WorksheetsModule Quiz - Security and WLAN Concepts
Total questions: 106
Worksheet time: 53mins
What is a recommended best practice when dealing with the native VLAN?
Use port security.
Turn off DTP.
Assign it to an unused VLAN.
Assign the same VLAN number as the management VLAN
On what switch ports should PortFast be enabled to enhance STP stability?
only ports that are elected as designated ports
all trunk ports that are not root ports
all end-user ports
only ports that attach to a neighboring switch
Which command would be best to use on an unused switch port if a company adheres to the best practices as recommended by Cisco?
switchport port-security mac-address sticky mac-address
ip dhcp snooping
shutdown
switchport port-security violation shutdown
switchport port-security mac-address sticky
Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)
DHCP server failover
extended ACL
port security
DHCP snooping
strong password on DHCP servers
What is the best way to prevent a VLAN hopping attack?
Use ISL encapsulation on all trunk links.
Disable STP on all nontrunk ports.
Use VLAN 1 as the native VLAN on trunk ports.
Disable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.
Which procedure is recommended to mitigate the chances of ARP spoofing?
Enable port security globally.
Enable DHCP snooping on selected VLANs.
Enable IP Source Guard on trusted ports.
Enable DAI on the management VLAN.
What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)
trusted DHCP port
untrusted port
unknown port
established DHCP port
unauthorized port
Which two commands can be used to enable PortFast on a switch? (Choose two.)
S1(config-if)# enable spanning-tree portfast
S1(config-if)# spanning-tree portfast
S1(config)# enable spanning-tree portfast default
S1(config)# spanning-tree portfast default
S1(config-line)# spanning-tree portfast
An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. After verifying the cause of the violation, how should the administrator re-enable the port without disrupting network operation?
Reboot the switch.
Issue the shutdown command followed by the no shutdown command on the interface.
Issue the no switchport port-security command, then re-enable port security.
Issue the no switchport port-security violation shutdown command on the interface.
A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?
ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping vlan
ip dhcp snooping trust
A network administrator is configuring DAI on a switch with the command ip arp inspection validate dst-mac. What is the purpose of this configuration command?
to check the destination MAC address in the Ethernet header against the MAC address table
to check the destination MAC address in the Ethernet header against the source MAC address in the ARP body
to check the destination MAC address in the Ethernet header against the user-configured ARP ACLs
to check the destination MAC address in the Ethernet header against the target MAC address in the ARP body
Which security feature should be enabled in order to prevent an attacker from overflowing the MAC address table of a switch?
storm control
port security
BPDU filter
root guard
What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?
VLAN hopping
DHCP spoofing
ARP poisoning
ARP spoofing
A network administrator is configuring DAI on a switch. Which command should be used on the uplink interface that connects to a router?
ip arp inspection trust
ip dhcp snooping
ip arp inspection vlan
spanning-tree portfast
Where are dynamically learned MAC addresses stored when sticky learning is enabled with the switchport port-security mac-address sticky command?
flash
NVRAM
RAM
ROM
Which method would mitigate a MAC address flooding attack?
Configuring port security
Increasing the size of the CAM table
Increasing the speed of switch ports
Using ACLs to filter broadcast traffic on the switch
Which action will bring an error-disabled switch port back to an operational state?
Clear the MAC address table on the switch.
Issue the shutdown and no shutdown interface config commands.
Issue the switchport mode access interface config command.
Remove and reconfigure port security on the interface.
Which two statements are true regarding switch port security? (Choose two.)
After entering the sticky parameter, only MAC addresses subsequently learned are converted to secure MAC addresses.
Dynamically learned secure MAC addresses are lost when the switch reboots.
If fewer than the maximum number of MAC addresses for a port are configured statically, dynamically learned addresses are added to CAM until the maximum number is reached.
The three configurable violation modes all log violations via SNMP.
The three configurable violation modes all require user intervention to reenable ports.
Port security has been enabled on access ports to allow a maximum of two MAC addresses. Which port security violation would drop the frame and send a notification to the syslog server if the maximum number of MAC addresses is exceeded?
Protect
Restrict
Shutdown
Warning
Which feature should be configured on PortFast enabled switches to prevent rogue switches from being added to a network?
BPDU guard
DAI
DHCP snooping
Port security
Which port security feature enables switches to automatically learn and retain MAC addresses for each port?
Auto secure MAC addresses
Dynamic secure MAC addresses
Static secure MAC addresses
Sticky secure MAC addresses
Assume that BPDU Guard has been enabled globally on all access ports. However, one port must not be configured with the feature. Which command would explicitly disable BPDU Guard on that switch port?
