Cisco 2, Module 11

Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)

• DHCP snooping

• extended ACL

• port security

• DHCP server failover

• strong password on DHCP servers

What is the best way to prevent a VLAN hopping attack?

• 1. Disable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.

• 1. Use VLAN 1 as the native VLAN on trunk ports.

• 1. Use ISL encapsulation on all trunk links.

• 1. Disable STP on all nontrunk ports.

Which procedure is recommended to mitigate the chances of ARP spoofing?

• 1. Enable DAI on the management VLAN.

• 1. Enable DHCP snooping on selected VLANs.

• 1. Enable port security globally.

• 1. Enable IP Source Guard on trusted ports.

What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)

• 1. unknown port

• 1. trusted DHCP port

• 1. established DHCP port

• 1. untrusted port

• 1. authorized DHCP port

Which two commands can be used to enable PortFast on a switch? (Choose two.)

• 1. S1(config)# spanning-tree portfast default

• 1. S1(config-line)# spanning-tree portfast

• 1. S1(config)# enable spanning-tree portfast default

• 1. S1(config-if)# enable spanning-tree portfast

• 1. S1(config-if)# spanning-tree portfast

An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. After verifying the cause of the violation, how should the administrator re-enable the port without disrupting network operation?

• 1. Reboot the switch.

• 1. Issue the no switchport port-security violation shutdown command on the interface.

• 1. Issue the shutdown command followed by the no shutdown command on the interface.

• 1. Issue the no switchport port-security command, then re-enable port security.

A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?

• 1. ip dhcp snooping limit rate

• 1. ip dhcp snooping

• 1. ip dhcp snooping vlan

• 1. ip dhcp snooping trust

A network administrator is configuring DAI on a switch with the command ip arp inspection validate dst-mac. What is the purpose of this configuration command?

• 1. to check the destination MAC address in the Ethernet header against the target MAC address in the ARP body

• 1. to check the destination MAC address in the Ethernet header against the user-configured ARP ACLs

• 1. to check the destination MAC address in the Ethernet header against the MAC address table

• 1. to check the destination MAC address in the Ethernet header against the source MAC address in the ARP body

Which security feature should be enabled in order to prevent an attacker from overflowing the MAC address table of a switch?

• 1. BPDU filter

• 1. root guard

• 1. storm control

• 1. port security

What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?

• 1. DHCP spoofing

• 1. ARP spoofing

• 1. VLAN hopping

• 1. ARP poisoning