Cisco (200-301) Exam Questions And Answers page 56

The switchport protected interface configuration command is used to configure protected ports (private VLAN edge ports) on a Cisco Catalyst 2950 switch. A protected port cannot directly communicate with any other protected port on the same switch. It is used in cases where an application requires that no traffic be directly passed from port to port on the same switch. All traffic through the protected port must be transmitted via a Layer 3 device, such as a router.
The switchport port-security command enables basic switch port security. With this command, you can define a group of source MAC addresses (called an address table) that are allowed to access the port. The switch will not forward any packets to the port with source addresses that do not match this group. This is one method a network administrator can use to prevent unauthorized access to the LAN by only allowing company-known MAC addresses. Controlling which MAC addresses can access a port has the following advantages:
• It can ensure full bandwidth on the port if the table is limited to a single source address.
• It can make the port more secure by preventing access from unknown MAC addresses. It can also be used to prevent access on unused ports to prevent unauthorized hosts from accessing the LAN.
The switchport port-security violation command further defines actions a switch can take on the interface in the event of a security violation by following the command with a choice from the {shutdown | restrict | protect} options.
The switchport port-vlan-edge command is incorrect because this is not a valid Cisco command.
Objective:
Infrastructure Security
Sub-Objective:
Configure, verify, and troubleshoot port security
References:

Acknowledgement packets are sent unreliably over the network, and there is no guaranteed delivery of acknowledgement packets between neighboring routers.
Acknowledgement packets are a special type of hello packets that do not contain data and have a non-zero acknowledgement number. These are sent as a unicast.
Update, Query, and Reply packets use Reliable Transport Protocol (RTP), which ensures guaranteed delivery of packets between neighboring devices. The RTP mechanism ensures loop-free synchronized network.
Objective:
Routing Fundamentals
Sub-Objective:
Configure, verify, and troubleshoot EIGRP for IPv4 (excluding authentication, filtering, manual summarization, redistribution, stub)
Internetworking Technology Handbook > Enhanced Interior Gateway Routing Protocol (EIGRP)

Secure Shell (SSH) provides a secure alternative to Telnet for remote management of a Cisco device. Configuring Secure Shell (SSH) support on a Cisco router involves a minimum of three commands:
• ip domain-name [domain-name]: configures the DNS of the router (global configuration mode)
• crypto key generates rsa: generates a cryptographic key to be used with SSH (global configuration mode)
• transport input ssh: allows SSH connections on the router's VTY lines (VTY line configuration mode)
The transport input ssh command allows only SSH connectivity to the router, and prevents clear-text Telnet connections. To enable both SSH and Telnet, you would use the transport input ssh telnet command.
The ip access-group command is incorrect because this command is used to activate an access control list (ACL) on an interface, and does not pertain to SSH.
The service config command is incorrect because this command is used to automatically configure routers from a network server, and does not pertain to SSH.
Objective:
Infrastructure Security
Sub-Objective:
Configure, verify, and troubleshoot basic device hardening
Cisco > Support > Technology Support > Security and VPN > Secure Shell (SSH) > Design > Configuring Secure Shell on Routers and Switches Running Cisco IOS > Document ID: 4145

The auth keyword specifies that the user should be authenticated using either the HMAC-MD5 or HMAC-SHA algorithms. These algorithms are specified during the creation of the SNMP user.
For example, the following command creates a user named V3User who will be a member of the SNMP group V3Group and will use HMAC-MD5 with a password of Password:
snmp-server user V3User V3Group v3 auth md5 Password

The authentication mechanism is not configured on the interface. All SNMP commands are executed at the global configuration prompt.
The authentication mechanism is not configured at the host level. The version and security model (authentication, authentication and encryption, or neither) are set at the host level.
The authentication mechanism is not configured at the SNMP group level. The group level is where access permissions like read and write are set. This is why a user account must be a member of a group to derive an access level, even if it is a group of one.
Objective:
Infrastructure Management
Sub-Objective:
Configure and verify device-monitoring protocols
Configuring SNMP Support > Understanding SNMP > SNMP Versions
Cisco IOS Network Management Command Reference > snmp-server engineID local through snmp trap link-status > snmp-server host

Cost reduction from standardization and automation is a benefit that accrues to the cloud provider, not the cloud users. Additional benefits to cloud providers are:
• High utilization through virtualization and shared resources
• Easier administration
• Fail-in-place operations model
Benefits that accrue to cloud users include:
• On-demand self-service resources provisioning
• Centralized appearance of resources
• Highly available, horizontally scaled applications
• No local backups required
Cloud users can also benefit from new services such as intelligent DNS, which can direct user requests to locations that are using fewer resources.
Objective:
Network Fundamentals
Sub-Objective:
Describe the effects of cloud resources on enterprise network architecture
Cloud and Systems Management Benefits