CCNP 300-115 TOPIC SEGURIDAD

Frage 1 von 31

1

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Wähle eine der folgenden:

A DHCP snooping database agent should be configured.
Enable DHCP snooping for all VLANs that are associated with the switch.
Disable Option 82 for DHCP data insertion.
Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting.
Apply ip dhcp snooping trust on all interfaces with dynamic addresses.

Erklärung

Frage 2 von 31

1

Which portion of AAA looks at what a user has access to?

Wähle eine der folgenden:

authorization
authentication
accounting
auditing

Erklärung

Frage 3 von 31

1

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

Wähle eine der folgenden:

(config)# aaa authentication login default radius local
(config)# aaa authentication login login radius local
(config)# aaa authentication login default local radius
(config)# aaa authentication login radius local

Erklärung

Frage 4 von 31

1

A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP
snooping. For more protection against malicious attacks, the network team is considering enabling
dynamic ARP inspection alongside DHCP snooping. Which solution ensures that the server
maintains network reachability in the future?

Wähle eine der folgenden:

Disable DHCP snooping information option.
Configure a static DHCP snooping binding entry on the switch.
Trust the interface that is connected to the server with the ip dhcp snooping trust command.
Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify macaddress
command.

Erklärung

Frage 5 von 31

1

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

Wähle eine der folgenden:

Disable VTP and manually assign VLANs.
Ensure all switches are configured as VTP server mode.
Configure VTP Transparent Mode.
Enable VTP version 3.

Erklärung

Frage 6 von 31

1

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

Wähle eine der folgenden:

Packets from the workstation will be rate limited according to the default values set on the switch.
The interface that is connected to the workstation in question will be put into the errdisabled state.
Traffic will pass accordingly after the new IP address is populated into the binding database.
The packets originating from the workstation are assumed to be spoofed and will be discarded.

Erklärung

Frage 7 von 31

1

A DHCP configured router is connected directly to a switch that has been provisioned with DHCP
snooping. IP Source Guard with the ip verify source port-security command is configured under
the interfaces that connect to all DHCP clients on the switch. However, clients are not receiving an
IP address via the DHCP server. Which option is the cause of this issue?

Wähle eine der folgenden:

The DHCP server does not support information option 82.
The DHCP client interfaces have storm control configured.
Static DHCP bindings are not configured on the switch.
DHCP snooping must be enabled on all VLANs, even if they are not utilized for dynamic address
allocation.

Erklärung

Frage 8 von 31

1

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

Wähle eine der folgenden:

The local DHCP server is disabled prior to enabling IP Source Guard.
The interfaces are configured as Layer 3 using the no switchport command.
No VLANs exist on the switch and/or the switch is configured in VTP transparent mode
The switch is configured for sdm prefer routing as the switched database management template.
The configured SVIs on the switch have been removed for the associated interfaces.

Erklärung

Frage 9 von 31

1

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

Wähle eine oder mehr der folgenden:

SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold.
The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth.
The switch resumes forwarding broadcasts when they are below 65% of bandwidth.
Only broadcast traffic is limited by this particular storm control configuration.
Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface
bandwidth
The switch drops broadcasts when they reach 75% of bandwidth.

Erklärung

Frage 10 von 31

1

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

Wähle eine der folgenden:

switch(config)# errdisable recovery interval 180
switch(config)# errdisable recovery cause psecure-violation
switch(config)# switchport port-security protect
switch(config)# switchport port-security aging type inactivity
switch(config)# errdisable recovery cause security-violation

Erklärung

Frage 11 von 31

1

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

Wähle eine oder mehr der folgenden:

switch# show mac address-table
switch# show port-security
switch# show ip verify source
switch# show ip arp inspection
switch# show mac address-table address <mac address>

Erklärung

Frage 12 von 31

1

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Wähle eine der folgenden:

storm control
SDM routing
Cisco IOS parser
integrated routing and bridging
Dynamic ARP Inspection

Erklärung

Frage 13 von 31

1

Which command globally enables AAA on a device?

Wähle eine der folgenden:

aaa new-model
aaa authentication
aaa authorization
aaa accounting

Erklärung

Frage 14 von 31

1

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Wähle eine der folgenden:

network
IP mobile
EXEC
auth-proxy

Erklärung

Frage 15 von 31

1

Which authentication service is needed to configure 802.1x?

Wähle eine der folgenden:

RADIUS with EAP Extension
TACACS+
RADIUS with CoA
RADIUS using VSA

Erklärung

Frage 16 von 31

1

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Wähle eine der folgenden:

none required
username cisco with password cisco
no username with password linepass
login authentication default

Erklärung

Frage 17 von 31

1

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Wähle eine der folgenden:

RADIUS server, local username, line password
RADIUS server, line password, local username
Line password, local username, RADIUS server
Line password, RADIUS server, local username

Erklärung

Frage 18 von 31

1

Which type of information does the DHCP snooping binding database contain?

