wayground logo

Free Printable Worksheets

Font size

S
M
L
XL
Worksheets

CCNA 2B Midterm Module 10-13

Total questions: 197

Worksheet time: 16hrs 25mins

Name
Class
Date
1.

M10: Which attack encrypts the data on hosts in an attempt to extract a monetary payment from the victim?

a)

DDoS

b)

Data Breach

c)

Malware

d)

Ransomware

2.

M10: Which devices are specifically designed for network security? (Choose three)

a)

VPN-Enabled Router

b)

NGFW (Next-Generation Firewall)

c)

Switch

d)

WLC (Wireless LAN Controller)

e)

NAC (Network Access Control)

3.

M10: Which device monitors SMTP traffic to block threats and encrypt outgoing messages to prevent data loss?

a)

NGFW (Next-Generation Firewall)

b)

ESA (Email Security Appliance)

c)

NAC (Network Access Control)

d)

WSA (Wireless Security Appliance)

4.

M10: Which device monitors HTTP traffic to block access to risky sites and encrypt outgoing messages?

a)

NGFW (Next-Generation Firewall)

b)

ESA (Email Security Appliance)

c)

NAC (Network Access Control)

d)

WSA (Wireless Security Appliance)

5.

M11: Which AAA component is responsible for collecting and reporting usage data for auditing and billing purposes?

a)

Authentication

b)

Authorization

c)

Accounting

6.

M10: Which AAA component is responsible for controlling who is permitted to access the network?

a)

Authentication

b)

Authorization

c)

Accounting

7.

M10: Which AAA component is responsible for determining what the user can access?

a)

Authentication

b)

Authorization

c)

Accounting

8.

M10: In an 802.1X implementation, which device is responsible for relaying responses?

a)

Supplicant

b)

Authenticator

c)

Router

d)

Authentication Server

e)

Client

9.

M10: Which of the following mitigation techniques are used to protect Layer 3 through Layer 7 of the OSI Model? (Choose three.)

a)

DHCP Snooping

b)

VPN

c)

Firewall

d)

IPSG

e)

IPS devices

10.

M10: Which of the following mitigation techniques prevents many types of attacks including MAC address table overflow and DHCP starvation attacks?

a)

IPSG (IP Source Guard)

b)

DHCP Snooping

c)

DAI (Dynamic ARP Inspection)

d)

Port Security

11.

M10: Which of the following mitigation techniques prevents MAC and IP address spoofing?

a)

IPSG (IP Source Guard)

b)

DHCP Snooping

c)

DAI (Dynamic ARP Inspection)

d)

Port Security

12.

M10: Which of the following mitigation techniques prevents ARP spoofing and ARP poisoning attacks?

a)

IPSG (IP Source Guard)

b)

DHCP Snooping

c)

DAI (Dynamic ARP Inspection)

d)

Port Security

13.

M10: Which of the following mitigation techniques prevents DHCP starvation and DHCP spoofing attacks?

a)

IPSG (IP Source Guard)

b)

DHCP Snooping

c)

DAI (Dynamic ARP Inspection)

d)

Port Security

14.

M10: What is the behavior of a switch as a result of a successful MAC address table attack?

a)

The switch will shut down.

b)

The switch interfaces will transition to the error-disabled state.

c)

The switch will forward all received frames to all other ports within the VLAN.

d)

The switch will drop all received frames.

15.

M10: What would be the primary reason a threat actor would launch a MAC address overflow attack?

a)

So that the threat actor can see frames that are destined for other devices.

b)

So that the threat actor can execute arbitrary code on the switch.

c)

So that the switch stops forwarding traffic.

d)

So that the legitimate hosts cannot obtain a MAC address.

16.

M10: What mitigation technique must be implemented to prevent MAC address overflow attacks?

a)

IPSG (IP Source Guard)

b)

DAI (Dynamic ARP Inspection)

c)

Port Security

d)

DHCP Snooping

17.

M10: A threat actor changes the MAC address of the threat actor's device to the MAC address of the default gateway. What type of attack is this?

a)

Address spoofing

b)

ARP spoofing

c)

DHCP starvation

d)

CDP reconnaissance

e)

STP attack

18.

M10: A threat actor sends a BPDU message with priority 0. What type of attack is this?

a)

Address spoofing

b)

ARP spoofing

c)

CDP reconnaissance

d)

DHCP starvation

e)

STP attack

19.

M10: A threat actor leases all the available IP addresses on a subnet. What type of attack is this?

a)

Address spoofing

b)

ARP spoofing

c)

CDP reconnaissance

d)

DHCP starvation

e)

STP attack

20.

M10: A threat actor sends a message that causes all other devices to believe the MAC address of the threat actor's device is the default gateway. What type of attack is this?

a)

Address spoofing

b)

ARP spoofing

c)

CDP reconnaissance

d)

DHCP starvation

e)

STP attack

21.

M10: A threat actor configures a host with the 802.1Q protocol and forms a trunk with the connected switch. What type of attack is this?

a)

VLAN hopping

b)

ARP spoofing

c)

CDP reconnaissance

d)

DHCP starvation

e)

STP attack

22.

M10: A threat actor discovers the IOS version and IP addresses of the local switch. What type of attack is this?

a)

VLAN hopping

b)

ARP spoofing

c)

CDP reconnaissance

d)

DHCP starvation

e)

STP attack

23.

M10: What two protocols are supported on Cisco devices for AAA communications? (Choose two.)

a)

TACACS+

b)

HSRP

c)

RADIUS

d)

LLDP

e)

VTP

24.

M10: Which service is enabled on a Cisco router by default that can reveal significant information about the router and potentially make it more vulnerable to attack?

a)

LLDP

b)

CDP

c)

FTP

d)

HTTP

25.

M10: When security is a concern, which OSI Layer is considered to be the weakest link in a network system?​

a)

Layer 2

b)

Layer 7

c)

Layer 4

d)

Layer 3

26.

