Layer 1/Layer 2 Defense GDSA Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A data center manager is planning a security upgrade for a server room that houses critical network switches. The room is accessible only to authorized staff, but there have been incidents of unauthorized access. The manager wants to implement controls that provide both deterrence and detection of physical tampering, while also ensuring that if an attacker gains physical access to a switch console port, they cannot easily reconfigure the device. Which combination of controls is most effective?

   • AInstall a biometric access control system, use tamper-evident seals on equipment, and set strong passwords on console ports.
   • BInstall surveillance cameras and disable unused switch ports.
   • CUse cable locks on all equipment and enable BPDU guard on all ports.
   • DUse a lockable rack and enable port security on all switch ports.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing logs and sees that a switch's CAM table is full, causing the switch to flood unicast traffic to all ports. The analyst suspects a MAC flooding attack. Which two controls should be implemented to mitigate this attack and its consequences?

   • ADisable unused ports and enable Dynamic ARP Inspection.
   • BBPDU guard and root guard.
   • CPrivate VLANs and loop guard.
   • DPort security to limit MAC addresses per port and DHCP snooping to validate DHCP messages.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of a MAC flooding attack?

   • ATo redirect traffic to a malicious server
   • BTo create a loop in the network topology
   • CTo overwhelm the switch's MAC address table and force it to flood traffic to all ports
   • DTo disable the switch's management interface
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A network architect is designing a multi-tenant building where each tenant has its own VLAN. The architect wants to prevent any tenant from affecting the spanning tree topology of the core network. The core switch is the root bridge. Which combination of STP features should be applied on the access ports facing tenant switches?

   • ARoot guard and loop guard on all access ports.
   • BLoop guard and UDLD on all access ports.
   • CRoot guard and BPDU guard on all access ports.
   • DPort security and DHCP snooping on all access ports.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of root guard in a Spanning Tree Protocol environment?

   • ATo disable a port that receives BPDUs
   • BTo limit the number of MAC addresses on a port
   • CTo prevent a designated port from becoming a root port
   • DTo detect unidirectional links
   Reveal Solution Discussion Select an answer first