A company wants to segment traffic between finance and engineering groups. Both groups are on the same IP subnet and share the same access switches. The admin wants to enforce policies based on user identity rather than IP address, because users move between offices. Which segmentation method meets this requirement?

Configure access control lists (ACLs) based on source IP addresses

Use private VLANs to isolate traffic within the same subnet

Deploy Security Group Tags (SGTs) and classify traffic based on user authentication

Create separate VLANs for finance and engineering and assign ports accordingly

An attacker on an access port is sending frames with rapidly changing source MAC addresses, attempting to overflow the switch's MAC address table. The admin wants to stop this attack while allowing the legitimate device on the port to continue working. Which configuration achieves this?

Set the port to 'switchport mode trunk' with 'allowed vlan none'

Configure 'storm-control unicast level 50' on the port

Enable port security with 'maximum 1' and 'violation restrict' on the port

Enable 'spanning-tree bpduguard' on the port

CiscoCertified Network Professional Security

Domain 2Objective 3

2.3 Configure Network Infrastructure Security Methods (network Segmentation Using VLANs or SGTs; Layer 2 and Port Security; DHCP Snooping; Dynamic ARP Inspection; Storm Control; and Defenses Against MAC, ARP, VLAN Hopping, STP, and DHCP Rogue Attacks) 350-701 Practice Questions (Page 5)

Part of the Network Security domain, which accounts for 25% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

12concepts

25%of the exam

Questions 21–25

21application · medium
A company wants to segment traffic between finance and engineering groups. Both groups are on the same IP subnet and share the same access switches. The admin wants to enforce policies based on user identity rather than IP address, because users move between offices. Which segmentation method meets this requirement?
Select an answer first
22application · medium
An attacker on an access port is sending frames with rapidly changing source MAC addresses, attempting to overflow the switch's MAC address table. The admin wants to stop this attack while allowing the legitimate device on the port to continue working. Which configuration achieves this?
Select an answer first
23foundation · easy
Which Layer 2 attack involves an attacker sending frames with a spoofed source MAC address to fill the switch's MAC address table?
Select an answer first
24foundation · easy
In a DHCP snooping configuration, which port type should be configured for the port connecting to a legitimate DHCP server?
Select an answer first
25foundation · easy
Which attack involves an attacker sending frames with a spoofed source MAC address to trick the switch into forwarding traffic to the attacker's port?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

2.3 Configure Network Infrastructure Security Methods (network Segmentation Using VLANs or SGTs; Layer 2 and Port Security; DHCP Snooping; Dynamic ARP Inspection; Storm Control; and Defenses Against MAC, ARP, VLAN Hopping, STP, and DHCP Rogue Attacks) 350-701 Practice Questions (Page 5)

Questions 21–25

An attacker on an access port is sending frames with rapidly changing source MAC addresses, attempting to overflow the switch's MAC address table. The admin wants to stop this attack while allowing the legitimate device on the port to continue working. Which configuration achieves this?

Which Layer 2 attack involves an attacker sending frames with a spoofed source MAC address to fill the switch's MAC address table?

In a DHCP snooping configuration, which port type should be configured for the port connecting to a legitimate DHCP server?

Which attack involves an attacker sending frames with a spoofed source MAC address to trick the switch into forwarding traffic to the attacker's port?

Keep studying — Network Security