M10: Which Layer 2 attack will result in a switch flooding incoming frames to all ports?

a)

MAC address overflow

b)

Spanning Tree Protocol manipulation

c)

IP address spoofing

d)

ARP poisoning

27.

M10: Why is authentication with AAA preferred over a local database method?

a)

It uses less network bandwidth.

b)

It provides a fallback authentication method if the administrator forgets the username or password.

c)

It requires a login and password combination on the console, vty lines, and aux ports.​

d)

It specifies a different password for each line or port.

28.

M10: In a server-based AAA implementation, which protocol will allow the router to successfully communicate with the AAA server?

a)

SSH

b)

RADIUS

c)

802.1x

d)

TACACS​

29.

M10: Which Cisco solution helps prevent MAC and IP address spoofing attacks?

a)

DHCP Snooping

b)

IP Source Guard

c)

Port Security

d)

Dynamic ARP Inspection

30.

M10: What is the purpose of AAA accounting?

a)

to determine which operations the user can perform

b)

to collect and report application usage

c)

to determine which resources the user can access

d)

to prove users are who they say they are

31.

M10: Which Layer 2 attack will result in legitimate users not getting valid IP addresses?

a)

ARP spoofing

b)

IP address spoofing

c)

MAC address flooding

d)

DHCP starvation

32.

M10: Which three Cisco products focus on endpoint security solutions? (Choose three.)

a)

SSL/IPsec VPN Appliance

b)

NAC Appliance

c)

Web Security Appliance

d)

Email Security Appliance

e)

IPS Sensor Appliance

33.

M10: True or False? In the 802.1X standard, the client attempting to access the network is referred to as the supplicant.

a)

True

b)

False

34.

M10: What is involved in an IP address spoofing attack?

a)

A rogue DHCP server provides false IP configuration parameters to legitimate DHCP clients.

b)

Bogus DHCPDISCOVER messages are sent to consume all the available IP addresses on a DHCP server.

c)

A legitimate network IP address is hijacked by a rogue node.

d)

A rogue node replies to an ARP request with its own MAC address indicated for the target IP address.

35.

M10: What three services are provided by the AAA framework? (Choose three.)

a)

automation

b)

authorization

c)

authentication

d)

autoconfiguration

e)

accounting

36.

M10: Because of implemented security controls, a user can only access a server with FTP. Which AAA component accomplishes this?

a)

auditing

b)

accessibility

c)

authentication

d)

authorization

e)

Accounting

37.

M10: What mitigation plan is best for thwarting a DoS attack that is creating a MAC address table overflow?

a)

Disable DTP.

b)

Enable port security.

c)

Place unused ports in an unused VLAN.

d)

Disable STP.

38.

M11: What is a recommended best practice when dealing with the native VLAN?

a)

Turn off DTP.

b)

Use port security.

c)

Assign it to an unused VLAN.

d)

Assign the same VLAN number as the management VLAN.

39.

M11: On what switch ports should PortFast be enabled to enhance STP stability?

a)

all end-user ports

b)

all trunk ports that are not root ports

c)

only ports that are elected as designated ports

d)

only ports that attach to a neighboring switch

40.

M11: Which command would be best to use on an unused switch port if a company adheres to the best practices as recommended by Cisco?

a)

switchport port-security mac-address sticky mac-address

b)

ip dhcp snooping

c)

switchport port-security mac-address sticky

d)

switchport port-security violation shutdown

e)

Shutdown

41.

M11: Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)

a)

extended ACL

b)

strong password on DHCP servers

c)

port security

d)

DHCP snooping

e)

DHCP server failover

42.

M11: What is the best way to prevent a VLAN hopping attack?

a)

Use ISL encapsulation on all trunk links.

b)

Use VLAN 1 as the native VLAN on trunk ports.

c)

Disable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.

d)

Disable STP on all nontrunk ports.

43.

M11: Which procedure is recommended to mitigate the chances of ARP spoofing?

a)

Enable port security globally.

b)

Enable DAI on the management VLAN.

c)

Enable IP Source Guard on trusted ports.

d)

Enable DHCP snooping on selected VLANs.

44.

M11: What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)

a)

unauthorized port

b)

trusted DHCP port

c)

untrusted port

d)

established DHCP port

e)

authorized DHCP port

45.

M11: Which two commands can be used to enable PortFast on a switch? (Choose two.)

a)

S1(config)# enable spanning-tree portfast default

b)

S1(config-line)# spanning-tree portfast

c)

S1(config-if)# enable spanning-tree portfast

d)

S1(config)# spanning-tree portfast default

e)

S1(config-if)# spanning-tree portfast

46.

M11: An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. After verifying the cause of the violation, how should the administrator re-enable the port without disrupting network operation?

a)

Issue the no switchport port-security violation shutdown command on the interface.

b)

Issue the shutdown command followed by the no shutdown command on the interface.

c)

Issue the no switchport port-security command, then re-enable port security.

d)

Reboot the switch.

47.

M11: A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?

a)

ip dhcp snooping

b)

ip dhcp snooping limit rate

c)

ip dhcp snooping vlan

d)

ip dhcp snooping trust

48.

M11: A network administrator is configuring DAI on a switch with the command ip arp inspection validate dst-mac. What is the purpose of this configuration command?

a)

to check the destination MAC address in the Ethernet header against the MAC address table

b)

to check the destination MAC address in the Ethernet header against the target MAC address in the ARP body

c)

to check the destination MAC address in the Ethernet header against the source MAC address in the ARP body

d)

to check the destination MAC address in the Ethernet header against the user-configured ARP ACLs

49.

M11: Which security feature should be enabled in order to prevent an attacker from overflowing the MAC address table of a switch?

a)

port security

b)

storm control

c)

root guard

d)

BPDU filter

50.

M11: What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?

a)

DHCP spoofing

b)

ARP poisoning

c)

VLAN hopping

d)

ARP spoofing

51.

M11: A network administrator is configuring DAI on a switch. Which command should be used on the uplink interface that connects to a router?

a)

spanning-tree portfast

b)

ip arp inspection trust

c)

ip arp inspection vlan

d)

ip dhcp snooping

52.

