Port Security Including MAC Limiting, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard JN0-352 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which Junos feature must be enabled before IP source guard can be configured?

   • ASpanning Tree Protocol
   • BDHCP snooping
   • CDynamic ARP Inspection
   • DMAC limiting
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network administrator is configuring a Junos switch for a conference room where visitors plug in laptops. The administrator wants to prevent MAC flooding attacks while still allowing multiple devices to connect. The switch is connected to a DHCP server that assigns addresses to all devices. What should the administrator configure on the access interface?

   • AConfigure the interface as a trunk port and enable 'storm-control' with a broadcast threshold.
   • BSet the interface to 'interface-mode access' and apply a MAC limit of 5 with the 'mac-limit' statement.
   • CEnable DHCP snooping on the interface and set the 'dhcp-trust' option to 'untrusted'.
   • DApply a firewall filter that permits only DHCP traffic and denies all other IP traffic.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A network administrator is configuring a Junos switch to prevent ARP spoofing. DHCP snooping is enabled, but the administrator is concerned about the impact of DAI on network performance. The switch has a high volume of ARP traffic. What should the administrator do to minimize the performance impact while still preventing ARP spoofing?

   • AEnable DAI only on access ports where untrusted devices connect.
   • BEnable DAI and disable ARP learning on access ports.
   • CEnable DAI and increase the ARP cache timeout.
   • DEnable DAI on all ports, including uplinks.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of IP source guard on a Junos switch?

   • ATo limit the number of IP addresses that can be used on an interface
   • BTo encrypt IP traffic between the switch and hosts
   • CTo prevent ARP spoofing by validating ARP packets
   • DTo prevent IP spoofing by filtering traffic based on the DHCP snooping binding database
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Junos switch has DHCP snooping enabled globally. The switch connects to a DHCP server on ge-0/0/1 and to end-user devices on ge-0/0/2 through ge-0/0/10. The administrator wants to ensure that only the DHCP server can provide IP addresses and that ARP spoofing is prevented. What should the administrator configure?

   • ASet all interfaces as 'dhcp-trust' and enable DAI only on ge-0/0/1.
   • BSet ge-0/0/1 as 'dhcp-trust' and ge-0/0/2 through ge-0/0/10 as 'dhcp-untrusted', then enable Dynamic ARP Inspection (DAI) globally.
   • CEnable DAI on all interfaces and configure a static ARP entry for the DHCP server.
   • DConfigure IP source guard on ge-0/0/2 through ge-0/0/10 and leave DHCP snooping disabled.
   Reveal Solution Discussion Select an answer first