Wähle eine der folgenden:

untrusted hosts with leased IP addresses
trusted hosts with leased IP addresses
untrusted hosts with available IP addresses
trusted hosts with available IP addresses

Erklärung

Frage 19 von 31

1

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Wähle eine der folgenden:

Dynamic ARP Inspection
storm control
VTP pruning
DHCP snooping

Erklärung

Frage 20 von 31

1

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Wähle eine der folgenden:

ip dhcp snooping trust
ip dhcp snooping
ip dhcp trust
ip dhcp snooping information

Erklärung

Frage 21 von 31

1

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Wähle eine der folgenden:

promiscuous port
isolated port
community port
trunk port

Erklärung

Frage 22 von 31

1

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Wähle eine der folgenden:

isolated VLAN
primary VLAN
community VLAN
promiscuous VLAN

Erklärung

Frage 23 von 31

1

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

Wähle eine der folgenden:

DHCP snooping database
dynamic ARP database
dynamic routing database
static ARP database

Erklärung

Frage 24 von 31

1

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Wähle eine der folgenden:

DHCP snooping
storm control
spanning-tree portfast
private VLAN

Erklärung

Frage 25 von 31

1

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

Wähle eine der folgenden:

storm control
port security
VTP pruning
VLAN trunking

Erklärung

Frage 26 von 31

1

Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected?

Wähle eine der folgenden:

router(config-if)#storm-control action shutdown
router(config-if)#storm-control action trap
router(config-if)#storm-control action error
router(config-if)#storm-control action enable

Erklärung

Frage 27 von 31

1

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Wähle eine der folgenden:

It allows port security to secure the MAC address that 802.1x authenticates.
It allows port security to secure the IP address that 802.1x authenticates.
It allows 802.1x to secure the MAC address that port security authenticates.
It allows 802.1x to secure the IP address that port security authenticates.

Erklärung

Frage 28 von 31

1

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

Wähle eine der folgenden:

sticky
dynamic
static
secure

Erklärung

Frage 29 von 31

1

On which interface can port security be configured?

Wähle eine der folgenden:

static trunk ports
destination port for SPAN
EtherChannel port group
dynamic access point

Erklärung

Frage 30 von 31

1

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

Wähle eine der folgenden:

promiscuous
community
isolated
trunked

Erklärung

Frage 31 von 31

1

When you configure a private VLAN, which type of port must you configure the gateway router port
as?

Wähle eine der folgenden:

promiscuous port
isolated port
community port
access port

	Erstellt von Alexander Gomez vor etwa 10 Jahre

topic security

CCNP 300-115 TOPIC SEGURIDAD

Frage 1 von 31

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database. What is the solution to avoid the snooping database from being rebuilt after every device reboot?

Wähle eine der folgenden:

Erklärung

Frage 2 von 31

Which portion of AAA looks at what a user has access to?

Wähle eine der folgenden:

Erklärung

Frage 3 von 31

Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the local user database?

Wähle eine der folgenden:

Erklärung

Frage 4 von 31

Wähle eine der folgenden:

Erklärung

Frage 5 von 31

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. Which configuration must be made before the private VLAN is configured?

Wähle eine der folgenden:

Erklärung

Frage 6 von 31

DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. The IP address of one of the workstations does not match any entries found in the DHCP binding database. Which statement describes the outcome of this scenario?

Wähle eine der folgenden:

Erklärung

Frage 7 von 31

Wähle eine der folgenden:

Erklärung

Frage 8 von 31

A switch is added into the production network to increase port capacity. A network engineer is configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip verify source under several of the interfaces. Which option is the cause of the problem?

Wähle eine der folgenden:

Erklärung

Frage 9 von 31

The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail server. In which three ways does this command impact the traffic? (Choose three.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 10 von 31

After port security is deployed throughout an enterprise campus, the network team has been overwhelmed with port reset requests. They decide to configure the network to automate the process of re-enabling user ports. Which command accomplishes this task?

Wähle eine der folgenden:

Erklärung

Frage 11 von 31

The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server. Which two commands help trace this PC when the MAC address is known? (Choose two.)

Wähle eine oder mehr der folgenden:

Erklärung

Frage 12 von 31

While troubleshooting a network outage, a network engineer discovered an unusually high level of broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of bandwidth used by broadcast traffic?

Wähle eine der folgenden:

Erklärung

Frage 13 von 31

Which command globally enables AAA on a device?

Wähle eine der folgenden:

Erklärung

Frage 14 von 31

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Wähle eine der folgenden:

Erklärung

Frage 15 von 31

Which authentication service is needed to configure 802.1x?

Wähle eine der folgenden:

Erklärung

Frage 16 von 31

Refer to the exhibit. Which login credentials are required when connecting to the console port in this output?

Wähle eine der folgenden:

Erklärung

Frage 17 von 31

Refer to the exhibit. When a network administrator is attempting an SSH connection to the device, in which order does the device check the login credentials?

Wähle eine der folgenden:

Erklärung

Frage 18 von 31

Which type of information does the DHCP snooping binding database contain?

Wähle eine der folgenden:

Erklärung

Frage 19 von 31

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database?

Wähle eine der folgenden:

Erklärung

Frage 20 von 31

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server?

Wähle eine der folgenden:

Erklärung

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

When you configure a private VLAN, which type of port must you configure the gateway router port
as?