Modules 10-13: L2 Security and WLANs

1. Which Layer 2 attack will result in legitimate users not getting valid IP addresses?

• Arp spoofing

• DHCP starvation

• IP address spoofing

• Mac address Flooding

Answer explanation

Explanation: The DHCP starvation attack causes the exhaustion of the IP address pool of a DHCP server before legitimate users can obtain valid IP addresses.

2. What mitigation plan is best for thwarting a DoS attack that is creating a MAC address table overflow?

• Disable Dtp

• Disable STP

• Enable port security

• Place unused ports in an unused VLAN

Answer explanation

Explanation: A MAC address (CAM) table overflow attack, buffer overflow, and MAC address spoofing can all be mitigated by configuring port security. A network administrator would typically not want to disable STP because it prevents Layer 2 loops. DTP is disabled to prevent VLAN hopping. Placing unused ports in an unused VLAN prevents unauthorized wired connectivity.

3. Which three Cisco products focus on endpoint security solutions? (Choose three.)

• IPs sensor Appliance

• Web Security Appliance

• Email Security Appliance

• Adaptive Security Appliance

• NAC Appliance

Answer explanation

Explanation: The primary components of endpoint security solutions are Cisco Email and Web Security appliances, and Cisco NAC appliance. ASA, SSL/IPsec VPN, and IPS sensor appliances all provide security solutions that focus on the enterprise network, not on endpoint devices.

True Or false?

In the 802.1X standard, the client attempting to access the network is referred to as the supplicant.

• True

• False

5. Which authentication method stores usernames and passwords in the router and is ideal for small networks?

• Server-based AAA over TACACS+

• local AAA over RAIDUS

• server-based AAA

• Local AAA

• local AAA over TACS+

Answer explanation

Explanation: In a small network with a few network devices, AAA authentication can be implemented with the local database and with usernames and passwords stored on the network devices. Authentication using the TACACS+ or RADIUS protocol will require dedicated ACS servers although this authentication solution scales well in a large network.

6. What represents a best practice concerning discovery protocols such as CDP and LLDP on network devices?

• Enable CDP on edge devices, and enable LLDP on interior devices

• Use the open standard LLDP rather than CDP

• Use the default router settings for CDP and LLDP

• Disable both protocols on all interfaces where they are not required

Answer explanation

Explanation: Both discovery protocols can provide hackers with sensitive network information. They should not be enabled on edge devices, and should be disabled globally or on a per-interface basis if not required. CDP is enabled by default.​

7. Which protocol should be used to mitigate the vulnerability of using Telnet to remotely manage network devices?

• SNMP

• TFTP

• SSH

• SCP

Answer explanation

Explanation: Telnet uses plain text to communicate in a network. The username and password can be captured if the data transmission is intercepted. SSH encrypts data communications between two network devices. TFTP and SCP are used for file transfer over the network. SNMP is used in network management solutions.

8. Which statement describes the behavior of a switch when the MAC address table is full?

• It treats frames as unknown unicast and floods all incoming frames to all ports on the switch

• • It treats frames as unknown unicast and floods all incoming frames to all ports across multiple switches.

• It treats frames as unknown unicast and floods all incoming frames to all ports within the local VLAN.

• • It treats frames as unknown unicast and floods all incoming frames to all ports within the collision domain.

Answer explanation

Explanation: When the MAC address table is full, the switch treats the frame as an unknown unicast and begins to flood all incoming traffic to all ports only within the local VLAN.

9. What device is considered a supplicant during the 802.1X authentication process?

• • the router that is serving as the default gateway

• • the authentication server that is performing client authentication

• the client that is requesting authentication

• • the switch that is controlling network access

Answer explanation

Explanation: The devices involved in the 802.1X authentication process are as follows:

• The supplicant, which is the client that is requesting network access

• The authenticator, which is the switch that the client is connecting to and that is actually controlling physical network access

• The authentication server, which performs the actual authentication

10. Refer to the exhibit. Port Fa0/2 has already been configured appropriately. The IP phone and PC work properly. Which switch configuration would be most appropriate for port Fa0/2 if the network administrator has the following goals?

No one is allowed to disconnect the IP phone or the PC and connect some other wired device.
If a different device is connected, port Fa0/2 is shut down.
The switch should automatically detect the MAC address of the IP phone and the PC and add those addresses to the running configuration.

• • SWA(config-if)# switchport port-security
    SWA(config-if)# switchport port-security mac-address sticky

• SWA(config-if)# switchport port-security
  SWA(config-if)# switchport port-security maximum 2
  SWA(config-if)# switchport port-security mac-address sticky SWA(config-if)# switchport port-security violation restrict

• • SWA(config-if)# switchport port-security mac-address sticky
    SWA(config-if)# switchport port-security maximum 2

• SWA(config-if)# switchport port-security

  SWA(config-if)# switchport port-security maximum 2

  SWA(config-if)# switchport port-security mac-address sticky

Answer explanation

Explanation: The default mode for a port security violation is to shut down the port so the switchport port-security violation command is not necessary. The switchport port-security command must be entered with no additional options to enable port security for the port. Then, additional port security options can be added.