Copy and Edit

CCNA Security Chapter 6 Exam

Description

CCNA Security Chapter 6 Exam
d94829 d94829
Quiz by d94829 d94829, updated more than 1 year ago
d94829 d94829
Created by d94829 d94829 over 6 years ago
588
3
0

Resource summary

Question 1

Question
Refer to the exhibit. The Fa0/2 interface on switch S1 has been configured with the switchport port-security mac-address 0023.189d.6456 command and a workstation has been connected. What could be the reason that the Fa0/2 interface is shutdown?
Image:
Gu Qod Y7 Dl Tr1 Tlvef Yswu Mz9v F Tav J Ux Jw D Dn Nv Numxw Za Rrqt Do Wy R Lr41 Xd L V Lj Y Uy9xdh P Dd Jyh Vi Jk Ylpnagjh Lg R3 Re Vi17 I9 Zfol2 I9y Gn5ysd6ok B4y2i2n Ub4 Vkfz8 Ez Uj L3xv7gpl4vvwc0z0we R7ey3 T F Akb Oxa4j M Fxov Ll6nc9 Kng Fv Bxq Apa8s (image/png)
Answer
  • The connection between S1 and PC1 is via a crossover cable
  • The Fa0/24 interface of S1 is configured with the same MAC address as the Fa0/2 interface
  • S1 has been configured with a switchport port-security aging command
  • The MAC address of PC1 that connects to the Fa0/2 interface is not the configured MAC address

Question 2

Question
Two devices that are connected to the same switch need to be totally isolated from one another. Which Cisco switch security feature will provide this isolation?
Answer
  • PVLAN Edge
  • DTP
  • SPAN
  • BPDU guard

Question 3

Question
Which two functions are provided by Network Admission Control?
Answer
  • protecting a switch from MAC address table overflow attacks
  • enforcing network security policy for hosts that connect to the network
  • ensuring that only authenticated hosts can access the network
  • stopping excessive broadcasts from disrupting network traffic
  • limiting the number of MAC addresses that can be learned on a single switch port

Question 4

Question
Which spanning-tree enhancement prevents the spanning-tree topology from changing by blocking a port that receives a superior BPDU?
Answer
  • BDPU filter
  • PortFast
  • BPDU guard
  • root guard

Question 5

Question
Which security feature should be enabled in order to prevent an attacker from overflowing the MAC address table of a switch?
Answer
  • root guard
  • port security
  • storm control
  • BPDU filter

Question 6

Question
In what situation would a network administrator most likely implement root guard?
Answer
  • on all switch ports (used or unused)
  • on all switch ports that connect to a Layer 3 device
  • on all switch ports that connect to host devices
  • on all switch ports that connect to another switch
  • on all switch ports that connect to another switch that is not the root bridge

Question 7

Question
What component of Cisco NAC is responsible for performing deep inspection of device security profiles?
Answer
  • Cisco NAC Profiler
  • Cisco NAC Agent
  • Cisco NAC Manager
  • Cisco NAC Server

Question 8

Question
What is the role of the Cisco NAC Manager in implementing a secure networking infrastructure?
Answer
  • to define role-based user access and endpoint security policies
  • to assess and enforce security policy compliance in the NAC environment
  • to perform deep inspection of device security profiles
  • to provide post-connection monitoring of all endpoint devices

Question 9

Question
What is the role of the Cisco NAC Server within the Cisco Secure Borderless Network Architecture?
Answer
  • providing the ability for company employees to create guest accounts
  • providing post-connection monitoring of all endpoint devices
  • defining role-based user access and endpoint security policies
  • assessing and enforcing security policy compliance in the NAC environment

Question 10

Question
What is the role of the Cisco NAC Guest Server within the Cisco Borderless Network architecture?
Answer
  • It defines role-based user access and endpoint security policies.
  • It provides the ability for creation and reporting of guest accounts
  • It provides post-connection monitoring of all endpoint devices
  • It performs deep inspection of device security profiles

