3.4 Layer 2 Security Techniques CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A network engineer is configuring DHCP snooping on a switch that also runs DAI. The switch has a mix of DHCP and static IP hosts. The engineer notices that ARP requests from static hosts are being dropped by DAI. What is the most likely cause?

   • AIP Device Tracking is not enabled for static hosts.
   • BDAI is not enabled on the VLAN where the static hosts are connected.
   • CThe DHCP snooping binding database is not populated because the switch is not trusted.
   • DThe static hosts are not in the DHCP snooping binding database, and no ARP ACL is configured.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A network administrator is configuring port security on a switch port that connects to a VoIP phone and a PC. The phone is daisy-chained to the PC. The administrator wants to allow both MAC addresses but also wants to prevent any other device from connecting. Which configuration is correct?

   • APort security with maximum MAC addresses 2, violation mode shutdown, and sticky learning.
   • BPort security with maximum MAC addresses 1, violation mode protect, and sticky learning.
   • CPort security with maximum MAC addresses 2, violation mode restrict, and no sticky learning.
   • DPort security with maximum MAC addresses 3, violation mode shutdown, and sticky learning.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A network engineer is implementing RA Guard on a switch that also runs DHCPv6 snooping. The engineer wants to ensure that only the legitimate router can send Router Advertisements, but the router uses a link-local address that changes periodically. What is the best way to configure RA Guard?

   • AConfigure RA Guard with a policy that permits the router's MAC address.
   • BUse IP Device Tracking to dynamically allow the router's RA.
   • CConfigure RA Guard with a policy that permits the router's link-local address.
   • DDisable RA Guard and rely on DHCPv6 snooping to filter RAs.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A security administrator is using VACLs to filter traffic within a VLAN. The administrator also needs to ensure that BPDUs are not filtered by the VACL. Which configuration should be applied?

   • ADisable VACL on the VLAN and use ACLs on the SVI.
   • BUse port security to allow BPDUs.
   • CConfigure the VACL to permit BPDU traffic (spanning-tree) explicitly.
   • DEnable BPDU Guard on all ports to protect BPDUs.
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A network administrator is troubleshooting a problem where DHCP snooping is not populating the binding table for some clients. The clients are using static IP addresses. The administrator has enabled DHCP snooping and DAI on the VLAN. What is the most likely cause of the missing bindings?

   • ADAI is interfering with DHCP snooping.
   • BIP Device Tracking is not enabled.
   • CThe DHCP snooping database is not configured to write to flash.
   • DStatic IP clients do not generate DHCP messages, so they are not in the DHCP snooping binding table.
   Reveal Solution Discussion Select an answer first