercriminal attempting to prevent legitimate users from accessing network services?
Explanation: Topic 3.5.9 – Denial of Service (DoS) attacks aim to disrupt normal service.
9. Which requirement of secure communications is ensured by the implementation of MD5 or SHA hash generating algorithms?
Explanation: Topic 3.10.2 – A ping sweep is a tool that is used during a reconnaissance attack. Other tools that might be used during this type of attack include a ping sweep, port scan, or Internet information query. A reconnaissance attack is used to gather information about a particular network, usually in preparation for another type of network attack.
10. If an asymmetric algorithm uses a public key to encrypt data, what is used to decrypt it?
Explanation: Topic 3.10.8 – When an asymmetric algorithm is used, public and private keys are used for the encryption. Either key can be used for encryption, but the complementary matched key must be used for the decryption. For example if the public key is used for encryption, then the private key must be used for the decryption.
11. Refer to the exhibit. Which two ACLs would permit only the two LAN networks attached to R1 to access the network that connects to R2 G0/1 interface? (Choose two.)
Explanation: Topic 4.2.2 – The permit 192.168.10.0 0.0.0.127 command ignores bit positions 1 through 7, which means that addresses 192.168.10.0 through 192.168.10.127 are allowed through. The two ACEs of permit 192.168.10.0 0.0.0.63 and permit 192.168.10.64 0.0.0.63 allow the same address range through the router.
12. Which two packet filters could a network administrator use on an IPv4 extended ACL? (Choose two.)
Explanation: Topic 5.4.1 – Extended access lists commonly filter on source and destination IPv4 addresses and TCP or UDP port numbers. Additional filtering can be provided for protocol types.
13. What type of ACL offers greater flexibility and control over network access?
Explanation: Topic 5.4.1 – The two types of ACLs are standard and extended. Both types can be named or numbered, but extended ACLs offer greater flexibility.
14. What is the quickest way to remove a single ACE from a named ACL?
Explanation: Topic 5.2.3 – Named ACL ACEs can be removed using the no command followed by the sequence number.
15. Refer to the exhibit. A network administrator is configuring a standard IPv4 ACL. What is the effect after the command no access-list 10 is entered?
Explanation: Topic 5.1.4 – The R1(config)# no access-list
16. Refer to the exhibit. A network administrator has configured ACL 9 as shown. Users on the 172.31.1.0 /24 network cannot forward traffic through router CiscoVille. What is the most likely cause of the traffic failure?
Explanation: Topic 4.1.3 – When verifying an ACL, the statements are always listed in a sequential order. Even though there is an explicit permit for the traffic that is sourced from network 172.31.1.0 /24, it is being denied due to the previously implemented ACE of CiscoVille(config)# access-list 9 deny 172.31.0.0 0.0.255.255. The sequence of the ACEs must be modified to permit the specific traffic that is sourced from network 172.31.1.0 /24 and then to deny 172.31.0.0 /16.
17. A network administrator needs to configure a standard ACL so that only the workstation of the administrator with the IP address 192.168.15.23 can access the virtual terminal of the main router. Which two configuration commands can achieve the task? (Choose two.)
Explanation: Topic 4.2.4 – To permit or deny one specific IP address, either the wildcard mask 0.0.0.0 (used after the IP address) or the wildcard mask keyword host (used before the IP address) can be used.
18. Refer to the exhibit. Which command would be used in a standard ACL to allow only devices on the network attached to R2 G0/0 interface to access the networks attached to R1?
Explanation: Topic 4.2.3 – Standard access lists only filter on the source IP address. In the design, the packets would be coming from the 192.168.10.96/27 network (the R2 G0/0 network). The correct ACL is access-list 1 permit 192.168.10.96 0.0.0.31.
19. A network administrator is writing a standard ACL that will deny any traffic from the 172.16.0.0/16 network, but permit all other traffic. Which two commands should be used? (Choose two.)