S1(config)# no spanning-tree bpduguard default
S1(config)# no spanning-tree portfast bpduguard default
S1(config-if)# no enable spanning-tree bpduguard
S1(config-if)# no spanning-tree bpduguard enable
S1(config-if)# no spanning-tree portfast bpduguard
Which DAI command checks the source MAC address in the Ethernet header against the target MAC address in the ARP body?
ip arp inspection validate dst-mac
ip arp inspection validate dst-mac ip
ip arp inspection validate ip
ip arp inspection validate src-mac
What is the result of entering the ip dhcp snooping limit rate 4 interface configuration command?
The port can receive up to 4 DHCP discovery messages per second.
The port can receive up to 4 DHCP offer messages per second.
The port can send up to 4 DHCP messages per second.
The port can send up to 4 DHCP offer discovery messages per second.
Port security has been enabled on a switch port. What is the default violation mode in use by default?
Restrict
Disabled
Protect
Shutdown
What techniques should be done to mitigate VLAN attacks? (Choose three.)
Disable DTP.
Enable BPDU guard.
Set the native VLAN to an unused VLAN.
Enable Source Guard.
Enable trunking manually.
Port security has been enabled on interface Fa0/1 and the show port-security interface fa0/1 command has been entered. What does the Port Status “Secure-up” message indicate?
The Fa0/1 port is currently error-disabled.
The Fa0/1 port violation mode is “protect”.
There are no hosts connected to the secured Fa0/1 port.
There is a host connected to the secured Fa0/1 port.
In the context of mobile devices, what does the term tethering involve?
connecting a mobile device to a USB port on a computer in order to charge the mobile device
connecting a mobile device to another mobile device or computer to share a network connection
connecting a mobile device to a 4G cellular network
connecting a mobile device to a hands-free headset
Which feature of 802.11n wireless access points allows them to transmit data at faster speeds than previous versions of 802.11 Wi-Fi standards did?
SPS
WPS
MITM
MIMO
Which method of wireless authentication is currently considered to be the strongest?
open
WPA
WPA2
WEP
shared key
Which parameter is commonly used to identify a wireless network name when a home wireless AP is being configured?
SSID
BESS
ad hoc
ESS
Which characteristic describes a wireless client operating in active mode?
ability to dynamically change channels
must be configured for security before attaching to an AP
must know the SSID to connect to an AP
broadcasts probes that request the SSID
Which IEEE standard operates at wireless frequencies in both the 5 GHz and 2.4 GHz ranges?
802.11a
802.11g
802.11b
802.11n
Which statement describes an autonomous access point?
It is a standalone access point.
It is managed by a WLAN controller.
It is server-dependent.
It is used for networks that require a large number of access points.
Which two roles are typically performed by a wireless router that is used in a home or small business? (Choose two.)
Ethernet switch
RADIUS authentication server
repeater
WLAN controller
access point
Which protocol and port numbers are used by both IPv4 and IPv6 CAPWAP tunnels? (Choose two.)
TCP
ICMP
UDP
17 and 163
5246 and 5247
If three 802.11b access points need to be deployed in close proximity, which three frequency channels should be used? (Choose three.)
6
8
11
3
1
Which type of telecommunication technology is used to provide Internet access to vessels at sea?
satellite
cellular
WiMax
municipal WiFi
Which wireless network topology is being configured by a technician who is installing a keyboard, a mouse, and headphones, each of which uses Bluetooth?
hotspot
ad hoc mode
infrastructure mode
mixed mode
Which type of wireless topology is created when two or more Basic Service Sets are interconnected by Ethernet?
BSS
ESS
ad hoc WLAN
IBISS
WiFi Direct
What Wi-Fi management frame is regularly broadcast by APs to announce their presence?
association
beacon
probe
authentication
An AP regularly broadcasts which type of management frame?
Authentication
Beacon
Probe request
Probe response
What type of wireless antenna is best suited for providing coverage in large open spaces, such as hallways or large conference rooms?
Directional
Omnidirectional
Parabolic dish
Yagi
Which wireless security method requires clients to manually identify the SSID to connect to the WLAN?
MAC Address Filtering
IP Address Filtering
SSID cloaking
SSID disclosing
What are the two methods that a wireless client can use to discover an AP? (Choose two.)
Delivering a broadcast frame
Initiating a three-way handshake
Receiving a broadcast beacon frame probe response
Sending an ARP request
Transmitting a probe request
What type of wireless network topology would be used in a medium to large organization?
