security modules 10/11 SRWE

What is port security and how can it be configured on switches?

• Port security is a feature that allows you to restrict input to an interface by limiting and identifying IP addresses of the stations allowed to access the port. It can be configured on switches by enabling it on the interface and setting the maximum number of allowed IP addresses.

• Port security is a feature that allows you to restrict input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It can be configured on switches by enabling it on the interface and setting the maximum number of allowed MAC addresses.

• Port security is a feature that allows you to restrict output to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It can be configured on switches by disabling it on the interface and setting the maximum number of allowed MAC addresses.

• Port security is a feature that allows you to restrict input and output to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. It can be configured on switches by enabling it on the interface and setting the minimum number of allowed MAC addresses.

Explain the concept of MAC address filtering and how it can be implemented on switches.

• MAC address filtering is a security feature that only works for wireless networks

• MAC address filtering is a security feature that allows or denies network access based on the MAC address of the device. It can be implemented on switches by configuring a list of allowed or denied MAC addresses in the switch's settings.

• MAC address filtering can be implemented on switches by configuring a list of allowed or denied IP addresses

• MAC address filtering is a feature that allows filtering based on IP addresses

What is DHCP snooping and how can it be configured on switches?

• DHCP snooping is a security feature that filters out unauthorized DHCP messages. It can be configured on switches by enabling DHCP snooping globally and on specific VLANs, and by configuring trusted interfaces.

• DHCP snooping is a protocol used for managing IP addresses on a network. It can be configured on switches by enabling DHCP snooping globally and on specific VLANs, and by configuring untrusted interfaces.

• DHCP snooping is a feature that enhances network performance by prioritizing DHCP messages. It can be configured on switches by disabling DHCP snooping globally and on specific VLANs, and by configuring untrusted interfaces.

• DHCP snooping is a security feature that prevents unauthorized access to the DHCP server. It can be configured on switches by enabling DHCP snooping globally and on all interfaces, and by configuring untrusted VLANs.

How does enabling dynamic ARP inspection enhance switch security?

• It prevents ARP spoofing attacks

• It causes network congestion

• It increases the risk of ARP poisoning

• It slows down network performance

What are the best practices for securing switch management interfaces?

• Leaving the default password unchanged

• Disabling encryption for faster access

• Using strong passwords, enabling encryption, restricting access through ACLs, and regularly updating firmware

• Allowing unrestricted access to the management interface

How can port security be used to restrict the number of MAC addresses on a switch port?

• By configuring the maximum number of allowed MAC addresses on a switch port.

• By configuring the switch port to automatically accept any MAC address

• By allowing all MAC addresses to connect to the switch port

• By disabling the switch port completely

Describe the process of implementing MAC address filtering to control network access on a switch.

• Install a firewall on the switch to block unwanted MAC addresses

• Send an email to all network users asking for their MAC addresses

• Access the switch's configuration interface and create a list of allowed MAC addresses, then apply the list to specific switch ports.

• Unplug all network cables and then re-plug them in random order

What are the potential security risks associated with DHCP snooping and how can they be mitigated?

• Enable DHCP snooping on the switch, configure trusted ports for legitimate DHCP servers, and enable dynamic ARP inspection.

• Block all DHCP traffic on the switch to prevent any potential security risks

• Disable DHCP snooping on the switch and allow all ports to communicate freely

• Use default VLAN for all devices to avoid any DHCP snooping issues

Explain the role of dynamic ARP inspection in preventing ARP spoofing attacks on a network.

• Dynamic ARP inspection allows all ARP requests and responses without verification

• Dynamic ARP inspection only verifies TCP packets in a network

• Dynamic ARP inspection is only used for preventing DNS attacks

• Dynamic ARP inspection verifies the ARP packets in a network to prevent ARP spoofing attacks by ensuring that only valid ARP requests and responses are allowed.

What are the common vulnerabilities associated with switch management interfaces and how can they be secured?

• Using strong, unique passwords, enabling encryption, and regularly updating firmware

• Enabling remote access to the management interface, using the same password for all switches, and never updating firmware

• Using weak, easily guessable passwords, leaving encryption disabled, and never updating firmware

• Leaving the default password unchanged, disabling encryption, and never updating firmware