Advanced CCNP Switch Configuration and Security Quiz

1. Which statement correctly explains the process of mitigating ARP attacks on a switch where dynamic ARP inspection (DAI) has been configured?

DAI sends a notification to the network administrator for manual IP-to-MAC verification.

DAI modifies the ARP cache directly to correct spoofed ARP entries.

All ARP packets are dropped to prevent ARP poisoning attacks.

The intercepted packets are verified against the DHCP snooping binding table for valid IP-to-MAC bindings

Dynamic ARP Inspection (DAI) works by intercepting ARP packets on a switch, verifying them against the DHCP snooping binding table to ensure that the IP-to-MAC bindings are valid. This helps prevent ARP poisoning attacks by ensuring that only legitimate ARP packets are allowed to update the ARP cache.

Explanation

Dynamic ARP Inspection (DAI) works by intercepting ARP packets on a switch, verifying them against the DHCP snooping binding table to ensure that the IP-to-MAC bindings are valid. This helps prevent ARP poisoning attacks by ensuring that only legitimate ARP packets are allowed to update the ARP cache.

2. What feature does an SNMP manager need to be able to set a parameter on ACSw1?

C manager who is using host 10.0.0.1

A manager who is using host 192.168.0.5

B manager who is using host 192.168.0.1

D manager who is using host 172.16.0.1

The correct answer specifies the specific host IP address that needs to be used by the SNMP manager to set a parameter on ACSw1.

Explanation

The correct answer specifies the specific host IP address that needs to be used by the SNMP manager to set a parameter on ACSw1.

3. What is a true statement concerning the core layer within the hierarchical design model?

The core layer is where network security devices such as firewalls and intrusion prevention systems are typically located.

The core layer is responsible for providing access to the end devices in the network.

Dynamic routing protocols should be disabled at the core layer to reduce network complexity.

Routing should be configured without traffic filtering, address translation, or other packet manipulation at the core.

In the hierarchical design model, the core layer is responsible for high-speed packet switching with minimal processing. Routing functions are typically maintained at this layer without implementing additional functions like traffic filtering, address translation, or other packet manipulation to ensure efficient and fast data transport.

Explanation

In the hierarchical design model, the core layer is responsible for high-speed packet switching with minimal processing. Routing functions are typically maintained at this layer without implementing additional functions like traffic filtering, address translation, or other packet manipulation to ensure efficient and fast data transport.

4. When a port security violation occurs on a switch port, the switch sends a syslog message but does not shut down the port. What port security mode is in effect?

Disable

Shutdown

Restrict

Protect

In the 'restrict' port security mode, when a violation occurs, the switch sends a syslog message but does not shut down the port. The other modes mentioned would lead to different actions upon a violation.

Explanation

In the 'restrict' port security mode, when a violation occurs, the switch sends a syslog message but does not shut down the port. The other modes mentioned would lead to different actions upon a violation.

5. Which three steps are required to configure interfaces as routed ports on a multilayer Catalyst switch? (Choose three).

Configure VLANs on the interfaces

Configure trunking on the interfaces

Enable port security on the interfaces

To configure interfaces as routed ports on a multilayer Catalyst switch, you need to enable IP routing globally, assign IP addresses to routed ports, and disable Layer 2 functionality on interfaces that will be configured as routed ports. Configuring VLANs, enabling port security, or configuring trunking are not necessary steps for this specific task.

Explanation

To configure interfaces as routed ports on a multilayer Catalyst switch, you need to enable IP routing globally, assign IP addresses to routed ports, and disable Layer 2 functionality on interfaces that will be configured as routed ports. Configuring VLANs, enabling port security, or configuring trunking are not necessary steps for this specific task.

6. What action should be taken by a network administrator to restore connectivity when a bridging loop occurs?

Restart all the networking equipment in the network.

Disable ports that should be in the blocking state.

Ignore the issue and wait for it to resolve on its own.

Reconfigure the entire network topology.

When a bridging loop occurs in a network, disabling ports that should be in the blocking state helps to eliminate the loop and restore connectivity. Restarting all networking equipment or reconfiguring the network topology may not necessarily address the root cause of the issue and might lead to extended downtime. Ignoring the issue can result in prolonged disruption to user connectivity.

Explanation

When a bridging loop occurs in a network, disabling ports that should be in the blocking state helps to eliminate the loop and restore connectivity. Restarting all networking equipment or reconfiguring the network topology may not necessarily address the root cause of the issue and might lead to extended downtime. Ignoring the issue can result in prolonged disruption to user connectivity.

7. Which three actions can cause problems with a VTP implementation? (Choose three).

Adding new VLANs to the VTP server

Configuring VTP passwords

Enabling VTP pruning

Changing the VTP domain name, setting the VTP mode to transparent, and deleting the VTP configuration file can all cause issues with VTP. Enabling VTP pruning, configuring VTP passwords, and adding new VLANs to the VTP server do not directly cause problems with a VTP implementation.

Explanation

Changing the VTP domain name, setting the VTP mode to transparent, and deleting the VTP configuration file can all cause issues with VTP. Enabling VTP pruning, configuring VTP passwords, and adding new VLANs to the VTP server do not directly cause problems with a VTP implementation.

8. Which QoS requirement should be taken into account when implementing VoIP in a campus environment?

Increasing latency to ensure data traffic has higher priority

The QoS requirements should accommodate the smooth demand on bandwidth, low latency, and delay for voice traffic.

Ignoring delay requirements for voice traffic

Providing unlimited bandwidth for all types of traffic

When implementing VoIP in a campus environment, it is crucial to consider QoS requirements that prioritize smooth demand on bandwidth, low latency, and minimal delay for voice traffic to ensure high call quality and reliability.

Explanation

When implementing VoIP in a campus environment, it is crucial to consider QoS requirements that prioritize smooth demand on bandwidth, low latency, and minimal delay for voice traffic to ensure high call quality and reliability.

9. When troubleshooting GLBP in an environment with a VLAN that spans multiple access layer switches, what can a network engineer do to fix suboptimal paths for upstream traffic?

Use HSRP instead of GLBP.

Implement OSPF for routing instead of GLBP.

Increase the GLBP priority on the active router.

Disable load balancing on GLBP routers.

GLBP uses load balancing to distribute traffic across routers. If suboptimal paths are being used for upstream traffic, it is recommended to switch to HSRP which provides a simpler failover mechanism and prevents suboptimal path selection.

Explanation

GLBP uses load balancing to distribute traffic across routers. If suboptimal paths are being used for upstream traffic, it is recommended to switch to HSRP which provides a simpler failover mechanism and prevents suboptimal path selection.