Explanation: Topic 5.1.2 – To deny traffic from the 172.16.0.0/16 network, the access-list 95 deny 172.16.0.0 0.0.255.255 command is used. To permit all other traffic, the access-list 95 permit any statement is added.
20. Refer to the exhibit. An ACL was configured on R1 with the intention of denying traffic from subnet 172.16.4.0/24 into subnet 172.16.3.0/24. All other traffic into subnet 172.16.3.0/24 should be permitted. This standard ACL was then applied outbound on interface Fa0/0. Which conclusion can be drawn from this configuration?
Explanation: Topic 4.1.3 – Because of the implicit deny at the end of all ACLs, the access-list 1 permit any command must be included to ensure that only traffic from the 172.16.4.0/24 subnet is blocked and that all other traffic is allowed.
21. Refer to the exhibit. A network administrator needs to add an ACE to the TRAFFIC-CONTROL ACL that will deny IP traffic from the subnet 172.23.16.0/20. Which ACE will meet this requirement?
Explanation: Topic 4.1.3 – The only filtering criteria specified for a standard access list is the source IPv4 address. The wild card mask is written to identify what parts of the address to match, with a 0 bit, and what parts of the address should be ignored, which a 1 bit. The router will parse the ACE entries from lowest sequence number to highest. If an ACE must be added to an existing access list, the sequence number should be specified so that the ACE is in the correct place during the ACL evaluation process.
22. Refer to the exhibit. A network administrator configures an ACL on the router. Which statement describes the result of the configuration?
Explanation: Topic 5.4.1 – In an extended ACL, the first address is the source IP address and the second one is the destination IP address. TCP port number 22 is a well-known port number reserved for SSH connections. Telnet connections use TCP port number 23.
23. Refer to the exhibit. What can be determined from this output?
Explanation: Topic 5.2.5 – ACL entry 10 in MyACL matches any Telnet packets between host 10.35.80.22 and 10.23.77.101. No matches have occurred on this ACE as evidenced by the lack of a “(xxx matches)” ACE. The deny ip any any ACE is not required because there is an implicit deny ACE added to every access control list. When no matches exist for an ACL, it only means that no traffic has matched the conditions that exist for that particular line. The ACL is monitoring traffic that matches three specific hosts going to very specific destination devices. All other traffic is not permitted by the implicit deny ip any any ACE.
24. Refer to the exhibit. A network administrator wants to permit only host 192.168.1.1 /24 to be able to access the server 192.168.2.1 /24. Which three commands will achieve this using best ACL placement practices? (Choose three.)
Explanation: Topic 4.4.3 – An extended ACL is placed as close to the source of the traffic as possible. In this case.it is placed in an inbound direction on interface fa0/0 on R2 for traffic entering the router from host with the IP address192.168.1.1 bound for the server with the IP address192.168.2.1.
25. Consider the following access list.
access-list 100 permit ip host 192.168.10.1 any
access-list 100 deny icmp 192.168.10.0 0.0.0.255 any echo
access-list 100 permit ip any any
Which two actions are taken if the access list is placed inbound on a router Gigabit Ethernet port that has the IP address 192.168.10.254 assigned? (Choose two.)
Explanation: Topic 5.4.1 – The first ACE allows the 192.168.10.1 device to do any TCP/IP-based transactions with any other destination. The second ACE stops devices on the 192.168.10.0/24 network from issuing any pings to any other location. Everything else is permitted by the third ACE. Therefore, a Telnet/SSH session or ping reply is allowed from a device on the 192.168.10.0/24 network.
26. Refer to the exhibit. The named ACL "Managers" already exists on the router. What will happen when the network administrator issues the commands that are shown in the exhibit?
Explanation: Topic 5.2.4 – When entering ACEs into an existing named ACL without specifying sequence numbers, they are appended.
