Font size
WorksheetsNetacad Exam: Module 10-13 L2 Security and WLANS
Total questions: 42
Worksheet time: 21mins
A network administrator of a college is configuring the WLAN user authentication process. Wireless users are required to enter username and password credentials that will be verified by a server. Which server would provide such service?
AAA
NAT
SNMP
RADIUS
What can be determined about port security from the information that is shown?
The port has been shut down.
The port has two attached devices.
The port violation mode is the default for any port that has port security enabled.
The port has the maximum number of MAC addresses that is supported by a Layer 2 switch port which is configured for port security.
A network engineer is troubleshooting a newly deployed wireless network that is using the latest 802.11 standards. When users access high bandwidth services such as streaming video, the wireless network performance is poor. To improve performance the network engineer decides to configure a 5 GHz frequency band SSID and train users to use that SSID for streaming media services. Why might this solution improve the wireless network performance for that type of service?
The 5 GHz band has a greater range and is therefore likely to be interference-free.
Requiring the users to switch to the 5 GHz band for streaming media is inconvenient and will result in fewer users accessing these services.
The 5 GHz band has more channels and is less crowded than the 2.4 GHz band, which makes it more suited to streaming multimedia.
The only users that can switch to the 5 GHz band will be those with the latest wireless NICs, which will reduce usage.
Which two Cisco solutions help prevent DHCP starvation attacks?
A. Port Security
B. IP Source Guard
C. DHCP Snooping
D. Web Security Appliance
E. Dynamic ARP Inspection
A network administrator is configuring port security on a Cisco switch. The company security policy specifies that when a violation occurs, packets with unknown source addresses should be dropped and no notification should be sent. Which violation mode should be configured on the interfaces?
Off
Restrict
Protect
Shutdown
While attending a conference, participants are using laptops for network connectivity. When a guest speaker attempts to connect to the network, the laptop fails to display any available wireless networks. The access point must be operating in which mode?
Active
Mixed
Open
Passive
What is the function provided by CAPWAP protocol in a corporate wireless network?
CAPWAP provides the encapsulation and forwarding of wireless user traffic between an access point and a wireless LAN controller.
CAPWAP provides the encryption of wireless user traffic between an access point and a wireless client.
CAPWAP provides connectivity between an access point using IPv6 addressing and a wireless client using IPv4 addressing.
CAPWAP creates a tunnel on Transmission Control Protocol (TCP) ports in order to allow a WLC to configure an autonomous access point.
Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?
B) Frames from PC1 will be dropped, and there will be no log of the violation.
A) Frames from PC1 will be dropped, and a log message will be created.
D) Frames from PC1 will be forwarded to its destination, and a log entry will be created.
E) Frames from PC1 will be forwarded to its destination, but a log entry will not be created.
C) Frames from PC1 will cause the interface to shut down immediately, and a log entry will be made.
What is a wireless security mode that requires a RADIUS server to authenticate wireless users?
Enterprise
Personal
Shared key
WEP
Refer to the exhibit. Port Fa0/2 has already been configured appropriately. The IP phone and PC work properly. Which switch configuration would be most appropriate for port Fa0/2 if the network administrator has the following goals? - No one else is allowed to disconnect the IP phone or the PC and connect some other wired device. - If a different device is connected, port Fa0/2 is shut down. - The switch should automatically detect the MAC address of the IP phone and the PC and add those addresses to the running configuration.
SWA(config-if)# switchport port-security
SWA(config-if)# switchport port-security mac-address sticky
SWA(config-if)# switchport port-security maximum 2
SWA(config-if)# switchport port-security maximum 2 mac-address sticky
What are three techniques for mitigating VLAN attacks?
Enable trunking manually.
Enable BPDU guard.
Enable Source Guard.
Set the native VLAN to an unused VLAN.
Disable DTP.
A network administrator is working to improve WLAN performance on a dual-band wireless router. What is a simple way to achieve a split-the-traffic result?
Require all wireless devices to use the 802.11n standard.
Check and keep the firmware of the wireless router updated.
Make sure that different SSIDs are used for the 2.4 GHz and 5 GHz bands.
Add a Wi-Fi range extender to the WLAN and set the AP and the range extender to serve different bands.
A network administrator is configuring a RADIUS server connection on a Cisco 3500 series WLC. The configuration requires a shared secret password. What is the purpose for the shared secret password?
It allows users to authenticate and access the WLAN.
It is used by the RADIUS server to authenticate WLAN users.
It is used to authenticate and encrypt user data on the WLAN.
It is used to encrypt the messages between the WLC and the RADIUS server.
What device is considered a supplicant during the 802.1X authentication process?
The client that is requesting authentication
The switch that is controlling network access
The authentication server that is performing client authentication
The router that is serving as the default gateway
What security benefit is gained from enabling BPDU guard on PortFast enabled interfaces?
Preventing rogue switches from being added to the network
Protecting against Layer 2 loops
Enforcing the placement of root bridges
Preventing buffer overflow attacks
What are the two methods that are used by a wireless NIC to discover an AP?
Sending an ARP request
Delivering a broadcast frame
Transmitting a probe request
Initiating a three-way handshake
Receiving a broadcast beacon frame
Match each functional component of AAA with its description.
Determines what resources users can access or the operations they are allowed to perform
Authorization
Proves that users are who they say they are
Authentication
Records what users do and what they access
Accounting
Which access control component, implementation, or protocol logs EXEC and configuration commands configured by a user?
Accounting
802.1X
Authorization
Authentication
A technician is about to install and configure a wireless network at a small branch office. What is the first security measure the technician should apply immediately upon powering up the wireless router?
Configure encryption on the wireless router and the connected wireless devices.
Disable the wireless network SSID broadcast.
