Cisco CCNA 200-301 Security Fundamentals Practice Questions

Free CCNA 200-301 Security Fundamentals practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main Cisco CCNA 200-301 page. A free account includes a fixed set of 20 questions for this exam; paid access unlocks the full bank.

1. Question 1Security Fundamentals

   Which type of access control list (ACL) filters traffic based on source IP address only?

   • ANamed ACL
   • BReflexive ACL
   • CExtended ACL
   • DStandard ACLCorrect
   ✓ Correct answer: D

   Standard IP ACLs (numbered 1-99 and 1300-1999 on Cisco IOS) match packets solely on the source IP address using an address and wildcard mask. Because they cannot match destination address, protocol, or port, they offer coarse filtering and are typically placed close to the destination to avoid inadvertently blocking legitimate traffic to other destinations.

   Why the other options are wrong

   • ANamed ACL is a naming convention that allows ACLs to be referenced by name instead of number; a named ACL can be either standard or extended, so naming alone does not determine what fields are matched.
   • BReflexive ACL is a dynamic ACL that automatically creates temporary permit entries for return traffic matching an established outbound session, filtering based on session state rather than just source IP.
   • CExtended ACL (numbered 100-199 and 2000-2699) filters on source IP, destination IP, protocol type, and source and destination port numbers, providing much more granular control than a standard ACL.
2. Question 2Security Fundamentals

   What advantage does WPA3-Personal's SAE provide over WPA2's PSK?

   • AFaster roaming between wireless access points
   • BResistance to offline password guessingCorrect
   • CSupport for open networks with no password
   • DReuse of the older WEP cipher for keys
   ✓ Correct answer: B

   SAE replaces the WPA2 PSK exchange with a password-authenticated key agreement that provides forward secrecy. An attacker who captures the exchange still cannot test candidate passwords offline. This closes the main WPA2-Personal weakness.

   Why the other options are wrong

   • ASAE improves security, not roaming speed, which is handled by 802.11r and related standards.
   • COpen, password-free access is WPA3 Enhanced Open (OWE), not SAE.
   • DSAE uses modern cryptography; it does not reuse the insecure WEP cipher.
3. Question 3Security Fundamentals

   A security analyst at BlackRock Defense detects an attack where an adversary is overwhelming a web server with SYN packets from spoofed source addresses, never completing the TCP handshake. What type of attack is this?

   • ADNS amplification attack
   • BSYN flood attackCorrect
   • CMan-in-the-middle attack
   • DBrute force attack
   ✓ Correct answer: B

   A SYN flood is a denial-of-service attack against the TCP three-way handshake. The attacker sends a stream of SYN packets with spoofed source addresses; the server allocates connection state and replies with SYN-ACK, then waits for a final ACK that never arrives because no real host owns those addresses. The half-open connection table fills and legitimate handshakes are refused. SYN cookies, which defer state allocation until a valid ACK returns, together with connection rate limiting, are the standard mitigations.

   Why the other options are wrong

   • ADNS amplification attacks send small DNS queries with a spoofed victim IP to open resolvers that respond with large DNS replies directed at the victim, overwhelming the victim's bandwidth - the attack uses UDP DNS, not TCP SYN packets.
   • CMan-in-the-middle attacks involve an attacker intercepting communications between two parties, often using ARP spoofing or rogue access points - the objective is eavesdropping or data manipulation, not exhausting TCP connection tables.
   • DBrute force attacks systematically try all possible passwords or encryption keys until the correct one is found - they target authentication systems rather than exhausting TCP connection resources with spoofed SYN packets.
4. Question 4Security Fundamentals

   What happens to traffic that matches no explicit ACL entry?

   • AIt is dropped by the implicit deny at the endCorrect
   • BIt is permitted by an implicit allow entry rule
   • CIt is punted to the router CPU for review
   • DIt is logged but still allowed to pass
   ✓ Correct answer: A

   Cisco IOS ACLs are read top-down, and every ACL ends with an invisible deny any. A packet that matches no permit statement falls through to this implicit deny and is dropped. This is why an ACL needs at least one permit to pass any traffic and why entry order matters.

   Why the other options are wrong

   • BThere is no implicit permit; the hidden final rule is deny any.
   • CUnmatched traffic is dropped, not sent to the CPU for review.
   • DUnmatched traffic is denied, not allowed through with logging.
5. Question 5Security Fundamentals

   In WPA3-Personal, SAE replaces which WPA2 mechanism?