27. In which TCP attack is the cybercriminal attempting to overwhelm a target host with half-open TCP connections?
Explanation: Topic 3.7.3 – In a TCP SYN flood attack, the attacker sends to the target host a continuous flood of TCP SYN session requests with a spoofed source IP address. The target host responds with a TCP-SYN-ACK to each of the SYN session requests and waits for a TCP ACK that will never arrive. Eventually the target is overwhelmed with half-open TCP connections.
28. Which protocol is attacked when a cybercriminal provides an invalid gateway in order to create a man-in-the-middle attack?
Explanation: Topic 3.8.7 – A rogue DHCP server can provide a wrong default gateway for MITM attacks.
29. Refer to the exhibit. An administrator has configured a standard ACL on R1 and applied it to interface serial 0/0/0 in the outbound direction. What happens to traffic leaving interface serial 0/0/0 that does not match the configured ACL statements?
Explanation: Topic 4.1.3 – Any traffic that does not match one of the statements in an ACL has the implicit deny applied to it, which means the traffic is dropped.
30. Refer to the exhibit. The Gigabit interfaces on both routers have been configured with subinterface numbers that match the VLAN numbers connected to them. PCs on VLAN 10 should be able to print to the P1 printer on VLAN 12. PCs on VLAN 20 should print to the printers on VLAN 22. What interface and in what direction should you place a standard ACL that allows printing to P1 from data VLAN 10, but stops the PCs on VLAN 20 from using the P1 printer? (Choose two.)
Explanation: Topic 4.4.4 – A standard access list is commonly placed as close to the destination network as possible because access control expressions in a standard ACL do not include information about the destination network. The destination in this example is printer VLAN 12 which has router R1 Gigabit subinterface 0/1/.12 as its gateway. A sample standard ACL that only allows printing from data VLAN 10 (192.168.10.0/24), for example, and no other VLAN would be as follows:
R1(config)# access-list 1 permit 192.168.10.0 0.0.0.255 R1(config)# access-list 1 deny any R1(config)# interface gigabitethernet 0/1.12 R1(config-if)# ip access-group 1 out
31. Which statement describes a characteristic of standard IPv4 ACLs?
Explanation: Topic 4.4.1 – A standard IPv4 ACL can filter traffic based on source IP addresses only. Unlike an extended ACL, it cannot filter traffic based on Layer 4 ports. However, both standard and extended ACLs can be identified with either a number or a name, and both are configured in global configuration mode.
32. What is considered a best practice when configuring ACLs on vty lines?
Explanation: Topic 5.3.1 – Applying the same ACL to all VTY lines ensures consistent access control.
33. Refer to the exhibit. An administrator first configured an extended ACL as shown by the output of the show access-lists command. The administrator then edited this access-list by issuing the commands below.
Router(config)# ip access-list extended 101
Router(config-ext-nacl)# no 20
Router(config-ext-nacl)# 5 permit tcp any any eq 22
Router(config-ext-nacl)# 20 deny
Which two conclusions can be drawn from this new configuration? (Choose two.)
Explanation: Topic 5.2.3 – After editing, the ACL permits SSH (port 22) and ICMP (ping), but denies all other TCP and UDP.
34. Which set of access control entries would allow all users on the 192.168.10.0/24 network to access a web server that is located at 172.17.80.1, but would not allow them to use Telnet?
Explanation: Topic 5.4.2 – Use an extended ACL to allow HTTP (port 80) to the server and deny Telnet (port 23).
35. What is the term used to describe a mechanism that takes advantage of a vulnerability?
Explanation: Topic 3.1.1 – An exploit is a mechanism that takes advantage of a vulnerability.
36. Refer to the exhibit. The network administrator has an IP address of 192.168.11.10 and needs access to manage R1. What is the best ACL type and placement to use in this situation?
Explanation: Topic 5.3.1 – Standard ACLs permit or deny packets based only on the source IPv4 address. Because all traffic types are permitted or denied, standard ACLs should be located as close to the destination as possible. Extended ACLs permit or deny packets based on the source IPv4 address and destination IPv4 address, protocol type, source and destination TCP or UDP ports and more. Because the filtering of extended ACLs is so specific, extended ACLs should be located as close as possible to the source of the traffic to be filtered. Undesirable traffic is denied close to the source network without crossing the network infrastructure.
