Cisco CCNA 200-301 Security Fundamentals Practice Questions

Free CCNA 200-301 Security Fundamentals practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main Cisco CCNA 200-301 page. Sign up free to practice the full set.

1. Question 1Security Fundamentals

   Which type of access control list (ACL) filters traffic based on source IP address only?

   • ANamed ACL
   • BReflexive ACL
   • CExtended ACL
   • DStandard ACLCorrect
   ✓ Correct answer: D

   Standard IP ACLs (numbered 1-99 and 1300-1999 on Cisco IOS) match packets solely on the source IP address using an address and wildcard mask. Because they cannot match destination address, protocol, or port, they offer coarse filtering and are typically placed close to the destination to avoid inadvertently blocking legitimate traffic to other destinations.

   Why the other options are wrong

   • ANamed ACL is a naming convention that allows ACLs to be referenced by name instead of number; a named ACL can be either standard or extended, so naming alone does not determine what fields are matched.
   • BReflexive ACL is a dynamic ACL that automatically creates temporary permit entries for return traffic matching an established outbound session, filtering based on session state rather than just source IP.
   • CExtended ACL (numbered 100-199 and 2000-2699) filters on source IP, destination IP, protocol type, and source and destination port numbers, providing much more granular control than a standard ACL.
2. Question 2Security Fundamentals

   What advantage does WPA3-Personal's SAE provide over WPA2's PSK?

   • AFaster roaming between wireless access points
   • BResistance to offline password guessingCorrect
   • CSupport for open networks with no password
   • DReuse of the older WEP cipher for keys
   ✓ Correct answer: B

   SAE replaces the WPA2 PSK exchange with a password-authenticated key agreement that provides forward secrecy. An attacker who captures the exchange still cannot test candidate passwords offline. This closes the main WPA2-Personal weakness.

   Why the other options are wrong

   • ASAE improves security, not roaming speed, which is handled by 802.11r and related standards.
   • COpen, password-free access is WPA3 Enhanced Open (OWE), not SAE.
   • DSAE uses modern cryptography; it does not reuse the insecure WEP cipher.
3. Question 3Security Fundamentals

   A security analyst at BlackRock Defense detects an attack where an adversary is overwhelming a web server with SYN packets from spoofed source addresses, never completing the TCP handshake. What type of attack is this?

   • ADNS amplification attack
   • BSYN flood attackCorrect
   • CMan-in-the-middle attack
   • DBrute force attack
   ✓ Correct answer: B

   A SYN flood attack is a type of Denial of Service (DoS) attack that exploits the TCP three-way handshake. The attacker sends a large number of SYN (synchronize) packets with spoofed source IP addresses to the target server. The server allocates resources and responds with SYN-ACK packets, waiting for the final ACK that never arrives because the source addresses are fake. The server's half-open connection table fills up, preventing legitimate TCP connections from being established. Mitigation techniques include SYN cookies and rate limiting.

   Why the other options are wrong

   • ADNS amplification attacks send small DNS queries with a spoofed victim IP to open resolvers that respond with large DNS replies directed at the victim, overwhelming the victim's bandwidth - the attack uses UDP DNS, not TCP SYN packets.
   • CMan-in-the-middle attacks involve an attacker intercepting communications between two parties, often using ARP spoofing or rogue access points - the objective is eavesdropping or data manipulation, not exhausting TCP connection tables.
   • DBrute force attacks systematically try all possible passwords or encryption keys until the correct one is found - they target authentication systems rather than exhausting TCP connection resources with spoofed SYN packets.
4. Question 4Security Fundamentals

   What happens to traffic that matches no explicit ACL entry?

   • AIt is dropped by the implicit deny at the endCorrect
   • BIt is permitted by an implicit allow entry rule
   • CIt is punted to the router CPU for review
   • DIt is logged but still allowed to pass
   ✓ Correct answer: A

   Cisco IOS ACLs are read top-down, and every ACL ends with an invisible deny any. A packet that matches no permit statement falls through to this implicit deny and is dropped. This is why an ACL needs at least one permit to pass any traffic and why entry order matters.

   Why the other options are wrong

   • BThere is no implicit permit; the hidden final rule is deny any.
   • CUnmatched traffic is dropped, not sent to the CPU for review.
   • DUnmatched traffic is denied, not allowed through with logging.
5. Question 5Security Fundamentals

   In WPA3-Personal, SAE replaces which WPA2 mechanism?

