Infrastructure Security

An engineer configures AAA on a router with the following: 'aaa new-model', 'aaa authentication login default group tacacs+', and a TACACS+ server that is fully reachable. After saving, remote SSH logins work correctly using TACACS+ credentials, but the engineer notices that when logging in through the physical console port, the router still prompts for and accepts credentials against the TACACS+ server rather than allowing local-only access. The console line has no 'login authentication' command applied. Why is the console being authenticated against TACACS+?

A network engineer configures AAA on a router with the command 'aaa authentication login VTY-ACCESS group tacacs+ none' and applies it to the VTY lines. During a security audit, the auditor notes that when the TACACS+ servers were temporarily unreachable during maintenance, administrators were able to log in without providing any credentials. The engineer intended for local authentication to serve as the backup. Which change correctly resolves the security concern while preserving login access during a TACACS+ outage?

A network engineer configures a router to authenticate administrative logins against a RADIUS server. Users can log in successfully with their RADIUS credentials, but every user lands at privilege level 1 and cannot enter privileged EXEC mode even though the RADIUS server is configured to return a cisco-av-pair of 'shell:priv-lvl=15'. The relevant configuration includes 'aaa authentication login default group radius local' and 'line vty 0 4 / login authentication default'. Which configuration change will allow the returned privilege level to be applied automatically at login?

A network engineer configures AAA on a router with the commands 'aaa authentication login default group tacacs+' and points to a single TACACS+ server. During a maintenance window the TACACS+ server becomes unreachable, and all administrators are now locked out of the device even though local usernames exist. What change will allow login using the local database when the TACACS+ server is down, without weakening security while the server is reachable?

A network engineer configures a router to authenticate administrative logins against a TACACS+ server reachable only through the management VRF via Loopback0. Local logins work as a fallback, but every attempt to authenticate to the TACACS+ server times out. Debugging shows the packets are being sourced from the outbound physical interface IP, which is not permitted on the ACL protecting the TACACS+ server. Which configuration will resolve the authentication failures?

After applying a CoPP policy to a distribution router, network engineers report that EIGRP adjacencies over the LAN segments repeatedly drop and re-form. The CoPP configuration includes a class 'CLASS-ROUTING' matched with ACL 'ACL-ROUTING' that permits 'ip host 224.0.0.5 any' and a police rate that is generous. All other classes drop. SSH, SNMP, and BGP work fine. Which change to the ACL will restore stable EIGRP adjacencies?

After applying a new CoPP policy on a core router, users report that large file transfers through the router intermittently stall, while small pings and normal browsing work fine. Investigation shows the router must generate ICMP 'fragmentation-needed' (Type 3, Code 4) messages for a path with a smaller MTU, but Path MTU Discovery is failing end-to-end. The CoPP policy includes a class matching ICMP that is police-limited to a very low rate with 'exceed-action drop'. Which action best resolves the issue?

After deploying a new CoPP policy on an enterprise core router, network operations reports that OSPF adjacencies on several interfaces repeatedly drop and re-establish, while SSH and SNMP management continue to work normally. The relevant policy configuration is: class-map match-any CP-ROUTING matching access-list 120, which permits 'ip ospf any any'; a policy-map CP-POLICY with class CP-ROUTING configured with 'police 8000 conform-action transmit exceed-action drop'; and 'control-plane service-policy input CP-POLICY'. The router runs OSPF over broadcast segments with many neighbors. Which action MOST likely resolves the adjacency instability?

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, users report that transit traffic passing through the router is unaffected, but a newly added deny-all class at the end of the policy-map (applied to catch unclassified traffic to the router itself) is dropping legitimate SSH sessions to the device from a management subnet. The management subnet was intentionally omitted from the permit ACLs. Which characteristic of CoPP explains why only the router-destined SSH traffic is impacted and not the transit traffic?

A network engineer configures CoPP on an edge router to rate-limit management traffic. The NMS uses SNMPv2c to poll the router. After deployment, the NMS reports intermittent timeouts and gaps in interface statistics graphs. The engineer runs 'show policy-map control-plane' and sees the SNMP class matching only a small number of packets while a large and increasing conform/exceed drop count appears under the 'class-default' policer, which is configured with a low 8 kbps rate. Which action most likely resolves the SNMP polling problem?

A network engineer configures CoPP on an ISR to protect the router. A policy-map named CONTROL-PLANE-POLICY classifies and polices SNMP, SSH, and OSPF traffic and is applied with 'service-policy input CONTROL-PLANE-POLICY' under control-plane. Users report that the router is no longer sending SNMP traps to the NMS, although SNMP GET polling from the NMS still works and traps were confirmed working before CoPP was applied. What is the MOST likely cause?