37. A technician is tasked with using ACLs to secure a router. When would the technician use the any configuration option or command?
Explanation: Topic 4.2.4 – The any keyword matches any source or destination IP address.
38. Which statement accurately characterizes the evolution of threats to network security?
Explanation: Topic 3.1.2 – Internal threats can be intentional or accidental and cause greater damage than external threats because the internal user has direct access to the internal corporate network and corporate data.
39. A user receives a phone call from a person who claims to represent IT services and then asks that user for confirmation of username and password for auditing purposes. Which security threat does this phone call represent?
Explanation: Topic 3.5.6 – Social engineering attempts to gain the confidence of an employee and convince that person to divulge confidential and sensitive information, such as usernames and passwords. DDoS attacks, spam, and keylogging are all examples of software based security threats, not social engineering.
40. In what way are zombies used in security attacks?
Explanation: Topic 3.5.9 – Social engineering attempts to gain the confidence of an employee and convince that person to divulge confidential and sensitive information, such as usernames and passwords. DDoS attacks, spam, and keylogging are all examples of software based security threats, not social engineering.
41. Which attack involves threat actors positioning themselves between a source and destination with the intent of transparently monitoring, capturing, and controlling the communication?
Explanation: Topic 3.3.4 – The man-in-the-middle attack is a common IP-related attack where threat actors position themselves between a source and destination to transparently monitor, capture, and control the communication.
42. Which two keywords can be used in an access control list to replace a wildcard mask or address and wildcard mask pair? (Choose two.)
Explanation: Topic 4.2.4 – The host keyword is used when using a specific device IP address in an ACL. For example, the deny host 192.168.5.5 command is the same is the deny 192.168.5.5 0.0.0.0 command. The any keyword is used to allow any mask through that meets the criteria. For example, the permit any command is the same as permit 0.0.0.0 255.255.255.255 command.
43. Which statement describes a difference between the operation of inbound and outbound ACLs?
Explanation: Topic 4.1.3 – With an inbound ACL, incoming packets are processed before they are routed. With an outbound ACL, packets are first routed to the outbound interface, then they are processed. Thus processing inbound is more efficient from the router perspective. The structure, filtering methods, and limitations (on an interface, only one inbound and one outbound ACL can be configured) are the same for both types of ACLs.
44. What effect would the Router1(config-ext-nacl)# permit tcp 172.16.4.0 0.0.0.255 any eq www command have when implemented inbound on the f0/0 interface?
Explanation: Topic 5.4.2 – The ACE permits TCP traffic from the specified source network to any destination on port 80 (HTTP).
45. Which ACE will permit a packet that originates from any network and is destined for a web server at 192.168.1.1?
Explanation: Topic 5.4.2 – The correct syntax is: permit tcp any host
46. Refer to the exhibit. A new network policy requires an ACL denying FTP and Telnet access to a Corp file server from all interns. The address of the file server is 172.16.1.15 and all interns are assigned addresses in the 172.18.200.0/24 network. After implementing the ACL, no one in the Corp network can access any of the servers. What is the problem?
Explanation: Topic 4.1.3 – Both named and numbered ACLs have an implicit deny ACE at the end of the list. This implicit deny blocks all traffic.
47. A technician is tasked with using ACLs to secure a router. When would the technician use the access-class 20 in configuration option or command?
Explanation: Topic 5.3.1 – The access-class command is used on VTY lines to restrict management access.
48. What is the term used to describe the same pre-shared key or secret key, known by both the sender and receiver to encrypt and decrypt data?
Explanation: Topic 3.10.7 – Symmetric encryption uses a shared key.
49. Refer to the exhibit. Internet privileges for an employee have been revoked because of abuse but the employee still needs access to company resources. What is the best ACL type and placement to use in this situation?
