A security administrator wants to mitigate DHCP spoofing, ARP spoofing, and MAC flooding attacks on a campus network. The switches support DHCP snooping, DAI, and port security. Which combination of features should be implemented?

Enable DHCP snooping, DAI, and port security on all access ports.

Enable DHCP snooping and port security, but not DAI.

Enable DHCP snooping and DAI, but not port security.

Enable port security and DAI, but not DHCP snooping.

A network administrator has enabled DAI on VLAN 30. A user reports that they cannot communicate with other devices on the same VLAN. The administrator checks the switch and finds that DAI is dropping ARP packets from the user's port. The user's device is a DHCP client and has a valid IP address. What is the most likely cause?

The user's port is configured as trusted for DAI.

The DHCP snooping binding table does not have an entry for the user's device.

Port security is blocking the user's MAC address.

After enabling DHCP snooping on a switch, a user reports that they cannot obtain an IP address. The administrator checks the DHCP snooping binding table and sees no entries for the user's port. The switch is connected to a DHCP server on a different VLAN. What is the most likely cause?

DAI is blocking ARP requests from the user.

The switch does not have an IP address on the user's VLAN.

The port connected to the DHCP server is untrusted.

The user's port has port security enabled with a violation.

A network administrator is configuring a new switch for a small office. The switch has DHCP snooping enabled globally and on VLAN 50. The administrator wants to prevent DHCP spoofing attacks from unauthorized devices plugged into access ports. Which configuration is necessary?

Configure the uplink port as trusted and leave the access ports as untrusted.

Configure all ports as untrusted.

Configure all ports as trusted.

Enable port security on all access ports.

CiscoCertified Network Associate (CCNA)

Domain 5Objective 7

5.7 Configure and Verify Layer 2 Security Features (DHCP Snooping, Dynamic ARP Inspection, and Port Security) 200-301 Practice Questions (Page 3)

Part of the Security Fundamentals domain, which accounts for 15% of the 200-301 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

7concepts

15%of the exam

Questions 11–15

11application · medium
A security administrator wants to mitigate DHCP spoofing, ARP spoofing, and MAC flooding attacks on a campus network. The switches support DHCP snooping, DAI, and port security. Which combination of features should be implemented?
Select an answer first
12expert · hard
A network administrator has enabled DAI on VLAN 30. A user reports that they cannot communicate with other devices on the same VLAN. The administrator checks the switch and finds that DAI is dropping ARP packets from the user's port. The user's device is a DHCP client and has a valid IP address. What is the most likely cause?
Select an answer first
13application · medium
After enabling DHCP snooping on a switch, a user reports that they cannot obtain an IP address. The administrator checks the DHCP snooping binding table and sees no entries for the user's port. The switch is connected to a DHCP server on a different VLAN. What is the most likely cause?
Select an answer first
14application · medium
A network administrator is configuring a new switch for a small office. The switch has DHCP snooping enabled globally and on VLAN 50. The administrator wants to prevent DHCP spoofing attacks from unauthorized devices plugged into access ports. Which configuration is necessary?
Select an answer first
15foundation · easy
Which command displays the port security settings for all interfaces, including the maximum MAC addresses and violation mode?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-301

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-301” is a trademark of its owner, used for identification only.

5.7 Configure and Verify Layer 2 Security Features (DHCP Snooping, Dynamic ARP Inspection, and Port Security) 200-301 Practice Questions (Page 3)

Questions 11–15

A security administrator wants to mitigate DHCP spoofing, ARP spoofing, and MAC flooding attacks on a campus network. The switches support DHCP snooping, DAI, and port security. Which combination of features should be implemented?

After enabling DHCP snooping on a switch, a user reports that they cannot obtain an IP address. The administrator checks the DHCP snooping binding table and sees no entries for the user's port. The switch is connected to a DHCP server on a different VLAN. What is the most likely cause?

A network administrator is configuring a new switch for a small office. The switch has DHCP snooping enabled globally and on VLAN 50. The administrator wants to prevent DHCP spoofing attacks from unauthorized devices plugged into access ports. Which configuration is necessary?

Which command displays the port security settings for all interfaces, including the maximum MAC addresses and violation mode?

Keep studying — Security Fundamentals