Ad hoc
Hotspot
Infrastructure
Mixed mode
Tethering
What IEEE 802.11 wireless standards operate only in the 2.4 GHz range? (Choose two.)
802.11ac
802.11n
802.11a
802.11g
802.11b
Which IEEE wireless standard is backward compatible with older wireless protocols and supports data rates up to 1.3 Gb/s?
802.11
802.11a
802.11ac
802.11g
802.11n
In a 2.4 GHz wireless network, which three channels should be used to avoid interference from nearby wireless devices? (Choose three.)
1
6
11
0
3
Which authentication method is more secure but requires the services of a RADIUS server?
WEP Enterprise
WPA Personal
WPA Enterprise
WPA2 Personal
Which option correctly describes when an AP openly advertises its service by periodically sending broadcast beacon frames containing the SSID, supported standards, and security settings?
Active mode
Mixed mode
Open authentication mode
Passive mode
A user is configuring a wireless access point and wants to prevent any neighbors from discovering the network. What action does the user need to take?
Configure DMZ settings.
Configure a DNS server.
Disable SSID broadcast.
Enable WPA encryption.
When a wireless network in a small office is being set up, which type of IP addressing is typically used on the networked devices?
network
public
wireless
private
A user has just purchased a generic home router and would like to secure it. What should be done to help secure the wireless home router?
Change the default SSID.
Set a private IPv4 network for the internal network.
Allow only IPv6 traffic to enter the router.
Change the default administrator password.
Which protocol could be used by a company to monitor devices such as a wireless LAN controller (WLC)?
SSH
NTP
PAT
SNMP
When configuring a Cisco 3500 series wireless LAN controller (WLC) for a WPA2 Enterprise WLAN, what has to be created on the WLC before creating the new WLAN?
a security module
a new SSID
a VLAN for the wireless network
a security policy
What is a DHCP scope as it relates to a WLAN configured on the WLC controller?
a pool of IP addresses for WLAN clients
a corporate plan for allocation of IP addresses for wireless clients
security rules associated with DHCP for WLANs
the distance allotted for wireless clients that can receive IP addressing information
Why would a technician configure a passphrase for a WLAN on a wireless router?
to protect someone from changing the configuration
to protect the SSID from being changed
to protect someone from cabling directly to the router and accessing the router
to configure wireless client authentication
A customer installs a wireless access point at home in the closet next to the kitchen. The customer mentions that the wireless communication performance seems degraded when the cordless phone or the microwave oven is in use. What is the possible reason for this degradation?
The surge of electricity when a microwave oven is in use disrupts the operation of the access point.
The cordless phone joins the WLAN and shares the available bandwidth.
The wireless signal is in the same radio frequency range as the household devices are in.
The access point is on the same electrical circuit as the phone base unit and microwave oven are.
The access point is close to walls.
What functionality is required on routers to provide remote workers with VoIP and videoconferencing capabilities?
IPsec
PPPoE
QoS
VPN
A wireless router is displaying the IP address of 192.168.0.1. What could this mean?
Dynamic IP address allocation has been configured on the router and is functioning correctly.
The wireless router has been configured to use the frequencies on channel 1.
The NAT function is not working on the wireless router.
The wireless router still has the factory default IP address.
A laptop cannot connect to a wireless access point. Which two troubleshooting steps should be taken first? (Choose two.)
Ensure that the wireless SSID is chosen.
Ensure that the correct network media is selected.
Ensure that the NIC is configured for the proper frequency.
Ensure that the laptop antenna is attached.
Ensure that the wireless NIC is enabled.
In setting up a small office network, the network administrator decides to assign private IP addresses dynamically to workstations and mobile devices. Which feature must be enabled on the company router in order for office devices to access the internet?
UPnP
NAT
QoS
MAC filtering
What is a difference between autonomous APs that operate in a home environment and controller-based APs that operate in a corporate environment?
Controller-based APs can be automatically configured and managed by a WLAN controller.
Controller-based APs are known as lightweight APs and require an initial configuration to operate.
Autonomous APs do not support PoE.
Autonomous APs incorporate the functions of a router, switch, and AP into one device.
Which WLC tab would a network administrator typically use to see a summary view of the most heavily used WLANs including the number of clients using a particular WLAN?
Commands
Monitor
WLANs
Controller
Users on an IEEE 802.11n network are complaining of slow speeds. The network administrator checks the AP and verifies it is operating properly. What can be done to improve the wireless performance in the network?
Switch to an 802.11g AP.
Split the wireless traffic between the 802.11n 2.4 GHz band and the 5 GHz band.
Set the AP to mixed mode.