Explanation: Topic 4.4.4 – Standard ACLs permit or deny packets based only on the source IPv4 address. Because all traffic types are permitted or denied, standard ACLs should be located as close to the destination as possible. – Extended ACLs permit or deny packets based on the source IPv4 address and destination IPv4 address, protocol type, source and destination TCP or UDP ports and more. Because the filtering of extended ACLs is so specific, extended ACLs should be located as close as possible to the source of the traffic to be filtered. Undesirable traffic is denied close to the source network without crossing the network infrastructure.
50. Refer to the exhibit. The student on the H1 computer continues to launch an extended ping with expanded packets at the student on the H2 computer. The school network administrator wants to stop this behavior, but still allow both students access to web-based computer assignments. What would be the best plan for the network administrator?
Explanation: Topic 4.4.5 – This access list must be an extended ACL in order to filter on specific source and destination host addresses. Commonly, the best place for an extended ACL is closest to the source, which is H1. Traffic from H1 travels into the switch, then out of the switch into the R1 Gi0/0 interface. This Gi0/0 interface would be the best location for this type of extended ACL. The ACL would be applied on the inbound interface since the packets from H1 would be coming into the R1 router.
51. A technician is tasked with using ACLs to secure a router. When would the technician use the 'ip access-group 101 in' configuration option or command?
Explanation: Topic 5.4.2 – The ip access-group command applies an ACL to an interface, and in specifies inbound direction.
52. In which type of attack is falsified information used to redirect users to malicious Internet sites?
Explanation: Topic 3.8.4 – DNS cache poisoning redirects users to malicious sites.
53. What is a feature of an IPS?
Explanation: Topic 3.9.4 – An advantage of an intrusion prevention systems (IPS) is that it can identify and stop malicious packets. However, because an IPS is deployed inline, it can add latency to the network.
54. What is the term used to describe a potential danger to a company’s assets, data, or network functionality?
Explanation: Topic 3.1.1 – A threat is a potential danger to a company’s assets, data, or network functionality. An exploit is a mechanism that takes advantage of a vulnerability. A vulnerability is a weakness in a system, or its design, that could be exploited by a threat.
55. Refer to the exhibit. Network 192.168.30.0/24 contains all of the company servers. Policy dictates that traffic from the servers to both networks 192.168.10.0 and 192.168.11.0 be limited to replies for original requests. What is the best ACL type and placement to use in this situation?
Explanation: Topic 5.4.6 – Standard ACLs permit or deny packets based only on the source IPv4 address. Because all traffic types are permitted or denied, standard ACLs should be located as close to the destination as possible. Extended ACLs permit or deny packets based on the source IPv4 address and destination IPv4 address, protocol type, source and destination TCP or UDP ports and more. Because the filtering of extended ACLs is so specific, extended ACLs should be located as close as possible to the source of the traffic to be filtered. Undesirable traffic is denied close to the source network without crossing the network infrastructure.
56. What does the CLI prompt change to after entering the command ip access-list standard aaa from global configuration mode?
Explanation: Topic 5.1.3 – The command enters standard named ACL configuration mode.
57. Refer to the exhibit. Many employees are wasting company time accessing social media on their work computers. The company wants to stop this access. What is the best ACL type and placement to use in this situation?
Explanation: Topic 4.4.5 – Extended ACLs should be placed close to the source (R1 interfaces) to block specific traffic like social media.
58. A technician is tasked with using ACLs to secure a router. When would the technician use the 40 deny host 192.168.23.8 configuration option or command?
Explanation: Topic 5.2.3 – A numbered ACL ACE uses the sequence number (40) followed by deny/permit.
59. What is the best description of Trojan horse malware?
Explanation: Topic 3.4.2 – A Trojan horse masquerades as legitimate software.
60. What wild card mask will match networks 172.16.0.0 through 172.19.0.0?
Explanation: Topic 4.2.3 – The range 172.16.0.0 to 172.19.0.0 matches the third octet from 16 to 19 (bits 0 and 1 vary), so wildcard mask is 0.3.255.255.
