3.4 Layer 2 Security Techniques CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What happens to a switch port when BPDU Guard is enabled and it receives a BPDU?

   • AThe port is placed in a blocking state
   • BThe port is put into an error-disabled state
   • CThe port is configured as a root port
   • DThe BPDU is ignored
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which port security violation mode shuts down the port and requires manual intervention to re-enable it?

   • AShutdown
   • BBlock
   • CRestrict
   • DProtect
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of configuring port security aging on a switch port?

   • ATo automatically remove learned MAC addresses after a specified time
   • BTo prevent any MAC address from being learned on the port
   • CTo increase the maximum number of MAC addresses allowed on the port
   • DTo permanently secure the MAC addresses on the port
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of DHCP snooping?

   • ATo encrypt DHCP messages
   • BTo filter untrusted DHCP messages and build a binding database
   • CTo replace the DHCP server
   • DTo assign IP addresses to hosts
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator is troubleshooting a series of ARP cache poisoning attacks on a campus LAN. The switches are Cisco Catalyst 3850s running IOS-XE. The administrator has already enabled DHCP snooping globally and on the relevant VLANs. Which additional configuration is required to validate ARP packets and prevent these attacks?

   • AEnable DAI on the VLANs and apply an ARP ACL that permits only valid IP-to-MAC bindings.
   • BConfigure port security on all access ports to limit the number of MAC addresses and prevent ARP spoofing.
   • CEnable BPDU Guard on all access ports to prevent rogue switches from sending ARP replies.
   • DEnable IP Device Tracking on the VLANs to build a separate IP-to-MAC database for ARP validation.
   Reveal Solution Discussion Select an answer first