Change the authentication method on the AP.
What is the first security setting that should be applied when connecting a wireless router in a small network?
Change the default administrative username and password.
Enable encryption on the wireless router.
Disable the wireless network SSID broadcast beacon.
Enable MAC address filtering on the wireless router.
Which option is an easy way to improve wireless performance on an 802.11n wireless router?
Connect a Wi-Fi range extender on the 2.4 GHz band to a wireless router on the 5 GHz band.
Require all wireless devices to use the 802.11g standard.
Use different SSID names for the 2.4 GHz and 5 GHz bands.
Use the same SSID name for all wireless bands.
Which Cisco 3504 WLC dashboard menu option provides an overview of the number of configured wireless networks, associated access points (APs), and active clients?
Access Points
Advanced
Network Summary
Rogues
Which protocol is used to monitor a network?
LWAPP
RADIUS
SNMP
WLC
Which service on a wireless router enables a host with an internal private IPv4 address to access an outside network using a public IPv4 address?
DHCP
DNS
LWAPP
NAT
Which service available on some wireless routers can be used to prioritize email over web data traffic?
DHCP
DNS
NAT
QoS
What must be done before creating a new WLAN on a Cisco 3500 series WLC?
Build or have a RADIUS server available.
Build or have an SNMP server available.
Create a new SSID.
Create a new VLAN interface.
Which frequency band SSID name should users with time-sensitive applications connect to?
The 2.4 GHz band, because it is less crowded than the 5 GHz band.
The 2.4 GHz band, because it has more channels than the 5 GHz band.
The 2.4 GHz band, because the channel is likely interference-free.
The 5 GHz band, because it has more channels than the 2.4 GHz band.
A Cisco 3500 series WLC is configured to access a RADIUS server. The configuration requires a shared secret password. What is the purpose for the shared secret password?
It allows users to authenticate and access the WLAN.
It is used by the RADIUS server to authenticate WLAN users.
It is used to authenticate and encrypt user data on the WLAN.
It is used to encrypt messages between the WLC and the server.
Which type of WLAN extends wireless coverage using a few APs controlled using a smartphone app?
Lightweight access point (LWAP)
Wi-Fi Extender
Wireless LAN Controller (WLC)
Wireless Mesh Network (WMN)
Which feature on a Cisco router permits the forwarding of traffic for which there is no specific route?
next-hop
gateway of last resort
outgoing interface
route source
Which three advantages are provided by static routing? (Choose three.)
The path a static route uses to send data is known.
Static routing typically uses less network bandwidth and fewer CPU operations than dynamic routing does.
Static routing does no advertise over the network, thus providing better security.
No intervention is required to maintain changing route information.
Static routes scale well as the network grows.
What are two functions of dynamic routing protocols? (Choose two.)
to discover the network
to avoid exposing network information
to assure low router overhead
to choose the path that is specified by the administrator
to maintain routing tables
What is an advantage of using dynamic routing protocols instead of static routing?
fewer router resource overhead requirements
easier to implement
more secure in controlling routing updates
ability to actively search for new routes if the current path becomes unavailable
Which value represents the “trustworthiness” of a route and is used to determine which route to install into the routing table when there are multiple routes toward the same destination?
outgoing interface
routing protocol
metric
administrative distance
Which packet-forwarding method does a router use to make switching decisions when it is using a forwarding information base and an adjacency table?
fast switching
process switching
Cisco Express Forwarding
flow process
Which type of route would typically be used on a border router so that devices inside the company could access the Internet?
static
directly connected
summary
default
What are two functions of a router? (Choose two.)
It provides segmentation at Layer 2.
A router connects multiple IP networks.
It determines the best path to send packets.
It builds a routing table based on ARP requests.
It controls the flow of data via the use of Layer 2 addresses.
When a router learns that multiple paths are available to a destination network from the same routing protocol, which factor is considered by a router to choose the best path to forward a packet?
the reliability value of the neighboring routers
the fastest bandwidth of exiting interfaces
the lowest metric
the order of paths on the routing table
Which two route source codes are automatically created within a routing table whenever a router interface is configured with an IP address and activated? (Choose two.)
D
S
C
L
O
The output of the show ip route command contains the following entry: S 10.2.0.0 [1/0] via 172.16.2.2. What value is indicated by the 1 in the [1/0] portion of the output?
metric
interface ID through which the network can be reached
number of hops
administrative distance
Which type of static route creates a gateway of last resort?
summary static route
standard static route
floating static route
default static route
What are two common types of static routes in routing tables? (Choose two)
a static route converted from a route that is learned through a dynamic routing protocol
a static route to a specific network
a default static route
a static route shared between two neighboring routers
a built-in static route by IOS
What are two reasons why an administrator might choose to use static routing rather than dynamic routing? (Choose two.)
