24 Security Fundamentals Practice Questions & Answers

Every Security Fundamentals practice question from the Cisco CCNA 200-301 Practice Test, with the correct answer and a short explanation.

Start practice test →

1. A security researcher releases a script that sends a crafted packet to a switch's management service, triggers a known buffer overflow, and opens a privileged shell for the sender. In standard security terminology, what is the script itself?
- A.A threat against the switch
- B.A vulnerability in the switch
- C.An exploit of the overflow flaw✓ Answer
- D.A mitigation of the overflow
An exploit is the tool or technique that takes advantage of a vulnerability. Here the buffer overflow flaw is the vulnerability, the chance that someone will use the script against the switch is the threat, and patching or restricting access to the management service is the mitigation. The script is the exploit.
Ref QB-38U5J4Source: Cisco CCNA 200-301 Exam Topics — 5.1 Key security concepts (threats, vulnerabilities, exploits, mitigation)Report a problem with this question
2. Syslog on an edge router shows thousands of SSH login attempts in one hour against the admin account, each using a different common word or a password seen in public breach lists. Which attack is this, and which control best reduces its chance of success?
- A.Man-in-the-middle attack; enabling DHCP snooping on edge VLANs
- B.Reconnaissance scan; disabling CDP on every external interface
- C.Brute-force attack; type 7 encryption of the router passwords
- D.Dictionary attack; long passphrases plus lockout after failed tries✓ Answer
Guessing passwords taken from a word list or breach list is a dictionary attack; a brute-force attack instead tries every possible combination. Long, uncommon passphrases are not on the list, and lockout or login rate limiting caps how many guesses the attacker gets. Type 7 encoding only hides passwords inside the configuration file and does nothing against online guessing.
Ref QB-HQANS2Source: Cisco CCNA 200-301 Exam Topics — 5.1 Key security concepts (password attacks and mitigation)Report a problem with this question
3. A public web server is overwhelmed by traffic arriving from tens of thousands of compromised home routers and IP cameras in many countries. Each source sends only a modest amount, and blocking a few source addresses has no visible effect. How is this attack best classified?
- A.A reconnaissance sweep by a worm
- B.A man-in-the-middle relay attack
- C.A DoS attack from one spoofed host
- D.A DDoS attack driven by a botnet✓ Answer
A distributed denial-of-service attack uses many compromised devices (a botnet) at the same time, so no single source is large and blocking individual addresses barely helps; a plain DoS comes from one source. Reconnaissance gathers information rather than exhausting resources, and a man-in-the-middle attack intercepts traffic rather than flooding a target.
Ref QB-28GTC3Source: Cisco CCNA 200-301 Exam Topics — 5.1 Key security concepts (DoS and DDoS attacks)Report a problem with this question
4. Each quarter, the security team sends employees realistic fake phishing emails, and anyone who clicks the link sees a short reminder page about spotting phishing. Posters near the printers carry similar tips. Which security program element do these activities represent?
- A.A user awareness program✓ Answer
- B.A physical access control
- C.A user training curriculum
- D.An incident response plan
User awareness keeps security in people's minds through ongoing, informal reminders such as simulated phishing campaigns and posters. User training is formal, scheduled instruction with set content, physical access control protects facilities with badges, locks and mantraps, and incident response covers how the organization reacts once an attack occurs.
Ref QB-MQCNA6Source: Cisco CCNA 200-301 Exam Topics — 5.2 Security program elements (user awareness, training, physical access control)Report a problem with this question
5. On router EDGE-1 the running configuration contains both an enable password line with the value BlueFox7 and an enable secret line with the value Harbor!88. A technician at the user EXEC prompt types enable. Which password moves the session to privileged EXEC mode?
- A.Only Harbor!88, the enable secret value✓ Answer
- B.Either value, since both lines are active
- C.Only BlueFox7, the enable password value
- D.Neither value, until one line is deleted
When both commands are present, IOS uses the enable secret and ignores the enable password. The enable secret is stored as a one-way hash, which is why it is the preferred command and why it overrides the older, weaker enable password.
