CCNP 300-115 TOPIC SEGURIDAD

Questão 1 de 31

1

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Selecione uma das seguintes:

A DHCP snooping database agent should be configured.
Enable DHCP snooping for all VLANs that are associated with the switch.
Disable Option 82 for DHCP data insertion.
Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting.
Apply ip dhcp snooping trust on all interfaces with dynamic addresses.

Explicação

Questão 2 de 31

1

Which portion of AAA looks at what a user has access to?

Selecione uma das seguintes:

authorization
authentication
accounting
auditing

Explicação

Questão 3 de 31

1

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

Selecione uma das seguintes:

(config)# aaa authentication login default radius local
(config)# aaa authentication login login radius local
(config)# aaa authentication login default local radius
(config)# aaa authentication login radius local

Explicação

Questão 4 de 31

1

A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP
snooping. For more protection against malicious attacks, the network team is considering enabling
dynamic ARP inspection alongside DHCP snooping. Which solution ensures that the server
maintains network reachability in the future?

Selecione uma das seguintes:

Disable DHCP snooping information option.
Configure a static DHCP snooping binding entry on the switch.
Trust the interface that is connected to the server with the ip dhcp snooping trust command.
Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify macaddress
command.

Explicação

Questão 5 de 31

1

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

Selecione uma das seguintes:

Disable VTP and manually assign VLANs.
Ensure all switches are configured as VTP server mode.
Configure VTP Transparent Mode.
Enable VTP version 3.

Explicação

Questão 6 de 31

1

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

Selecione uma das seguintes:

Packets from the workstation will be rate limited according to the default values set on the switch.
The interface that is connected to the workstation in question will be put into the errdisabled state.
Traffic will pass accordingly after the new IP address is populated into the binding database.
The packets originating from the workstation are assumed to be spoofed and will be discarded.

Explicação

Questão 7 de 31

1

A DHCP configured router is connected directly to a switch that has been provisioned with DHCP
snooping. IP Source Guard with the ip verify source port-security command is configured under
the interfaces that connect to all DHCP clients on the switch. However, clients are not receiving an
IP address via the DHCP server. Which option is the cause of this issue?

Selecione uma das seguintes:

The DHCP server does not support information option 82.
The DHCP client interfaces have storm control configured.
Static DHCP bindings are not configured on the switch.
DHCP snooping must be enabled on all VLANs, even if they are not utilized for dynamic address
allocation.

Explicação

Questão 8 de 31

1

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

Selecione uma das seguintes:

The local DHCP server is disabled prior to enabling IP Source Guard.
The interfaces are configured as Layer 3 using the no switchport command.
No VLANs exist on the switch and/or the switch is configured in VTP transparent mode
The switch is configured for sdm prefer routing as the switched database management template.
The configured SVIs on the switch have been removed for the associated interfaces.

Explicação

Questão 9 de 31

1

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

Selecione uma ou mais das seguintes:

SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold.
The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth.
The switch resumes forwarding broadcasts when they are below 65% of bandwidth.
Only broadcast traffic is limited by this particular storm control configuration.
Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface
bandwidth
The switch drops broadcasts when they reach 75% of bandwidth.

Explicação

Questão 10 de 31

1

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

Selecione uma das seguintes:

switch(config)# errdisable recovery interval 180
switch(config)# errdisable recovery cause psecure-violation
switch(config)# switchport port-security protect
switch(config)# switchport port-security aging type inactivity
switch(config)# errdisable recovery cause security-violation

Explicação

Questão 11 de 31

1

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

Selecione uma ou mais das seguintes:

switch# show mac address-table
switch# show port-security
switch# show ip verify source
switch# show ip arp inspection
switch# show mac address-table address <mac address>

Explicação

Questão 12 de 31

1

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Selecione uma das seguintes:

storm control
SDM routing
Cisco IOS parser
integrated routing and bridging
Dynamic ARP Inspection

Explicação

Questão 13 de 31

1

Which command globally enables AAA on a device?

Selecione uma das seguintes:

aaa new-model
aaa authentication
aaa authorization
aaa accounting

Explicação

Questão 14 de 31

1

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Selecione uma das seguintes:

network
IP mobile
EXEC
auth-proxy

Explicação

Questão 15 de 31

1

Which authentication service is needed to configure 802.1x?

Selecione uma das seguintes:

RADIUS with EAP Extension
TACACS+
RADIUS with CoA
RADIUS using VSA

Explicação

Questão 16 de 31

1

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Selecione uma das seguintes:

none required
username cisco with password cisco
no username with password linepass
login authentication default

Explicação

Questão 17 de 31

1

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Selecione uma das seguintes:

RADIUS server, local username, line password
RADIUS server, line password, local username
Line password, local username, RADIUS server
Line password, RADIUS server, local username

Explicação

Questão 18 de 31

1

Which type of information does the DHCP snooping binding database contain?

