Volume 2 - Chapter 10: Securing Network Devices

Question 1

What is the command that enables the encryption of existing configured passwords on a switch?

Answer 1

service password-encryption

Question 2

A network engineer runs the command “show run | begin line con 0”

Which returns the following response:
line con 0
password 7 070C285F4D06
login

How is the password for the console encrypted?

Answer 2

The password type of 7 indicates that this is a password encrypted with the “service password-encryption” command.

Question 3

A network engineer enables password encryption which returns the following configuration:
line con 0
password 7 9FDJS6RFN0F908S
login

The engineer then removes password encryption using the “no service password-encryption” command. What will be the output when the engineer performs a “show run”?

Answer 3

The command will produce the same output:
line con 0
password 7 9FDJS6RFN0F908S
login

Turning off password encryption does not remove the encryption for any currently configured passwords. The password needs to be manually changed.

Question 4

Describe how IOS handles enable passwords when both of the following commands are configured:
* enable secret xxxxx
* enable password xxxxx

Answer 4

IOS will ignore the password command and only use the secret.

Question 5

A network engineer does not configure an enable password or secret.

What will happen when logging into the switch console?

Answer 5

The user will enter priviledge EXEC mode automatically.

Question 6

Describe how passwords differ between the following:
* An enable password encrypted with the “service password-encryption” command
* An configured enable secret

Answer 6

When using the secret, the switch hashes the password using a hashing algorithm and does not store the unencrypted password

Question 7

What default enable secret hashing method is used in IOS by default?

Answer 7

MD5

Question 8

A network engineer runs the command “show run | include enable secret” which returns the following response:
* enable secret 8 OE5EHoii16eG=

What does this output tell us about the currently configured enable credential?

Answer 8

The enable secret is hashed using SHA-256.

Question 9

A network engineer runs the command “show run | include enable secret” which returns the following response:
* enable secret 5 OAAEHo8v16et=

What does this output tell us about the currently configured enable credential?

Answer 9

The enable secret is hashed using MD5.

Question 10

A network engineer runs the command “show run | include enable secret” which returns the following response:
* enable secret 9 OAAEHo8v16et=

What does this output tell us about the currently configured enable credential?

Answer 10

The enable secret is hashed using Scrypt.

Question 11

What is the command to change the algorithm-type for the enable secret?

Answer 11

enable algorithm-type type secret password

Question 12

What default enable secret hashing method is used in IOS-XE by default?

Answer 12

Scrypt

Question 13

True or False:

IOS supports using different password types (cleartext versus secret) for different users.

Answer 13

True, you can configure specific users with a password and other users with a secret.

However, you cannot configure a secret and a password for the same user.

Question 14

What is the command to change the algorithm-type for a specific local user?

Answer 14

username username algorithm-type type secret password

Question 15

What default username and secret hashing method is used in IOS by default?

Answer 15

MD5

Question 16

What default username and secret hashing method is used in IOS-XE by default?

Answer 16

Scrypt

Question 17

True or False:

IOS-XE supports MD5 for username secret hashing.

Answer 17

False, IOS-XE does support MD5 for enable secrets, but does not for local user secrets.

Question 18

A device that sits at the edge of a network and blocks traffic based on exploit signatures is referred to as?

Answer 18

An Intrusion Prevention System (IPS).

Question 19

What feature on Cisco NGFWs is used to perform deep traffic inspection?

Answer 19

Application Visibility and Control (AVC).

Question 20

Describe how a Next Generation IPS differs from an IPS.

Answer 20

NGIPSs use contextual awareness to provide more accurate threats while reducing the amount of events logged.

NGIPSs use reputation based filtering to score websites and online services.

NGIPSs asses the impact levels of security events to determine if they are valid attacks.