Ref QB-58JTV6Source: Cisco CCNA 200-301 Exam Topics — 5.3 Device access control using local passwordsReport a problem with this question
6. An auditor reviewing a switch configuration backup sees the console and VTY passwords stored in the form 'password 7 0822455D0A16' after service password-encryption was enabled. What is the correct assessment of these entries?
- A.AES encryption that needs a key held in NVRAM
- B.Encryption that also protects Telnet sessions
- C.A salted one-way hash as strong as enable secret
- D.Reversible type 7 encoding that is easily decoded✓ Answer
service password-encryption applies only type 7, a weak reversible encoding that freely available tools decode instantly; it merely stops casual shoulder-surfing of the configuration. It is not a hash, uses no AES key, and does nothing for passwords typed into a Telnet session, which still cross the network in cleartext.
Ref QB-KQZA55Source: Cisco CCNA 200-301 Exam Topics — 5.3 Device access control using local passwordsReport a problem with this question
7. During an audit, a packet capture of a router management session to TCP port 23 shows the administrator's username and password in readable text. Which change fixes this exposure?
- A.Allow only SSH on the VTY lines, which uses encrypted TCP 22✓ Answer
- B.Keep Telnet but encrypt stored passwords with type 7
- C.Keep Telnet but move it to TCP 22 so traffic is encrypted
- D.Move management to the web interface over HTTP on TCP 80
Telnet (TCP 23) sends everything, including credentials, in cleartext, while SSH (TCP 22) encrypts the entire session, so restricting the VTY lines to SSH removes the exposure. Type 7 only changes how passwords are stored in the configuration, HTTP on port 80 is also cleartext (HTTPS on 443 would be required), and moving Telnet to another port adds no encryption.
Ref QB-487GQ5Source: Cisco CCNA 200-301 Exam Topics — 2.8 Network device management access (Telnet, SSH, HTTP, HTTPS)Report a problem with this question
8. A company is choosing a sign-in method for its network operations staff that must count as true multifactor authentication. Which combination qualifies?
- A.A smart card badge plus a PIN✓ Answer
- B.A password plus a separate PIN
- C.A fingerprint plus a face scan
- D.Two passwords on separate servers
MFA requires factors from at least two different categories: something you know, something you have, and something you are. A smart card is something you have and a PIN is something you know. A password and a PIN are both knowledge, a fingerprint and a face scan are both biometrics, and two passwords are still a single category.
Ref QB-EQ8N9XSource: Cisco CCNA 200-301 Exam Topics — 5.4 Password alternatives (multifactor authentication)Report a problem with this question
9. A company's password policy forces every user to change passwords every 30 days. Help desk reports show users responding with predictable patterns such as Spring1!, Summer1!, Autumn1!. Which revision best matches current NIST guidance on password policy?
- A.Display a password hint at login to cut down on resets
- B.Require long passphrases and block known-breached passwords✓ Answer
- C.Shorten the change interval to 14 days and require symbols
- D.Cap length at 8 characters so passwords are easier to recall
NIST guidance favors length (passphrases) and screening new passwords against breached and commonly used lists, and it advises against forced periodic changes unless there is evidence of compromise, because forced changes produce exactly these predictable patterns. A shorter interval makes the pattern worse, a length cap weakens passwords, and hints leak information to attackers.
Ref QB-X7ETUXSource: NIST SP 800-63B memorized secret verifier requirements; Cisco CCNA 200-301 Exam Topics — 5.4 Password policy elementsReport a problem with this question
10. A branch office with 40 employees needs an always-on encrypted connection to headquarters across the internet. Management does not want any VPN software installed or launched on the branch PCs. Which solution fits?
- A.A remote-access IPsec VPN with a client on every PC
- B.A plain GRE tunnel with no IPsec between the routers
- C.A site-to-site IPsec VPN between the two edge routers✓ Answer
- D.A clientless TLS VPN that each user opens in a browser
A site-to-site VPN connects entire networks: the edge routers or firewalls encrypt traffic between the sites, the tunnel stays up permanently, and end hosts need no VPN client. Remote-access VPNs, whether client-based or clientless through a browser, serve individual users on demand, and GRE by itself provides tunneling without any encryption.
