100% Latest & Updated Cisco 200-301 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 630
An administrator leaves an authenticated management session idle for hours, creating a session-hijack risk. Which IOS management-line inactivity setting automatically closes such unused sessions?
- Set service password-encryption and assume it times out idle sessions
- Use login local without specifying an idle timeout
- Configure an appropriate exec-timeout on management lines
- Set an unrelated interface hold queue length
Explanation
Correct Answer
C:Inactivity timeouts limit persistence of abandoned administrative sessions.
Incorrect Answers
A:Password obfuscation is unrelated to terminating an already authenticated inactive terminal.
B:Login authentication establishes a session but does not configure automatic inactivity termination.
D:Queue buffering cannot log out idle terminal sessions and may adversely affect packet handling.
Question 631
Privileged administrative access currently requires a password. Policy now demands a separate factor from another category even if an attacker knows that password. Which added authentication approach meets this explicit two-factor requirement?
- Use multifactor authentication
- Replace the password entirely with a fingerprint-only single-factor login
- Replace the password entirely with a certificate-only device identity check
- Store the original password inside a password manager without enforcing another factor
Explanation
Correct Answer
A:MFA requires authentication factors from different categories, such as something known plus something possessed. Theft of a reused password then does not by itself satisfy the second factor.
Incorrect Answers
B:A fingerprint may be an inherence factor, but by itself it does not satisfy the specified requirement for two independent categories.
C:A certificate can authenticate a device or key holder; using it as the only factor does not add the demanded second factor.
D:Secure password storage reduces credential-management risk but still permits password-only access if the authentication policy stays unchanged.
Question 632
An enterprise has repeated password reuse between privileged network-device accounts. What credential policy reduces credential stuffing by ensuring each account has a long, unpredictable unique secret?
- Mandate short, easily memorized shared passwords across devices
- Require unique long passphrases or managed strong secrets
- Disable all passwords and rely only on a management VLAN
- Rotate all passwords to a known shared naming pattern
Explanation
Correct Answer
B:Unique, long random credentials reduce guessing and credential-stuffing risk across devices. Reusing the same password means one compromise can grant access to every system that shares it.
Incorrect Answers
A:Short reused secrets facilitate credential stuffing and do not provide the required per-account uniqueness.
C:Network reachability limits are not a substitute for unpredictable per-account authentication secrets.
D:Predictable transformations can be guessed and still undermine uniqueness across privileged accounts.
Question 633
An operations group maintains hundreds of administrator device passwords and must avoid saving them in plaintext spreadsheets or team chat. Which managed credential storage system should be used?
- Store each password in a shared spreadsheet protected only by file-name secrecy
- Paste device credentials into a permanent team-chat message for easy search
- Use an approved password manager or secrets vault
- Embed unencrypted passwords directly into automation scripts committed to a repository
Explanation
Correct Answer
C:A vault protects generated secrets and facilitates controlled access.
Incorrect Answers
A:A plaintext spreadsheet risks disclosure and has poor control over access, rotation, and audit.
B:Chat history exposes reusable administrative secrets and does not meet vault access-control requirements.
D:Source code history can expose credentials widely; central approved vault storage is safer.
Question 634
A device-management service needs mutual machine identity based on a trusted PKI rather than sharing an operator's common password. Which certificate-backed authentication mechanism is suitable?
- Use a validated certificate-based authentication design
- Use one shared local password on both machines instead of certificates
- Rely solely on a preconfigured IP address as the machine identity
- Use an unauthenticated TLS connection with certificate checking disabled
Explanation
Correct Answer
A:Certificates support cryptographic identity assurance through trusted public keys.
Incorrect Answers
B:A shared secret does not provide the requested PKI-based mutual machine identity and trust-chain validation.
C:An IP address is not a cryptographic proof of identity and can be spoofed or reassigned.
D:Encryption without peer validation cannot establish the stated trusted mutual machine identities.
Question 635
A privileged user logs in with a biometric factor supported by a secured authenticator and protected enrollment process. Which factor category is the biometric in a strong identity policy?
