Question bank
CCNP Security
40 CCNP Security questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation and Programmability
6 questions in this domain
- Question 1Single Choice
In the Cyber Kill Chain, an attacker has built a weaponized document and is now sending it to the target. Which phase is taking place?
- AWeaponization
- BDeliveryCorrect answer
- CExploitation
- DInstallation
Why this is the answer
Delivery is the phase in which the weaponized payload is transmitted to the target. Weaponization only builds the malicious payload before delivery.
- Question 2Multiple Select
Which two statements about digital signatures are correct?
- AThe sender hashes the message and signs the resulting digest with a private key.Correct answer
- BThe signature can be verified using the sender's public key.Correct answer
- CThe sender encrypts the whole message with the receiver's public key to create the signature.
- DHashing is unnecessary because the original message itself is encrypted with the private key.
Why this is the answer
A digital signature is created by hashing the message and signing that digest with the sender's private key. Verification uses the sender's public key; the entire message is not encrypted with the private key.
- Question 3Interactive
Examine the captured RADIUS Access-Request fields in the code block. Which part is encrypted by standard RADIUS?
- AUser-PasswordCorrect answer
- BUser-Name
- CNAS-IP-Address
- DEntire packet
Why this is the answer
Standard RADIUS encrypts only the User-Password attribute in an Access-Request packet. The username and other attributes are sent in cleartext.
- Question 4Single Choice
A user enters the wrong password and the RADIUS server replies with Access-Reject. If a fallback local method is configured on the device, what should occur?
- AAccept the user through the local database
- BReject the user without trying the local fallbackCorrect answer
- CRetry the request after five seconds and then accept
- DConvert the reject into an Access-Challenge
Why this is the answer
Fallback to the local database is used when the AAA server is unavailable or times out. If the server explicitly rejects the login, the device must not fall back to local authentication.
- Question 5Multiple Select
Which two statements correctly compare the strength of 3DES with AES-128?
- A3DES can use a 168-bit key, but its effective security is only around 112 bits.Correct answer
- B3DES is always stronger than AES-128 because 168 bits is greater than 128 bits.
- CAES-128 provides an effective security level of about 128 bits, which is higher than the effective security of 3DES.Correct answer
- DAES-128 has an effective security level of 56 bits because it uses a shorter block size.
Why this is the answer
Despite the possible 168-bit key, 3DES has only about 112 bits of effective security due to meet-in-the-middle attacks. AES-128 therefore provides a higher effective security level.
- Question 6Interactive
Review the AAA configuration in the code block. Which statements accurately describe the command authorization behavior?
- AIt uses TACACS+ to authorize level 1 commands.Correct answer
- BIt uses RADIUS as the authorization server.
- CLocal authorization is used only when the TACACS+ server is unavailable.Correct answer
- DThe configuration is invalid because TACACS+ cannot authorize CLI commands.
Why this is the answer
The configuration applies TACACS+ command authorization to privilege level 1 commands and specifies local as a fallback. TACACS+ supports per-command authorization, but RADIUS does not.
Cloud and Content Security
4 questions in this domain
- Question 7Single Choice
In the Cyber Kill Chain, during which phase does the attacker transmit the weaponized payload to the target?
- AWeaponization
- BReconnaissance
- CCommand and Control
- DDeliveryCorrect answer
Why this is the answer
Delivery is the phase where the weapon is transmitted to the target. Weaponization only builds the weapon, and command and control occurs later after the target has been compromised.
- Question 8Multiple Select
Which two statements correctly distinguish encryption from digital signatures when used in a TLS handshake?
- AA digital signature is created with the signer's private key and verified with the signer's public key.Correct answer
- BTLS application data is encrypted with symmetric keys derived during the handshake.Correct answer
- CIn TLS, encrypting data with the server's private key provides the same security as a digital signature.
- DA digital signature provides confidentiality for the TLS session.
Why this is the answer
Digital signatures authenticate and ensure the integrity of handshake information, while TLS session confidentiality is provided by symmetric session keys. A digital signature is not a confidentiality mechanism.
- Question 9Interactive
Examine the RADIUS Access-Request in the code block. Which portion of this RADIUS packet is encrypted in a standard PAP transaction?
- AOnly the User-Password attribute is encrypted.Correct answer
- BAll attributes in the Access-Request are encrypted.
- COnly the NAS-IP-Address is encrypted.
- DThe complete Access-Request packet, including the RADIUS header, is encrypted.