Ref QB-XG33R3Source: Cisco CCNA 200-301 Exam Topics — 5.5 IPsec remote access and site-to-site VPNsReport a problem with this question
11. Two security gateways are being configured for IPsec. The design requires that the payload of every packet be unreadable to anyone capturing it on the internet, as well as integrity-checked. Which IPsec protocol must carry the traffic?
- A.AH, IP protocol 51
- B.IKE, UDP port 500
- C.ESP, IP protocol 50✓ Answer
- D.GRE, IP protocol 47
ESP provides confidentiality through encryption together with integrity, origin authentication and anti-replay. AH provides integrity and authentication but no encryption, so the payload stays readable. GRE is a tunneling protocol with no encryption, and IKE only negotiates the security associations and keys; it does not carry the protected data.
Ref QB-EZVV53Source: IETF RFC 4303 (ESP) and RFC 4302 (AH); Cisco CCNA 200-301 Exam Topics — 5.5 IPsec VPNsReport a problem with this question
12. A standard ACL entry must match every source address in 172.16.8.0/22 and nothing else. Which wildcard mask belongs with the network address 172.16.8.0?
- A.255.255.252.0
- B.0.0.3.255✓ Answer
- C.0.0.1.255
- D.0.0.7.255
A wildcard mask is the inverse of the subnet mask. A /22 mask is 255.255.252.0, and 255.255.255.255 minus 255.255.252.0 gives 0.0.3.255, which lets the third octet vary from 8 to 11. 0.0.7.255 would match a /21 (172.16.8.0 to 172.16.15.255), 0.0.1.255 only a /23, and 255.255.252.0 is the subnet mask itself, which as a wildcard would ignore the network bits.
Ref QB-YGEDW4Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (wildcard masks)Report a problem with this question
13. Router R1 connects the user LAN 10.1.50.0/24 on G0/0 to a WAN link toward router R2, and R2 connects the server LAN 10.9.9.0/24 on G0/1. Users in 10.1.50.0/24 must be blocked from the server LAN but must still reach the internet and every other site. A standard ACL that denies 10.1.50.0 0.0.0.255 and then permits any will be used. Where should it be applied?
- A.Outbound on R1's WAN interface, the link toward R2
- B.Outbound on R2 G0/1, the interface facing the server LAN✓ Answer
- C.Inbound on R1 G0/0, the interface facing the user LAN
- D.Inbound on R2 G0/1, the interface facing the server LAN
A standard ACL matches only the source address, so placing it near the source (R1 G0/0 inbound or R1's WAN outbound) would cut those users off from everything beyond that point. Placing it close to the destination, outbound toward the server LAN, affects only traffic headed there. Inbound on R2 G0/1 would filter packets coming from the servers, not traffic going to them. Extended ACLs, by contrast, are placed close to the source.
Ref QB-FZ88B4Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (ACL placement)Report a problem with this question
14. To block one guest subnet, an engineer creates a standard ACL with a single entry, deny 192.168.5.0 0.0.0.255, and applies it outbound on the router's LAN interface. Immediately, no host on any subnet can reach that LAN. What is the cause?
- A.Standard ACLs work only when applied in the inbound direction
- B.The wildcard should be 255.255.255.0 to match the subnet
- C.The implicit deny at the end drops all unmatched traffic✓ Answer
- D.Standard ACL numbers must be 100-199 to filter subnets
Every ACL ends with an invisible deny any, so an ACL containing only deny entries permits nothing; adding a permit any after the deny fixes it. Standard ACLs can be applied in either direction, 0.0.0.255 is the correct wildcard for a /24, and 1-99 is a valid standard range (100-199 is for extended ACLs).
Ref QB-ZGSQ36Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (implicit deny)Report a problem with this question
15. An administrator wants only hosts in the management subnet 10.99.0.0/24 to be able to open SSH sessions to router CORE-1, no matter which interface the connection arrives on, without affecting transit traffic through the router. Which approach achieves this?
- A.Enable port security on the management interface
- B.Apply an extended ACL outbound on the management port
- C.Apply a standard ACL to the router's VTY lines✓ Answer
- D.Apply a standard ACL outbound on every interface
An ACL applied to the VTY lines (with access-class rather than ip access-group) filters only sessions that terminate on the router's own virtual terminal lines, whatever interface they arrive on, and leaves transit traffic untouched. Outbound interface ACLs filter traffic leaving the router, not sessions destined to it, and port security is a switch feature that limits MAC addresses on a port.
