3.4 Layer 2 Security Techniques CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network engineer is securing a switch that connects to a DHCP server and multiple end-user devices. The goal is to prevent rogue DHCP servers and DHCP starvation attacks. The engineer has enabled DHCP snooping globally. What additional configuration is required to achieve the goal?

   • AConfigure the port connected to the DHCP server as trusted and enable DHCP snooping on the user VLANs.
   • BEnable DAI on the user VLANs to filter DHCP messages.
   • CConfigure IP Device Tracking on the switch to monitor DHCP requests.
   • DEnable port security on all user ports to limit the number of DHCP requests per port.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A network engineer is configuring DAI on a VLAN that has both DHCP and static hosts. The engineer wants to ensure that ARP requests from static hosts are validated, but also wants to prevent ARP spoofing from DHCP hosts. Which configuration is the most secure and efficient?

   • AEnable DAI on the VLAN and use port security to statically define all MAC addresses.
   • BEnable DAI on the VLAN and configure all static hosts as trusted ports.
   • CEnable DAI on the VLAN, configure ARP ACLs for static hosts, and rely on DHCP snooping bindings for DHCP hosts.
   • DEnable DAI on the VLAN and disable DHCP snooping to avoid conflicts.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to restrict each switch port to a single authorized device. The network uses DHCP for IP assignment. The security team wants to prevent MAC spoofing and unauthorized devices from connecting. Which configuration approach best meets these requirements?

   • AEnable IP Device Tracking and set a static IP-to-MAC binding.
   • BEnable DHCP snooping and configure the port as trusted.
   • CEnable port security with sticky MAC addresses and a violation mode of shutdown.
   • DEnable DAI with ARP ACLs to permit only the authorized MAC.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A network administrator is deploying IPv6 on a campus network. The security team is concerned about rogue router advertisements that could redirect traffic. The switches are Cisco Catalyst 3850s. Which feature should be enabled to filter unauthorized IPv6 router advertisements?

   • ADHCPv6 Guard on access ports.
   • BIPv6 First Hop Security with BPDU Guard.
   • CRA Guard on access ports facing end devices.
   • DPort security with IPv6 MAC addresses.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security administrator needs to block all traffic between two departments that share the same VLAN, except for HTTP and HTTPS traffic to a specific web server. The switch is a Catalyst 4500. Which technology should be used to enforce this policy?

   • ADAI with ARP ACLs to block traffic.
   • BDHCP snooping with a rate limit to drop traffic.
   • CPort security with MAC-based ACLs.
   • DVACL on the VLAN to filter traffic between hosts.
   Reveal Solution Discussion Select an answer first