Day 1 – Network Security Technologies Quiz

1. For the same MAC address, a manually configured has a higher priority than an automatically generated MAC entry.

• A. True
• B. False

2. DHCP snooping is a security feature that can be used to defend against various attacks. Which of the following are included in those attacks? (Multiple Answers)

• A. TCP flag attacks
• B. Bogus DHCP server attacks
• C. Man-in-the-middle attacks and IP/MAC spoofing attacks
• D. Starvation attacks by changing the CHADDR field value

3. Which of the following statements about IPSG is incorrect?

• A. IPSG is a source IP address filtering technology based on Layer 3 interfaces.
• B. IPSG can be used to prevent hosts from changing IP addresses.
• C. IPSG can be used to check the validity of IP packets. If IP packets are invalid, the device reports an alarm to an NMS.
• D. IPSG can defend against IP address spoofing attacks.

4. Which of the following statements is incorrect about the user authentication points on the network?

• A. Deploying user authentication points at the access layer achieves granular permission management and high network security.
• B. Deploying user authentication points at the access layer has both advantages and disadvantages when compared to doing so at the aggregation or core layer. Policy association can be applied if user authentication points are deployed at the access layer.
• C. Moving user authentication points from the access layer to the aggregation or core layer greatly reduces the number of user authentication points, thereby effectively mitigating the pressure on the AAA server.
• D. When user authentication points are moved from the access layer to the aggregation layer, MAC address authentication for users may fail.

5. In the firewall hot standby scenario, which of the following protocols is used to back up the session table between the active and standby firewalls?

• A. BFD
• B. HRP
• C. VRRP
• D. VGMP

6. To prevent hackers from attacking user devices or networks using MAC addresses, you can configure MAC addresses of untrusted users as blackhole MAC addresses to filter out such invalid MAC addresses. When receiving a packet whose source or destination MAC address is a blackhole MAC address on a device, the device discards the packet.

• A. TRUE
• B. FALSE

7. If the number of MAC: addresses learned on an interface enabled with port security reaches the upper limit, which of the following actions may the switch take? (Multiple answers)

• A. Sets the interface state to error-down and generates an alarm.
• B. Discards packets with unknown source MAC addresses without generating any alarm.
• C. Sets the interface state to error-down without generating any alarm.
• D. Discards packets with unknown source MAC addresses and generates an alarm.

8. In Huawei’s free mobility solution, if one device functions as both an authentication point and a policy enforcement point, the administrator needs to subscribe to IP-security group entries to view IP-security group information.

• A. TRUE
• B. FALSE