Ref QB-GZKJG5Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (filtering VTY access)Report a problem with this question
16. Hosts in 10.20.0.0/16 must be allowed to send standard DNS queries over UDP to the server 198.51.100.53. Which extended ACL entry, applied inbound on the interface facing those hosts, permits exactly this traffic?
- A.permit udp host 198.51.100.53 10.20.0.0 0.0.255.255 eq 53
- B.permit udp 10.20.0.0 255.255.0.0 host 198.51.100.53 eq 53
- C.permit udp 10.20.0.0 0.0.255.255 host 198.51.100.53 eq 69
- D.permit udp 10.20.0.0 0.0.255.255 host 198.51.100.53 eq 53✓ Answer
An extended entry lists the protocol, then source, then destination, then the destination port. DNS queries go to UDP port 53, and a /16 source needs wildcard 0.0.255.255. Port 69 is TFTP, 255.255.0.0 used as a wildcard would match the wrong addresses, and swapping source and destination matches traffic coming from the server rather than queries going to it.
Ref QB-2H5397Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (extended ACL entries, well-known ports)Report a problem with this question
17. show access-lists on router BR-2 displays this extended ACL, applied inbound on the LAN interface: 10 deny tcp any host 203.0.113.10 eq 23 (14 matches) 20 permit ip 10.0.0.0 0.255.255.255 any (95812 matches) 30 permit tcp 10.0.0.0 0.255.255.255 any eq 80 (0 matches) All LAN hosts use 10.x.x.x addresses and browse the web constantly. Why does entry 30 show zero matches?
- A.Entry 30 is checked only after the implicit deny any at the end
- B.Entry 20 matches that web traffic first, so 30 is never reached✓ Answer
- C.Hit counters increase only on entries that deny packets
- D.The ACL is inbound, so it never sees web traffic from hosts
ACLs are processed top-down and stop at the first match. Every packet sourced from 10.0.0.0/8 that is not Telnet to 203.0.113.10 matches the broader entry 20, so entry 30 is redundant and never evaluated. Permit entries count matches too, an inbound ACL on the LAN interface does see host traffic, and nothing is ever evaluated after the implicit deny.
Ref QB-HZXVN6Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (top-down first-match processing)Report a problem with this question
18. A named extended ACL has entries with sequence numbers 10, 20 and 30. The engineer must add a new deny entry that is evaluated after entry 10 but before entry 20, without any outage. What is the correct approach?
- A.Add the line at the end; IOS reorders entries by specificity
- B.Apply a second ACL with that line to the same interface
- C.Remove the whole ACL and retype every line in the new order
- D.Enter the new line with sequence number 15 inside the ACL✓ Answer
Named ACLs support sequence numbers, so an entry given number 15 is inserted between 10 and 20 while the ACL stays in service. Removing and retyping the ACL opens a window with no filtering, IOS does not reorder extended entries by specificity, and only one ACL per protocol can be applied per interface per direction, so a second one simply replaces the first.
Ref QB-3HGDE8Source: Cisco CCNA 200-301 Exam Topics — 5.6 Configure and verify access control lists (named ACLs and sequence numbers)Report a problem with this question
19. A switch has DHCP snooping enabled globally and for VLAN 20. The legitimate DHCP server sits beyond the switch's uplink port G1/0/48, and no interface has been configured as trusted. What happens when clients in VLAN 20 request addresses?
- A.Server OFFER and ACK messages arriving on the uplink are dropped✓ Answer
- B.Client DISCOVER messages arriving on access ports are dropped
- C.Every port stays trusted until DAI is also enabled on VLAN 20
- D.Clients get leases, but the binding table stays empty for now
With DHCP snooping enabled, every port is untrusted by default, and untrusted ports drop DHCP server messages such as OFFER, ACK and NAK. Because the uplink to the real server is untrusted, the server's replies are discarded and every client fails to get an address. Client messages are allowed on untrusted ports, so marking the uplink as trusted fixes the problem.
Ref QB-JZA8U7Source: Cisco CCNA 200-301 Exam Topics — 5.7 Layer 2 security features (DHCP snooping)Report a problem with this question
20. After dynamic ARP inspection is enabled on VLAN 30, PCs that receive addresses from DHCP keep working, but network printers with manually configured static IP addresses lose connectivity. DHCP snooping is enabled on VLAN 30 with the uplink trusted. What explains this?