A network monitoring server performs SNMP GETBULK walks against a core router every 5 minutes. Recently, the NMS reports intermittent timeouts and partial MIB tables, but pings and SSH to the router remain stable. On the router, 'show policy-map control-plane' shows the SNMP class with a growing number of dropped packets under 'exceed', while the 'conform' counter also increases. The class matches ACL traffic to UDP 161. What is the MOST likely cause of the intermittent SNMP failures?

A network engineer configured CoPP on a core router to protect the control plane. After applying the policy, administrators report intermittent SSH session timeouts to the router, while ping and OSPF adjacencies remain stable. The relevant configuration is: class-map match-all COPP-MGMT match access-group name SSH-ACL ! policy-map COPP-POLICY class COPP-MGMT police 8000 conform-action transmit exceed-action drop ! control-plane service-policy input COPP-POLICY The SSH-ACL correctly matches TCP port 22 to the router loopback. The command 'show policy-map control-plane' shows a steadily increasing number of exceeded (dropped) packets in class COPP-MGMT. What is the most likely cause?

A network engineer configures CoPP on a core router to rate-limit management traffic. After applying the policy, administrators report they can no longer reach the router via HTTPS for the web GUI, but SSH still works fine. The relevant configuration is shown below: ip access-list extended MGMT-TRAFFIC permit tcp any any eq 22 permit tcp any any eq 80 class-map match-all MGMT match access-group name MGMT-TRAFFIC policy-map COPP-POLICY class MGMT police 8000 conform-action transmit exceed-action transmit class class-default police 8000 conform-action transmit exceed-action drop control-plane service-policy input COPP-POLICY What is the most likely cause of the HTTPS connectivity failure?

A network engineer configures CoPP on a core router to protect the control plane. After applying the policy, routine management traffic works, but scheduled firmware pushes to the router via TFTP now fail intermittently, and 'show policy-map control-plane' shows a rising drop counter in class-default. The engineer's policy has explicit classes for SSH, SNMP, and OSPF with generous rates, plus a class-default with 'police rate 8000 pps conform-action transmit exceed-action drop'. Which action best resolves the TFTP failures without weakening protection for other traffic?

On an access switch, users on VLAN 40 report they are not receiving IPv6 addresses from the stateful DHCPv6 server, which resides upstream through interface GigabitEthernet1/0/24. You have configured IPv6 DHCP guard globally with a policy attached to all access ports and the uplink. The relevant configuration shows: ipv6 dhcp guard policy CLIENT_POLICY device-role client ! interface range GigabitEthernet1/0/1 - 23 ipv6 dhcp guard attach-policy CLIENT_POLICY interface GigabitEthernet1/0/24 ipv6 dhcp guard attach-policy CLIENT_POLICY DHCPv6 SOLICIT messages leave the clients, but DHCPv6 ADVERTISE/REPLY messages never reach them. What is the cause?

An access switch is configured with IPv6 ND inspection on VLAN 30. After enabling the feature, several legitimate hosts on VLAN 30 that use manually configured static IPv6 addresses lose connectivity, while hosts using SLAAC and DHCPv6 work fine. The binding table shows entries only for the SLAAC and DHCPv6 hosts. Which explanation best accounts for this behavior?

A network engineer is deploying IPv6 First Hop Security on an access switch. IPv6 Source Guard is configured on the host-facing ports, but legitimate hosts are being dropped even though they are using valid autoconfigured addresses. The engineer confirms that RA Guard and DHCP Guard are working correctly, but 'show ipv6 neighbor binding' returns an empty table for the affected ports. Which additional feature must be enabled to populate the binding table so Source Guard permits these hosts?

An engineer enabled IPv6 RA Guard on an access switch to prevent rogue router advertisements from client-facing ports. After deployment, clients on VLAN 30 no longer receive default gateway information, and 'show ipv6 nd raguard policy HOST_POLICY' shows the policy is applied to all VLAN 30 access ports. The legitimate router is connected to GigabitEthernet1/0/48, which is also configured with the HOST_POLICY. What is the most likely cause and correct remediation?

A network engineer enables IPv6 RA Guard on an access switch to prevent rogue router advertisements from client-facing ports. After applying a policy to all edge ports, the engineer notices that the legitimate upstream router connected to GigabitEthernet1/0/24 is no longer being learned as a default gateway by hosts, and no RAs are seen on downstream ports. The RA Guard policy configured is: 'ipv6 nd raguard policy CLIENT' with 'device-role host', applied on every access port including Gi1/0/24. Which action correctly resolves the issue while keeping RA Guard protection on the client ports?