WorksheetsModule 7-9
Total questions: 75
Worksheet time: 39mins
What is a recommended best practice when dealing with the native VLAN?
Use port security.
Turn off DTP.
Assign it to an unused VLAN.
Assign the same VLAN number as the management VLAN.
On what switch ports should PortFast be enabled to enhance STP stability?
only ports that are elected as designated ports
all trunk ports that are not root ports
all end-user ports
only ports that attach to a neighboring switch
Which command would be best to use on an unused switch port if a company adheres to the best practices as recommended by Cisco?
ip dhcp snooping
mac-address
switchport port-security violation shutdown
shutdown
switchport port-security mac-address sticky
Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)
DHCP server failover
extended ACL
port security
DHCP snooping
strong password on DHCP servers
What is the best way to prevent a VLAN hopping attack?
Use ISL encapsulation on all trunk links.
Disable STP on all nontrunk ports.
Use VLAN 1 as the native VLAN on trunk ports.
Disable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.
Which procedure is recommended to mitigate the chances of ARP spoofing?
Enable port security globally.
Enable DHCP snooping on selected VLANs.
Enable IP Source Guard on trusted ports.
Enable DAI on the management VLAN.
What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)
trusted DHCP port
untrusted port
established DHCP port
unauthorized port
unknown port
Which two commands can be used to enable PortFast on a switch? (Choose two.)
S1(config-if)# enable spanning-tree portfast
S1(config-if)# spanning-tree portfast
S1(config)# enable spanning-tree portfast default
S1(config)# spanning-tree portfast default
S1(config-line)# spanning-tree portfast
An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. After verifying the cause of the violation, how should the administrator re-enable the port without disrupting network operation?
Reboot the switch.
Issue the shutdown command followed by the no shutdown command on the interface.
Issue the no switchport port-security command, then re-enable port security.
Issue the no switchport port-security violation shutdown command on the interface.
A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?
ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping vlan
ip dhcp snooping trust
A network administrator is configuring DAI on a switch with the command ip arp inspection validate dst-mac. What is the purpose of this configuration command?
to check the destination MAC address in the Ethernet header against the MAC address table
to check the destination MAC address in the Ethernet header against the source MAC address in the ARP body
to check the destination MAC address in the Ethernet header against the user-configured ARP ACLs
to check the destination MAC address in the Ethernet header against the target MAC address in the ARP body
Which security feature should be enabled in order to prevent an attacker from overflowing the MAC address table of a switch?
storm control
port security
BPDU filter
root guard
What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?
VLAN hopping
DHCP spoofing
ARP poisoning
ARP spoofing
A network administrator is configuring DAI on a switch. Which command should be used on the uplink interface that connects to a router?
ip arp inspection trust
ip dhcp snooping
ip arp inspection vlan
spanning-tree portfast
Where are dynamically learned MAC addresses stored when sticky learning is enabled with the switchport port-security mac-address sticky command?
flash
NVRAM
RAM
ROM
Which method would mitigate a MAC address flooding attack?
Configuring port security
Increasing the size of the CAM table
Increasing the speed of switch ports
Using ACLs to filter broadcast traffic on the switch
Which action will bring an error-disabled switch port back to an operational state?
Clear the MAC address table on the switch.
Issue the shutdown and no shutdown interface config commands.
Issue the switchport mode access interface config command.
Remove and reconfigure port security on the interface.
Which two statements are true regarding switch port security? (Choose two.)
After entering the sticky parameter, only MAC addresses subsequently learned are converted to secure MAC addresses.
Dynamically learned secure MAC addresses are lost when the switch reboots.
If fewer than the maximum number of MAC addresses for a port are configured statically, dynamically learned addresses are added to CAM until the maximum number is reached.
The three configurable violation modes all log violations via SNMP.
The three configurable violation modes all require user intervention to reenable ports.
Port security has been enabled on access ports to allow a maximum of two MAC addresses. Which port security violation would drop the frame and send a notification to the syslog server if the maximum number of MAC addresses is exceeded?