- A.DAI inspects only ARP on trunks, so access ports are blocked
- B.DAI drops all ARP replies unless port security is enabled
- C.The printers exceed the default rate limit of 15 ARP pps
- D.The printers have no DHCP snooping binding to validate their ARP✓ Answer
DAI compares ARP packets received on untrusted ports against the DHCP snooping binding table. Hosts with static addresses never went through DHCP, so they have no binding and their ARP is dropped; the fix is an ARP ACL or static bindings for them. Exceeding the rate limit would err-disable the port, which printers rarely trigger, and DAI works on untrusted access ports independently of port security.
Ref QB-82Z6XRSource: Cisco CCNA 200-301 Exam Topics — 5.7 Layer 2 security features (dynamic ARP inspection)Report a problem with this question
21. An access port has port security with a maximum of 2 MAC addresses. When a third device is connected, its frames are dropped, a syslog message is generated, the security violation counter increases, and the port stays up for the first two devices. Which violation mode is configured?
- A.Shutdown
- B.Protect
- C.Restrict✓ Answer
- D.Sticky
Restrict drops frames from unauthorized MAC addresses, sends a log or SNMP notification, and increments the violation counter while keeping the port up. Protect also drops the frames but silently, with no log and no counter increase, and shutdown (the default) err-disables the whole port. Sticky is a MAC learning method, not a violation mode.
Ref QB-RH6CHSSource: Cisco CCNA 200-301 Exam Topics — 5.7 Layer 2 security features (port security violation modes)Report a problem with this question
22. A switch port is configured with port security and sticky MAC learning. The port learns a workstation's MAC address, and the next day the switch is power-cycled before anyone saves the configuration. After the reload the learned address is gone. Why?
- A.Sticky addresses age out of the table after five minutes by default
- B.Sticky addresses go to the running config, which was not saved✓ Answer
- C.Sticky learning is kept only on ports configured in trunk mode
- D.Sticky addresses are erased whenever the port goes err-disabled
Sticky learning converts dynamically learned MAC addresses into secure entries in the running configuration only. Unless the running configuration is copied to the startup configuration, a reload discards those entries. Sticky entries do not age out by default, port security is normally configured on access ports, and an err-disable event does not remove sticky entries.
Ref QB-92CH4TSource: Cisco CCNA 200-301 Exam Topics — 5.7 Layer 2 security features (port security sticky MAC learning)Report a problem with this question
23. An enterprise wants a central server to control administrator logins to its routers and switches, authorize each individual CLI command separately, and encrypt the entire body of every AAA packet. Which protocol and transport meet these requirements?
- A.TACACS+ over TCP port 49✓ Answer
- B.TACACS+ over UDP port 1812
- C.RADIUS over UDP port 1812
- D.RADIUS over TCP port 49
TACACS+ runs over TCP port 49, encrypts the whole packet body, and keeps authentication, authorization and accounting separate, which allows per-command authorization for device administration. RADIUS uses UDP (1812/1813), encrypts only the password, and combines authentication with authorization, which suits network access such as 802.1X and VPN users.
Ref QB-SHHPPTSource: IETF RFC 8907 (TACACS+) and RFC 2865 (RADIUS); Cisco CCNA 200-301 Exam Topics — 5.8 AAA conceptsReport a problem with this question
24. A help desk technician logs in to switch ACC-7 with her own credentials, which a central AAA server validates. She can run show commands, but when she tries to enter global configuration mode, the server rejects the command. Which AAA function is blocking her?
- A.Encryption of the AAA session payload
- B.Authorization of her permitted commands✓ Answer
- C.Authentication of her login credentials
- D.Accounting of the commands she enters
Authentication already succeeded, because she logged in with validated credentials. Authorization decides what an authenticated user may do, so the server's refusal of a specific command is an authorization decision. Accounting only records what she did, and encryption protects the AAA traffic without deciding which commands are allowed.
Ref QB-A2QU9USource: Cisco CCNA 200-301 Exam Topics — 5.8 Authentication, authorization, and accounting conceptsReport a problem with this question