M11: Where are dynamically learned MAC addresses stored when sticky learning is enabled with the switchport port-security mac-address sticky command?

a)

ROM

b)

flash

c)

NVRAM

d)

RAM

53.

M12: Which of the following wireless networks typically uses lower powered transmitters for short ranges?

a)

WPAN

b)

WLAN

c)

WMAN

d)

WWAN

54.

M12: Which of the following wireless networks are specified in the IEEE 802.11 standards for the 2.4 GHz and 5 GHz radio frequencies?

a)

WPAN

b)

WLAN

c)

WMAN

d)

WWAN

55.

M12: Which of the following is an IEEE 802.15 WPAN standard that uses a device-pairing process to communicate?

a)

Cellular

b)

WiMAX

c)

Wi-Fi

d)

Bluetooth

56.

M12: Which 802.11 standards exclusively use the 5 GHz radio frequency? (Choose 2)

a)

802.11a

b)

802

c)

802.11n

d)

802.11ac

e)

802.11ax

57.

M12: Which standards organization is responsible for allocating radio frequencies?

a)

IEEE

b)

ITU-R

c)

Wi-Fi Alliance

58.

M12: True or False: Laptops that do not have an integrated wireless NIC can only be attached to the network through a wired connection.

a)

True

b)

False

59.

M12: Which of the following components are integrated in a wireless home router? (Choose three.)

a)

Access point

b)

Switch

c)

Router

d)

Range extender

60.

M12: True or False: When you need to expand the coverage of a small network, the best solution is to use a range extender.

a)

True

b)

False

61.

M12: Which of the following is a standalone device, like a home router, where the entire WLAN configuration resides on the device?

a)

Range extender

b)

Autonomous AP

c)

Controller-based AP

d)

USB Wireless NIC

62.

M12: Which of the following antennas provide 360 degrees of coverage?

a)

Wireless NIC

b)

Directional

c)

Omnidirectional

d)

MIMO

63.

M12: Which wireless topology mode is used by two devices to connect in a peer-to-peer network?

a)

Ad hoc

b)

Infrastructure

c)

Tethering

64.

M12: True or False: An ESS is created when two or more BSSs need to be joined to support roaming clients.

a)

True

b)

False

65.

M12: How many address fields are in the 802.11 wireless frame?

a)

2

b)

3

c)

4

d)

5

66.

M12: What is the term for an AP that openly advertises its service periodically?

a)

Active

b)

Infrastructure

c)

Ad hoc

d)

Passive

67.

M12: What is the term for an AP that does not send a beacon, but waits for clients to send probes?

a)

Active

b)

Infrastructure

c)

Ad hoc

d)

Passive

68.

M12: What IP versions does CAPWAP support?

a)

IPv4 only

b)

IPv6 only

c)

IPv4 by default, but can configure IPv6

d)

IPv6 by default, but can configure IPv4

69.

M12: What UDP ports and IP protocols are used by CAPWAP for IPv4? (Choose three.)

a)

17

b)

136

c)

5246

d)

5247

e)

802.11

70.

M12: What UDP ports and IP protocols are used by CAPWAP for IPv6? (Choose three.)

a)

17

b)

136

c)

5246

d)

5247

e)

802.11

71.

M12: In the split MAC architecture for CAPWAP, which of the following are the responsibility of the AP? (Choose four.)

a)

Packet acknowledgments and retransmissions

b)

Beacons and probe responses

c)

MAC layer data encryption and decryption

d)

Frame queueing and packet prioritization

e)

Termination of 802.11 traffic on a wired interface

72.

M12: In the split MAC architecture for CAPWAP, which of the following are the responsibility of the WLC? (Choose four.)

a)

Authentication

b)

Association and re-association of roaming clients

c)

MAC layer data encryption and decryption

d)

Frame translation to other protocols

e)

Termination of 802.11 traffic on a wired interface

73.

M12: True or False: DTLS is enabled by default on the control and data CAPWAP tunnels.

a)

True

b)

False

74.

M12: Which of the following statements are true about modes of operation for a FlexConnect AP? (Choose two.)

a)

In connect mode, the WLC is unreachable and the AP switches local traffic and performs client authentication locally.

b)

In standalone mode, the WLC is unreachable and the AP switches local traffic and performs client authentication locally.

c)

In connect mode, the WLC is reachable and performs all its CAPWAP functions.

d)

In standalone mode, the WLC is reachable and performs all its CAPWAP functions

75.

M12: Which of the following modulation techniques rapidly switches a signal among frequency channels?

a)

DSSS

b)

FHSS

c)

OFDM

d)

OFDMA

76.

M12: Which of the following modulation techniques spreads a signal over a larger frequency band?

a)

DSSS

b)

FHSS

c)

OFDM

d)

OFDMA

77.

M12: Which of the following modulation techniques is used in the new 802.11ax standard?

a)

DSSS

b)

FHSS

c)

OFDM

d)

OFDMA

78.

M12: How many channels are available for the 2.4 GHz band in Europe?

a)

11

b)

13

c)

14

d)

24

79.

M12: How many channels are available for the 5 GHz band?

a)

11

b)

13

c)

14

d)

24

80.

M12: Which of the following is most likely NOT the source of a wireless DoS attack?

a)

Radio interference

b)

Improperly configured devices

c)

Rogue AP

d)

Malicious user

81.

M12: True or False: A rogue AP is a misconfigured AP connected to the network and a possible source of DoS attacks.

a)

True

b)

False

82.

M12: What type of attack is an “evil twin AP” attack?

a)

DoS

b)

MITM

c)

Wireless intruder

d)

Radio interference

83.

M12: What are the best ways to secure WLANs? (Choose two.)

a)

Authentication

b)

SSID cloaking

c)

Encryption

d)

MAC address filtering

84.

M12: Which of the following authentication methods does not use a password shared between the wireless client and the AP?

a)

WEP

b)

WPA

c)

WPA2

d)

WPA3

e)

Open

85.