Question 11

Question
Which three functions are provided under Cisco NAC framework solution? (Choose three.)
Answer
  • VPN connection
  • AAA services
  • intrusion prevention
  • scanning for policy compliance
  • secure connection to servers
  • remediation for noncompliant devices

Question 12

Question
Which feature is part of the Antimalware Protection security solution?
Answer
  • file retrospection
  • user authentication and authorization
  • data loss prevention
  • spam blocking

Question 13

Question
What security countermeasure is effective for preventing CAM table overflow attacks?
Answer
  • DHCP snooping
  • Dynamic ARP Inspection
  • IP source guard
  • port security

Question 14

Question
What is the behavior of a switch as a result of a successful CAM table attack?
Answer
  • The switch will forward all received frames to all other ports
  • The switch will drop all received frames
  • The switch interfaces will transition to the error-disabled state
  • The switch will shut down

Question 15

Question
What additional security measure must be enabled along with IP Source Guard to protect against address spoofing?
Answer
  • port security
  • BPDU Guard
  • root guard
  • DHCP snooping

Question 16

Question
What are three techniques for mitigating VLAN hopping attacks? (Choose three.)
Answer
  • Set the native VLAN to an unused VLAN
  • Disable DTP
  • Enable Source Guard
  • Enable trunking manually
  • Enable BPDU guard
  • Use private VLANs

Question 17

Question
What two mechanisms are used by Dynamic ARP inspection to validate ARP packets for IP addresses that are dynamically assigned or IP addresses that are static? (Choose two.)
Answer
  • MAC-address-to-IP-address bindings
  • RARP
  • ARP ACLs
  • IP ACLs
  • Source Guard

Question 18

Question
What protocol should be disabled to help mitigate VLAN hopping attacks?
Answer
  • STP
  • ARP
  • CDP
  • DTP

Question 19

Question
What network attack seeks to create a DoS for clients by preventing them from being able to obtain a DHCP lease?
Answer
  • DHCP spoofing
  • CAM table attack
  • IP address spoofing
  • DHCP starvation

Question 20

Question
What is the only type of port that an isolated port can forward traffic to on a private VLAN
Answer
  • a community port
  • a promiscuous port
  • another isolated port
  • any access port in the same PVLAN

Question 21

Question
Which STP stability mechanism is used to prevent a rogue switch from becoming the root switch?
Answer
  • Source Guard
  • BPDU guard
  • root guard
  • loop guard

Question 22

Question
How can a user connect to the Cisco Cloud Web Security service directly?
Answer
  • through the connector that is integrated into any Layer 2 Cisco switch
  • by using a proxy autoconfiguration file in the end device
  • by accessing a Cisco CWS server before visiting the destination web site
  • by establishing a VPN connection with the Cisco CWS

Question 23

Question
What security benefit is gained from enabling BPDU guard on PortFast enabled interfaces?
Answer
  • enforcing the placement of root bridges
  • preventing buffer overflow attacks
  • preventing rogue switches from being added to the network
  • protecting against Layer 2 loops

Question 24

Question
Which mitigation technique would prevent rogue servers from providing false IP configuration parameters to clients
Answer
  • implementing port-security on edge ports
  • implementing port security
  • turning on DHCP snooping
  • disabling CDP on edge ports
Show full summary Hide full summary

Want to create your own Quizzes for free with GoConqr? Learn more.

Similar

CCNA Security HW 3 & 4 (also exam review)
Anthony Schulmeister
CCNA Security 210-260 IINS - Exam 1
Mike M
CCNA Security 210-260 IINS - Exam 2
Mike M
CCNA Security 210-260 IINS - Exam 3
Mike M
CCNA Security Final Exam
Maikel Degrande
CCNA Part 1
Axiom42
CCNA Answers – CCNA Exam
Abdul Demir
CCNA Part 2
Axiom42
Hálózat 5
Cougar
CCNA Security Chapter 1 Exam
d94829 d94829
CCNA Security Chapter 4 Exam
d94829 d94829
Browse Library