Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which IPv6 security measure is used to authenticate OSPFv3 routing updates?

   • AMD5 authentication
   • BRA Guard
   • CIPsec
   • DDHCPv6 Guard
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network engineer is hardening a campus access layer. The switch connects to end-user PCs and IP phones. The requirement is to prevent MAC flooding attacks while allowing the IP phone to register with the call manager. The engineer also needs to ensure that only the IT department's management station can SSH to the switch. Which configuration approach meets both requirements?

   • AEnable port security with sticky MAC addresses and a maximum of two MAC addresses per port, and apply an IPv4 ACL on the VTY lines.
   • BConfigure storm control for broadcast traffic and enable IP source guard on all access ports.
   • CEnable DHCP snooping and dynamic ARP inspection globally, and configure an IPv6 ACL for management access.
   • DSet the port to a static access VLAN and enable BPDU guard, then apply a standard ACL to the physical port.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A dual-stack router is being deployed at a branch office. The router connects to an ISP via BGP and also provides internal routing via OSPFv3. The security policy requires that BGP sessions are authenticated, OSPFv3 updates are encrypted, and management access is restricted to a specific IPv6 host. The router also needs to prevent IP spoofing on the ISP-facing interface. Which set of configurations best meets all requirements?

   • AConfigure BGP neighbor password, OSPFv3 area authentication, and apply an IPv6 ACL to the console line.
   • BConfigure BGP MD5 authentication, OSPFv3 IPsec encryption, an IPv6 ACL on VTY lines, and uRPF on the ISP-facing interface.
   • CUse BGP prefix lists, OSPFv3 authentication, an IPv4 ACL on VTY lines, and uRPF on the internal interface.
   • DEnable BGP TTL security, OSPFv3 passive interface, an IPv6 ACL on the physical interface, and DHCPv6 guard.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large campus network is experiencing ARP spoofing attacks in the access layer. The network uses both IPv4 and IPv6. The security team wants to implement a comprehensive solution that prevents ARP spoofing, IPv6 neighbor discovery spoofing, and also protects the switch CPU from control plane floods. The switches are capable of DHCP snooping, DAI, RA guard, and CoPP. Which combination of features should be enabled?

   • AEnable DHCP snooping, DAI, IPv6 RA guard, and control plane policing for IPv4 and IPv6 control packets.
   • BEnable port security, IP source guard for IPv4, and IPv6 source guard, but skip CoPP.
   • CApply IPv4 and IPv6 ACLs on all access ports and enable uRPF on the uplinks.
   • DEnable storm control, BPDU guard, and DHCPv6 guard.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A network engineer is troubleshooting a router that is dropping legitimate OSPFv3 packets. The router has an IPv6 ACL applied to the VTY lines, CoPP policy, and uRPF on the WAN interface. The OSPFv3 neighbor is on the WAN interface. Which configuration is most likely causing the drops?

   • AThe IPv6 ACL on the VTY lines is blocking OSPFv3 packets destined to the router's IPv6 address.
   • BThe OSPFv3 authentication is misconfigured, causing the router to reject the packets.
   • CThe CoPP policy is rate-limiting OSPFv3 packets because they are classified as control plane traffic.
   • DThe uRPF check is failing because the OSPFv3 source address is not in the routing table.
   Reveal Solution Discussion Select an answer first