Why this is the answer
In a basic RADIUS Access-Request, RADIUS encrypts only the User-Password attribute. Other attributes, such as User-Name and NAS-IP-Address, are sent in the clear.
- Question 10Single Choice
What is the effective security strength of 3DES when compared with AES-128?
- A56 bits
- B112 bitsCorrect answer
- C128 bits
- D168 bits
Why this is the answer
Meet-in-the-middle attacks reduce the effective security of 3DES to about 112 bits, which is why AES-128 is generally considered stronger despite 3DES having a 168-bit key.
Endpoint Security and Forensics
6 questions in this domain
- Question 11Single Choice
In which phase of an attack is the weaponized content actually sent to the target?
- ADeliveryCorrect answer
- BWeaponization
- CExploitation
- DInstallation
Why this is the answer
Weaponization creates the malicious payload, and delivery is the phase in which that payload is sent to the target.
- Question 12Multiple Select
Which statements about RADIUS authorization and packet encryption are correct? Select all that apply.
- AEncrypts only the password in Access-RequestCorrect answer
- BCan authorize individual CLI commands
- CProvides basic allow or deny authorizationCorrect answer
- DLeaves most other fields unencryptedCorrect answer
Why this is the answer
RADIUS does not support command-level authorization; it provides basic allow/deny and encrypts only the password in Access-Request.
- Question 13Interactive
Using the code snippet, which value is encrypted with the private key to form the digital signature?
- AThe entire original message
- BThe message digestCorrect answer
- CThe receiver's public key
- DThe session key
Why this is the answer
A digital signature is created by encrypting a digest or hash of the message with the signer's private key, not by encrypting the entire message.
- Question 14Single Choice
Why is a 168-bit 3DES key not considered stronger than AES-128?
- A3DES effective security is only 112 bitsCorrect answer
- B3DES uses a 64-bit key
- C3DES cannot be used for encryption
- DAES-128 uses a 256-bit effective key
Why this is the answer
3DES effective security is roughly 112 bits, not 168, so AES-128 remains cryptographically stronger.
- Question 15Multiple Select
Which statements are correct about the server digital signature during a TLS handshake? Select all that apply.
- AProves possession of the private keyCorrect answer
- BEncrypts all session data using that private key
- CIs calculated over a message digestCorrect answer
- DAuthenticates the server to the clientCorrect answer
Why this is the answer
The server's digital signature authenticates it and is computed over a digest. TLS session data is not encrypted with the server's private key.
- Question 16Interactive
Based on the AAA server output, which statements about the protocol timeouts are correct? Select all that apply.
- ATACACS+ timeout is 5 secondsCorrect answer
- BRADIUS timeout is 5 secondsCorrect answer
- CTACACS+ timeout is 30 seconds
- DRADIUS timeout is 10 seconds
Why this is the answer
The output shows both TACACS+ and RADIUS timeout values set to 5 seconds, matching the default value for both protocols.
Network Security
8 questions in this domain
- Question 17Single Choice
In the Cyber Kill Chain, an attacker packages malware into an Excel spreadsheet to be sent to a target. Which phase represents this action?
- ADelivery
- BWeaponizationCorrect answer
- CExploitation
- DCommand and Control
Why this is the answer
The Cyber Kill Chain defines Weaponization as the phase where an attacker creates and prepares a deliverable that combines malware with an exploit. Delivery is the subsequent phase when the weapon is transmitted.
- Question 18Multiple Select
Which two attributes are correct about IPsec peer authentication methods used in Cisco VPNs?
- AIPsec peers can authenticate using pre-shared keys.Correct answer
- BIPsec peers can authenticate using digital certificates with a PKI.Correct answer
- CIPsec always requires a PKI/CA to exchange keys.
- DIPsec only supports certificate-based authentication; pre-shared keys are not allowed.
Why this is the answer
IPsec supports both PSK and digital certificate authentication. A PKI/CA is only required for the certificate method; pre-shared keys function without a PKI.
- Question 19Interactive
Refer to the AAA command in the code block. A user attempts to log in and the TACACS+ server indicates that the password is incorrect. What is the router behavior?
- AIt immediately denies access and does not attempt local authentication.Correct answer
- BIt falls back to the local user database to validate the password.
- CIt retries TACACS+ authentication four times.
- DIt creates a temporary local user account and authenticates.