61. What is the term used to describe gray hat hackers who publicly protest organizations or governments by posting articles, videos, leaking sensitive information, and performing network attacks?
Explanation: Topic 3.2.2 – Hacktivists are motivated by political or social causes.
62. A technician is tasked with using ACLs to secure a router. When would the technician use the no ip access-list 101 configuration option or command?
Explanation: Topic 5.4.2 – The no ip access-list command deletes an entire ACL.
63. What is the term used to describe unethical criminals who compromise computer and network security for personal gain, or for malicious reasons?
Explanation: Topic 3.2.1 – Black hat hackers are unethical threat actors who use their skills to compromise computer and network security vulnerabilities. The goal is usually financial gain or personal gain, or the hacker may have malicious intent. A vulnerability broker is a gray hat hacker who attempts to discover exploits and report them to vendors, sometimes for prizes or rewards. Hacktivists are gray hat hackers who publicly protest organizations or governments by posting articles or videos, leaking sensitive information, and performing network attacks. Script kiddies are inexperienced hackers (sometimes teenagers) running existing scripts, tools, and exploits to cause harm—but typically not for profit.
64. What is the term used to describe a guarantee that the message is not a forgery and does actually come from whom it states?
Explanation: Topic 3.10.2 – Origin authentication verifies the sender's identity.
65. A technician is tasked with using ACLs to secure a router. When would the technician use the ip access-group 101 in configuration option or command?
Explanation: Topic 5.4.2 – Same as Q51.
66. A technician is tasked with using ACLs to secure a router. When would the technician use the remark configuration option or command?
Explanation: Topic 5.1.2 – The remark command adds comments to ACLs.
67. Refer to the exhibit. The company CEO demands that one ACL be created to permit email traffic to the internet and deny FTP access. What is the best ACL type and placement to use in this situation?
Explanation: Topic 4.4.1 – An extended ACL outbound on the WAN interface can permit email (TCP port 25) and deny FTP (ports 20/21).
68. A technician is tasked with using ACLs to secure a router. When would the technician use the established configuration option or command?
Explanation: Topic 5.4.6 – The established keyword permits TCP packets that are part of an existing connection.
69. A technician is tasked with using ACLs to secure a router. When would the technician use the deny configuration option or command?
Explanation: Topic 5.1.2 – The deny command is used to block traffic.
70. Refer to the exhibit. Only authorized remote users are allowed remote access to the company server 192.168.30.10. What is the best ACL type and placement to use in this situation?
Explanation: Topic 4.4.5 – Place an extended ACL inbound on the WAN interface to filter remote access to the server.
71. Refer to the exhibit. Employees on 192.168.11.0/24 work on critically sensitive information and are not allowed access off their network. What is the best ACL type and placement to use in this situation?
Explanation: Topic 4.4.3 – A standard ACL inbound on the interface connected to the sensitive network can block all traffic from that network.
72. A technician is tasked with using ACLs to secure a router. When would the technician use the host configuration option or command?
Explanation: Topic 4.2.4 – The host keyword specifies a single IP address.
73. What commonly motivates cybercriminals to attack networks as compared to hacktivists or state-sponsored hackers?
Explanation: Topic 3.2.3 – Cybercriminals are commonly motivated by money. Hackers are known to hack for status. Cyberterrorists are motivated to commit cybercrimes for religious or political reasons.
74. Refer to the exhibit. The company has provided IP phones to employees on the 192.168.10.0/24 network and the voice traffic will need priority over data traffic. What is the best ACL type and placement to use in this situation?
Explanation: Topic 4.4.3 – Standard ACLs permit or deny packets based only on the source IPv4 address. Because all traffic types are permitted or denied, standard ACLs should be located as close to the destination as possible. Extended ACLs permit or deny packets based on the source IPv4 address and destination IPv4 address, protocol type, source and destination TCP or UDP ports and more. Because the filtering of extended ACLs is so specific, extended ACLs should be located as close as possible to the source of the traffic to be filtered. Undesirable traffic is denied close to the source network without crossing the network infrastructure.
