CCIE Security
Domain 3Objective 4
3.4 Layer 2 Security Techniques CCIE-SECURITY Practice Questions (Page 9)
Part of the 3.0 Security Infrastructure domain, which accounts for 15% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)
53questions here
11free pages
7concepts
15%of the exam
Questions 41–45
- 41
An admin is troubleshooting a network where DHCP clients are receiving IP addresses, but ARP resolution is failing intermittently. DHCP snooping is enabled, and DAI is configured on the VLAN. The admin notices that some devices are using static IP addresses. What is the most likely cause of the ARP failures?
Select an answer first - 42
A network admin is securing a switch that has both IPv4 and IPv6 traffic. The admin wants to protect the STP topology by preventing unauthorized switches from becoming the root bridge, and also wants to prevent rogue IPv6 routers from sending advertisements. Which combination of features should be enabled?
Select an answer first - 43
A company has a policy that each switch port should allow only one device, but some ports are used for IP phones that require two MAC addresses (phone and PC). The admin has enabled port security with a maximum of 2 MAC addresses. However, they also want to ensure that if a violation occurs, the port is not completely disabled but only drops traffic from unknown MACs. Which violation mode should be used?
Select an answer first - 44
An organization is deploying IPv6 and wants to ensure that only the legitimate router can send Router Advertisements. They have enabled RA Guard on access ports. However, they also want to filter IPv6 traffic between two subnets within the same VLAN. What is the best approach?
Select an answer first - 45
A switch has DHCP snooping enabled on VLAN 10. The admin notices that some legitimate DHCP clients are not receiving IP addresses. The DHCP server is connected to port Gi1/0/1, and clients are on ports Gi1/0/2-24. What is the most likely cause of the issue?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.