A network admin is connecting a new access switch to an existing distribution switch. The access switch has a mix of user PCs and a server that must be isolated from the user traffic. The admin wants to prevent a user from reconfiguring the access switch port to trunk and gaining access to the server's VLAN. Which configuration change on the access switch directly addresses this risk?

Set the uplink port to 'switchport mode trunk' and all user ports to 'switchport mode access' with 'switchport nonegotiate'

Configure 'switchport port-security maximum 1' on the uplink port

Enable 'spanning-tree portfast' on all user-facing ports

Place all user ports in a separate VLAN and the server in a different VLAN, then enable routing between them

A switch port experiences intermittent slowdowns. Monitoring shows the port receives a high rate of broadcast frames from a connected device, but the device is functioning normally. The admin wants to suppress the broadcast traffic without disabling the port or blocking all broadcast frames. Which configuration should be applied?

Enable 'switchport port-security maximum 1' on the port

Configure 'storm-control broadcast level 10' on the port

Configure 'storm-control unicast level 10' on the port

Set 'spanning-tree portfast' on the port

Which types of traffic can storm control be configured to monitor and suppress?

Broadcast, multicast, and unknown unicast traffic

What is the goal of an ARP poisoning attack?

To fill the switch's MAC address table with fake entries

To send fake ARP replies so that the attacker's MAC address is associated with the IP address of a legitimate host

To exhaust the DHCP address pool

What is the primary defense against a rogue DHCP server attack?

DHCP snooping with trusted ports configured for legitimate DHCP servers

Port security with a maximum MAC count of 1

Storm control on the uplink port

CiscoCertified Network Professional Security

Domain 2Objective 3

2.3 Configure Network Infrastructure Security Methods (network Segmentation Using VLANs or SGTs; Layer 2 and Port Security; DHCP Snooping; Dynamic ARP Inspection; Storm Control; and Defenses Against MAC, ARP, VLAN Hopping, STP, and DHCP Rogue Attacks) 350-701 Practice Questions (Page 2)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

25%of the exam

Questions 6–10

6application · medium
A network admin is connecting a new access switch to an existing distribution switch. The access switch has a mix of user PCs and a server that must be isolated from the user traffic. The admin wants to prevent a user from reconfiguring the access switch port to trunk and gaining access to the server's VLAN. Which configuration change on the access switch directly addresses this risk?
Select an answer first
7application · medium
A switch port experiences intermittent slowdowns. Monitoring shows the port receives a high rate of broadcast frames from a connected device, but the device is functioning normally. The admin wants to suppress the broadcast traffic without disabling the port or blocking all broadcast frames. Which configuration should be applied?
Select an answer first
8foundation · easy
Which types of traffic can storm control be configured to monitor and suppress?
Select an answer first
9foundation · easy
What is the goal of an ARP poisoning attack?
Select an answer first
10foundation · easy
What is the primary defense against a rogue DHCP server attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

2.3 Configure Network Infrastructure Security Methods (network Segmentation Using VLANs or SGTs; Layer 2 and Port Security; DHCP Snooping; Dynamic ARP Inspection; Storm Control; and Defenses Against MAC, ARP, VLAN Hopping, STP, and DHCP Rogue Attacks) 350-701 Practice Questions (Page 2)

Questions 6–10

Which types of traffic can storm control be configured to monitor and suppress?

What is the goal of an ARP poisoning attack?

What is the primary defense against a rogue DHCP server attack?

Keep studying — Network Security