Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network engineer is deploying IPv6 in a data center. They need to prevent an attacker from spoofing DHCPv6 messages on the access layer. Which feature should be enabled on the switch ports connected to end hosts?

   • AIPv6 source guard
   • BIPv6 ACL
   • CIPv6 RA guard
   • DDHCPv6 guard
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network administrator is configuring a router for remote management. They want to use AAA for authentication and also ensure that only SSH traffic is allowed to the router's VTY lines. Which configuration is required?

   • AConfigure AAA authentication for login, and enable Telnet on the VTY lines
   • BConfigure AAA and use SNMPv3 for management
   • CConfigure local usernames and apply an ACL that permits only TCP port 23
   • DConfigure AAA authentication for login, and apply an ACL that permits only TCP port 22 to the VTY lines
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network engineer is configuring a switch that connects to a server farm. The servers are statically configured with IP addresses. The engineer wants to prevent IP spoofing on the server ports. Which feature should be enabled?

   • ADynamic ARP Inspection (DAI)
   • BDHCP snooping with a static binding
   • CPort-security with MAC limiting
   • DIP source guard with static IP-source binding
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A service provider router is running BGP with multiple customers. The network team wants to prevent BGP route spoofing and also ensure that only legitimate BGP peers can establish sessions. Which two mechanisms should be implemented?

   • ABGP MD5 authentication and a route map
   • BBGP next-hop-self and a distribute list
   • CBGP TTL security and a prefix list
   • DBGP MD5 authentication and a BGP neighbor ACL
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large enterprise network is experiencing intermittent connectivity issues on an access switch. The switch has DHCP snooping, DAI, IP source guard, and port-security enabled on all access ports. A user reports that their PC cannot reach the network after being moved to a different port. The PC uses a static IP address. The network administrator checks the DHCP snooping binding table and finds no entry for the PC's IP. What is the most likely cause of the connectivity failure?

   • ADAI is dropping the PC's ARP packets because the port is untrusted
   • BIP source guard is dropping the PC's traffic because there is no binding entry
   • CDHCP snooping is blocking the PC because it is sending DHCP requests
   • DPort-security is blocking the PC because the MAC address is not allowed
   Reveal Solution Discussion Select an answer first