IP Services

An engineer wants only encrypted remote shell access to a router's VTY lines and must block clear-text logins. Which transport configuration on the VTY lines meets this requirement?

• Atransport input telnet, because Telnet is the default secure transport for VTY sessions.
• Btransport input all, because listing all protocols still forces clients to choose the encrypted one.
• Ctransport input none, because removing transports leaves SSH as the implicit fallback protocol.
• Dtransport input ssh, because this permits SSH sessions and denies Telnet on the VTY lines.check_circle Correct

Why A is wrong: Tempting because Telnet is a long-standing VTY transport, but Telnet is unencrypted, so permitting it directly contradicts the requirement for encrypted-only access.

Why B is wrong: Wrong because transport input all permits Telnet as well as SSH, so a client could still connect with clear-text Telnet; it does not block insecure logins.

Why C is wrong: Wrong because transport input none blocks every inbound protocol on those lines, including SSH, so no remote shell access works at all.

Why D is correct: Setting the input transport to ssh allows only encrypted SSH sessions and refuses Telnet, satisfying the encrypted-only requirement.

An administrator needs to copy an IOS image to a router from a server that requires no login and uses a lightweight, connectionless transport. Which protocol fits this description?

• AFTP, which runs over TCP and authenticates each session with a username and password.
• BTFTP, which runs over UDP and transfers files without any authentication.check_circle Correct
• CSCP, which tunnels file transfers inside an authenticated SSH session.
• DHTTPS, which encrypts the transfer over TCP using a server certificate.

Why A is wrong: Tempting because FTP transfers IOS images too, but it runs over connection-oriented TCP and demands credentials, which contradicts the no-login, connectionless requirement.

Why B is correct: TFTP uses connectionless UDP and performs no authentication, matching the lightweight, no-login transfer described.

Why C is wrong: Wrong because SCP relies on an authenticated SSH session over TCP, so it is neither login-free nor connectionless.

Why D is wrong: Wrong because HTTPS is connection-oriented over TCP and adds TLS encryption with a certificate, the opposite of the lightweight connectionless method described.

A security review flags that the monitoring system reads device counters using community strings sent in clear text with no message integrity check. Which SNMP version should replace it to add authentication and encryption of the SNMP payload?

• ASNMPv1, because it replaces community strings with a username and hashes each request
• BSNMPv2c, because it introduces per-user encryption while keeping community strings for compatibility
• CSNMPv2, because its inform messages encrypt every notification end to end
• DSNMPv3, because it adds user-based authentication and privacy that encrypts the SNMP payloadcheck_circle Correct

Why A is wrong: SNMPv1 is the oldest version and relies entirely on clear-text community strings with no authentication or encryption, so it does not solve the flagged problem.

Why B is wrong: SNMPv2c adds bulk retrieval and improved error handling but still authenticates with clear-text community strings and provides no encryption, so the exposure remains.

Why C is wrong: Informs are merely acknowledged notifications and carry no encryption; the SNMPv2 family still depends on community strings, so this does not add confidentiality.

Why D is correct: SNMPv3 introduces the user-based security model with authentication (message integrity and origin) and the privacy option that encrypts the payload, directly closing the clear-text community-string gap.

A router runs inside source NAT so that a workstation in the private LAN can reach a public web server. The workstation holds a private RFC 1918 address, and the router rewrites the source to a registered public address before the packet leaves the WAN interface. Which NAT term describes that registered public address the workstation is translated to?

• AInside local address, because it is the address the router assigns to the inside host before the packet is forwarded to the WAN.
• BOutside global address, because it is the public address that the inside host is given when its traffic crosses to the outside.
• CInside global address, because it is the registered public address that represents the inside host as seen from the outside network.check_circle Correct
• DOutside local address, because it is the public address the inside host presents while communicating with the outside server.

Why A is wrong: The inside local address is the private address the host actually uses inside the network, not the registered public address it is translated to, so this term is the wrong end of the mapping.

Why B is wrong: The outside global address is the real public address of the destination on the outside network, not the address assigned to the translated inside host, so the label is applied to the wrong host.

Why C is correct: The inside global address is exactly the routable public address the router substitutes for the inside host's private address, so outside devices see the inside host by this address.

Why D is wrong: The outside local address is how an outside host appears to devices inside the network, so it does not describe the inside host's own translated public address.

An engineer is comparing policing and shaping for an outbound enterprise WAN link and must choose the behaviour that imposes a hard rate ceiling without adding queuing delay to the flow. Which statement correctly describes that choice?

• AShaping enforces the ceiling by dropping any packet above the rate, so it adds no delay
• BPolicing enforces the ceiling by dropping or remarking excess traffic immediately, adding no buffering delaycheck_circle Correct
• CPolicing buffers excess traffic and releases it later, which smooths the flow but adds delay
• DShaping remarks excess packets to a lower DSCP and forwards them immediately without buffering

Why A is wrong: Shaping does not drop conforming-over-rate packets; it buffers and delays them, so attributing a no-delay hard drop to shaping inverts the two mechanisms.

Why B is correct: Policing meters traffic against a rate and acts on the excess at once by dropping or remarking it, with no buffer, so it imposes a hard ceiling without introducing queuing delay.

Why C is wrong: Buffering and smoothing describe shaping, not policing; policing has no queue and never delays the excess, so this swaps the definitions.

Why D is wrong: Immediate remarking with no buffer is policing behaviour; shaping instead holds excess in a queue, so this attributes the wrong action to shaping.