Protect
Restrict
Shutdown
Warning
Which feature should be configured on PortFast enabled switches to prevent rogue switches from being added to a network?
BPDU guard
DAI
DHCP snooping
Port security
Which port security feature enables switches to automatically learn and retain MAC addresses for each port?
Auto secure MAC addresses
Dynamic secure MAC addresses
Static secure MAC addresses
Sticky secure MAC addresses
Assume that BPDU Guard has been enabled globally on all access ports. However, one port must not be configured with the feature. Which command would explicitly disable BPDU Guard on that switch port?
S1(config)# no spanning-tree bpduguard default
S1(config)# no spanning-tree portfast bpduguard default
S1(config-if)# no enable spanning-tree bpduguard
S1(config-if)# no spanning-tree bpduguard enable
S1(config-if)# no spanning-tree portfast bpduguard
Which DAI command checks the source MAC address in the Ethernet header against the target MAC address in the ARP body?
ip arp inspection validate dst-mac
ip arp inspection validate dst-mac ip
ip arp inspection validate ip
ip arp inspection validate src-mac
What is the result of entering the ip dhcp snooping limit rate 4 interface configuration command?
The port can receive up to 4 DHCP discovery messages per second.
The port can receive up to 4 DHCP offer messages per second.
The port can send up to 4 DHCP messages per second.
The port can send up to 4 DHCP offer discovery messages per second.
Port security has been enabled on a switch port. What is the default violation mode in use by default?
Restrict
Disabled
Protect
Shutdown
What techniques should be done to mitigate VLAN attacks? (Choose three.)
Enable trunking manually.
Enable Source Guard.
Set the native VLAN to an unused VLAN.
Enable BPDU guard.
Disable DTP.
Port security has been enabled on interface Fa0/1 and the show port-security interface fa0/1 command has been entered. What does the Port Status “Secure-up” message indicate?
The Fa0/1 port is currently error-disabled.
The Fa0/1 port violation mode is “protect”.
There are no hosts connected to the secured Fa0/1 port.
There is a host connected to the secured Fa0/1 port.
1. In the context of mobile devices, what does the term tethering involve?
connecting a mobile device to a USB port on a computer in order to charge the mobile device
connecting a mobile device to another mobile device or computer to share a network connection
connecting a mobile device to a 4G cellular network
connecting a mobile device to a hands-free headset
2. Which feature of 802.11n wireless access points allows them to transmit data at faster speeds than previous versions of 802.11 Wi-Fi standards did?
SPS
WPS
MITM
MIMO
3. Which method of wireless authentication is currently considered to be the strongest?
open
WPA
WPA2
WEP
shared key
4. Which parameter is commonly used to identify a wireless network name when a home wireless AP is being configured?
SSID
BESS
ad hoc
ESS
5. Which characteristic describes a wireless client operating in active mode?
ability to dynamically change channels
must be configured for security before attaching to an AP
must know the SSID to connect to an AP
broadcasts probes that request the SSID
6. Which IEEE standard operates at wireless frequencies in both the 5 GHz and 2.4 GHz ranges?
802.11a
802.11g
802.11b
802.11n
7. Which statement describes an autonomous access point?
It is a standalone access point.
It is managed by a WLAN controller.
It is server-dependent.
It is used for networks that require a large number of access points.
8. Which two roles are typically performed by a wireless router that is used in a home or small business? (Choose two.)
Ethernet switch
RADIUS authentication server
repeater
WLAN controller
access point
9. Which protocol and port numbers are used by both IPv4 and IPv6 CAPWAP tunnels? (Choose two.)
TCP
ICMP
UDP
17 and 163
5246 and 5247
10. If three 802.11b access points need to be deployed in close proximity, which three frequency channels should be used? (Choose three.)
