Layer 1/Layer 2 Defense GDSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A university is deploying a new computer lab with 30 student workstations. The lab manager wants to prevent students from connecting personal devices to the network and also wants to ensure that if a student connects a rogue switch, it cannot affect the rest of the network. Which two controls should be implemented on the lab switch ports?

   • ADisable unused ports and enable loop guard.
   • BPort security with a maximum MAC address limit and BPDU guard.
   • CDHCP snooping and Dynamic ARP Inspection.
   • DPrivate VLANs and root guard.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key characteristic of a private VLAN (PVLAN)?

   • AIt provides additional isolation within a VLAN by restricting communication between ports in the same VLAN
   • BIt provides a separate IP address range for each port
   • CIt allows all ports in the VLAN to communicate freely
   • DIt encrypts traffic between hosts in the same VLAN
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is disabling unused switch ports an effective Layer 2 security control?

   • AIt reduces broadcast traffic on the network
   • BIt prevents MAC address spoofing
   • CIt prevents unauthorized devices from connecting to the network
   • DIt encrypts data transmitted over the port
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A network administrator is configuring a new access layer for a financial trading floor. The environment has strict security requirements: no rogue DHCP servers, no ARP spoofing, and no IP spoofing. The administrator plans to enable DHCP snooping, Dynamic ARP Inspection, and IP Source Guard. Which additional configuration is required to ensure these features work correctly?

   • AConfigure the DHCP snooping binding table to include static IP reservations for devices that do not use DHCP.
   • BDisable DTP on all access ports.
   • CEnable BPDU guard on all access ports.
   • DConfigure all access ports as trusted for DHCP snooping.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A hospital network has a mix of IoT devices (e.g., infusion pumps, patient monitors) and clinical workstations. The IoT devices are on a separate VLAN, but the security team is concerned that if one IoT device is compromised, it could be used to attack other IoT devices on the same VLAN. The devices need to communicate only with a central management server. Which Layer 2 solution provides the strongest isolation while minimizing administrative overhead?

   • AConfigure a private VLAN with the management server as the promiscuous port and all IoT devices as isolated ports.
   • BEnable DHCP snooping and DAI on the IoT VLAN.
   • CPlace each IoT device in its own VLAN and route all traffic through a firewall.
   • DUse port security with a single MAC address on each IoT port.
   Reveal Solution Discussion Select an answer first