Selecione uma das seguintes:

untrusted hosts with leased IP addresses
trusted hosts with leased IP addresses
untrusted hosts with available IP addresses
trusted hosts with available IP addresses

Explicação

Questão 19 de 31

1

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Selecione uma das seguintes:

Dynamic ARP Inspection
storm control
VTP pruning
DHCP snooping

Explicação

Questão 20 de 31

1

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Selecione uma das seguintes:

ip dhcp snooping trust
ip dhcp snooping
ip dhcp trust
ip dhcp snooping information

Explicação

Questão 21 de 31

1

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Selecione uma das seguintes:

promiscuous port
isolated port
community port
trunk port

Explicação

Questão 22 de 31

1

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Selecione uma das seguintes:

isolated VLAN
primary VLAN
community VLAN
promiscuous VLAN

Explicação

Questão 23 de 31

1

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

Selecione uma das seguintes:

DHCP snooping database
dynamic ARP database
dynamic routing database
static ARP database

Explicação

Questão 24 de 31

1

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Selecione uma das seguintes:

DHCP snooping
storm control
spanning-tree portfast
private VLAN

Explicação

Questão 25 de 31

1

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

Selecione uma das seguintes:

storm control
port security
VTP pruning
VLAN trunking

Explicação

Questão 26 de 31

1

Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected?

Selecione uma das seguintes:

router(config-if)#storm-control action shutdown
router(config-if)#storm-control action trap
router(config-if)#storm-control action error
router(config-if)#storm-control action enable

Explicação

Questão 27 de 31

1

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Selecione uma das seguintes:

It allows port security to secure the MAC address that 802.1x authenticates.
It allows port security to secure the IP address that 802.1x authenticates.
It allows 802.1x to secure the MAC address that port security authenticates.
It allows 802.1x to secure the IP address that port security authenticates.

Explicação

Questão 28 de 31

1

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

Selecione uma das seguintes:

sticky
dynamic
static
secure

Explicação

Questão 29 de 31

1

On which interface can port security be configured?

Selecione uma das seguintes:

static trunk ports
destination port for SPAN
EtherChannel port group
dynamic access point

Explicação

Questão 30 de 31

1

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

Selecione uma das seguintes:

promiscuous
community
isolated
trunked

Explicação

Questão 31 de 31

1

When you configure a private VLAN, which type of port must you configure the gateway router port
as?

Selecione uma das seguintes:

promiscuous port
isolated port
community port
access port

	Criado por Alexander Gomez mais de 7 anos atrás

topic security

CCNP 300-115 TOPIC SEGURIDAD

Questão 1 de 31

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database. What is the solution to avoid the snooping database from being rebuilt after every device reboot?

Selecione uma das seguintes:

Explicação

Questão 2 de 31

Which portion of AAA looks at what a user has access to?

Selecione uma das seguintes:

Explicação

Questão 3 de 31

Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the local user database?

Selecione uma das seguintes:

Explicação

Questão 4 de 31

Selecione uma das seguintes:

Explicação

Questão 5 de 31

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. Which configuration must be made before the private VLAN is configured?

Selecione uma das seguintes:

Explicação

Questão 6 de 31

DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. The IP address of one of the workstations does not match any entries found in the DHCP binding database. Which statement describes the outcome of this scenario?

Selecione uma das seguintes:

Explicação

Questão 7 de 31

Selecione uma das seguintes:

Explicação

Questão 8 de 31

A switch is added into the production network to increase port capacity. A network engineer is configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip verify source under several of the interfaces. Which option is the cause of the problem?

Selecione uma das seguintes:

Explicação

Questão 9 de 31

The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail server. In which three ways does this command impact the traffic? (Choose three.)

Selecione uma ou mais das seguintes:

Explicação

Questão 10 de 31

After port security is deployed throughout an enterprise campus, the network team has been overwhelmed with port reset requests. They decide to configure the network to automate the process of re-enabling user ports. Which command accomplishes this task?

Selecione uma das seguintes:

Explicação

Questão 11 de 31

The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server. Which two commands help trace this PC when the MAC address is known? (Choose two.)

Selecione uma ou mais das seguintes:

Explicação

Questão 12 de 31

While troubleshooting a network outage, a network engineer discovered an unusually high level of broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of bandwidth used by broadcast traffic?

Selecione uma das seguintes:

Explicação

Questão 13 de 31

Which command globally enables AAA on a device?

Selecione uma das seguintes:

Explicação

Questão 14 de 31

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Selecione uma das seguintes:

Explicação

Questão 15 de 31

Which authentication service is needed to configure 802.1x?

Selecione uma das seguintes:

Explicação

Questão 16 de 31

Refer to the exhibit. Which login credentials are required when connecting to the console port in this output?

Selecione uma das seguintes:

Explicação

Questão 17 de 31

Refer to the exhibit. When a network administrator is attempting an SSH connection to the device, in which order does the device check the login credentials?

Selecione uma das seguintes:

Explicação

Questão 18 de 31

Which type of information does the DHCP snooping binding database contain?

Selecione uma das seguintes:

Explicação

Questão 19 de 31

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database?

Selecione uma das seguintes:

Explicação

Questão 20 de 31

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server?

Selecione uma das seguintes:

Explicação

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

When you configure a private VLAN, which type of port must you configure the gateway router port
as?