M12: Which encryption method is used by the original 802.11 specification?

a)

AES

b)

TKIP

c)

AES or TKIP

d)

RC4

86.

M12: Which of the following encryption methods uses CCMP to recognize if the encrypted and non-encrypted bits have been altered?

a)

AES

b)

TKIP

c)

RC4

87.

M12: Which of the following authentication methods has the user enter a pre-shared password? (Choose two)

a)

Open

b)

WPA Personal

c)

WPA Enterprise

d)

WPA2 Personal

e)

WPA2 Enterprise

88.

M12: In the context of mobile devices, what does the term tethering involve?

a)

connecting a mobile device to a USB port on a computer in order to charge the mobile device

b)

connecting a mobile device to a 4G cellular network

c)

connecting a mobile device to another mobile device or computer to share a network connection

d)

connecting a mobile device to a hands-free headset

89.

M12: Which feature of 802.11n wireless access points allows them to transmit data at faster speeds than previous versions of 802.11 Wi-Fi standards did?

a)

MIMO

b)

MITM

c)

SPS

d)

WPS

90.

M12: Which method of wireless authentication is currently considered to be the strongest?

a)

WPA

b)

shared key

c)

open

d)

WEP

e)

WPA2

91.

M12: Which parameter is commonly used to identify a wireless network name when a home wireless AP is being configured?

a)

SSID

b)

BESS

c)

ESS

d)

ad hoc

92.

M12: Which characteristic describes a wireless client operating in active mode?

a)

broadcasts probes that request the SSID

b)

ability to dynamically change channels

c)

must know the SSID to connect to an AP

d)

must be configured for security before attaching to an AP

93.

M12: Which IEEE standard operates at wireless frequencies in both the 5 GHz and 2.4 GHz ranges?

a)

802.11g

b)

802.11n

c)

802.11a

d)

802.11b

94.

M12: Which statement describes an autonomous access point?

a)

It is managed by a WLAN controller.

b)

It is used for networks that require a large number of access points.

c)

It is a standalone access point.

d)

It is server-dependent.

95.

M12: Which two roles are typically performed by a wireless router that is used in a home or small business? (Choose two.)

a)

repeater

b)

RADIUS authentication server

c)

Ethernet switch

d)

access point

e)

WLAN controller

96.

M12: Which protocol and port numbers are used by both IPv4 and IPv6 CAPWAP tunnels? (Choose two.)

a)

TCP

b)

ICMP

c)

17 and 163

d)

5246 and 5247

e)

UDP

97.

M12: If three 802.11b access points need to be deployed in close proximity, which three frequency channels should be used? (Choose three.)

a)

1

b)

3

c)

5

d)

6

e)

11

98.

M12: Which type of telecommunication technology is used to provide Internet access to vessels at sea?

a)

cellular

b)

WiMax

c)

satellite

d)

municipal WiFi

99.

M12: Which wireless network topology is being configured by a technician who is installing a keyboard, a mouse, and headphones, each of which uses Bluetooth?

a)

ad hoc mode

b)

infrastructure mode

c)

hotspot

d)

mixed mode

100.

M12: Which type of wireless topology is created when two or more Basic Service Sets are interconnected by Ethernet?

a)

IBISS

b)

WiFi Direct

c)

ad hoc WLAN

d)

ESS

e)

BSS

101.

M12: What Wi-Fi management frame is regularly broadcast by APs to announce their presence?

a)

probe

b)

association

c)

beacon

d)

authentication

102.

M13: A user is configuring a wireless access point and wants to prevent any neighbors from discovering the network. What action does the user need to take?

a)

Configure a DNS server.

b)

Enable WPA encryption.

c)

Disable SSID broadcast.

d)

Configure DMZ settings.

103.

M13: When a wireless network in a small office is being set up, which type of IP addressing is typically used on the networked devices?

a)

private

b)

public

c)

network

d)

Wireless

104.

M13: A user has just purchased a generic home router and would like to secure it. What should be done to help secure the wireless home router?

a)

Set a private IPv4 network for the internal network.

b)

Change the default SSID.

c)

Change the default administrator password.

d)

Allow only IPv6 traffic to enter the router.

105.

M13: Which protocol could be used by a company to monitor devices such as a wireless LAN controller (WLC)?

a)

NTP

b)

PAT

c)

SNMP

d)

SSH

106.

M13: When configuring a Cisco 3500 series wireless LAN controller (WLC) for a WPA2 Enterprise WLAN, what has to be created on the WLC before creating the new WLAN?

a)

a security module

b)

a VLAN for the wireless network

c)

a new SSID

d)

a security policy

107.

M13: What is a DHCP scope as it relates to a WLAN configured on the WLC controller?

a)

a pool of IP addresses for WLAN clients

b)

security rules associated with DHCP for WLANs

c)

the distance allotted for wireless clients that can receive IP addressing information

d)

a corporate plan for allocation of IP addresses for wireless clients

108.

M13: Why would a technician configure a passphrase for a WLAN on a wireless router?

a)

to configure wireless client authentication

b)

to protect someone from cabling directly to the router and accessing the router

c)

to protect someone from changing the configuration

d)

to protect the SSID from being changed

109.

M13: A customer installs a wireless access point at home in the closet next to the kitchen. The customer mentions that the wireless communication performance seems degraded when the cordless phone or the microwave oven is in use. What is the possible reason for this degradation?

a)

The surge of electricity when a microwave oven is in use disrupts the operation of the access point.

b)

The wireless signal is in the same radio frequency range as the household devices are in.

c)

The access point is close to walls.

d)

The access point is on the same electrical circuit as the phone base unit and microwave oven are.

110.

M13: What functionality is required on routers to provide remote workers with VoIP and videoconferencing capabilities?

a)

VPN

b)

QoS

c)

PPPoE

d)

IPsec

111.

M13: A wireless router is displaying the IP address of 192.168.0.1. What could this mean?

a)

The NAT function is not working on the wireless router.

b)

The wireless router has been configured to use the frequencies on channel 1.

c)

Dynamic IP address allocation has been configured on the router and is functioning correctly.

d)

The wireless router still has the factory default IP address.

