CCNP 300-115 TOPIC SEGURIDAD

Pregunta 1 de 31

1

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Selecciona una de las siguientes respuestas posibles:

A DHCP snooping database agent should be configured.
Enable DHCP snooping for all VLANs that are associated with the switch.
Disable Option 82 for DHCP data insertion.
Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting.
Apply ip dhcp snooping trust on all interfaces with dynamic addresses.

Explicación

Pregunta 2 de 31

1

Which portion of AAA looks at what a user has access to?

Selecciona una de las siguientes respuestas posibles:

authorization
authentication
accounting
auditing

Explicación

Pregunta 3 de 31

1

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

Selecciona una de las siguientes respuestas posibles:

(config)# aaa authentication login default radius local
(config)# aaa authentication login login radius local
(config)# aaa authentication login default local radius
(config)# aaa authentication login radius local

Explicación

Pregunta 4 de 31

1

A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP
snooping. For more protection against malicious attacks, the network team is considering enabling
dynamic ARP inspection alongside DHCP snooping. Which solution ensures that the server
maintains network reachability in the future?

Selecciona una de las siguientes respuestas posibles:

Disable DHCP snooping information option.
Configure a static DHCP snooping binding entry on the switch.
Trust the interface that is connected to the server with the ip dhcp snooping trust command.
Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify macaddress
command.

Explicación

Pregunta 5 de 31

1

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

Selecciona una de las siguientes respuestas posibles:

Disable VTP and manually assign VLANs.
Ensure all switches are configured as VTP server mode.
Configure VTP Transparent Mode.
Enable VTP version 3.

Explicación

Pregunta 6 de 31

1

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

Selecciona una de las siguientes respuestas posibles:

Packets from the workstation will be rate limited according to the default values set on the switch.
The interface that is connected to the workstation in question will be put into the errdisabled state.
Traffic will pass accordingly after the new IP address is populated into the binding database.
The packets originating from the workstation are assumed to be spoofed and will be discarded.

Explicación

Pregunta 7 de 31

1

A DHCP configured router is connected directly to a switch that has been provisioned with DHCP
snooping. IP Source Guard with the ip verify source port-security command is configured under
the interfaces that connect to all DHCP clients on the switch. However, clients are not receiving an
IP address via the DHCP server. Which option is the cause of this issue?

Selecciona una de las siguientes respuestas posibles:

The DHCP server does not support information option 82.
The DHCP client interfaces have storm control configured.
Static DHCP bindings are not configured on the switch.
DHCP snooping must be enabled on all VLANs, even if they are not utilized for dynamic address
allocation.

Explicación

Pregunta 8 de 31

1

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

Selecciona una de las siguientes respuestas posibles:

The local DHCP server is disabled prior to enabling IP Source Guard.
The interfaces are configured as Layer 3 using the no switchport command.
No VLANs exist on the switch and/or the switch is configured in VTP transparent mode
The switch is configured for sdm prefer routing as the switched database management template.
The configured SVIs on the switch have been removed for the associated interfaces.

Explicación

Pregunta 9 de 31

1

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold.
The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth.
The switch resumes forwarding broadcasts when they are below 65% of bandwidth.
Only broadcast traffic is limited by this particular storm control configuration.
Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface
bandwidth
The switch drops broadcasts when they reach 75% of bandwidth.

Explicación

Pregunta 10 de 31

1

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

Selecciona una de las siguientes respuestas posibles:

switch(config)# errdisable recovery interval 180
switch(config)# errdisable recovery cause psecure-violation
switch(config)# switchport port-security protect
switch(config)# switchport port-security aging type inactivity
switch(config)# errdisable recovery cause security-violation

Explicación

Pregunta 11 de 31

1

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

switch# show mac address-table
switch# show port-security
switch# show ip verify source
switch# show ip arp inspection
switch# show mac address-table address <mac address>

Explicación

Pregunta 12 de 31

1

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Selecciona una de las siguientes respuestas posibles:

storm control
SDM routing
Cisco IOS parser
integrated routing and bridging
Dynamic ARP Inspection

Explicación

Pregunta 13 de 31

1

Which command globally enables AAA on a device?

Selecciona una de las siguientes respuestas posibles:

aaa new-model
aaa authentication
aaa authorization
aaa accounting

Explicación

Pregunta 14 de 31

1

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Selecciona una de las siguientes respuestas posibles:

network
IP mobile
EXEC
auth-proxy

Explicación

Pregunta 15 de 31

1

Which authentication service is needed to configure 802.1x?

Selecciona una de las siguientes respuestas posibles:

RADIUS with EAP Extension
TACACS+
RADIUS with CoA
RADIUS using VSA

Explicación

Pregunta 16 de 31

1

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Selecciona una de las siguientes respuestas posibles:

none required
username cisco with password cisco
no username with password linepass
login authentication default

Explicación

Pregunta 17 de 31

1

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Selecciona una de las siguientes respuestas posibles:

RADIUS server, local username, line password
RADIUS server, line password, local username
Line password, local username, RADIUS server
Line password, RADIUS server, local username

Explicación

Pregunta 18 de 31

1

Which type of information does the DHCP snooping binding database contain?

