Skip to content
Log in Sign up My account

Infrastructure Security Practice Questions

15 original questions covering ENARSI 3.1 to 3.4. Most are exhibit-based: find the fault before you look at the options. Answer every one before opening any explanation. Target: 12 of 15 (80%).

1. Blueprint 3.1 Refer to the exhibit. The TACACS+ server at 10.50.1.10 has been powered off for maintenance. No administrator can log in to R1 over SSH or on the console. What change restores access while keeping TACACS+ as the primary method?

aaa new-model
aaa authentication login default group tacacs+
aaa authorization exec default group tacacs+ if-authenticated
!
username netadmin privilege 15 secret 9 $9$hQ3...
!
line con 0
line vty 0 15
 login local
 transport input ssh
  • A. Add login local under line con 0
  • B. Change the list to aaa authentication login default group tacacs+ local
  • C. Change the list to aaa authentication login default local group tacacs+
  • D. Remove aaa authorization exec default group tacacs+ if-authenticated
Answer: B

The default list has only one method. When the server does not answer, TACACS+ returns ERROR and there is no next method, so authentication fails on every line that uses the default list, including the console. Adding local after the group gives a fallback while keeping TACACS+ first. A does nothing, because login local is ignored once aaa new-model is on. C makes the local database primary, which violates the requirement. D is unrelated: authorization is only reached after authentication succeeds, and if-authenticated would already let a local user through.

2. Blueprint 3.1 Refer to the exhibit. An engineer created a new method list for the VTY lines that uses RADIUS. Logins still go to the TACACS+ server. Why?

aaa authentication login default group tacacs+ local
aaa authentication login VTY-RAD group RAD-GRP local
!
line vty 0 15
 transport input ssh

R1# debug aaa authentication
AAA/AUTHEN/LOGIN (00000031): Pick method list 'default'
  • A. RADIUS cannot be used for VTY logins
  • B. The default list always takes precedence over a named list
  • C. The named list is not referenced under the VTY lines with login authentication VTY-RAD
  • D. The RADIUS server group must be called radius
Answer: C

A named method list does nothing until a line or service references it. The debug confirms that the default list was picked. Adding login authentication VTY-RAD under line vty 0 15 fixes it. A is false: RADIUS is commonly used for device login. B is reversed: a named list attached to a line overrides the default. D is false: group NAME refers to any server group by its name.

3. Blueprint 3.1 Refer to the exhibit. R1 uses RADIUS for VTY logins with local fallback. Every SSH login pauses for several seconds and then succeeds only with the local password. The server administrator says R1 is configured correctly as a client with the right key, and the server listens on UDP 1812 and 1813.

R1# show running-config | section radius server
radius server RAD1
 address ipv4 10.50.1.20
 key Rad-Key-01

R1# show aaa servers | include RADIUS|State|Authen
RADIUS: id 2, priority 1, host 10.50.1.20, auth-port 1645, acct-port 1646
     State: current DEAD, duration 290s, previous duration 0s
     Authen: request 9, timeouts 27, failover 0, retransmission 18

What is the fix?

  • A. Change the key to type 7
  • B. Add ip radius source-interface with the outgoing interface
  • C. Change the method list to group RAD-GRP without local
  • D. Add auth-port 1812 acct-port 1813 to the address ipv4 command
Answer: D

The router is sending requests to the legacy ports 1645 and 1646, which is what IOS uses when no ports are specified. The server listens on 1812 and 1813, so it never answers, the server is marked DEAD, and each login falls back to the local database after the timeout. A changes only how the key is stored. B is not supported by the evidence: the server administrator confirmed the client definition, and the counters show timeouts, not rejects. C would remove the fallback and lock users out.

4. Blueprint 3.1 Administrators authenticated by TACACS+ can run configure terminal and change interface settings, although the TACACS+ server is set to deny interface commands for the helpdesk group. Level 15 command authorization is configured with aaa authorization commands 15 default group tacacs+ local. Which command is missing?

  • A. aaa authorization console
  • B. aaa accounting commands 15 default start-stop group tacacs+
  • C. aaa authorization config-commands
  • D. aaa authorization exec default group tacacs+ local
Answer: C

By default, command authorization applies to EXEC mode commands only. Commands entered in configuration mode, such as interface GigabitEthernet0/1, are not sent to the server unless aaa authorization config-commands is configured. A extends authorization to the console line, but these users connect over the VTY lines. B records commands but does not enforce anything. D controls the EXEC session and privilege level, not individual commands.

5. Blueprint 3.2.a Refer to the exhibit. Users on 10.10.10.0/24 behind R1 can still browse to the web server 10.3.30.80 although the ACL is meant to block them. All other filtering on R1 works as expected. What is the cause?

R1# show ip interface GigabitEthernet0/1 | include access list
  Outgoing access list is not set
  Inbound  access list is BLOCK_WEB

R1# show access-lists
Extended IP access list BLOCK-WEB
    10 deny tcp 10.10.10.0 0.0.0.255 host 10.3.30.80 eq www
    20 deny tcp 10.10.10.0 0.0.0.255 host 10.3.30.80 eq 443
    30 permit ip any any
  • A. The ACL needs a deny ip any any at the end
  • B. The interface references BLOCK_WEB, which does not exist, so all traffic is permitted
  • C. Lines 10 and 20 must use range 80 443
  • D. Extended ACLs must be applied outbound
Answer: B

The interface points to BLOCK_WEB with an underscore, while the ACL is named BLOCK-WEB with a hyphen. An ACL that is applied but not defined permits everything, and IOS accepts the reference without an error. Apply the correct name. A would make no difference to the web traffic and would break everything else. D is false. C would also match every port between 80 and 443, which is not the requirement.

Free account required for the rest

This page has 15 questions and the first 5 are shown here. You're seeing a free sample. A free account unlocks everything: every question bank, the timed exams, the cram sheets, the simulations and the lab files.

Create a free account Log in