An enterprise is deploying IPv6 in its access layer. The security team wants to prevent rogue DHCPv6 servers from assigning addresses and also prevent unauthorized devices from spoofing IPv6 addresses on the network. The switches are capable of Layer 2 security features. Which combination of features should be enabled on the access switches?

Apply IPv6 ACLs that permit only known MAC addresses and enable storm control.

Configure port security with IPv6 MAC addresses and enable BPDU guard.

Enable RA guard and configure IPv6 DHCP snooping binding database.

Enable DHCPv6 guard on all access ports and configure IPv6 source guard on untrusted ports.

A network engineer is securing a dual-stack router that connects to an untrusted external network. The router runs BGP with an ISP and also provides management access via SSH. The security policy requires that only the ISP's BGP peer can establish BGP sessions, and that management access is restricted to a specific IPv6 management host. Which configuration approach meets these requirements?

Configure BGP MD5 authentication and apply an IPv6 ACL to the VTY lines permitting only the management host.

Apply an IPv6 ACL on the external interface that permits only the ISP's address and enable DHCPv6 guard.

Enable control plane policing to rate-limit BGP packets and configure AAA for device access.

Use BGP prefix lists and enable uRPF on the external interface.

A switch in a data center connects to multiple servers. The security team wants to prevent ARP spoofing attacks and also ensure that the switch's CPU is not overwhelmed by broadcast traffic. The servers use static IP addresses. Which two features should be enabled on the switch?

Configure port security with sticky MAC addresses and enable BPDU guard.

Apply an IPv6 ACL and enable uRPF on the uplink.

Enable DHCP snooping and IP source guard.

Enable dynamic ARP inspection and configure storm control for broadcast traffic.

An enterprise is migrating to IPv6. The access switches are connected to end-user devices. The security team wants to block rogue IPv6 router advertisements and also prevent unauthorized devices from sending IPv6 traffic with spoofed source addresses. Which two features should be enabled on the access switches?

Enable DHCPv6 guard and configure IPv6 ACLs that permit only known MAC addresses.

Configure port security with IPv6 MAC addresses and enable storm control.

Enable RA guard on all access ports and configure IPv6 source guard on untrusted ports.

Apply an IPv6 ACL that permits only the default gateway and enable BPDU guard.

A branch office switch connects to a distribution switch via a trunk port. The network team wants to prevent a rogue switch from being plugged into an access port and becoming the root bridge. They also want to limit the number of MAC addresses learned on that access port to two. Which configuration on the access port meets both requirements?

Enable storm control and set port-security maximum to 2

Enable root guard and set port-security maximum to 2

Enable BPDU guard and set port-security maximum to 2

Enable loop guard and set port-security maximum to 2

CCIE Enterprise Infrastructure

Domain 4Objective 2

Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 4)

Part of the Infrastructure Security and Services domain, which accounts for 15% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

3concepts

15%of the exam

Questions 16–20

16application · medium
An enterprise is deploying IPv6 in its access layer. The security team wants to prevent rogue DHCPv6 servers from assigning addresses and also prevent unauthorized devices from spoofing IPv6 addresses on the network. The switches are capable of Layer 2 security features. Which combination of features should be enabled on the access switches?
Select an answer first
17application · medium
A network engineer is securing a dual-stack router that connects to an untrusted external network. The router runs BGP with an ISP and also provides management access via SSH. The security policy requires that only the ISP's BGP peer can establish BGP sessions, and that management access is restricted to a specific IPv6 management host. Which configuration approach meets these requirements?
Select an answer first
18application · medium
A switch in a data center connects to multiple servers. The security team wants to prevent ARP spoofing attacks and also ensure that the switch's CPU is not overwhelmed by broadcast traffic. The servers use static IP addresses. Which two features should be enabled on the switch?
Select an answer first
19application · medium
An enterprise is migrating to IPv6. The access switches are connected to end-user devices. The security team wants to block rogue IPv6 router advertisements and also prevent unauthorized devices from sending IPv6 traffic with spoofed source addresses. Which two features should be enabled on the access switches?
Select an answer first
20application · medium
A branch office switch connects to a distribution switch via a trunk port. The network team wants to prevent a rogue switch from being plugged into an access port and becoming the root bridge. They also want to limit the number of MAC addresses learned on that access port to two. Which configuration on the access port meets both requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.

Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 4)

Questions 16–20

A switch in a data center connects to multiple servers. The security team wants to prevent ARP spoofing attacks and also ensure that the switch's CPU is not overwhelmed by broadcast traffic. The servers use static IP addresses. Which two features should be enabled on the switch?

Keep studying — Infrastructure Security and Services