VPNs, Network Monitoring, and Troubleshooting Essentials

VPNs

Understanding VPN Tunneling

1. How is tunneling accomplished in a VPN?

Tunneling in a VPN is achieved by encapsulating data packets within new headers from one or more VPN protocols. This process allows secure transmission over a public network.

Remote Access VPN Scenarios

2. Which two scenarios are examples of remote access VPNs?

• A mobile sales agent connecting to the company network securely over the internet.
• An employee who is working from home and accessing company resources through a secure connection.

Identifying IP Addresses in VPNs

3. Refer to the exhibit. Which IP address is the source for the encapsulated packet traveling?

The source IP address for the encapsulated packet is 172.16.1.2.

IPsec Framework

4. Which statement correctly describes IPsec?

IPsec operates at Layer 3 but can protect traffic originating from higher layers of the OSI model.

Data Confidentiality with IPsec

5. What is an IPsec protocol that provides data confidentiality?

ESP (Encapsulating Security Payload) is the IPsec protocol that provides data confidentiality.

IPsec Building Blocks

6. Which three statements describe the building blocks of IPsec?

• IPsec uses encryption algorithms to secure data.
• IPsec uses secret key cryptography to encrypt and decrypt data.
• IPsec uses ESP to provide confidentiality, integrity, and authentication.

Determining VPN Requirements

7. What key question would help determine whether an organization needs a site-to-site or remote access VPN?

Do users need to be able to connect to the network from various locations outside the office without compromising security?

Message Hash in VPN Connections

8. What is the purpose of a message hash in a VPN connection?

A message hash ensures that the data has not been tampered with during transit.

VPN Gateway in Network Design

9. A network design engineer is planning the implementation of a remote access VPN. What device is needed?

A VPN gateway is required for implementing a remote access VPN.

Benefits of VPNs for Remote Access

10. What is one benefit of using VPNs for remote access?

One major benefit is the potential for reduced connectivity costs.

Characteristics of IPsec VPNs

11. Which statement describes a characteristic of IPsec VPNs?

IPsec is compatible with all Layer 2 protocols.

Generic Routing Encapsulation (GRE)

12. What is the purpose of the generic routing encapsulation tunneling protocol?

GRE manages the transportation of IP packets between networks.

Asymmetrical Key Cryptosystem

13. Which algorithm is an asymmetrical key cryptosystem?

RSA is an example of an asymmetrical key cryptosystem.

IPsec Implementation Planning

14. A network design engineer is planning the implementation of an IPsec VPN. Which hashing algorithm is recommended?

A 512-bit SHA hashing algorithm is recommended for secure IPsec VPN implementations.

Encryption Algorithms in IPsec VPNs

15. What two encryption algorithms are used in IPsec VPNs?

• 3DES
• AES

Site-to-Site VPN Features

16. Which statement describes a feature of site-to-site VPNs?

Internal hosts send normal, unencapsulated packets within the site.

Cisco VPN Solution for Limited Access

17. Which Cisco VPN solution provides limited access to internal network resources through a web browser?

Clientless SSL VPN provides limited, browser-based access to internal network resources.

Hash-Based Message Authentication Code (HMAC)

18. Which two algorithms use Hash-based Message Authentication Code?

• MD5
• SHA

Data Integrity in IPsec

19. Which function of IPsec security services allows the receiver to verify that data was not altered during transmission?

Data integrity ensures that data remains unaltered during transmission.

Troubleshooting VPN Tunnel Issues

20. Open the PT Activity. Perform the tasks in the activity instructions and then answer the question. What is the cause of the failure?

The tunnel IP addresses are incorrect.

Diffie-Hellman (DH) in Key Exchange

21. What is the purpose of utilizing Diffie-Hellman (DH) algorithms in VPN connections?

DH algorithms allow two parties to establish a shared secret key over an insecure channel.

Analyzing VPN Tunnel Implementation

22. Refer to the exhibit. A tunnel was implemented between routers R1 and R2. What conclusions can be drawn?

• The data that is sent across this tunnel is not secure.
• A GRE tunnel is being used.

VPNs for Merged Corporations

23. Two corporations have just completed a merger. How can the networks of both companies be connected securely?

A site-to-site VPN can securely connect the networks of the two merged corporations.

Remote Access for Small Offices

24. Which remote access implementation scenario will support the use of a dynamic, multipoint VPN?

A central site that connects to multiple small office/home office (SOHO) locations.

