2.9 Utilize Network Controls for Network Hardening 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator is concerned about IP spoofing on an access layer switch. The switch has DHCP snooping enabled on the VLAN. The administrator wants to ensure that only IP addresses assigned by DHCP can be used on the access ports. What should be configured on the switch?

   • AIP Source Guard on the access ports
   • BDynamic ARP Inspection on the VLAN
   • CPort security with a maximum MAC address count of 1
   • DA VLAN ACL that denies all traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university is implementing network segmentation to isolate the research lab network from the student network. The research lab contains sensitive equipment that should not be accessible from the student network. The university also wants to allow students to access a public web server that is hosted in the research lab. Which approach should be taken?

   • AUse a firewall to allow all traffic from the student network to the research lab.
   • BPlace the web server in the student VLAN and the research equipment in the research VLAN.
   • CApply an ACL on the switch ports in the research lab that permits only the web server's traffic.
   • DCreate separate VLANs for the research lab and student network, and apply an ACL on the router that permits only HTTP/HTTPS traffic to the web server's IP address from the student VLAN.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network administrator is troubleshooting an issue where users in VLAN 20 are experiencing intermittent connectivity. The switch has DHCP snooping enabled for VLAN 20, and DAI is enabled on all access ports. The administrator discovers that some legitimate devices are using static IP addresses. What is the most likely cause of the connectivity issue?

   • ADAI is dropping ARP packets from static-IP devices because they do not have entries in the DHCP snooping binding table.
   • BThe switch is not trusted for DHCP snooping, so it is dropping all ARP packets.
   • CIP Source Guard is blocking all traffic from static-IP devices.
   • DDHCP snooping is blocking DHCP requests from static-IP devices.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A network administrator is deploying DHCP snooping on a switch that has a legitimate DHCP server connected to port Gi1/0/1. The administrator also wants to enable DAI and IP Source Guard on the access ports. However, some users report that they cannot obtain IP addresses after enabling DHCP snooping. What is the most likely cause?

   • AThe DHCP server port is not configured as a trusted port
   • BIP Source Guard is blocking DHCP discover messages
   • CDAI is dropping DHCP offers because they are not ARP packets
   • DPort security is limiting the number of MAC addresses on the access ports
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary function of an Access Control List (ACL) on a router or switch?

   • ATo filter traffic based on criteria such as source, destination, and port
   • BTo encrypt traffic between two network devices
   • CTo authenticate users attempting to access the network
   • DTo prevent MAC address spoofing on switch ports
   Reveal Solution Discussion Select an answer first