Why this is the answer
When a AAA server responds with a reject, the authentication process ends in failure; fallback to local is only triggered if the server does not respond, not when it rejects credentials.
- Question 20Single Choice
In a TLS handshake, why does the server use a digital signature?
- AIt allows the client to verify that the server owns the private key corresponding to its certificate.Correct answer
- BIt encrypts the handshake so no one can see the server's certificate.
- CIt computes the session key on behalf of the client.
- DIt provides confidentiality for the application data.
Why this is the answer
A digital signature is used for authentication: the server signs a value with its private key, and the client verifies it with the server's public key. This proves possession of the private key without encrypting the entire session.
- Question 21Multiple Select
Which two steps correctly describe how a sender creates a digital signature?
- ACompute a one-way hash of the message.Correct answer
- BEncrypt the hash using the sender's private key.Correct answer
- CEncrypt the entire original message using the receiver's public key.
- DEncrypt the message digest using the receiver's private key.
Why this is the answer
Digital signatures are created by hashing the message and then encrypting the hash (digest) with the sender's private key; this authenticates the sender and ensures message integrity.
- Question 22Interactive
The code block displays a RADIUS accounting record. Which event does the record describe?
- ASession start
- BSession termination/logoutCorrect answer
- CAuthentication rejection
- DSession duration update
Why this is the answer
Acct-Status-Type = Stop means the accounting server is being informed that the user session ended; start records are sent at the beginning and stop records at the end.
- Question 23Single Choice
Why is AES-128 stronger than 3DES when a 3DES key is 168 bits long?
- A3DES effective security is only about 112 bits; AES-128 provides full 128-bit strength.Correct answer
- B3DES uses shorter blocks, so it cannot encrypt large data.
- C3DES has been broken and provides no security at all.
- DAES-128 key length is actually 256 bits.
Why this is the answer
Despite the nominal 168-bit key, the effective security of 3DES is approximately 112 bits due to meet-in-the-middle attacks, making AES-128 stronger.
- Question 24Multiple Select
Which two statements are true about RADIUS security features?
- AIn standard RADIUS, only the user password is encrypted in an Access-Request.Correct answer
- BRADIUS generates Accounting-Start and Accounting-Stop messages for usage reporting.Correct answer
- CRADIUS can authorize every command typed on a network device.
- DRADIUS encrypts the entire packet with TLS.
Why this is the answer
Standard RADIUS encrypts the password but leaves other attributes in clear. It supports accounting via Start/Stop records. RADIUS does not provide per-command device authorization.
Security Concepts
10 questions in this domain
- Question 25Single Choice
In the Cyber Kill Chain, which stage creates the exploit and malicious deliverable before transmission?
- AWeaponization phaseCorrect answer
- BDelivery phase
- CExploitation phase
- DInstallation phase
Why this is the answer
Weaponization creates the packaged attack. Delivery is a later step that sends the package to the target.
- Question 26Multiple Select
Which two statements about digital signature use during a TLS handshake are true?
- AProves possession of the private keyCorrect answer
- BAllows client verification of certificate chainCorrect answer
- CEncrypts application data after the handshake
- DUses the public key to decrypt data at rest
Why this is the answer
TLS signatures authenticate the server and its parameters. Actual application data is protected by symmetric session keys, not signatures.
- Question 27Interactive
Refer to the TLS handshake flow in the code block. What does the server's signature over ServerKeyExchange prove?
- AProves possession of the matching private keyCorrect answer
- BEstablishes the session's AES key directly
- CValidates the client's identity
- DEncrypts all later application data traffic
Why this is the answer
The signature ties the ephemeral key parameters to the server's certificate, proving possession of the private key without encrypting data.
- Question 28Single Choice
How does PKI relate to IPsec peer authentication?
- AOptional when pre-shared keys are configuredCorrect answer
- BRequired for every IPsec tunnel
- CReplaces encryption algorithms
- DRequired only for data integrity
Why this is the answer
IPsec can authenticate peers with pre-shared keys, so PKI certificates are not mandatory in every deployment.
- Question 29Multiple Select
Which two statements correctly describe hashing in digital signature generation?
- AThe sender signs the message digestCorrect answer
- BThe receiver recomputes the digest during verificationCorrect answer
- CThe entire original message is encrypted
- DThe receiver's private key is used for signature generation
Why this is the answer
Digital signatures use a hash of the message. The private key signs the digest, not the full message.
- Question 30Interactive
In the key generation code shown, which entropy source produces the strongest cryptographic key?