   • AThe 802.1X EAP authentication exchange
   • BThe RADIUS server accounting session
   • CThe WPS push-button pairing process
   • DThe Pre-Shared Key four-way handshakeCorrect
   ✓ Correct answer: D

   WPA3-Personal replaces the WPA2 Pre-Shared Key four-way handshake with SAE, a secure password-authenticated key exchange. SAE derives a fresh session key with forward secrecy and blocks offline password guessing on a captured exchange. This is the central WPA3-Personal upgrade.

   Why the other options are wrong

   • A802.1X and EAP are enterprise authentication, not the WPA2-Personal handshake SAE replaces.
   • BRADIUS accounting is unrelated to the WPA2-Personal key handshake.
   • CWPS is a separate pairing feature, not the four-way handshake replaced by SAE.
6. Question 6Security Fundamentals

   When implementing Fundamentals practices in Security Fundamentals, which approach is recommended?

   • AApply hardening settings device by device from a manual checklist
   • BAutomate repeatable processes using infrastructure as codeCorrect
   • CCopy a hardened configuration from one device to the rest by hand
   • DManage security settings through interactive CLI sessions per device
   ✓ Correct answer: B

   Automating security fundamentals using infrastructure as code ensures that hardening configurations - such as AAA policies, banner messages, SSH settings, and ACLs - are applied consistently and repeatably across all devices. This eliminates configuration drift that often leaves some devices in a less hardened state and is a key principle in CCNA automation.

   Why the other options are wrong

   • AWorking through a manual checklist device by device is easy to skip steps on and leaves no automated proof of compliance, unlike an infrastructure-as-code approach that applies hardening uniformly.
   • CHand-copying a hardened config still relies on per-device manual effort and drifts over time, whereas infrastructure as code re-enforces the baseline automatically.
   • DInteractive CLI sessions harden one device at a time with no declarative record, which cannot guarantee the consistent security state that infrastructure as code provides.
7. Question 7Security Fundamentals

   Which feature ensures that traffic entering an untrusted switch port has a source IP address matching an entry in the DHCP snooping binding table?

   • AIP Source GuardCorrect
   • BDynamic ARP Inspection
   • CDHCP snooping rate limiting
   • DRoot Guard
   ✓ Correct answer: A

   IP Source Guard builds on DHCP snooping by applying a per-port filter that only permits IP traffic whose source address matches a binding learned via DHCP, blocking spoofed source addresses.

   Why the other options are wrong

   • BDAI validates ARP packets, not the source IP of regular data frames.
   • CRate limiting throttles DHCP message volume only.
   • DRoot Guard protects spanning-tree root placement, unrelated to source IP filtering.
8. Question 8Security Fundamentals

   Which characteristic distinguishes WPA3-Personal from WPA2-Personal in terms of protection against offline dictionary attacks?

   • AWPA3 uses SAE, giving forward secrecy and resisting offline guessingCorrect
   • BWPA3 uses WEP keys that rotate every packet
   • CWPA3 keeps the WPA2 four-way handshake but requires a longer passphrase
   • DWPA3 relies on a static MAC address filter to admit only known client devices
   ✓ Correct answer: A

   SAE replaces the WPA2 four-way PSK handshake with a Dragonfly key-exchange that does not expose data allowing attackers to guess the passphrase offline, and it provides forward secrecy so past sessions stay secure if the password is later compromised.

   Why the other options are wrong

   • BWPA3 does not use WEP; WEP is deprecated and insecure.
   • CWPA3-Personal replaces the four-way handshake with SAE outright; passphrase length is not the change.
   • DMAC filtering is trivially defeated by spoofing and is not part of the WPA3 standard.

How Security Fundamentals is tested

This domain holds 105 of the 705 questions in the CCNA 200-301 bank, about 15%. The mix is 88 single-answer multiple choice and 17 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security Fundamentals on its own rather than re-running full-length mocks.

Other CCNA 200-301 exam domains

• Network Fundamentals148 questions
• Network Access137 questions
• IP Connectivity175 questions
• IP Services70 questions
• Automation and Programmability70 questions
• All CCNA 200-301 practice questions705 total
• Security Fundamentals study notesKey concepts
• Cisco practice examsAll Cisco

CCNA 200-301 Security Fundamentals FAQ