2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A switch has DHCP snooping enabled on VLAN 10. The administrator wants to prevent a malicious host from sending ARP replies claiming to be the default gateway. Which feature should be enabled on the VLAN?

   • APort security
   • BDynamic ARP Inspection (DAI)
   • CBPDU Guard
   • DIP Source Guard
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network engineer notices that a core router's CPU utilization spikes to 100% during a traffic surge, causing routing protocol adjacencies to drop. The engineer suspects that excessive traffic destined to the router itself is overwhelming the control plane. What should be configured to protect the control plane while allowing legitimate management traffic?

   • AIP Source Guard on all access ports
   • BAn ACL on the ingress interfaces blocking all traffic to the router's IP addresses
   • CPort security on the router's management port
   • DControl Plane Policing (CoPP) with a policy that rate-limits traffic to the control plane
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of DHCP snooping?

   • ATo provide DHCP failover between multiple servers
   • BTo encrypt DHCP traffic between clients and servers
   • CTo prevent rogue DHCP servers from offering unauthorized IP addresses
   • DTo assign static IP addresses to clients
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which practice is an example of network device hardening?

   • AUsing Telnet for remote management because it is simple
   • BEnabling all default services to ensure functionality
   • CAllowing SNMPv1 for monitoring because it is widely supported
   • DDisabling unused services and securing management interfaces
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations team needs to detect lateral movement within a network. They have deployed NetFlow on the core switches and have access to syslog from the firewalls. The team wants to identify when a host communicates with multiple internal hosts on port 445 within a short time frame. Which approach would be most effective?

   • AEnable SPAN on all access ports and capture full packets
   • BAnalyze NetFlow records for flows from a single source IP to multiple destination IPs on port 445
   • CUse SNMP polling of interface counters
   • DReview syslog messages for firewall deny events
   Reveal Solution Discussion Select an answer first