Static routing uses less router processing and bandwidth.
Static routing is easier to maintain in large networks.
Static routing does not require complete knowledge of the whole network.
Static routing is more secure.
Static routing is more scalable.
What address and prefix length is used when configuring an IPv6 default static route?
::1/128
FF02::1/8
::/0
0.0.0.0/0
What are two advantages of static routing over dynamic routing? (Choose two.)
Static routing is more secure because it does not advertise routes to other routers.
Static routing is relatively easy to configure for large networks.
Static routing requires very little knowledge of the network for correct implementation.
Static routing scales well with expanding networks.
Static routing uses fewer router resources than dynamic routing.
What type of route allows a router to forward packets even though its routing table contains no specific route to the destination network?
default route
destination route
dynamic route
generic route
The network administrator configures the router with the ip route 172.16.1.0 255.255.255.0 172.16.2.2 command. How will this route appear in the routing table?
C 172.16.1.0 [1/0] via 172.16.2.2
C 172.16.1.0 is directly connected, Serial0/0
S 172.16.1.0 [1/0] via 172.16.2.2
S 172.16.1.0 is directly connected, Serial0/0
R1 is configured with the ip route 10.1.0.0 255.255.0.0 g0/0/0 command. What happens if the G0/0/0 interface goes down?
The manually configured route remains in the routing table.
The router polls neighbors for a replacement route.
The router redirects the static route to a backup interface.
The static route is removed from the routing table.
What static route identifies the gateway IP address to which the router sends all IP packets for which it does not have a learned route?
Default static route
Floating static route
Generic static route
Summary static route
On which type of network would a dynamic routing protocol be implemented in?
On a home network router with wireless clients.
On a network that commonly experiences topology changes.
On a small two router network.
On a stub network connecting to a provider.
Which value in a routing table is used to compare routes received from a routing protocol?
administrative distance
metric
outgoing interface
routing protocol
A network administrator configures the G0/0/0 interface with the ip address 10.1.1.0 255.255.255.0 command. However, when the administrator issues the show ip route command, the routing table does not show the directly connected network. What is the possible cause of the problem?
No packets with a destination network of 172.16.1.0 have been sent to R1.
The configuration needs to be saved first.
The G0/0/0 interface has not been activated.
The subnet mask is incorrect for the IPv4 address.
A network administrator configures a router by the command ip route 0.0.0.0 0.0.0.0 209.165.200.226. What is the purpose of this command?
to forward all packets to the device with IP address 209.165.200.226
to forward packets destined for the network 0.0.0.0 to the device with IP address 209.165.200.226
to provide a route to forward packets for which there is no route in the routing table
to add a dynamic route for the destination network 0.0.0.0 to the routing table
Which type of static route that is configured on a router uses only the exit interface?
fully specified static route
directly connected static route
recursive static route
default static route
A network administrator uses the command ip route 172.18.0.0 255.255.0.0 S0/0/1 to configure a floating static route on a router. That route will function as a backup route to reach the EIGRP learned network 172.18.0.0/16. After this configuration, the EIGRP route is removed from the routing table even though EIGRP is still functioning properly. Why is the static route not functioning as intended?
The network mask is incorrectly configured.
The next hop neighbor IP address is not configured.
The destination network is incorrectly configured.
The administrative distance value is not high enough on the static route.
What type of static route is created when the next-hop IP address and exit interface are specified?
recursive static route
directly connected static route
fully specified static route
floating static route
What is the correct syntax of a floating static route?
ip route 209.165.200.228 255.255.255.248 serial 0/0/0
ip route 209.165.200.228 255.255.255.248 10.0.0.1 120
ip route 172.16.0.0 255.248.0.0 10.0.0.1
ip route 0.0.0.0 0.0.0.0 serial 0/0/0
Which static route statement shows a recursive IPv6 static route?
ipv6 route 0::/0 S0/0/0 254
ipv6 route 0::/0 S0/0/0
ipv6 route 2001:db8:cafe:1::/56 S0/0/0 2001:db8:1000:10::1
ipv6 route 2001:db8:cafe:1::/56 2001:db8:1000:10::1
ipv6 route 2001:db8:cafe:1::/56 S0/0/0
A network administrator is configuring a route to forward packets to a specific web server. What type of route should be configured by the administrator?
an OSPF route
a static route with an administrative distance higher than 1
a default route
a host route
