3.4 Layer 2 Security Techniques CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator is implementing DAI on a VLAN that uses static IP addresses for servers and DHCP for clients. The administrator wants to ensure that ARP requests for the static servers are validated. What is the best approach?

   • AUse port security to statically define the server MAC addresses.
   • BEnable DHCP snooping on the VLAN and trust the server ports.
   • CCreate an ARP ACL to permit the static IP-to-MAC bindings and enable DAI on the VLAN.
   • DEnable IP Device Tracking to populate the DAI binding table.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a policy that each switch port should allow only one MAC address, and if a different MAC is seen, the port should be shut down permanently until manually re-enabled. Which port security configuration meets this requirement?

   • APort security with maximum MAC addresses 2, violation mode shutdown, and sticky learning.
   • BPort security with maximum MAC addresses 1, violation mode restrict, and aging type inactivity.
   • CPort security with maximum MAC addresses 1, violation mode shutdown, and sticky MAC learning.
   • DPort security with maximum MAC addresses 1, violation mode protect, and no sticky learning.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network engineer is deploying IPv6 on a segment with multiple access switches. The engineer wants to ensure that only the legitimate router can send Router Advertisements. Which feature should be enabled on the access ports?

   • ADHCPv6 Guard on the access ports.
   • BBPDU Guard on the access ports.
   • CRA Guard with a policy that permits only the legitimate router's MAC address.
   • DIP Device Tracking to monitor RA messages.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A security administrator needs to block all traffic between two hosts in the same VLAN, but allow them to communicate with a server in a different VLAN. The switch is a Catalyst 6500 with a Supervisor Engine 720. The administrator has configured a VACL to deny traffic between the hosts. However, the hosts can still ping each other. What is the most likely cause?

   • AThe VACL is not capturing traffic because the hosts are on different VLANs.
   • BThe VACL is being bypassed because the traffic is switched in hardware.
   • CThe VACL is not configured with a default action of drop.
   • DThe VACL is not applied to the VLAN in the correct direction.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A network administrator is troubleshooting an STP issue where a switch port keeps going into errdisable state. The port is connected to a device that is sending BPDUs. The administrator wants to allow the port to recover automatically after 5 minutes. Which configuration should be used?

   • AEnable errdisable recovery for BPDU Guard with a timer of 300 seconds.
   • BIncrease the port security violation mode to protect.
   • CConfigure the port as a trunk port to allow BPDUs.
   • DDisable BPDU Guard on the port and enable BPDU Filtering.
   Reveal Solution Discussion Select an answer first