Selecciona una de las siguientes respuestas posibles:

untrusted hosts with leased IP addresses
trusted hosts with leased IP addresses
untrusted hosts with available IP addresses
trusted hosts with available IP addresses

Explicación

Pregunta 19 de 31

1

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Selecciona una de las siguientes respuestas posibles:

Dynamic ARP Inspection
storm control
VTP pruning
DHCP snooping

Explicación

Pregunta 20 de 31

1

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Selecciona una de las siguientes respuestas posibles:

ip dhcp snooping trust
ip dhcp snooping
ip dhcp trust
ip dhcp snooping information

Explicación

Pregunta 21 de 31

1

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Selecciona una de las siguientes respuestas posibles:

promiscuous port
isolated port
community port
trunk port

Explicación

Pregunta 22 de 31

1

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Selecciona una de las siguientes respuestas posibles:

isolated VLAN
primary VLAN
community VLAN
promiscuous VLAN

Explicación

Pregunta 23 de 31

1

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

Selecciona una de las siguientes respuestas posibles:

DHCP snooping database
dynamic ARP database
dynamic routing database
static ARP database

Explicación

Pregunta 24 de 31

1

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Selecciona una de las siguientes respuestas posibles:

DHCP snooping
storm control
spanning-tree portfast
private VLAN

Explicación

Pregunta 25 de 31

1

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

Selecciona una de las siguientes respuestas posibles:

storm control
port security
VTP pruning
VLAN trunking

Explicación

Pregunta 26 de 31

1

Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected?

Selecciona una de las siguientes respuestas posibles:

router(config-if)#storm-control action shutdown
router(config-if)#storm-control action trap
router(config-if)#storm-control action error
router(config-if)#storm-control action enable

Explicación

Pregunta 27 de 31

1

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Selecciona una de las siguientes respuestas posibles:

It allows port security to secure the MAC address that 802.1x authenticates.
It allows port security to secure the IP address that 802.1x authenticates.
It allows 802.1x to secure the MAC address that port security authenticates.
It allows 802.1x to secure the IP address that port security authenticates.

Explicación

Pregunta 28 de 31

1

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

Selecciona una de las siguientes respuestas posibles:

sticky
dynamic
static
secure

Explicación

Pregunta 29 de 31

1

On which interface can port security be configured?

Selecciona una de las siguientes respuestas posibles:

static trunk ports
destination port for SPAN
EtherChannel port group
dynamic access point

Explicación

Pregunta 30 de 31

1

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

Selecciona una de las siguientes respuestas posibles:

promiscuous
community
isolated
trunked

Explicación

Pregunta 31 de 31

1

When you configure a private VLAN, which type of port must you configure the gateway router port
as?

Selecciona una de las siguientes respuestas posibles:

promiscuous port
isolated port
community port
access port

	Creado por Alexander Gomez hace alrededor de 10 años

topic security

CCNP 300-115 TOPIC SEGURIDAD

Pregunta 1 de 31

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database. What is the solution to avoid the snooping database from being rebuilt after every device reboot?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 2 de 31

Which portion of AAA looks at what a user has access to?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 3 de 31

Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the local user database?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 4 de 31

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 5 de 31

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. Which configuration must be made before the private VLAN is configured?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 6 de 31

DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. The IP address of one of the workstations does not match any entries found in the DHCP binding database. Which statement describes the outcome of this scenario?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 7 de 31

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 8 de 31

A switch is added into the production network to increase port capacity. A network engineer is configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip verify source under several of the interfaces. Which option is the cause of the problem?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 9 de 31

The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail server. In which three ways does this command impact the traffic? (Choose three.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 10 de 31

After port security is deployed throughout an enterprise campus, the network team has been overwhelmed with port reset requests. They decide to configure the network to automate the process of re-enabling user ports. Which command accomplishes this task?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 11 de 31

The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server. Which two commands help trace this PC when the MAC address is known? (Choose two.)

Selecciona una o más de las siguientes respuestas posibles:

Explicación

Pregunta 12 de 31

While troubleshooting a network outage, a network engineer discovered an unusually high level of broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of bandwidth used by broadcast traffic?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 13 de 31

Which command globally enables AAA on a device?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 14 de 31

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 15 de 31

Which authentication service is needed to configure 802.1x?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 16 de 31

Refer to the exhibit. Which login credentials are required when connecting to the console port in this output?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 17 de 31

Refer to the exhibit. When a network administrator is attempting an SSH connection to the device, in which order does the device check the login credentials?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 18 de 31

Which type of information does the DHCP snooping binding database contain?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 19 de 31

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database?

Selecciona una de las siguientes respuestas posibles:

Explicación

Pregunta 20 de 31

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server?

Selecciona una de las siguientes respuestas posibles:

Explicación

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

When you configure a private VLAN, which type of port must you configure the gateway router port
as?