Home > Security Testlet

Security Testlet

October 20th, 2013 in ICND1, ICND1 100-101 Go to comments

Question

 

 

Security_SIM.jpg

Not sure about the requirement of this question but it is something like this:

Before this switch and router can be put to use in the network, what security risks can be found…

We are still not sure about the configurations in this sim but we got some information to share with you (updated on December-07-2011. Thanks Joe Mendola, xallax and many candidates who share the information!):

Maybe this is the configurations on Router and Switch (but notice that they are surely missing something):

ROUTER A CONFIGURATION

!
no service password-encryption
!
enable password cisco
!
username ciscouser privilege 15 password 0 cisco
!
banner motd ^CWelcome! If you encountered any problem, please consult the administrator^C
!
line vty 0 4
password 4t&34rkf
login local
transport input telnet ssh
!

 

SWITCH A CONFIGURATION

!
no service password-encryption
!
line console 0
line vty o 4
no login
transport input telnet ssh (????)
line vty 5 15 (????)
login (????)
transport input telnet ssh (????)
banner motd ^CWelcome! If you encountered any problem, please consult the administrator^C

Note: This is just what we gather and guess. In the exam the configurations may be different so make sure you understand about “enable secret”, “enable password”, “login”, “login local”, “transport input”, “line vty”, “service password-encryption”, “bannder motd”, “privilege” before taking this exam!

This sim has 4 questions:

Question 1

Identify security threats on RouterA (select 3)

A. unencrypted password set
B. unsecured message on banner
C. remote access can only be made through telnet or SSH
D. user gets level 15 automatically by default

 

Answer: A C D

Guideline to answer this question:

Because the “service password-encryption” is not set on RouterA so the password to access privileged mode (via the command “enable password cisco”) is unencrypted. Also, the password for VTY is unencrypted (notice that the password “4t&34rkf” is in fact unencrypted) -> A is correct.

Although the banner says “Welcome …” but it does not leak any security information so it is still safe -> B is not correct.

From the command “transport input telnet ssh” we learn that remote access can be mad through telnet or SSH. This is also the default setting of Cisco router -> C is correct.

In the “line vty 0 4″ configuration, the type of login is specified as “login local”. It means that the router will not use the password configured under “line vty 0 4″ (in this case “4t&34rkf”) but it will use the user & password configured in “username ciscouser privilege 15 password cisco” command. The command “username ciscouser privilege 15 password cisco” will grant the privilege of 15 for “ciscouser” user -> D is correct.

Question 2

Which two of the following are true regarding the configuration of RouterA (choose two)

A. at least 5 simultaneous remote connect are possible
B. only telnet protocol connections to Router A are supported
C. remotely connection to RouterA using telnet will succeed
D. console line connection will never time out due to inactivity
E. since DHCP is not used on Fa0/1 there is not a need to use the NAT protocol

 

Answer: A C

Guideline to answer this question:

A is correct as we can telnet from line 0 to line 4 (line vty o 4).

We can use both telnet and SSH to connect to this router (transport input telnet ssh) -> B is not correct.

C is correct as we can telnet to it.

D is not correct because by default, the timeout is set to 10 minutes on both the console and the vty ports.

E is not correct as NAT can be used even DHCP is not used.

Question 3

Select the options which are security issues which need to be modified before RouterA is used (not sure how many answers we can choose)

A. unencrypted weak password is configured to protect privilege mode
B. inappropriate wording in banner message
C. the virtual terminal lines have weak password configured
D. virtual terminal lines have a password, but it will not be used
E. configuration supports in-secure web server access

 

Answer: A D

Guideline to answer this question:

Privilege mode on RouterA is protected with unencrypted password (via “enable password” command) -> A is correct.

B is not correct as mentioned above.

The password of VTY lines is “4t&34rkf”. Although it is unencrypted but it is not a weak password because it has number & special characters inside -> C is not correct.

Although a password of “4t&34rkf” is configured but with the command “login local”, router will use the username of “ciscouser” & password of “cisco” (configured in “username ciscouser privilege 15 password 0 cisco” command) -> D is correct.

By checking the configuration of routerA with the “show run” command. To support web server access it must have the command “ip http server” but it does not -> E is not correct.

Question 4

Select three options which are security issues with the current configuration of Switch A. (Choose three)

A. privilege mode is protected with an unencrypted password
B. inappropriate wording in banner message
C. virtual terminal lines are protected only by a password requirement
D. both the username and password are weak
E. telnet connections can be used to remotely manage the switch
F. Cisco user will be granted privilege level 15 by default

 

Answer: not sure

Guideline to answer this question:

We haven’t had enough information about switch configuration so we can’t be sure about the correct answers but the below is a guideline:

Answer B is surely not correct as the wording in banner does not leak any security information.

If under “line vty 0 4″ you see the “login” command but it does not have a password then maybe answer C is correct. In this case if we try to telnet/ssh to the switch then we will receive a message “Password required, but none set” then we are kicked out ^^.

If you see popular username and password then maybe answer D is correct.

If the command “transport input …” specifies “telnet” as a method then answer E is correct.

For answer F, if you see something like this:

line vty 0 4
privilege level 15

or these lines:

username ciscouser privilege 15 password cisco

and

login local (in “line vty 0 4″)

then answer F is correct.

———————————-

Hope you will contribute your experience about this sim after taking the ICND1 exam. We will post here when we get new information about this sim as soon as possible.

Comments (403) Comments
Comment pages
1 3 4 5 115
  1. CCENT Student
    August 15th, 2014

    Took my test today, a variation of these security sim questions were on there. Used Cisco Press CCENT book, 9tut, and packet tracer to study. Good luck studying everyone!

  2. Anonymous
    August 18th, 2014

    Gave my test today got 973 …this question was on it amidst the confusion before i forget ..the simulation is the same …with you having to enter router A and switch A and do the sh run command to see the running config……the questions and answers have slight diff variation

    The router and switch confif have”no login commands instead of what is mentioned above”…..so any attempt to telnet gets straight entry to the user mode where it will ask the password and username….which is a correct option in the answers

    in Q1: option C is > remote access can only be made through Telnet(“see ssh is not included so hence this option is automatically wrong”)

    extra option E is right as mentioned above along with the unsecure banner…..so in short the right options are unsecure banner and option E saying any attempt to telnet will get straight access to user mode password and username…

    PS: i choose those two and have a 100% on that section so go for it ….if you feel its right but again it might vary with your questions so good luck everyone

  3. Cybs
    August 25th, 2014

    If you believe The transcender, for question 4, B is a correct answer. Basically, a hacker could make the argument that they were invited in so it is a security issue.

Comment pages
1 3 4 5 115
Add a Comment