- A knowledge factor because fingerprints are memorized by the user
- A possession factor because biometrics reside in an external USB key
- An inherence factor: something the user is
- A network-location factor because it can be validated using IP routing
Explanation
Correct Answer
C:A fingerprint or supported facial/other biometric trait is an inherence authentication factor. It should be used with appropriate enrollment, spoofing resistance, privacy and fallback safeguards, not confused with knowledge or possession.
Incorrect Answers
A:Biometrics represent an inherence factor, not a secret the user knows.
B:Possession concerns an authenticator the person has; the biometric itself is inherence, even if stored securely on a device.
D:A biometric trait is not an IP location and does not attest the network origin of a session.
Question 636
A router arrives from a supplier with a documented default administrator password still configured. Which provisioning step eliminates the shared factory-credential risk before production exposure?
- Retain the factory password but change only the router hostname
- Enable a restrictive syslog filter without modifying the default password
- Hide the management interface behind NAT while leaving the factory password unchanged
- Rotate default device credentials during provisioning
Explanation
Correct Answer
D:Changing known defaults closes a common unauthorized-login path.
Incorrect Answers
A:A different device label leaves the widely known default credential usable.
B:Logging policy cannot prevent authentication with a supplier-shared credential.
C:Reduced exposure helps but does not eliminate the default credential risk before production.
Question 637
An Internet-facing management login is being protected from guessing attacks. Which combination of unpredictable credential length and login-rate controls is required?
- Use a four-character password and disable rate limiting to make support easier
- Rely exclusively on an obscure admin URL path with no lockout or attempts monitoring
- Use sufficiently long unpredictable passwords with login-rate protections
- Use one shared administrator password for all staff so each can retry freely
Explanation
Correct Answer
C:High-entropy secrets and throttling raise the cost of online guessing.
Incorrect Answers
A:Short guessable passwords and unlimited attempts directly increase brute-force exposure.
B:URL obscurity does not provide robust authentication or guessing-rate controls.
D:Shared credentials undermine individual accountability and increase the success impact of guessing.
Question 638
A privileged administrator's password has been stolen. The organization wants an *independent* second factor to prevent password-only access. Which MFA policy change provides that extra proof?
- Require the same password twice at the same prompt
- Require a second independent authentication factor
- Require a different password stored in the same leaked note
- Require a security question based only on public biographical information
Explanation
Correct Answer
B:A compromised password alone does not satisfy an MFA login requirement.
Incorrect Answers
A:Repeating a compromised knowledge factor is not an independent second factor.
C:Two known passwords are still knowledge factors and may be compromised together.
D:Knowledge-based questions do not reliably provide an independent possession or inherence factor.
Question 639
Two automated network services must authenticate one another without exposing reusable shared secrets. Which supported certificate-based mutual authentication design meets that requirement?
- Use certificate-backed mutual authentication when supported
- Use a shared API token embedded in plaintext on both systems
- Disable certificate revocation and expiry checks for all service peers
- Use server-only TLS without validating the client certificate when mutual identity is mandatory
Explanation
Correct Answer
A:Certificates let systems prove possession of a private key.
Incorrect Answers
B:One reusable bearer secret does not provide independent PKI proof of mutual endpoint identity.
C:Skipping validation undercuts trust in compromised or expired certificates.
D:A server certificate alone does not authenticate the automated client to the service.
Question 640
A shared network administrator credential is confirmed exposed in a ticket attachment. Which immediate account and shared-secret response limits reuse of the compromised access?
- Keep the credential active and only ask users not to share it again
- Change the administrator display name but retain the same leaked secret
- Copy the compromised password into a new private ticket with no rotation
- Disable the account and rotate exposed shared secrets
Explanation
Correct Answer
D:Offboarding removes active credentials and residual shared access.
Incorrect Answers
A:The already-exposed secret remains reusable until it is revoked or rotated.
B:A renamed account with unchanged authentication secret is still compromised.
C:Relocation of the plaintext secret does not revoke attacker knowledge or access.
Cisco Certified Network Associate (CCNA) (200-301) Practice Tests
