Phase 4 Master Exam Bank: Enterprise Defense, Wireless & Field Diagnostics

The standard governing Wireless Local Area Networks (WLAN / Wi-Fi).

802.11a (5GHz 54Mbps), 802.11b (2.4GHz 11Mbps), 802.11g (2.4GHz 54Mbps), 802.11n (Wi-Fi 4 600Mbps), 802.11ac (Wi-Fi 5 6.9Gbps), 802.11ax (Wi-Fi 6 9.6Gbps).

Channels 1, 6, and 11.

Wireless radios operate Half-Duplex and cannot detect collisions while transmitting; CSMA/CA prevents collisions before they occur.

Condition where two wireless clients cannot hear each other but both communicate with the same Access Point, causing collisions.

Request to Send / Clear to Send handshake reserving wireless channel airtime to eliminate hidden node collisions.

Software timer inside wireless station frames setting channel reservation backoff countdown.

WEP (flawed RC4) -> WPA (TKIP) -> WPA2 (AES-CCMP) -> WPA3 (SAE Dragonfly).

Service Set Identifier - 32-character human-readable name identifying a WLAN network.

Personal uses a single Pre-Shared Key (PSK); Enterprise uses 802.1X EAP authentication with a RADIUS server.

Network security system monitoring and filtering incoming/outgoing traffic based on security rules.

Packet Filtering inspects isolated headers (L3/L4); Stateful Inspection tracks active connection state tables.

Translates private internal IP addresses into public IP addresses for Internet access.

Translates multiple private internal IPs to a single public IP address using distinct source port numbers.

Sequential rule list permitting or denying IP packets based on source/dest IP and port numbers.

1-99 and 1300-1999.

100-199 and 2000-2699.

Place as close to the DESTINATION as possible.

Place as close to the SOURCE as possible.

Unwritten final rule at end of every Cisco ACL that drops all unmatched traffic (deny ip any any).

Encrypted software tunnel extending a private network across a public infrastructure.

Remote Access connects individual mobile users to office; Site-to-Site connects two static corporate branch networks.

Suite of protocols securing IP communications via authentication and encryption.

AH provides integrity and authentication without encryption; ESP provides integrity, authentication, AND data payload encryption.

Attacker sends fake ARP replies mapping victim's IP to attacker's MAC address for MITM interception.

Attacker secretly intercepts and alters communication between two trusting nodes.

Denial of Service attack overwhelming server/network resources with malicious traffic.

Tests Layer 3 ICMP reachability and round-trip time latency to a target IP.

Traces hop-by-hop router path to a destination by incrementing ICMP IP TTL values.

Systematic diagnostic workflow starting at Layer 1 (Physical cabling) up to Layer 7 (Application).

access-list 10 deny 192.168.10.0 0.0.0.255 -> access-list 10 permit any -> interface Gi0/1 -> ip access-group 10 out

interface GigabitEthernet0/1 -> ip access-group 10 in

access-list 100 deny tcp host 192.168.1.50 host 10.0.0.5 eq 80 -> access-list 100 permit ip any any -> interface Gi0/0 -> ip access-group 100 in

Internal 192.168.1.10:52144 -> PAT Router -> Public 203.0.113.1:52144.

Massive surge of TCP SYN packets from spoofed IPs without completing ACK handshakes.

Inspecting HTTP POST payload showing Authorization header or form fields containing unencrypted username/password.

Station selects random backoff slot within contention window CW_min to CW_max after DIFS timer.

Multiple antennas transmit independent data streams simultaneously over same frequency channel (2x2 doubles throughput).

Doubles/quadruples throughput bandwidth but increases susceptibility to RF co-channel interference.

Re-patch Ethernet lead from non-PoE switch port to an 802.3af/at PoE port on Surveillance VLAN 30.

Full CLI configuration script for edge router Router-Edge-01 (Gi0/0 WAN, Gi0/1 LAN) establishing PAT overload, Extended ACL 102 for outbound HTTP/HTTPS/DNS, RSA 2048-bit SSH management, and switch port security.

IKE Phase 1 negotiates ISAKMP SA management tunnel (AES-256, SHA-256, DH Group 14). IKE Phase 2 negotiates IPSec SA transform sets (ESP-AES, ESP-SHA-HMAC) for encrypted data payload.

Detecting unauthorized DHCP Offer packets from rogue IP address and configuring Switch DHCP Snooping trust ports to mitigate.

Wireless LAN Controller managing fast BSS transition (802.11r) and steering dual-band clients to 5GHz/6GHz bands.

Never Trust, Always Verify: Continuous identity verification, micro-segmentation, and explicit ACL enforcement.

BGP neighbor MD5 authentication password combined with RPKI origin validation to prevent BGP route hijacking.

interface Gi0/0 -> standby 1 ip 192.168.1.254 -> standby 1 priority 110 -> standby 1 preempt.

SYN Cookies generate cryptographic sequence numbers to track SYN requests without allocating RAM, defeating SYN floods.

RSSI measurements (-30 dBm excellent to -85 dBm unusable). SNR_dB = RSSI_dBm - Noise_Floor_dBm.

monitor session 1 source interface Fa0/1 -> monitor session 1 destination interface Fa0/24.

Worked Cisco CLI security script and diagnostic solution for scenario 11 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 12 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 13 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 14 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 15 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 16 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 17 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 18 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 19 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 20 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 21 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 22 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 23 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 24 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 25 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 26 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 27 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 28 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 29 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.

Worked Cisco CLI security script and diagnostic solution for scenario 30 covering firewall rule ordering, VPN IPSec tunnels, and switch port security.