Lab Simulation 10 Guidelines This is a lab item in which tasks will be performed on virtual devices - Refer to the Tasks tab to view the tasks for this lab item. - Refer to the Topology tab to access

Submitted by yuriko_h· Mar 5, 2026Infrastructure Security - Configuring device access controls, extended named ACLs for traffic filtering, and switchport port security to protect the network from unauthorized access and traffic, aligning with Cisco CCNA/CCNP Security and Infrastructure domains.

Question

Lab Simulation 10 Guidelines This is a lab item in which tasks will be performed on virtual devices - Refer to the Tasks tab to view the tasks for this lab item. - Refer to the Topology tab to access the device console(s) and perform the tasks. - Console access is available for all required devices by clicking the device icon or using the tab(s) above the console window. - All necessary preconfigurations have been applied. - Do not change the enable password or hostname for any device. - Save your configurations to NVRAM before moving to the next item. - Click Next at the bottom of the screen to submit this lab and move to the next question. - When Next is clicked the lab closes and cannot be reopened. Topology Tasks Refer to the topology. All physical cabling is in place. Configure a local user account, a Named ACL (NACL), and security. Task 1 Configure a local account on Sw101 with telnet access only on virtual ports 0-4. Use the following information: - Username: support - Password: max2learn - Privilege level: Exec mode Task 2 Configure and apply a single NACL on Sw101 using the following: - Name: ENT_ACL - Restrict only PC2 on VLAN 200 from pinging PC1 - Allow only PC2 on VLAN 200 to telnet to Sw101 - Prevent all other devices from telnetting from VLAN 200 - Allow all other network traffic from VLAN 200 Task 3 Configure security on interface Ethernet 0/0 of Sw102: - Set the maximum number of secure MAC addresses to four. - Drop packets with unknown source addresses until the number of secure MAC addresses drops below the configured maximum value. No notification action is required. - Allow secure MAC addresses to be learned dynamically. Answer: Task 1# SW101: username support privilege 15 password max2learn line vty 0 4 login local transport input telnet Task 2# SW101: ip access-list extended ENT_ACL deny icmp host 192.168.200.10 192.168.100.10 permit tcp host 192.168.200.10 any eq 23 deny tcp any any eq 23 permit ip any any int vlan 200 ip access-group ENT_ACL in Task 3# SW102: int e0/0 switchport port-security switchport port-security maximum 4 switchport port-security voilation protect Final: copy running-config startup-config

Exhibits

Explanation

This lab simulation tests the ability to configure multiple security features across two switches: local user authentication with privilege levels and VTY line restrictions on Sw101, a Named Extended ACL with specific permit/deny statements applied to a VLAN interface, and port security with dynamic MAC learning and violation actions on Sw102. The correct approach requires precise CLI syntax for each task - including 'username support privilege 15 secret max2learn', 'ip access-list extended ENT_ACL' with correct ICMP/TCP deny and permit statements, 'ip access-group ENT_ACL in' on the VLAN 200 interface, and 'switchport port-security maximum 4', 'switchport port-security mac-address sticky', and the appropriate violation mode on Sw102's Ethernet 0/0. All configurations must be saved with 'copy running-config startup-config' or 'write memory' before proceeding.

Topics

#Named ACL Configuration#VTY Line Security#Port Security#Local Authentication

Community Discussion

No community discussion yet for this question.

Full 200-301 Practice