Network Monitoring

Interpreting Syslog Messages

1. Refer to the exhibit. Which two conclusions can be drawn from the syslog message?

• This message is a level 5 notification.
• This message indicates that the link status has changed.

Setting the System Clock for Accurate Logs

2. A network technician has issued the service timestamps log datetime msec command. What is the next step?

The next step is to set the clock: Branch1# clock set 08:00:00 05 AUG 2013

Syslog Message Retrieval Location

3. Refer to the exhibit. From what location have the syslog messages been retrieved?

The syslog messages have been retrieved from the router’s RAM.

Timestamp in Syslog Messages

4. Refer to the exhibit. What does the number 17:46:26.143 represent?

It represents the time when the syslog message was generated.

SNMP Trap Messages

5. What are SNMP trap messages?

SNMP trap messages are unsolicited messages sent by the SNMP agent to the SNMP manager, alerting it to a specific event.

Restricting SNMP Access

6. How can SNMP access be restricted to a specific SNMP manager?

Define an ACL and reference it using the snmp-server host command to restrict SNMP access.

SNMP Interface Status Monitoring

7. A network administrator issues two commands on a router: snmp-server enable traps snmp linkdown linkup and snmp-server host 192.168.1.10 version 2c public. What is the result?

If an interface goes up or down, an SNMP trap will be sent to the SNMP manager at 192.168.1.10.

SNMP vs. NetFlow

8. What is a difference between SNMP and NetFlow?

NetFlow collects more detailed traffic statistics than SNMP.

NetFlow Functionality

9. How does NetFlow function on a Cisco router or multilayer switch?

One user connection to an application exists as two NetFlow flows: one in each direction.

Information from NetFlow Data

10. Which type of information can an administrator obtain from exported NetFlow records?

The protocol that uses the largest volume of traffic on a network segment.

Purpose of NetFlow Implementation

11. What is the most common purpose of implementing NetFlow on a network?

To support accounting, billing, and network monitoring.

Default Syslog Destination

12. Which destination do Cisco routers and switches use to send syslog messages by default?

By default, syslog messages are sent to the console.

SNMP Trap for Security

13. Which SNMP feature provides a solution to the main weakness of SNMP community strings?

The SNMP trap feature enhances security by alerting the management station to specific events.

SNMP Configuration Changes

14. Which statement describes SNMP operation?

A set request is used by the NMS (Network Management System) to change configuration variables on the agent.

Syslog Severity Levels

15. A network administrator has issued the logging trap 4 global configuration command. What is the result?

The syslog client will send messages of severity level 4 (warnings) and lower to the syslog server.

Lowest Syslog Severity Level

16. When logging is used, which severity level indicates the most severe situation?

Emergency – Level 0 indicates the most severe situation.

Planning Network Upgrades with NetFlow

17. Refer to the exhibit. While planning an upgrade, a network engineer is reviewing NetFlow data. What is the largest traffic?

The largest volume of traffic is UDP-other.

Considerations for NetFlow Implementation

18. Which two statements describe items to be considered before implementing NetFlow on a production network?

• NetFlow can only be implemented on routers, not on switches.
• NetFlow consumes additional CPU resources, which should be considered in capacity planning.

Community Strings in SNMPv1 and SNMPv2

19. When SNMPv1 or SNMPv2 is being used, which feature provides security between the SNMP manager and agent?

Community strings provide a basic level of security between the SNMP manager and agent.

SNMP Access Restriction

20. Refer to the exhibit. What can be concluded from the produced output?

An ACL was configured to restrict SNMP access to specific management stations.

Common Syslog Messages

21. What are the most common syslog messages seen on a Cisco router or switch?

The most common syslog messages are linkup and linkdown messages.

SNMPv3 User Authentication

22. A network administrator has issued the snmp-server user admin1 admin v3 auth md5 mypassword priv des 256 myotherpassword command. What are two results?

• It uses MD5 authentication for SNMP messages.
• It adds a new user named”admin” to the SNMP group.

Syslog Protocol and Port

23. Fill in the blank. The syslog protocol uses UDP port 514 for communication.

The syslog protocol uses UDP port 514 for communication.

Community Strings in SNMP

24. When SNMPv1 or SNMPv2 is being used, which feature provides security between the SNMP manager and agent?

Community strings provide a basic level of security.

SNMPv3 User Configuration

25. A network administrator has issued the snmp-server user admin1 admin v3 auth md5 mypassword priv des 256 myotherpassword command. What are two results of this command?

• It uses MD5 authentication for SNMP messages.
• It adds a new user named”admin” to the SNMP group.