🚀 Ace Your CCNA Exam - Complete Study Pack!
Get 500+ exam-realistic questions, Packet Tracer labs, and detailed explanations.
Understanding Network Security (Modules 3-5)
Passing the CCNA 3 v7 Modules 3-5 exam requires a solid understanding of network security concepts, including threats, cryptography, and access control lists (ACLs). These modules cover security threats, mitigation techniques, AAA, encryption, and ACL configuration – essential knowledge for any network security professional.
Why Modules 3-5 Matter for Your Networking Career
Modules 3-5 focus on protecting enterprise networks from internal and external threats. You learn about common attacks like DDoS, phishing, and man-in-the-middle, and how to implement security measures using ACLs, firewalls, and encryption. Employers expect CCNA-certified professionals to understand security best practices, ACL placement, and cryptographic protocols. Mastering these topics prepares you for security roles and advanced certifications like CCNA Security.
Key Topics Covered in the Exam
Our verified answers address common exam questions on:
- Security Threats: Malware, DoS, social engineering, buffer overflow, and spoofing.
- Cryptography: Symmetric/asymmetric encryption, hashing (MD5/SHA), digital signatures, and PKI.
- AAA: Authentication, authorization, accounting, and RADIUS/TACACS+ protocols.
- Access Control Lists (ACLs): Standard vs extended, numbered vs named, ACE ordering, wildcard masks, and placement.
- ACL Configuration: Permit/deny, remarks, established, and application to interfaces/VTY lines.
- Mitigation Techniques: Port security, DHCP snooping, DAI, BPDU guard, and IPS/IDS.
Many questions present a topology and ask for the best ACL type and placement. Understanding the difference between standard and extended ACLs and where to place them is critical.
Common Pitfalls to Avoid
Students often confuse standard and extended ACLs – standard filters only on source IP, while extended can filter on source/destination IP, protocol, and ports. Another common mistake is misplacing ACLs – extended ACLs should be close to the source, standard ACLs close to the destination. Also, remember that ACEs are processed in order, so the sequence matters.
When practicing, avoid memorizing letter choices – focus on why a particular ACL type and placement is correct. For example, understand that established is used to permit return traffic for TCP connections.
Study Strategies That Work
To retain this material, combine our exam answers with hands-on practice. Use Packet Tracer to configure ACLs, apply them to interfaces, and test traffic filtering. Experiment with different wildcard masks and see how they affect the ACL behavior. This practical approach solidifies the theory.
Create flashcards for key terms: DDoS, SYN flood, MITM, buffer overflow, hash, symmetric encryption, ACL, wildcard mask, established, remark. Quiz yourself daily.
How to Use This Answer Page Effectively
Our goal is to provide accurate, up-to-date answers. Each question includes an explanation – read them carefully. If a concept is unclear, refer to Cisco NetAcad materials or our additional tutorials.
We regularly update this page to match any exam changes. Your feedback via comments helps other learners.
What's Next After Modules 3-5?
After mastering network security, Modules 6-8 cover WAN concepts, Modules 9-12 focus on network optimization and troubleshooting, and Modules 13-14 cover emerging technologies. Completing all CCNA 3 v7 exams earns the "Enterprise Networking, Security, and Automation" badge – a stepping stone to full CCNA certification.
Final Tips for Exam Day
- Get good sleep – fatigue leads to misreading questions.
- Read each question twice; watch for "not", "except", or "only".
- Manage time; skip difficult questions and return.
- Trust your first instinct unless you find clear evidence you misread.
Remember: The CCNA curriculum emphasizes practical troubleshooting. If you can explain why an ACL is placed a certain way or why a hash ensures integrity, you're ready. Good luck on your exam – and on your journey to networking expertise.