112.

M13: A laptop cannot connect to a wireless access point. Which two troubleshooting steps should be taken first? (Choose two.)

a)

Ensure that the wireless NIC is enabled.

b)

Ensure that the NIC is configured for the proper frequency.

c)

Ensure that the wireless SSID is chosen.

d)

Ensure that the correct network media is selected.

e)

Ensure that the laptop antenna is attached.

113.

M13: In setting up a small office network, the network administrator decides to assign private IP addresses dynamically to workstations and mobile devices. Which feature must be enabled on the company router in order for office devices to access the internet?

a)

QoS

b)

NAT

c)

MAC filtering

d)

UPnP

114.

M13: What is a difference between autonomous APs that operate in a home environment and controller-based APs that operate in a corporate environment?

a)

Autonomous APs do not support PoE.

b)

Controller-based APs can be automatically configured and managed by a WLAN controller.

c)

Controller-based APs are known as lightweight APs and require an initial configuration to operate.

d)

Autonomous APs incorporate the functions of a router, switch, and AP into one device.​

115.

M13: Which WLC tab would a network administrator typically use to see a summary view of the most heavily used WLANs including the number of clients using a particular WLAN?

a)

Monitor

b)

Controller

c)

Commands

d)

WLANs

116.

M13: Users on an IEEE 802.11n network are complaining of slow speeds. The network administrator checks the AP and verifies it is operating properly. What can be done to improve the wireless performance in the network?

a)

Set the AP to mixed mode.

b)

Split the wireless traffic between the 802.11n 2.4 GHz band and the 5 GHz band.

c)

Change the authentication method on the AP.

d)

Switch to an 802.11g AP.

117.

Which Layer 2 attack will result in legitimate users not getting valid IP addresses?

a)

ARP spoofing

b)

DHCP starvation

c)

IP address spoofing

d)

MAC address flooding

118.

What mitigation plan is best for thwarting a DoS attack that is creating a MAC address table overflow?

a)

Disable DTP.

b)

Disable STP.

c)

Enable port security.

d)

Place unused ports in an unused VLAN.

119.

Which three Cisco products focus on endpoint security solutions? (Choose three.)

a)

IPS Sensor Appliance

b)

Web Security Appliance

c)

Email Security Appliance

d)

SSL/IPsec VPN Appliance

e)

NAC Appliance

120.

True or False? In the 802.1X standard, the client attempting to access the network is referred to as the supplicant.

a)

True

b)

False

121.

Which authentication method stores usernames and passwords in the router and is ideal for small networks?

a)

server-based AAA over TACACS+

b)

local AAA over RADIUS

c)

server-based AAA

d)

local AAA over TACACS+

e)

local AAA

122.

What represents a best practice concerning discovery protocols such as CDP and LLDP on network devices?

a)

Enable CDP on edge devices, and enable LLDP on interior devices.

b)

Use the open standard LLDP rather than CDP.

c)

Use the default router settings for CDP and LLDP.

d)

Disable both protocols on all interfaces where they are not required.

123.

Which protocol should be used to mitigate the vulnerability of using Telnet to remotely manage network devices?

a)

SNMP

b)

TFTP

c)

SSH

d)

SCP

124.

Which statement describes the behavior of a switch when the MAC address table is full?

a)

It treats frames as unknown unicast and floods all incoming frames to all ports within the local VLAN.

b)

It treats frames as unknown unicast and floods all incoming frames to all ports across multiple switches.

c)

It treats frames as unknown unicast and floods all incoming frames to all ports on the switch.

d)

It treats frames as unknown unicast and floods all incoming frames to all ports within the collision domain.

125.

What device is considered a supplicant during the 802.1X authentication process?

a)

the router that is serving as the default gateway

b)

the authentication server that is performing client authentication

c)

the client that is requesting authentication

d)

the client that is requesting authentication

126.

Refer to the exhibit. Port Fa0/2 has already been configured appropriately. The IP phone and PC work properly. Which switch configuration would be most appropriate for port Fa0/2 if the network administrator has the following goals?

No one is allowed to disconnect the IP phone or the PC and connect some other wired device.

If a different device is connected, port Fa0/2 is shut down.

The switch should automatically detect the MAC address of the IP phone and the PC and add those addresses to the running configuration.

a)

SWA(config-if)# switchport port-security

SWA(config-if)# switchport port-security mac-address sticky

b)

SWA(config-if)# switchport port-security

SWA(config-if)# switchport port-security maximum 2

SWA(config-if)# switchport port-security mac-address sticky

SWA(config-if)# switchport port-security violation restrict

c)

SWA(config-if)# switchport port-security mac-address sticky

SWA(config-if)# switchport port-security maximum 2

d)

SWA(config-if)# switchport port-security

SWA(config-if)# switchport port-security maximum 2

SWA(config-if)# switchport port-security mac-address sticky

127.

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

a)

Frames from PC1 will be forwarded since the switchport port-security violation command is missing.

b)

Frames from PC1 will be forwarded to its destination, and a log entry will be created.

c)

Frames from PC1 will be forwarded to its destination, but a log entry will not be created.

d)

Frames from PC1 will cause the interface to shut down immediately, and a log entry will be made.

128.

Which type of VLAN-hopping attack may be prevented by designating an unused VLAN as the native VLAN?

a)

DHCP spoofing

b)

DHCP starvation

c)

VLAN double-tagging

d)

DTP spoofing

129.

A network administrator is configuring DAI on a switch with the command ip arp inspection validate src-mac. What is the purpose of this configuration command?

a)

It checks the source MAC address in the Ethernet header against the user-configured ARP ACLs.

b)

It checks the source MAC address in the Ethernet header against the MAC address table.

c)

It checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body.

d)

It checks the source MAC address in the Ethernet header against the target MAC address in the ARP body.

130.