Troubleshooting

Addressing Network Delays

1. Users are reporting longer delays in authentication and in accessing network resources. What should be compared?

Compare current network performance to the network performance baseline.

Change Control Procedures

2. A team of engineers has identified a solution to a significant network problem. What should be done next?

Follow change-control procedures to implement the solution.

Troubleshooting Process Steps

3. After which step in the network troubleshooting process would a network technician possibly use the debug command?

After gathering symptoms from suspect devices.

Initial Troubleshooting Steps

4. A user reports that the workstation cannot connect to a networked printer. What is the first action to take?

Ask the user to issue the ipconfig command to check the IP configuration.

Troubleshooting with the Ping Command

5. A network engineer is troubleshooting a network problem and can successfully ping a web server, but cannot access it via HTTP. Where should the engineer troubleshoot next?

From the network layer to the application layer.

Bottom-Up Troubleshooting

6. Which troubleshooting method begins by examining Layer 1 issues?

The bottom-up method starts with physical layer problems.

Interpreting Syslog Messages for Troubleshooting

7. Refer to the exhibit. Which two statements are correct based on the output?

• R1 will send system messages of levels 0, 1, 2, 3, and 4 to a server.
• The syslog server has the IPv4 address 192.168.10.10.

Troubleshooting Layer 2 Issues

8. An administrator is troubleshooting an end-user connectivity problem. The ping command is successful to a specific destination. At which layer is the issue likely to be?

The issue is likely at Layer 2.

Website Access Issues

9. Users report that the new web site http://www.company1.biz cannot be accessed. Which layer is the issue likely to be?

The issue is likely at the transport layer.

Network Connectivity After OS Patch

10. A user reports that after an OS patch was applied, the network cannot be accessed. What is a likely cause?

A corrupted NIC driver is a likely cause.

Configuring SSH for Troubleshooting

11. A network administrator is configuring SSH on a router. Which two configurations are required to allow troubleshooting?

• The transport input command must be configured on the vty lines.
• An extended ACL that permits traffic from the administrator’s workstation.

Troubleshooting Switch Connectivity

12. A user in a large office calls technical support to complain that a PC cannot connect to the network. What should be checked first?

Check the status of the departmental workgroup switch in the wiring closet.

VLAN Issues After Switch Reconnection

13. After cables were reconnected to a switch in a wiring closet, several PCs can no longer access the server. What is a likely cause?

The PCs are no longer on the correct VLAN.

Analyzing Traceroute Output

14. Refer to the exhibit. On the basis of the output, which two statements are correct?

• There is connectivity between the source and destination devices.
• There are 4 hops between the source and destination devices.

Verifying IP-to-MAC Resolution

15. Fill in the blank. Use the ARP cache to verify IP address to MAC address resolution.

Use the ARP cache to verify IP address to MAC address resolution.

Specialized Troubleshooting Tools

16. Which two specialized troubleshooting tools can monitor traffic and help detect bottlenecks?

• NAM (Network Analysis Module)
• Portable network analyzer

Troubleshooting Tools for Windows PCs

17. A group of Windows PCs in a new subnet cannot connect to the internet. Which three commands can help troubleshoot?

• ipconfig
• ping
• nslookup

Securing Web Traffic with SSL

18. A company is setting up a web site with SSL technology to protect user information. Which tool can verify encryption?

A protocol analyzer can be used to verify that traffic is encrypted.

Narrowing the Scope in Troubleshooting

19. In which step of gathering symptoms does the network engineer determine if the problem is at the core, distribution, or access layer?

Narrow the scope is the step where the engineer determines the problem’s location.

Initial Questions for Troubleshooting

20. A network technician is troubleshooting an email issue. What is a relevant open-ended question to ask the user?

When did you first notice your email problem?

Gathering Information with CDP

21. A network engineer issues the show cdp neighbors command on a switch. What is the purpose of this command?

To obtain information about directly connected Cisco devices.

Troubleshooting WAN Connectivity

22. Refer to the exhibit. A network engineer is troubleshooting a WAN connectivity problem. Based on the output, where is the issue?

The issue is at the transport layer.

Establishing a Network Performance Baseline

23. When should a network performance baseline be measured?

During normal work hours of an organization.

Syslog Severity Level for Emergencies

24. Which number represents the most severe level of syslog message severity?

0 represents the most severe level (Emergency).

Network Management Tools

• CiscoView
• What’s Up Gold
• HP OpenView BTO
• SolarWinds LAN Surveyor
• CyberGauge Software
• Internet Search Engines
• Cisco Tools & Resources Website