8
1
3
11
6
11. Which type of telecommunication technology is used to provide Internet access to vessels at sea?
satellite
cellular
WiMax
municipal WiFi
12. Which wireless network topology is being configured by a technician who is installing a keyboard, a mouse, and headphones, each of which uses Bluetooth?
hotspot
ad hoc mode
infrastructure mode
mixed mode
13. Which type of wireless topology is created when two or more Basic Service Sets are interconnected by Ethernet?
BSS
ESS
ad hoc WLAN
IBISS
WiFi Direct
14. What Wi-Fi management frame is regularly broadcast by APs to announce their presence?
association
beacon
probe
authentication
15. An AP regularly broadcasts which type of management frame?
Authentication
Beacon
Probe request
Probe response
16. What type of wireless antenna is best suited for providing coverage in large open spaces, such as hallways or large conference rooms?
Directional
Omnidirectional
Parabolic dish
Yagi
17. Which wireless security method requires clients to manually identify the SSID to connect to the WLAN?
MAC Address Filtering
IP Address Filtering
SSID cloaking
SSID disclosing
18. What are the two methods that a wireless client can use to discover an AP? (Choose two.)
Delivering a broadcast frame
Initiating a three-way handshake
Receiving a broadcast beacon frame probe response
Sending an ARP request
Transmitting a probe request
What type of wireless network topology would be used in a medium to large organization?
Ad hoc
Hotspot
Infrastructure
Mixed mode
Tethering
20. What IEEE 802.11 wireless standards operate only in the 2.4 GHz range? (Choose two.)
802.11b
802.11a
802.11g
802.11n
802.11ac
21. Which IEEE wireless standard is backward compatible with older wireless protocols and supports data rates up to 1.3 Gb/s?
802.11
802.11a
802.11ac
802.11g
802.11n
22. In a 2.4 GHz wireless network, which three channels should be used to avoid interference from nearby wireless devices? (Choose three.)
0
1
3
6
11
23. Which authentication method is more secure but requires the services of a RADIUS server?
WEP Enterprise
WPA Personal
WPA Enterprise
WPA2 Personal
24. Which option correctly describes when an AP openly advertises its service by periodically sending broadcast beacon frames containing the SSID, supported standards, and security settings?
Active mode
Mixed mode
Open authentication mode
Passive mode
1. A user is configuring a wireless access point and wants to prevent any neighbors from discovering the network. What action does the user need to take?
Configure DMZ settings.
Configure a DNS server.
Disable SSID broadcast.
Enable WPA encryption.
2. When a wireless network in a small office is being set up, which type of IP addressing is typically used on the networked devices?
network
public
wireless
private
3. A user has just purchased a generic home router and would like to secure it. What should be done to help secure the wireless home router?
Change the default SSID.
Set a private IPv4 network for the internal network.
Allow only IPv6 traffic to enter the router.
Change the default administrator password.
4. Which protocol could be used by a company to monitor devices such as a wireless LAN controller (WLC)?
SSH
NTP
PAT
SNMP
5. When configuring a Cisco 3500 series wireless LAN controller (WLC) for a WPA2 Enterprise WLAN, what has to be created on the WLC before creating the new WLAN?
a security module
a new SSID
a VLAN for the wireless network
a security policy
6. What is a DHCP scope as it relates to a WLAN configured on the WLC controller?
a pool of IP addresses for WLAN clients
a corporate plan for allocation of IP addresses for wireless clients
security rules associated with DHCP for WLANs
the distance allotted for wireless clients that can receive IP addressing information
7. Why would a technician configure a passphrase for a WLAN on a wireless router?
to protect someone from changing the configuration
to protect the SSID from being changed
to protect someone from cabling directly to the router and accessing the router
to configure wireless client authentication
A customer installs a wireless access point at home in the closet next to the kitchen. The customer mentions that the wireless communication performance seems degraded when the cordless phone or the microwave oven is in use. What is the possible reason for this degradation?
The surge of electricity when a microwave oven is in use disrupts the operation of the access point.
The cordless phone joins the WLAN and shares the available bandwidth.
The wireless signal is in the same radio frequency range as the household devices are in.