Which two commands can be used to enable BPDU guard on a switch? (Choose two.)

a)

S1(config)# spanning-tree bpduguard default

b)

S1(config-if)# spanning-tree portfast bpduguard

c)

S1(config)# spanning-tree portfast bpduguard default

d)

S1(config-if)# enable spanning-tree bpduguard

e)

S1(config-if)# spanning-tree bpduguard enable

131.

As part of the new security policy, all switches on the network are configured to automatically learn MAC addresses for each port. All running configurations are saved at the start and close of every business day. A severe thunderstorm causes an extended power outage several hours after the close of business. When the switches are brought back online, the dynamically learned MAC addresses are retained. Which port security configuration enabled this?

a)

auto secure MAC addresses

b)

dynamic secure MAC addresses

c)

static secure MAC addresses

d)

sticky secure MAC addresses

132.

Which type of management frame may regularly be broadcast by an AP?

a)

authentication

b)

probe request

c)

probe response

d)

beacon

133.

What are the two methods that are used by a wireless NIC to discover an AP? (Choose two.)

a)

delivering a broadcast frame

b)

receiving a broadcast beacon frame

c)

initiating a three-way handshake

d)

transmitting a probe request

134.

A technician is configuring the channel on a wireless router to either 1, 6, or 11. What is the purpose of adjusting the channel?

a)

to enable different 802.11 standards

b)

to avoid interference from nearby wireless devices

c)

to disable broadcasting of the SSID

d)

to provide stronger security modes

135.

While attending a conference, participants are using laptops for network connectivity. When a guest speaker attempts to connect to the network, the laptop fails to display any available wireless networks. The access point must be operating in which mode?

a)

mixed

b)

passive

c)

active

d)

open

136.

A network administrator is required to upgrade wireless access to end users in a building. To provide data rates up to 1.3 Gb/s and still be backward compatible with older devices, which wireless standard should be implemented?

a)

802.11n

b)

802.11ac

c)

802.11g

d)

802.11b

137.

A technician is about to install and configure a wireless network at a small branch office. What is the first security measure the technician should apply immediately upon powering up the wireless router?

a)

Enable MAC address filtering on the wireless router.

b)

Configure encryption on the wireless router and the connected wireless devices.

c)

Change the default user-name and password of the wireless router.

d)

Disable the wireless network SSID broadcast.

138.

On a Cisco 3504 WLC dashboard, which option provides access to the full menu of features?

a)

Access Points

b)

Network Summary

c)

Advanced

d)

Rogues

139.

Which step is required before creating a new WLAN on a Cisco 3500 series WLC?

a)

Create a new SSID.

b)

Build or have an SNMP server available.

c)

Build or have a RADIUS server available.

d)

Create a new VLAN interface.

140.

A network engineer is troubleshooting a newly deployed wireless network that is using the latest 802.11 standards. When users access high bandwidth services such as streaming video, the wireless network performance is poor. To improve performance the network engineer decides to configure a 5 Ghz frequency band SSID and train users to use that SSID for streaming media services. Why might this solution improve the wireless network performance for that type of service?

a)

Requiring the users to switch to the 5 GHz band for streaming media is inconvenient and will result in fewer users accessing these services.

b)

The 5 GHz band has more channels and is less crowded than the 2.4 GHz band, which makes it more suited to streaming multimedia.

c)

The 5 GHz band has a greater range and is therefore likely to be interference-free.

d)

The only users that can switch to the 5 GHz band will be those with the latest wireless NICs, which will reduce usage.

141.

A network administrator is configuring a RADIUS server connection on a Cisco 3500 series WLC. The configuration requires a shared secret password. What is the purpose for the shared secret password?

a)

It is used by the RADIUS server to authenticate WLAN users.

b)

It is used to authenticate and encrypt user data on the WLAN.

c)

It is used to encrypt the messages between the WLC and the RADIUS server.

d)

It allows users to authenticate and access the WLAN.

142.

Which three parameters would need to be changed if best practices are being implemented for a home wireless AP? (Choose three.)

a)

wireless client operating system password

b)

antenna frequency

c)

wireless network password

d)

AP password

e)

SSID

143.

Which access control component, implementation, or protocol is based upon usernames and passwords?

a)

802.1X

b)

accounting

c)

authentication

d)

authorization

144.

Which type of wireless network is based on the 802.11 standard and a 2.4-GHz or 5-GHz radio frequency?

a)

wireless metropolitan-area network

b)

wireless wide-area network

c)

wireless local-area network

d)

wireless personal-area network

145.

Which two Cisco solutions help prevent DHCP starvation attacks? (Choose two.)

a)

DHCP Snooping

b)

IP Source Guard

c)

Dynamic ARP Inspection

d)

Port Security

146.

What are three techniques for mitigating VLAN attacks? (Choose three.)

a)

Enable trunking manually.

b)

Disable DTP.

c)

Enable Source Guard.

d)

Set the native VLAN to an unused VLAN.

147.

Refer to the exhibit. What can be determined about port security from the information that is shown?

a)

The port has the maximum number of MAC addresses that is supported by a Layer 2 switch port which is configured for port security.

b)

The port has been shut down.

c)

The port violation mode is the default for any port that has port security enabled.

d)

The port has two attached devices.

148.

A network administrator of a college is configuring the WLAN user authentication process. Wireless users are required to enter username and password credentials that will be verified by a server. Which server would provide such service?

a)

AAA

b)

NAT

c)

RADIUS

d)

SNMP

149.

A technician is troubleshooting a slow WLAN that consists of 802.11b and 802.11g devices . A new 802.11n/ac dual-band router has been deployed on the network to replace the old 802.11g router. What can the technician do to address the slow wireless speed?

a)

Split the wireless traffic between the 802.11n 2.4 GHz band and the 5 GHz band.

b)

Update the firmware on the new router.

c)

Configure devices to use a different channel.

d)

Change the SSID.

150.

The company handbook states that employees cannot have microwave ovens in their offices. Instead, all employees must use the microwave ovens located in the employee cafeteria. What wireless security risk is the company trying to avoid?

a)

improperly configured devices

b)

rogue access points

c)

accidental interference

d)

interception of data

151.

