1.3

Question 1

What is XTACACS?

Answer 1

Extended TACACS

• A proprietary, customized version of TACACS created by Cisco
• Provides additional support for accounting and auditing.
• Not often used anymore.

Question 2

What is TACACS+?

Answer 2

• The latest version of TACACS, and usually the only one still used today.
• Not backwards compatible
• Released as an open standard in 1993
• Adds more authentication requests and response codes.

Question 3

What is Kerberos?

Answer 3

A network authentication protocol

• Single sign-on feature: authenticate once, and you’re trusted by the system. No need to re-authenticate to everything separately.
• Mutual authentication: client authenticates to the server, and the server also authenticates to the client
• Also provides encryption, preventing man-in-the-middle or reply attacks.
• A standard since the 1980s, developed by MIT.
• Microsoft started using Kerberos in Windows 2000.

Question 4

What is “local authentication”?

Answer 4

A type of authentication in which credentials are stored on the local device, rather than any centralized database or directory.

For example, switches typically only use local authentication.

• Most devices include an initial local account, which has a default password.

Question 5

What are possible factors of MFA?

Answer 5

Multi-factor authentication

Factors could include:

• Something you are
• Something you have
• Something you know
• Somewhere you are
• Something you do

Question 6

What is NAC?

Answer 6

Network Access Control

A form of port-based access control (physical ports, not TCP/UDP ports). Requires authentication before allowing access to any interface on the switch.

IEEE 802.1X is the most common standard of NAC.

Question 7

What is Port Security, and how does it operate?

Answer 7

A method for preventing unauthorized connections to a switch interface, based on the source MAC address (even if it is forwarded from elsewhere).

• Configure the max number of MAC addresses allowed on an interface (Might just be a single MAC, and/or you might configure an allow list of specific MACs).
• The switch monitors the number of unique MACs
• Once the max is exceeded, port security activates. The default is usually to disable the interface.
• Also referred to as Flood Guard

Question 8

What is MAC filtering?

Answer 8

Limits access by MAC address, either through allow lists or block lists.

However, MACs are easy to spoof, so this is only security through obscurity.

Question 9

What is an ACL?

Answer 9

Access Control List

• Used to allow or deny traffic, or apply NAT, QoS, or other settings on the traffic.
• Usually configured on routers
• Can evaluate based on criteria such as Source, Destination, Port number, ICMP, etc.

Question 10

What are common types of Wireless Encryption (including historical)?

Answer 10

WEP

WPA

WPA2