CCNA - SRWE - 11.6.4

What is a recommended best practice when dealing with the native VLAN?

• Use port security

• Turn off DTP

• Assign the same VLAN number as the management VLAN

• Assign it to an unused VLAN

On what switch ports should PortFast be enabled to enhance STP stability?

• only ports that attach to a neighboring switch.

• all trunk ports that are not root ports.

• only ports that are elected as designated ports.

• all end-user ports

Which command would be best to use on an unused switch port if a company adheres to the best practices as recommended by Cisco?

• switchport port-security mac-address sticky mac-address

• switchport port-security mac-address sticky

• switchport port-security violation shutdown

• ip dhcp snooping

• shutdown

Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)

• DHCP snooping

• DHCP server failover

• port security

• extended ACL

• strong password on DHCP servers

What is the best way to prevent a VLAN hopping attack?

• Use VLAN 1 as the native VLAN on trunk ports.

• Disable STP on all nontrunk ports.

• Use ISL encapsulation on all trunk links.

• Disable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.

Which procedure is recommended to mitigate the chances of ARP spoofing?

• Enable port security globally.

• Enagle DAI on the management VLAN.

• Enable DHCP snooping on selected VLANs

• Enable IP Source Guard on trusted ports.

What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)

• unknown port

• unauthorized port

• untrusted port

• authorized DHCP port

• trusted DHCP port

Which two commands can be used to enable PortFast on a switch? (Choose two.)

• S1(config-line)# spanning-tree portfast

• S1(config)# enable spanning-tree portfast default

• S1(config-if)# enable spanning-tree portfast

• S1(config)# spanning-tree portfast default

• S1(config-if)# spanning-tree portfast

An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. After verifying the cause of the violation, how should the administrator re-enable the port without disrupting network operation?

• Issue the shutdown command followed by the no shutdown command on the interface

• Issue the no switchport port-security command, then re-enable port security.

• Issue the no switchport port-security violation shutdown command on the interface

• Reboot the switch

A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?

• ip dhcp snooping

• ip dhcp snooping trust

• ip dhcp snooping limit rate

• ip dhcp snooping vlan