Infrastructure Security

ENARSI · 35 questions

• A municipal 911 PSAP wants per-operator command authorization on border routers so junior techs cannot change routing without approval. Which AAA choice best supports that admin control?
• A county elections office needs centralized login authentication and accounting on routers but not granular per-command authorization. When is RADIUS a reasonable fit versus TACACS+ for that device-admin need?
• A civic data center loses reachability to its TACACS+ servers during a WAN outage. How should AAA method lists preserve admin access on the routers?
• A regional planning commission sees routers reject AAA login even though usernames exist on the TACACS+ server. Which cause commonly produces that failure pattern?
• A municipal fiber consortium configures IOS AAA for VTY access and must keep authentication, authorization, and accounting roles clear. What distinction should engineers apply?
• A city traffic-operations center enables TACACS+ command authorization and then sees privileged commands fail for valid network engineers. What dependency should they verify on the AAA server?
• A county jail facilities team wants an audit trail of configuration changes on border routers. Which AAA capability best records those administrative actions?
• A public-library branch network uses centralized TACACS+ for VTY access but must survive total AAA-server loss at the console. What local safeguard should remain?
• A municipal hospital campus WAN places RADIUS in a management VRF, but routers never reach the AAA host. Which troubleshooting focus is most appropriate first?
• A city IT team lists only one TACACS+ server for router administration and sees intermittent login failures when that host flaps. What change improves AAA resilience?
• A county network team configures IOS AAA on the same civic border router for both 802.1X-style network access ideas and VTY device administration. For ENARSI infrastructure-security troubleshooting, which AAA context is the primary focus when operators cannot enter privileged EXEC on the router?
• A township public works department migrates civic WAN routers to named AAA method lists, yet the lists appear ignored until a prerequisite is fixed. What must be enabled for modern AAA method lists to take effect?
• A municipal water utility wants console break-glass logins to use the local database while remote VTY admins authenticate to TACACS+. How should AAA method lists be applied to achieve that split?
• A transit authority reviews AAA debugs after failed civic-router logins. How should an explicit reject from the AAA server be treated differently from a timeout with no reply?
• A port authority sees repeated admin login failures to edge routers that use RADIUS in a management VRF. What should operators verify before concluding that user passwords are wrong?
• An airport authority wants an IPv4 ACL that permits management access only from a /24 jump-host subnet and denies other sources, matching solely on source address. Which ACL type fits that requirement?
• A housing authority needs an IPv4 ACL that allows HTTPS to a civic portal VIP from guest networks while denying other TCP to that VIP. Which ACL capability is required?
• A library consortium wants contractor laptops to reach lab routers only during posted business hours. Which IPv4 ACL feature directly supports that schedule?
• A county courts Internet edge should drop packets arriving from the outside that claim source addresses from the court's internal civic address space. What is an appropriate ACL anti-spoof approach?
• A city clerk's office ACL that should block inbound Internet probes never matches interesting traffic. Engineers confirm the entries are correct. What common application mistake explains the miss?
• A parks department permits outbound HTTPS to a permits portal but forgets return or established considerations and wonders why related traffic dies. What ACL behavior should they remember?
• A sanitation department dual-stacks civic border routers and needs to restrict IPv6 management-plane access similarly to IPv4 ACLs. Which feature family addresses that on IOS?
• An emergency-management office applies an IPv6 traffic filter on camera subnets after a dual-stack cutover, but some ICMPv6 neighbor-discovery traffic breaks unexpectedly. What troubleshooting awareness is most appropriate?
• A school district WAN edge should drop inbound packets whose source addresses are not reachable via the receiving interface's FIB path under symmetric routing. Which uRPF mode enforces that check?
• A fire-district IT team dual-homes civic routers to two ISPs with asymmetric return paths and finds strict uRPF dropping legitimate traffic. Which adjustment matches ENARSI uRPF guidance for that topology?
• A police records bureau enables uRPF on an edge and wants visibility into dropped spoof attempts for forensic review. What operational approach supports that visibility?
• An assessor's office adds a new deny ACE to a civic edge ACL and needs proof the entry is matching production traffic. Which verification cue is most direct?
• A building-permits office drafts an extended ACL to allow SSH from a jump host to a router address while denying other TCP. Which match criteria set correctly expresses that intent without relying on object-group shortcuts in the stem?
• A public-health department must block SMB from the Internet to civic file servers while still allowing administrative SSH from approved jump hosts. Which extended ACL design approach is appropriate?
• A wastewater treatment plant renumbers interfaces after a dual-stack redesign and finds an IPv6 traffic filter no longer affects camera traffic. What should engineers verify first about the filter?
• A municipal 911 PSAP wants both header-based policy and reverse-path checks on the Internet edge. How do ACLs and uRPF complement each other?
• A county elections office uses a time-based ACL for contractors but still sees after-hours access because a broader entry matches first. What ACL principle explains the failure?
• A civic data center prefers readable ACL names such as BLOCK-GUEST-SMB on WAN routers instead of only numeric lists. What is the main operational trade-off highlighted by named extended ACLs?
• A regional planning commission hardens SNMP access on civic routers with SNMPv3 and wants a companion control that limits which management stations can send SNMP to the box. How can an IPv4 ACL help?
• A municipal fiber consortium reviews router security features for an ENARSI study guide aligned to official domain 3.2. Which feature set stays inside that objective rather than substituting zone-based firewall as the primary answer?