Layer 1/Layer 2 Defense GDSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A data center manager is concerned about unauthorized physical access to network switches in a shared colocation facility. The facility provides locked cabinets, but the manager wants an additional control that can detect if someone opens the cabinet or tampers with the equipment. Which control is most appropriate?

   • AEnable BPDU guard on all switch ports connected to the cabinet.
   • BConfigure port security on all switch ports in the cabinet.
   • CUse cable locks to secure the switches inside the cabinet.
   • DInstall tamper-evident seals on the cabinet doors and use a camera to monitor the aisle.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A small business has a network closet that is accessible to all employees. The owner wants to prevent someone from unplugging a switch and plugging in a personal device to gain network access. Which combination of physical and Layer 2 controls is most effective?

   • AUse cable locks on the switches and enable BPDU guard.
   • BInstall a camera and disable unused ports.
   • CUse tamper-evident seals and enable DHCP snooping.
   • DLock the network closet and enable port security on all switch ports.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A network administrator is investigating a security incident where an attacker on a guest VLAN was able to intercept traffic from a user on a different VLAN. The attacker used a double-tagged 802.1Q frame to send traffic to the victim's VLAN. The switch is configured with the default native VLAN on trunk ports. Which configuration change would best mitigate this type of VLAN hopping attack?

   • AChange the native VLAN on all trunk ports to an unused VLAN ID.
   • BEnable BPDU guard on all access ports.
   • CDisable DTP on all access ports.
   • DEnable Dynamic ARP Inspection on all VLANs.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is investigating a report of slow network performance. The analyst discovers that an attacker has been sending frames with 802.1Q tags and a native VLAN mismatch to reach a VLAN that should be isolated. Which Layer 2 attack is being used, and which mitigation is most effective?

   • ASpanning Tree attack; enable BPDU guard.
   • BARP spoofing; enable Dynamic ARP Inspection.
   • CMAC flooding; enable port security with a maximum MAC count.
   • DVLAN hopping; disable trunking on access ports and use a dedicated native VLAN.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A small financial firm occupies a shared office building. The server room door has a standard key lock, and the network rack is open to the hallway. A recent audit noted that an unauthorized person could unplug a switch uplink and plug in a rogue device. Which combination of controls would best address the physical exposure while also limiting the impact of a rogue device at the data link layer?

   • AEnable DHCP snooping and Dynamic ARP Inspection on the switch.
   • BUse cable locks on the switch and configure a private VLAN for the server room segment.
   • CInstall a biometric door lock, add tamper-evident seals to the rack, and enable port security on all switch ports.
   • DMove the switch to a locked cabinet and disable all unused ports on the switch.
   Reveal Solution Discussion Select an answer first