The access point is on the same electrical circuit as the phone base unit and microwave oven are.
The access point is close to walls.
9. What functionality is required on routers to provide remote workers with VoIP and videoconferencing capabilities?
IPsec
PPPoE
QoS
VPN
10. A wireless router is displaying the IP address of 192.168.0.1. What could this mean?
Dynamic IP address allocation has been configured on the router and is functioning correctly.
The wireless router has been configured to use the frequencies on channel 1.
The NAT function is not working on the wireless router.
The wireless router still has the factory default IP address.
11. A laptop cannot connect to a wireless access point. Which two troubleshooting steps should be taken first? (Choose two.)
Ensure that the wireless SSID is chosen.
Ensure that the correct network media is selected.
Ensure that the NIC is configured for the proper frequency.
Ensure that the laptop antenna is attached.
Ensure that the wireless NIC is enabled.
In setting up a small office network, the network administrator decides to assign private IP addresses dynamically to workstations and mobile devices. Which feature must be enabled on the company router in order for office devices to access the internet?
UPnP
NAT
QoS
MAC filtering
13. What is a difference between autonomous APs that operate in a home environment and controller-based APs that operate in a corporate environment?
Controller-based APs are known as lightweight APs and require an initial configuration to operate.
Autonomous APs do not support PoE.
Autonomous APs incorporate the functions of a router, switch, and AP into one device.
Controller-based APs can be automatically configured and managed by a WLAN controller.
14. Which WLC tab would a network administrator typically use to see a summary view of the most heavily used WLANs including the number of clients using a particular WLAN?
Commands
Monitor
WLANs
Controller
15. Users on an IEEE 802.11n network are complaining of slow speeds. The network administrator checks the AP and verifies it is operating properly. What can be done to improve the wireless performance in the network?
Switch to an 802.11g AP.
Split the wireless traffic between the 802.11n 2.4 GHz band and the 5 GHz band.
Set the AP to mixed mode.
Change the authentication method on the AP.
17. Which option is an easy way to improve wireless performance on an 802.11n wireless router?
Connect a Wi-Fi range extender on the 2.4 GHz band to a wireless router on the 5 GHz band.
Require all wireless devices to use the 802.11g standard.
Use different SSID names for the 2.4 GHz and 5 GHz bands.
Use the same SSID name for all wireless bands.
18. Which Cisco 3504 WLC dashboard menu option provides an overview of the number of configured wireless networks, associated access points (APs), and active clients?
Access Points
Advanced
Network Summary
Rogues
19. Which protocol is used to monitor a network?
LWAPP
RADIUS
SNMP
WLC
20. Which service on a wireless router enables a host with an internal private IPv4 address to access an outside network using a public IPv4 address?
DHCP
DNS
LWAPP
NAT
21. Which service available on some wireless routers can be used to prioritize email over web data traffic?
DHCP
DNS
NAT
QoS
22. What must be done before creating a new WLAN on a Cisco 3500 series WLC?
Build or have a RADIUS server available.
Build or have an SNMP server available.
Create a new SSID.
Create a new VLAN interface.
23. Which frequency band SSID name should users with time-sensitive applications connect to?
The 2.4 GHz band, because it is less crowded than the 5 GHz band.
The 2.4 GHz band, because it has more channels than the 5 GHz band.
The 2.4 GHz band, because the channel is likely interference-free.
The 5 GHz band, because it has more channels than the 2.4 GHz band.
24. A Cisco 3500 series WLC is configured to access a RADIUS server. The configuration requires a shared secret password. What is the purpose for the shared secret password?
It allows users to authenticate and access the WLAN.
It is used by the RADIUS server to authenticate WLAN users.
It is used to authenticate and encrypt user data on the WLAN.
It is used to encrypt messages between the WLC and the server.
25. Which type of WLAN extends wireless coverage using a few APs controlled using a smartphone app?
Lightweight access point (LWAP)
Wi-Fi Extender
Wireless LAN Controller (WLC)
Wireless Mesh Network (WMN)