What is the function provided by CAPWAP protocol in a corporate wireless network?

a)

CAPWAP creates a tunnel on Transmission Control Protocol (TCP) ports in order to allow a WLC to configure an autonomous access point.

b)

CAPWAP provides the encapsulation and forwarding of wireless user traffic between an access point and a wireless LAN controller.

c)

CAPWAP provides connectivity between an access point using IPv6 addressing and a wireless client using IPv4 addressing.

d)

CAPWAP provides the encryption of wireless user traffic between an access point and a wireless client.

152.

Match the following functional component of AAA with its description: Authentification

a)

Determines what resources users can access or the operations they are allowed to perform

b)

proves that users are who they say they are

c)

records what users do and what they access

153.

Match the following functional component of AAA with its description: Authorization

a)

Determines what resources users can access or the operations they are allowed to perform

b)

proves that users are who they say they are

c)

records what users do and what they access

154.

Match the following functional component of AAA with its description: Accounting

a)

Determines what resources users can access or the operations they are allowed to perform

b)

proves that users are who they say they are

c)

records what users do and what they access

155.

What are two protocols that are used by AAA to authenticate users against a central database of usernames and password? (Choose two.)

a)

SSH

b)

TACACS+

c)

RADIUS

d)

NTP

156.

What is the result of a DHCP starvation attack?

a)

The attacker provides incorrect DNS and default gateway information to clients.

b)

The IP addresses assigned to legitimate clients are hijacked.

c)

Clients receive IP address assignments from a rogue DHCP server.

d)

Legitimate clients are unable to lease IP addresses.

157.

Which feature or configuration on a switch makes it vulnerable to VLAN double-tagging attacks?

a)

the limited size of content-addressable memory space

b)

the automatic trunking port feature enabled for all ports by default

c)

the native VLAN of the trunking port being the same as a user VLAN

d)

mixed duplex mode enabled for all ports by default

158.

Which component of AAA allows an administrator to track individuals who access network resources and any changes that are made to those resources?

a)

authentication

b)

accounting

c)

accessibility

d)

authorization

159.

Refer to the exhibit. PC1 and PC2 should be able to obtain IP address assignments from the DHCP server. How many ports among switches should be assigned as trusted ports as part of the DHCP snooping configuration?

a)

1

b)

3

c)

5

d)

7

160.

An IT security specialist enables port security on a switch port of a Cisco switch. What is the default violation mode in use until the switch port is configured to use a different violation mode?

a)

shutdown

b)

disabled

c)

restrict

d)

protect

161.

A laptop cannot connect to a wireless access point. Which two troubleshooting steps should be taken first? (Choose two.)

a)

Ensure that the correct network media is selected.

b)

Ensure that the laptop antenna is attached.

c)

Ensure that the wireless NIC is enabled.

d)

Ensure that the wireless SSID is chosen.

162.

What is an advantage of SSID cloaking?​

a)

Clients will have to manually identify the SSID to connect to the network.​

b)

It is the best way to secure a wireless network.

c)

SSIDs are very difficult to discover because APs do not broadcast them.​

d)

It provides free Internet access in public locations where knowing the SSID is of no concern.

163.

What is a wireless security mode that requires a RADIUS server to authenticate wireless users?

a)

personal

b)

shared key

c)

enterprise

d)

WEP

164.

A company has recently implemented an 802.11n wireless network. Some users are complaining that the wireless network is too slow. Which solution is the best method to enhance the performance of the wireless network?

a)

Disable DHCP on the access point and assign static addresses to the wireless clients.

b)

Upgrade the firmware on the wireless access point.

c)

Split the traffic between the 2.4 GHz and 5 GHz frequency bands.

d)

Replace the wireless NICs on the computers that are experiencing slow connections.

165.

Which protocol can be used to monitor the network?

a)

DHCP

b)

SNMP

c)

RADIUS

d)

AAA

166.

A network administrator deploys a wireless router in a small law firm. Employee laptops join the WLAN and receive IP addresses in the 10.0.10.0/24 network. Which service is used on the wireless router to allow the employee laptops to access the internet?

a)

DHCP

b)

RADIUS

c)

DNS

d)

NAT

167.

Which service can be used on a wireless router to prioritize network traffic among different types of applications so that voice and video data are prioritized over email and web data?

a)

QoS

b)

DNS

c)

DHCP

d)

NAT

168.

Which access control component, implementation, or protocol is based on device roles of supplicant, authenticator, and authentication server?

a)

accounting

b)

authentication

c)

authorization

d)

802.1X

169.

Which type of wireless network is suitable for national and global communications?

a)

wireless metropolitan-area network

b)

wireless local-area network

c)

wireless personal-area network

d)

wireless wide-area network

170.

Which feature on a switch makes it vulnerable to VLAN hopping attacks?

a)

the mixed duplex mode enabled for all ports by default

b)

the limited size of content-addressable memory space

c)

mixed port bandwidth support enabled for all ports by default

d)

the automatic trunking port feature enabled for all ports by default

171.

Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?

a)

accounting

b)

authentication

c)

auditing

d)

authorization

172.

Refer to the exhibit. The Fa0/2 interface on switch S1 has been configured with the switchport port-security mac-address 0023.189d.6456 command and a workstation has been connected. What could be the reason that the Fa0/2 interface is shutdown?

a)

The Fa0/24 interface of S1 is configured with the same MAC address as the Fa0/2 interface.

b)

The connection between S1 and PC1 is via a crossover cable.

c)

S1 has been configured with a switchport port-security aging command.

d)

The MAC address of PC1 that connects to the Fa0/2 interface is not the configured MAC address

173.

A network administrator enters the following commands on the switch SW1.

