CCNA2 MODULE 11

What is a recommended best practice when dealing with the native VLAN?

• Assign it to an unused VLAN

• Assign the same VLAN number as the management VLAN

• turn off DTP

• Use port security

On what switch ports should PortFast be enabled to enhance STP stability?

• all trunk ports that are not root ports

• only ports that attach to a neighboring switch

• only ports that are elected as designated ports

• all end-user ports

Which command would be best to use on an unused switch port if a company adheres to the best practices as recommended by Cisco?

• shutdown

• ip dhcp snooping

• switchport port-security mac-address sticky mac address

• switchport port-security violation shutdown

• switchport port-security mac-address sticky

Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)

• DHCP server failover

• strong password on DHCP server

• port security

• DHCP snooping

• extended ACL

What is the best way to prevent a VLAN hopping attack?

• Disable STP on all nontrunk ports

• Use ISL encapsulation on all trunk links

• Disable trunk negotiation for trunk ports and statistically set nontrunk ports as access ports

• Use VLAN 1 as the native VLAN on trunk ports

Which procedure is recommended to mitigate the chances of ARP spoofing?

• Enable DHCP snooping on selected VLANs

• Enable DAI on the management VLAN

• Enable IP Source Guard on trusted ports

• Enable port security globally

What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)

• untrusted port

• authorized DHCP port

• unauthorized port

• established DHCP port

• trusted DHCP port

Which two commands can be used to enable PortFast on a switch? (Choose two.)

• S1(config-line)# spanning-tree portfast

• S1(config)# enable spanning-tree portfast default

• S1(config)# spanning-tree portfast default

• S1(config-if)#enable spanning-tree portfast

• S1(config-if)#spanning-tree portfast

An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. After verifying the cause of the violation, how should the administrator re-enable the port without disrupting network operation?

• Issue the no switchport port-security command, then re-enable port security

• Reboot the switch

• Issue the shutdown command followed by the no shutdown command on the interface

• Issue the no switchport port-security violation shutdown command on the interface

A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?

• ip dhcp snooping trust

• ip dhcp snooping vlan

• ipdhcp snooping limit rate

• ip dhcp snooping