   • AThe 802.1X EAP authentication exchange
   • BThe RADIUS server accounting session
   • CThe WPS push-button pairing process
   • DThe Pre-Shared Key authentication methodCorrect
   ✓ Correct answer: D

   WPA3-Personal replaces the WPA2 pre-shared key authentication with SAE, a password-authenticated key exchange run as a commit and a confirm exchange. SAE produces a shared secret that is different on every authentication, and the standard four-way handshake then runs on top of that secret to install the session keys - so SAE changes how the two sides prove they know the passphrase, it does not remove the four-way handshake. Because the passphrase is never exposed to an offline test, a captured exchange cannot be dictionary-attacked, and every session gets forward secrecy.

   Why the other options are wrong

   • A802.1X with EAP is the WPA2-Enterprise authentication method; SAE replaces the personal-mode pre-shared key, not the enterprise EAP exchange.
   • BRADIUS accounting is unrelated to the WPA2-Personal key handshake.
   • CWPS is a separate device-pairing convenience feature; what SAE replaces is the pre-shared key authentication itself, not WPS.
6. Question 6Security Fundamentals

   A security team must apply the same hardening baseline - AAA, SSH settings, banners, and management ACLs - to 60 routers and switches and keep it applied. Which approach is recommended?

   • AApply hardening settings device by device from a manual checklist
   • BAutomate repeatable processes using infrastructure as codeCorrect
   • CCopy a hardened configuration from one device to the rest by hand
   • DManage security settings through interactive CLI sessions per device
   ✓ Correct answer: B

   Automating security fundamentals using infrastructure as code ensures that hardening configurations - such as AAA policies, banner messages, SSH settings, and ACLs - are applied consistently and repeatably across all devices. This eliminates configuration drift that often leaves some devices in a less hardened state and is a key principle in CCNA automation.

   Why the other options are wrong

   • AWorking through a manual checklist device by device is easy to skip steps on and leaves no automated proof of compliance, unlike an infrastructure-as-code approach that applies hardening uniformly.
   • CHand-copying a hardened config still relies on per-device manual effort and drifts over time, whereas infrastructure as code re-enforces the baseline automatically.
   • DInteractive CLI sessions harden one device at a time with no declarative record, which cannot guarantee the consistent security state that infrastructure as code provides.
7. Question 7Security Fundamentals

   Which feature drops IP packets received on an untrusted switch port unless the sender's address matches an entry in the DHCP snooping binding table?

   • AIP Source GuardCorrect
   • BDynamic ARP Inspection
   • CDHCP snooping rate limiting
   • DRoot Guard
   ✓ Correct answer: A

   IP Source Guard builds on DHCP snooping by applying a per-port filter that only permits IP traffic whose source address matches a binding learned via DHCP, blocking spoofed source addresses.

   Why the other options are wrong

   • BDAI validates ARP packets, not the source IP of regular data frames.
   • CRate limiting throttles DHCP message volume only.
   • DRoot Guard protects spanning-tree root placement, unrelated to source IP filtering.
8. Question 8Security Fundamentals

   Which characteristic distinguishes WPA3-Personal from WPA2-Personal in terms of protection against offline dictionary attacks?

   • AWPA3 uses SAE, giving forward secrecy and resisting offline guessingCorrect
   • BWPA3 uses WEP keys that rotate every packet
   • CWPA3 keeps the WPA2 four-way handshake but requires a longer passphrase
   • DWPA3 relies on a static MAC address filter to admit only known client devices
   ✓ Correct answer: A

   SAE replaces the WPA2 four-way PSK handshake with a Dragonfly key-exchange that does not expose data allowing attackers to guess the passphrase offline, and it provides forward secrecy so past sessions stay secure if the password is later compromised.

   Why the other options are wrong

   • BWPA3 does not use WEP; WEP is deprecated and insecure.
   • CWPA3-Personal replaces the four-way handshake with SAE outright; passphrase length is not the change.
   • DMAC filtering is trivially defeated by spoofing and is not part of the WPA3 standard.

How Security Fundamentals is tested

This domain holds 102 of the 689 questions in the CCNA 200-301 bank, about 15%. The mix is 88 single-answer multiple choice and 17 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security Fundamentals on its own rather than re-running full-length mocks.

Other CCNA 200-301 exam domains

• Network Fundamentals142 questions
• Network Access135 questions
• IP Connectivity170 questions
• IP Services70 questions
• Automation and Programmability70 questions
• All CCNA 200-301 practice questions689 total
• Security Fundamentals study notesKey concepts
• Cisco practice examsAll Cisco

CCNA 200-301 Security Fundamentals FAQ