What is the primary purpose of Dynamic ARP Inspection (DAI) on a switch?

To filter all ARP traffic to prevent any ARP requests from reaching the network

To encrypt ARP packets to protect them from eavesdropping

To replace ARP with a more secure protocol

To prevent ARP spoofing by validating ARP packets against the DHCP snooping binding database

Which type of DHCP message is typically filtered on an untrusted port by DHCP snooping?

DHCP server messages (e.g., DHCPOFFER, DHCPACK)

DHCP client messages (e.g., DHCPDISCOVER, DHCPREQUEST)

What is the primary purpose of Router Advertisement (RA) Guard?

To encrypt IPv6 router advertisements

To replace the IPv6 routing protocol

To filter IPv6 router advertisements to prevent rogue router attacks

To block all IPv6 traffic on a port

What is the primary purpose of a VLAN Access Control List (VACL)?

To filter traffic within a VLAN

To filter traffic between VLANs

CCIE Security

Domain 3Objective 4

3.4 Layer 2 Security Techniques CCIE-SECURITY Practice Questions (Page 1)

Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

15%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of Dynamic ARP Inspection (DAI) on a switch?
Select an answer first
2foundation · easy
Which type of DHCP message is typically filtered on an untrusted port by DHCP snooping?
Select an answer first
3foundation · easy
What is the primary purpose of Router Advertisement (RA) Guard?
Select an answer first
4foundation · easy
Which type of IPv6 message does RA Guard specifically filter?
Select an answer first
5foundation · easy
What is the primary purpose of a VLAN Access Control List (VACL)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.