security 2

Refer to the exhibit. PC1 and PC2 should be able to obtain IP address assignments from the DHCP server. How many ports among switches should be assigned as trusted ports as part of the DHCP snooping configuration?

7

What are three techniques for mitigating VLAN attacks?

Enable trunking manually. Disable DTP. Set the native VLAN to an unused VLAN.

A network administrator enters the following commands on the switch SW1. SW1(config)# interface range fa0/5 - 10 SW1(config-if)# ip dhcp snooping limit rate 6 What is the effect after these commands are entered?

FastEthernet ports 5 through 10 can receive up to 6 DHCP discovery messages per second.

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

Frames from PC1 will cause the interface to shut down immediately, and a log entry will be made.

A network administrator is configuring DAI on a switch with the command ip arp inspection validate src-mac . What is the purpose of this configuration command?

It checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body

Which two commands can be used to enable BPDU guard on a switch? (Choose two.)

S1(config)# spanning-tree portfast bpduguard default S1(config-if)# spanning-tree bpduguard enable

Refer to the exhibit. Port Fa0/2 has already been configured appropriately. The IP phone and PC work properly. Which switch configuration would be most appropriate for port Fa0/2 if the network administrator has the following goals?

SWA(config-if)# switchport port-security SWA(config-if)# switchport port-security maximum 2 SWA(config-if)# switchport port-security mac-address sticky

Refer to the exhibit. The Fa0/2 interface on switch S1 has been configured with the switchport port-security mac-address 0023.189d.6456 command and a workstation has been connected. What could be the reason that the Fa0/2 interface is shutdown?

The MAC address of PC1 that connects to the Fa0/2 interface is not the configured MAC address.

Refer to the exhibit. What can be determined about port security from the information that is shown?

The port violation mode is the default for any port that has port security enabled.

Which type of VLAN-hopping attack may be prevented by designating an unused VLAN as the native VLAN?

VLAN double-tagging

What security benefit is gained from enabling BPDU guard on PortFast enabled interfaces?

preventing rogue switches from being added to the network*

A network administrator is configuring port security on a Cisco switch. The company security policy specifies that when a violation occurs, packets with unknown source addresses should be dropped and no notification should be sent. Which violation mode should be configured on the interfaces?

protect

An IT security specialist enables port security on a switch port of a Cisco switch. What is the default violation mode in use until the switch port is configured to use a different violation mode?

shutdown

As part of the new security policy, all switches on the network are configured to automatically learn MAC addresses for each port. All running configurations are saved at the start and close of every business day. A severe thunderstorm causes an extended power outage several hours after the close of business. When the switches are brought back online, the dynamically learned MAC addresses are retained. Which port security configuration enabled this?

sticky secure MAC addresses