Which database does Dynamic ARP Inspection (DAI) use to validate ARP packets?

The MAC address table (CAM table)

The DHCP snooping binding table

What is the primary purpose of Dynamic ARP Inspection (DAI)?

To limit the rate of broadcast traffic on a port

To filter DHCP messages from untrusted sources

To encrypt ARP traffic between hosts

To validate ARP packets and prevent ARP spoofing and ARP poisoning attacks

What is the primary difference between SGT-based segmentation and traditional VLAN-based segmentation?

SGTs are based on the physical port where the device is connected, while VLANs are based on user identity

SGTs replace VLANs entirely and do not require any Layer 2 segmentation

SGTs enforce segmentation based on identity, while VLANs segment based on network location or topology

SGTs operate at Layer 4, while VLANs operate at Layer 2

A switch connects to a downstream switch that carries multiple VLANs. The admin wants to prevent a rogue switch from becoming the STP root and altering the forwarding topology. Which configuration on the upstream switch port provides this protection?

Enable 'spanning-tree bpduguard' on the port

Enable 'spanning-tree guard root' on the port

Set 'spanning-tree portfast' on the port

Configure 'switchport mode dynamic desirable' on the port

CiscoCertified Network Professional Security

Domain 2Objective 3

2.3 Configure Network Infrastructure Security Methods (network Segmentation Using VLANs or SGTs; Layer 2 and Port Security; DHCP Snooping; Dynamic ARP Inspection; Storm Control; and Defenses Against MAC, ARP, VLAN Hopping, STP, and DHCP Rogue Attacks) 350-701 Practice Questions (Page 3)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

25%of the exam

Questions 11–15

11foundation · easy
Which database does Dynamic ARP Inspection (DAI) use to validate ARP packets?
Select an answer first
12foundation · easy
What is the primary purpose of Dynamic ARP Inspection (DAI)?
Select an answer first
13foundation · easy
What is the primary difference between SGT-based segmentation and traditional VLAN-based segmentation?
Select an answer first
14foundation · easy
Which STP protection feature prevents a port from becoming a root port by placing it in a root-inconsistent state if it receives a superior BPDU?
Select an answer first
15application · medium
A switch connects to a downstream switch that carries multiple VLANs. The admin wants to prevent a rogue switch from becoming the STP root and altering the forwarding topology. Which configuration on the upstream switch port provides this protection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.