SW1(config)# interface range fa0/5 - 10

SW1(config-if)# ip dhcp snooping limit rate 6

What is the effect after these commands are entered?

a)

If any of the FastEthernet ports 5 through 10 receive more than 6 DHCP messages per second, the port will be shut down.

b)

FastEthernet ports 5 through 10 can receive up to 6 DHCP messages per second of any type.

c)

If any of the FastEthernet ports 5 through 10 receive more than 6 DHCP messages per second, the port will continue to operate and an error message will be sent to the network administrator.

d)

FastEthernet ports 5 through 10 can receive up to 6 DHCP discovery messages per second.

174.

A network administrator is configuring port security on a Cisco switch. The company security policy specifies that when a violation occurs, packets with unknown source addresses should be dropped and no notification should be sent. Which violation mode should be configured on the interfaces?

a)

off

b)

restrict

c)

protect

d)

shutdown

175.

A network administrator is working to improve WLAN performance on a dual-band wireless router. What is a simple way to achieve a split-the-traffic result?

a)

Add a Wi-Fi range extender to the WLAN and set the AP and the range extender to serve different bands.

b)

Check and keep the firmware of the wireless router updated.

c)

Make sure that different SSIDs are used for the 2.4 GHz and 5 GHz bands.

d)

Require all wireless devices to use the 802.11n standard.

176.

Which access control component, implementation, or protocol controls what users can do on the network?

a)

accounting

b)

802.1X

c)

authorization

d)

authentication

177.

Which type of wireless network is suitable for providing wireless access to a city or district?

a)

wireless wide-area network

b)

wireless personal-area network

c)

wireless local-area network

d)

wireless metropolitan-area network

178.

On a Cisco 3504 WLC Summary page ( Advanced > Summary ), which tab allows a network administrator to access and configure a WLAN for a specific security option such as WPA2?

a)

MANAGEMENT

b)

WIRELESS

c)

WLANs

d)

SECURITY

179.

What type of wireless antenna is best suited for providing coverage in large open spaces, such as hallways or large conference rooms?

a)

Yagi

b)

omnidirectional

c)

dish

d)

directional

180.

What security benefit is gained from enabling BPDU guard on PortFast enabled interfaces?

a)

preventing buffer overflow attacks

b)

preventing rogue switches from being added to the network

c)

protecting against Layer 2 loops

d)

enforcing the placement of root bridges

181.

Which access control component, implementation, or protocol logs EXEC and configuration commands configured by a user?

a)

authentication

b)

authorization

c)

802.1X

d)

accounting

182.

Which type of wireless network uses transmitters to provide coverage over an extensive geographic area?

a)

wireless metropolitan-area network

b)

wireless local-area network

c)

wireless personal-area network

d)

wireless wide-area network

183.

Which access control component, implementation, or protocol controls who is permitted to access a network?

a)

authorization

b)

802.1X

c)

accounting

d)

authentication

184.

What two IEEE 802.11 wireless standards operate only in the 5 GHz range? (Choose two.)

a)

802.11g

b)

802.11ad

c)

802.11a

d)

802.11ac

185.

Which type of wireless network uses low powered transmitters for a short-range network, usually 20 to 30 ft. (6 to 9 meters)?

a)

wireless metropolitan-area network

b)

wireless personal-area network

c)

wireless local-area network

d)

wireless wide-area network

186.

Which wireless network topology would be used by network engineers to provide a wireless network for an entire college building?

a)

ad hoc

b)

hotspot

c)

infrastructure

d)

mixed mode

187.

Which type of wireless network uses transmitters to provide wireless service over a large urban region?

a)

wireless wide-area network

b)

wireless personal-area network

c)

wireless metropolitan-area network

d)

wireless local-area network.

188.

Which type of wireless network is suitable for use in a home or office?

a)

wireless wide-area network

b)

wireless personal-area network

c)

wireless local-area network

d)

wireless metropolitan-area network

189.

Which access control component, implementation, or protocol indicates success or failure of a client-requested service with a PASS or FAIL message?

a)

accounting

b)

authentication

c)

802.1X

d)

authorization

190.

Which type of wireless network often makes use of devices mounted on buildings?

a)

wireless wide-area network

b)

wireless personal-area network

c)

wireless local-area network

d)

wireless metropolitan-area network

191.

Which type of wireless network commonly uses Bluetooth or ZigBee devices?

a)

wireless wide-area network

b)

wireless personal-area network

c)

wireless local-area network

d)

wireless metropolitan-area network

192.

A network administrator is configuring DAI on a switch with the command ip arp inspection validate src-mac . What is the purpose of this configuration command?

a)

It checks the source MAC address in the Ethernet header against the user-configured ARP ACLs.

b)

It checks the source MAC address in the Ethernet header against the MAC address table.

c)

It checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body.

d)

It checks the source MAC address in the Ethernet header against the target MAC address in the ARP body.

193.

Which access control component, implementation, or protocol collects and reports usage data?

a)

accounting

b)

authentication

c)

802.1X

d)

authorization

194.

Which access control component, implementation, or protocol audits what users actions are performed on the network?

a)

accounting

b)

authentication

c)

802.1X

d)

authorization

195.

Which access control component, implementation, or protocol restricts LAN access through publicly accessible switch ports?

a)

accounting

b)

authentication

c)

802.1X

d)

authorization

196.

A technician is troubleshooting a slow WLAN and decides to use the split-the-traffic approach. Which two parameters would have to be configured to do this? (Choose two.)

a)

Configure the 5 GHz band for streaming multimedia and time sensitive traffic.

b)

Configure the 2.4 GHz band for basic internet traffic that is not time sensitive.

c)

Configure the security mode to WPA Personal TKIP/AES for one network and WPA2 Personal AES for the other network

d)

Configure the security mode to WPA Personal TKIP/AES for both networks.

197.

A network administrator is required to upgrade wireless access to end users in a building. To provide data rates up to 1.3Gb/s and still be backward compatible with older devices, which wireless standard should be implemented?

a)

802.11g

b)

802.11n

c)

802.11ac

d)

802.11b

Similar Resources on Wayground

CNW-test

194 questions

CNW-test

quiz

Worksheet

•

University

tin học

192 questions

tin học

quiz

Worksheet

•

University