1. A security researcher releases a script that sends a crafted packet to a switch's management service, triggers a known buffer overflow, and opens a privileged shell for the sender. In standard security terminology, what is the script itself?

2. Syslog on an edge router shows thousands of SSH login attempts in one hour against the admin account, each using a different common word or a password seen in public breach lists. Which attack is this, and which control best reduces its chance of success?

3. A public web server is overwhelmed by traffic arriving from tens of thousands of compromised home routers and IP cameras in many countries. Each source sends only a modest amount, and blocking a few source addresses has no visible effect. How is this attack best classified?

4. Each quarter, the security team sends employees realistic fake phishing emails, and anyone who clicks the link sees a short reminder page about spotting phishing. Posters near the printers carry similar tips. Which security program element do these activities represent?

5. On router EDGE-1 the running configuration contains both an enable password line with the value BlueFox7 and an enable secret line with the value Harbor!88. A technician at the user EXEC prompt types enable. Which password moves the session to privileged EXEC mode?

6. An auditor reviewing a switch configuration backup sees the console and VTY passwords stored in the form 'password 7 0822455D0A16' after service password-encryption was enabled. What is the correct assessment of these entries?

7. During an audit, a packet capture of a router management session to TCP port 23 shows the administrator's username and password in readable text. Which change fixes this exposure?

8. A company is choosing a sign-in method for its network operations staff that must count as true multifactor authentication. Which combination qualifies?

9. A company's password policy forces every user to change passwords every 30 days. Help desk reports show users responding with predictable patterns such as Spring1!, Summer1!, Autumn1!. Which revision best matches current NIST guidance on password policy?

10. A branch office with 40 employees needs an always-on encrypted connection to headquarters across the internet. Management does not want any VPN software installed or launched on the branch PCs. Which solution fits?

11. Two security gateways are being configured for IPsec. The design requires that the payload of every packet be unreadable to anyone capturing it on the internet, as well as integrity-checked. Which IPsec protocol must carry the traffic?

12. A standard ACL entry must match every source address in 172.16.8.0/22 and nothing else. Which wildcard mask belongs with the network address 172.16.8.0?

14. To block one guest subnet, an engineer creates a standard ACL with a single entry, deny 192.168.5.0 0.0.0.255, and applies it outbound on the router's LAN interface. Immediately, no host on any subnet can reach that LAN. What is the cause?

15. An administrator wants only hosts in the management subnet 10.99.0.0/24 to be able to open SSH sessions to router CORE-1, no matter which interface the connection arrives on, without affecting transit traffic through the router. Which approach achieves this?

16. Hosts in 10.20.0.0/16 must be allowed to send standard DNS queries over UDP to the server 198.51.100.53. Which extended ACL entry, applied inbound on the interface facing those hosts, permits exactly this traffic?

18. A named extended ACL has entries with sequence numbers 10, 20 and 30. The engineer must add a new deny entry that is evaluated after entry 10 but before entry 20, without any outage. What is the correct approach?

19. A switch has DHCP snooping enabled globally and for VLAN 20. The legitimate DHCP server sits beyond the switch's uplink port G1/0/48, and no interface has been configured as trusted. What happens when clients in VLAN 20 request addresses?

20. After dynamic ARP inspection is enabled on VLAN 30, PCs that receive addresses from DHCP keep working, but network printers with manually configured static IP addresses lose connectivity. DHCP snooping is enabled on VLAN 30 with the uplink trusted. What explains this?

21. An access port has port security with a maximum of 2 MAC addresses. When a third device is connected, its frames are dropped, a syslog message is generated, the security violation counter increases, and the port stays up for the first two devices. Which violation mode is configured?

22. A switch port is configured with port security and sticky MAC learning. The port learns a workstation's MAC address, and the next day the switch is power-cycled before anyone saves the configuration. After the reload the learned address is gone. Why?

23. An enterprise wants a central server to control administrator logins to its routers and switches, authorize each individual CLI command separately, and encrypt the entire body of every AAA packet. Which protocol and transport meet these requirements?

24. A help desk technician logs in to switch ACC-7 with her own credentials, which a central AAA server validates. She can run show commands, but when she tries to enter global configuration mode, the server rejects the command. Which AAA function is blocking her?

Other topics in this exam