WorksheetsSwitch Security Configuration Quiz
Total questions: 27
Worksheet time: 14mins
What is a recommended best practice when dealing with the native VLAN?
Use port security.
Turn off DTP.
Assign it to an unused VLAN.
Assign the same VLAN number as the management VLAN.
On what switch ports should PortFast be enabled to enhance STP stability?
All end-user ports.
Only ports that attach to a neighboring switch.
All trunk ports that are not root ports.
Only ports that are elected as designated ports.
Which command would be best to use on an unused switch port if a company adheres to the best practices as recommended by Cisco?
ip dhcp snooping
switchport port-security violation shutdown
shutdown
switchport port-security mac-address sticky
Which two features on a Cisco Catalyst switch can be used to mitigate DHCP starvation and DHCP spoofing attacks? (Choose two.)
DHCP snooping
DHCP server failover
extended ACL
port security
What is the best way to prevent a VLAN hopping attack?
Disable trunk negotiation for trunk ports and statically set nontrunk ports as access ports.
Use VLAN 1 as the native VLAN on trunk ports.
Use ISL encapsulation on all trunk links.
Disable STP on all nontrunk ports.
Which procedure is recommended to mitigate the chances of ARP spoofing?
Enable port security globally.
Enable DAI on the management VLAN.
Enable DHCP snooping on selected VLANs.
Enable IP Source Guard on trusted ports.
What are two types of switch ports that are used on Cisco switches as part of the defense against DHCP spoofing attacks? (Choose two.)
unknown port
trusted DHCP port
unauthorized port
untrusted port
Which two commands can be used to enable PortFast on a switch? (Choose two.)
S1(config-if)# enable spanning-tree portfast
S1(config)# spanning-tree portfast default
S1(config-if)# spanning-tree portfast
S1(config)# enable spanning-tree portfast default
An administrator who is troubleshooting connectivity issues on a switch notices that a switch port configured for port security is in the err-disabled state. How should the administrator re-enable the port without disrupting network operation?
Issue the shutdown command followed by the no shutdown command on the interface.
Reboot the switch.
Issue the no switchport port-security violation shutdown command on the interface.
Issue the no switchport port-security command, then re-enable port security.
A network administrator is configuring DHCP snooping on a switch. Which configuration command should be used first?
ip dhcp snooping limit rate
ip dhcp snooping
ip dhcp snooping vlan
ip dhcp snooping trust
A network administrator is configuring DAI on a switch with the command ip arp inspection validate dst-mac. What is the purpose of this configuration command?
To check the destination MAC address in the Ethernet header against the target MAC address in the ARP body.
To check the destination MAC address in the Ethernet header against the user-configured ARP ACLs.
To check the destination MAC address in the Ethernet header against the source MAC address in the ARP body.
To check the destination MAC address in the Ethernet header against the MAC address table.
Which security feature should be enabled in order to prevent an attacker from overflowing the MAC address table of a switch?
storm control
port security
BPDU filter
root guard
What Layer 2 attack is mitigated by disabling Dynamic Trunking Protocol?
VLAN hopping
ARP spoofing
DHCP spoofing
ARP poisoning
A network administrator is configuring DAI on a switch. Which command should be used on the uplink interface that connects to a router?
ip arp inspection trust
ip dhcp snooping
ip arp inspection vlan
spanning-tree portfast
Where are dynamically learned MAC addresses stored when sticky learning is enabled with the switchport port-security mac-address sticky command?
NVRAM
RAM
ROM
flash
Which method would mitigate a MAC address flooding attack?
Configuring port security
Increasing the size of the CAM table
Using ACLs to filter broadcast traffic on the switch
Increasing the speed of switch ports
Which action will bring an error-disabled switch port back to an operational state?
Clear the MAC address table on the switch.
Issue the shutdown and no shutdown interface config commands.
Remove and reconfigure port security on the interface.
Issue the switchport mode access interface config command.
Which two statements are true regarding switch port security? (Choose two.)
After entering the sticky parameter, only MAC addresses subsequently learned are converted to secure MAC addresses.
The three configurable violation modes all log violations via SNMP.
If fewer than the maximum number of MAC addresses for a port are configured statically, dynamically learned addresses are added to CAM until the maximum number is reached.
Dynamically learned secure MAC addresses are lost when the switch reboots.
Port security has been enabled on access ports to allow a maximum of two MAC addresses. Which port security violation would drop the frame and send a notification to the syslog server if the maximum number of MAC addresses is exceeded?
Shutdown
Warning
Restrict
Protect
Which feature should be configured on PortFast enabled switches to prevent rogue switches from being added to a network?
DAI
Port security
BPDU guard
DHCP snooping
Which port security feature enables switches to automatically learn and retain MAC addresses for each port?
Dynamic secure MAC addresses
Sticky secure MAC addresses
Auto secure MAC addresses
Static secure MAC addresses
Assume that BPDU Guard has been enabled globally on all access ports. However, one port must not be configured with the feature. Which command would explicitly disable BPDU Guard on that switch port?
S1(config)# no spanning-tree portfast bpduguard default
S1(config-if)# no enable spanning-tree bpduguard
S1(config-if)# no spanning-tree portfast bpduguard
S1(config)# no spanning-tree bpduguard default
Which DAI command checks the source MAC address in the Ethernet header against the target MAC address in the ARP body?
ip arp inspection validate dst-mac
ip arp inspection validate src-mac
ip arp inspection validate dst-mac ip
ip arp inspection validate ip
What is the result of entering the ip dhcp snooping limit rate 4 interface configuration command?
The port can receive up to 4 DHCP offer messages per second.
The port can send up to 4 DHCP messages per second.
The port can receive up to 4 DHCP discovery messages per second.
The port can send up to 4 DHCP offer discovery messages per second.
Port security has been enabled on a switch port. What is the default violation mode in use by default?
Restrict
Shutdown
Disabled
Protect
What techniques should be done to mitigate VLAN attacks? (Choose three.)
Disable DTP.
Set the native VLAN to an unused VLAN.
Enable trunking manually.
Enable BPDU guard.
Enable Source Guard.
Port security has been enabled on interface Fa0/1 and the show port-security interface fa0/1 command has been entered. What does the Port Status 'Secure-up' message indicate?
The Fa0/1 port is currently error-disabled.
The Fa0/1 port violation mode is 'protect'.
There are no hosts connected to the secured Fa0/1 port.
There is a host connected to the secured Fa0/1 port.
