A network administrator is troubleshooting a user's inability to reach the internet. The access switch has DHCP snooping enabled. The user's PC is connected to port Gi1/0/5, which is configured as an untrusted port. The PC successfully obtained an IP address from the DHCP server, but traffic from the PC is being dropped. What is the most likely cause?

IP source guard is enabled on the port and the DHCP snooping binding table is empty

The port is in errdisable state due to a DHCP snooping violation

The port is configured as a DHCP snooping trusted port

The PC's MAC address is not in the MAC address table

A network engineer is configuring a new access layer switch for a secure campus deployment. The requirements are: (1) prevent DHCP starvation attacks from user ports, (2) prevent ARP spoofing, and (3) limit the number of MAC addresses per port. Which combination of features should be enabled on user-facing ports?

DHCP snooping, DAI, and port-security

Port-security, root guard, and DHCP snooping

DAI, storm control, and BPDU guard

DHCP snooping, IP source guard, and storm control

A network administrator needs to secure management access to a Cisco router. The requirements are: (1) use AAA for authentication, (2) restrict management access to a specific subnet, and (3) protect the control plane from excessive traffic. Which configuration approach best meets these requirements?

Configure local usernames, apply an ACL to the VTY lines, and enable storm control

Configure AAA with a local fallback, apply an ACL to the VTY lines, and enable control plane policing

Configure AAA, use SSH only, and enable BPDU guard

Configure AAA, apply an ACL to the physical interface, and enable uRPF

A network engineer is configuring a router that connects to an untrusted external network. The requirement is to prevent IP spoofing attacks where an attacker sends packets with a source address from the internal network. Which feature should be enabled on the external interface?

Access control list to permit internal source addresses

Control plane policing to rate-limit traffic

Unicast Reverse Path Forwarding (uRPF) in strict mode

Unicast Reverse Path Forwarding (uRPF) in loose mode

CCIE Enterprise Infrastructure

Domain 4Objective 2

Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 7)

Part of the Infrastructure Security and Services domain, which accounts for 15% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

3concepts

15%of the exam

Questions 31–35

31application · medium
A network administrator is troubleshooting a user's inability to reach the internet. The access switch has DHCP snooping enabled. The user's PC is connected to port Gi1/0/5, which is configured as an untrusted port. The PC successfully obtained an IP address from the DHCP server, but traffic from the PC is being dropped. What is the most likely cause?
Select an answer first
32expert · hard · select all that apply
A network administrator is designing a secure access layer for a new building. The requirements are: (1) prevent DHCP starvation, (2) prevent ARP spoofing, (3) prevent IP spoofing, and (4) limit broadcast storms. Which of the following features should be enabled on user-facing ports? (Select all that apply.)
Select an answer first
33application · medium
A network engineer is configuring a new access layer switch for a secure campus deployment. The requirements are: (1) prevent DHCP starvation attacks from user ports, (2) prevent ARP spoofing, and (3) limit the number of MAC addresses per port. Which combination of features should be enabled on user-facing ports?
Select an answer first
34application · medium
A network administrator needs to secure management access to a Cisco router. The requirements are: (1) use AAA for authentication, (2) restrict management access to a specific subnet, and (3) protect the control plane from excessive traffic. Which configuration approach best meets these requirements?
Select an answer first
35application · medium
A network engineer is configuring a router that connects to an untrusted external network. The requirement is to prevent IP spoofing attacks where an attacker sends packets with a source address from the internal network. Which feature should be enabled on the external interface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.

Network Security CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 7)

Questions 31–35

A network engineer is configuring a router that connects to an untrusted external network. The requirement is to prevent IP spoofing attacks where an attacker sends packets with a source address from the internal network. Which feature should be enabled on the external interface?

Keep studying — Infrastructure Security and Services