Change the default user-name and password of the wireless router.
Enable MAC address filtering on the wireless router.
A laptop cannot connect to a wireless access point. Which two troubleshooting steps should be taken first?
Ensure that the wireless NIC is enabled.
Ensure that the laptop antenna is attached.
Ensure that the wireless SSID is chosen.
Ensure that the correct network media is selected.
Ensure that the NIC is configured for the proper frequency.
As part of the new security policy, all switches on the network are configured to automatically learn MAC addresses for each port. All running configurations are saved at the start and close of every business day. A severe thunderstorm causes an extended power outage several hours after the close of business. When the switches are brought back online, the dynamically learned MAC addresses are retained. Which port security configuration enabled this?
Auto secure MAC addresses
Dynamic secure MAC addresses
Static secure MAC addresses
Sticky secure MAC addresses
Which protocol should be used to mitigate the vulnerability of using Telnet to remotely manage network devices?
SCP
SSH
TFTP
SNMP
The company handbook states that employees cannot have microwave ovens in their offices. Instead, all employees must use the microwave ovens located in the employee cafeteria. What wireless security risk is the company trying to avoid?
Accidental interference
Improperly configured devices
Interception of data
Rogue access points
Which type of wireless network commonly uses Bluetooth or ZigBee devices?
Wireless personal-area network
Wireless local-area network
Wireless metropolitan-area network
Wireless wide-area network
A technician is troubleshooting a slow WLAN that consists of 802.11b and 802.11g devices. A new 802.11n/ac dual-band router has been deployed on the network to replace the old 802.11g router. What can the technician do to address the slow wireless speed?
Change the SSID.
Configure devices to use a different channel.
Split the wireless traffic between the 802.11n 2.4 GHz band and the 5 GHz band.
Update the firmware on the new router.
On a Cisco 3504 WLC Summary page (Advanced > Summary), which tab allows a network administrator to access and configure a WLAN for a specific security option such as WPA2?
WLANs
SECURITY
WIRELESS
MANAGEMENT
Which component of AAA allows an administrator to track individuals who access network resources and any changes that are made to those resources?
A) Accessibility
B) Accounting
C) Authentication
D) Authorization
PC1 and PC2 should be able to obtain IP address assignments from the DHCP server. How many ports among switches should be assigned as trusted ports as part of the DHCP snooping configuration?
1
3
5
7
Which wireless network topology would be used by network engineers to provide a wireless network for an entire college building?
Ad hoc
Hotspot
Infrastructure
Mixed mode
Which statement describes the behavior of a switch when the MAC address table is full?
It treats frames as unknown unicast and floods all incoming frames to all ports on the switch.
It treats frames as unknown unicast and floods all incoming frames to all ports within the local VLAN.
It treats frames as unknown unicast and floods all incoming frames to all ports within the collision domain.
It treats frames as unknown unicast and floods all incoming frames to all ports across multiple switches.
Which component of AAA is used to determine which resources a user can access and which operations the user is allowed to perform?
Auditing
Accounting
Authorization
Authentication
A technician is configuring the channel on a wireless router to either 1, 6, or 11. What is the purpose of adjusting the channel?
To disable broadcasting of the SSID
To enable different 802.11 standards
To provide stronger security modes
To avoid interference from nearby wireless devices
Which feature or configuration on a switch makes it vulnerable to VLAN double-tagging attacks?
The limited size of content-addressable memory space
The native VLAN of the trunking port being the same as a user VLAN
Mixed duplex mode enabled for all ports by default
The automatic trunking port feature enabled for all ports by default
A network administrator enters the following commands on the switch SW1. SW1(config)# interface range fa0/5 – 10 SW1(config-if)# ip dhcp snooping limit rate 6 What is the effect after these commands are entered?
FastEthernet ports 5 through 10 can receive up to 6 DHCP discovery messages per second.
If any of the FastEthernet ports 5 through 10 receive more than 6 DHCP messages per second, the port will be shut down.
If any of the FastEthernet ports 5 through 10 receive more than 6 DHCP messages per second, the port will continue to operate and an error message will be sent to the network administrator.
FastEthernet ports 5 through 10 can receive up to 6 DHCP messages per second of any type.
Which type of wireless network is suitable for national and global communications?
Wireless local-area network
Wireless metropolitan-area network
Wireless wide-area network
Wireless personal-area network
What two IEEE 802.11 wireless standards operate only in the 5 GHz range?
802.11n
802.11ad
802.11ac
802.11b
802.11a
Refer to the exhibit. The Fa0/2 interface on switch S1 has been configured with the switchport port-security mac-address 0023.1894.6645 command and a workstation has been connected. What could be the reason that the Fa0/2 interface is shutdown?
The Fa0/2 interface of S1 is configured with the same MAC address as the Fa0/2 interface.
The connection between S1 and PC1 is via a crossover cable.
The MAC address of PC1 that connects to the Fa0/2 interface is not the configured MAC address.
S1 has been configured with a switchport port-security aging command.
Which step is required before creating a new WLAN on a Cisco 3500 series WLC?
Create a new SSID.
Create a new VLAN interface.
Build or have an SNMP server available.
Build or have a RADIUS server available.
Which type of management frame may regularly be broadcast by an AP?
Beacon
Probe request
Authentication
Probe response
which protocol can be used to monitor the network
AAA
DHCP
SNMP
RADIUS
which access control component, or protocol restricts LAN access through publicly accessible switch ports?
802.1X
Accounting
Authorization
Authentification
which two commands can be used (choose two)
S1(config)# spanning-tree bpduguard default
S1(config)# spanning-tree portfast bpduguard
S1(config)# spanning-tree bpduguard enable
S1(config)# spanning-tree portfast bpduguard default