- AHardware noise sourceCorrect answer
- BSystem clock value
- CReused software seed
- DStatic passphrase
Why this is the answer
Hardware RNGs use physical noise sources, producing true entropy. Time and software counters are predictable and should not be sole entropy sources.
- Question 31Single Choice
Why is AES-128 considered stronger than a 168-bit key 3DES implementation?
- A3DES offers only about 112 bits of securityCorrect answer
- B3DES offers exactly 168 bits of security
- CAES-128 offers less security than DES
- DAES-128 relies on a 168-bit key
Why this is the answer
3DES uses a 168-bit key but its effective strength is only about 112 bits due to meet-in-the-middle attacks. AES-128 is stronger.
- Question 32Multiple Select
Which two statements about cryptographic random number generation are true?
- AA secure PRNG must use high-entropy seedCorrect answer
- BHardware entropy improves key unpredictabilityCorrect answer
- CReusing the same seed makes stronger keys
- DStandard library PRNG output is always secure
Why this is the answer
A cryptographically secure PRNG needs high-quality entropy. Hardware entropy is non-deterministic and increases key unpredictability.
- Question 33Interactive
The AAA command in the code block includes local as a fallback method. What happens if RADIUS returns Access-Reject because the password is wrong? Choose two.
- AThe user is denied accessCorrect answer
- BLocal database is not checkedCorrect answer
- CLocal database is tried next
- DThe RADIUS request is retransmitted
Why this is the answer
An Access-Reject is a definitive denial. It is not a timeout or error, so the device does not fall back to the local database.
- Question 34Single Choice
Why is RADIUS inadequate as a complete administration protocol for CLI-level authorization?
- ANo per-command authorizationCorrect answer
- BNo password authentication
- CNo accounting support
- DNo packet encryption at all
Why this is the answer
RADIUS provides basic accept or reject authorization but cannot authorize individual CLI commands. TACACS+ is needed for that.
Security Services
6 questions in this domain
- Question 35Single Choice
In the Cyber Kill Chain, during which phase does an attacker transmit a weaponized payload to the target?
- AThe weaponization phase
- BThe exploitation phase
- CThe delivery phaseCorrect answer
- DThe installation phase
Why this is the answer
Delivery is the phase where the weapon is transferred to the target. Weaponization creates the payload, while exploitation and installation occur only after successful delivery.
- Question 36Multiple Select
Which statements correctly describe how the server's private key is used during a TLS handshake?
- AIt encrypts application data.
- BIt creates digital signatures.Correct answer
- CIt signs the server certificate.
- DIt proves possession of the private key.Correct answer
Why this is the answer
The TLS server signs handshake data with its private key, proving possession of the key. Symmetric keys encrypt application data, and the CA signs the server certificate.
- Question 37Interactive
Refer to the exhibit. In the displayed AAA method list, when does the router try the local database?
- AExplicit server rejection
- BServer unreachable or timeoutCorrect answer
- CUser enters a bad password
- DAt the start of login
Why this is the answer
If the AAA server explicitly denies access, no fallback occurs. The local method is used only when the server cannot be reached or times out.
- Question 38Single Choice
Which statement correctly describes the use of PKI certificates for authenticating IPsec peers in a VPN deployment?
- AOnly pre-shared keys are supported
- BPKI is not used by IPsec
- CPKI certificates authenticate IPsec peersCorrect answer
- DPKI applies only to TLS
Why this is the answer
IPsec supports authentication with PKI digital certificates. It is not limited to pre-shared keys, even though many candidates incorrectly assume it is.
- Question 39Multiple Select
Which statements correctly describe the process of generating a digital signature from a message hash?
- AEncrypt entire message with private key
- BHash the message firstCorrect answer
- CEncrypt hash with public key
- DEncrypt hash with private keyCorrect answer
Why this is the answer
A digital signature is created by hashing the original message and encrypting that hash with the sender's private key. The entire message is not encrypted by the private key.
- Question 40Interactive
Refer to the packet excerpt. Which single field in this RADIUS Access-Request is encrypted by the shared secret?
- AThe entire packet
- BUser-Password onlyCorrect answer
- CUser-Name only
- DAll attributes
Why this is the answer
RADIUS encrypts only the User-Password attribute in an Access-Request. Other fields remain readable, unlike TACACS+, which encrypts the entire packet body.
Frequently asked questions
Everything about the CCNP Security question bank and how to use it.