CCNP 300-115 TOPIC SEGURIDAD

Question 1 of 31

1

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Select one of the following:

A DHCP snooping database agent should be configured.
Enable DHCP snooping for all VLANs that are associated with the switch.
Disable Option 82 for DHCP data insertion.
Use IP Source Guard to protect the DHCP binding table entries from being lost upon rebooting.
Apply ip dhcp snooping trust on all interfaces with dynamic addresses.

Explanation

Question 2 of 31

1

Which portion of AAA looks at what a user has access to?

Select one of the following:

authorization
authentication
accounting
auditing

Explanation

Question 3 of 31

1

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

Select one of the following:

(config)# aaa authentication login default radius local
(config)# aaa authentication login login radius local
(config)# aaa authentication login default local radius
(config)# aaa authentication login radius local

Explanation

Question 4 of 31

1

A server with a statically assigned IP address is attached to a switch that is provisioned for DHCP
snooping. For more protection against malicious attacks, the network team is considering enabling
dynamic ARP inspection alongside DHCP snooping. Which solution ensures that the server
maintains network reachability in the future?

Select one of the following:

Disable DHCP snooping information option.
Configure a static DHCP snooping binding entry on the switch.
Trust the interface that is connected to the server with the ip dhcp snooping trust command.
Verify the source MAC address of all untrusted interfaces with ip dhcp snooping verify macaddress
command.

Explanation

Question 5 of 31

1

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

Select one of the following:

Disable VTP and manually assign VLANs.
Ensure all switches are configured as VTP server mode.
Configure VTP Transparent Mode.
Enable VTP version 3.

Explanation

Question 6 of 31

1

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

Select one of the following:

Packets from the workstation will be rate limited according to the default values set on the switch.
The interface that is connected to the workstation in question will be put into the errdisabled state.
Traffic will pass accordingly after the new IP address is populated into the binding database.
The packets originating from the workstation are assumed to be spoofed and will be discarded.

Explanation

Question 7 of 31

1

A DHCP configured router is connected directly to a switch that has been provisioned with DHCP
snooping. IP Source Guard with the ip verify source port-security command is configured under
the interfaces that connect to all DHCP clients on the switch. However, clients are not receiving an
IP address via the DHCP server. Which option is the cause of this issue?

Select one of the following:

The DHCP server does not support information option 82.
The DHCP client interfaces have storm control configured.
Static DHCP bindings are not configured on the switch.
DHCP snooping must be enabled on all VLANs, even if they are not utilized for dynamic address
allocation.

Explanation

Question 8 of 31

1

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

Select one of the following:

The local DHCP server is disabled prior to enabling IP Source Guard.
The interfaces are configured as Layer 3 using the no switchport command.
No VLANs exist on the switch and/or the switch is configured in VTP transparent mode
The switch is configured for sdm prefer routing as the switched database management template.
The configured SVIs on the switch have been removed for the associated interfaces.

Explanation

Question 9 of 31

1

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

Select one or more of the following:

SNMP traps are sent by default when broadcast traffic reaches 65% of the lower-level threshold.
The switchport is disabled when unicast traffic reaches 75% of the total interface bandwidth.
The switch resumes forwarding broadcasts when they are below 65% of bandwidth.
Only broadcast traffic is limited by this particular storm control configuration.
Multicast traffic is dropped at 65% and broadcast traffic is dropped at 75% of the total interface
bandwidth
The switch drops broadcasts when they reach 75% of bandwidth.

Explanation

Question 10 of 31

1

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

Select one of the following:

switch(config)# errdisable recovery interval 180
switch(config)# errdisable recovery cause psecure-violation
switch(config)# switchport port-security protect
switch(config)# switchport port-security aging type inactivity
switch(config)# errdisable recovery cause security-violation

Explanation

Question 11 of 31

1

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

Select one or more of the following:

switch# show mac address-table
switch# show port-security
switch# show ip verify source
switch# show ip arp inspection
switch# show mac address-table address <mac address>

Explanation

Question 12 of 31

1

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Select one of the following:

storm control
SDM routing
Cisco IOS parser
integrated routing and bridging
Dynamic ARP Inspection

Explanation

Question 13 of 31

1

Which command globally enables AAA on a device?

Select one of the following:

aaa new-model
aaa authentication
aaa authorization
aaa accounting

Explanation

Question 14 of 31

1

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Select one of the following:

network
IP mobile
EXEC
auth-proxy

Explanation

Question 15 of 31

1

Which authentication service is needed to configure 802.1x?

Select one of the following:

RADIUS with EAP Extension
TACACS+
RADIUS with CoA
RADIUS using VSA

Explanation

Question 16 of 31

1

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Select one of the following:

none required
username cisco with password cisco
no username with password linepass
login authentication default

Explanation

Question 17 of 31

1

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Select one of the following:

RADIUS server, local username, line password
RADIUS server, line password, local username
Line password, local username, RADIUS server
Line password, RADIUS server, local username

Explanation

Question 18 of 31

1

Which type of information does the DHCP snooping binding database contain?

Select one of the following:

untrusted hosts with leased IP addresses
trusted hosts with leased IP addresses
untrusted hosts with available IP addresses
trusted hosts with available IP addresses

Explanation

Question 19 of 31

1

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Select one of the following:

Dynamic ARP Inspection
storm control
VTP pruning
DHCP snooping

Explanation

Question 20 of 31

1

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Select one of the following:

ip dhcp snooping trust
ip dhcp snooping
ip dhcp trust
ip dhcp snooping information

Explanation

Question 21 of 31

1

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Select one of the following:

promiscuous port
isolated port
community port
trunk port

Explanation

Question 22 of 31

1

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Select one of the following:

isolated VLAN
primary VLAN
community VLAN
promiscuous VLAN

Explanation

Question 23 of 31

1

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

Select one of the following:

DHCP snooping database
dynamic ARP database
dynamic routing database
static ARP database

Explanation

Question 24 of 31

1

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Select one of the following:

DHCP snooping
storm control
spanning-tree portfast
private VLAN

Explanation

Question 25 of 31

1

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

Select one of the following:

storm control
port security
VTP pruning
VLAN trunking

Explanation

Question 26 of 31

1

Which command would a network engineer apply to error-disable a switchport when a packet-storm is detected?

Select one of the following:

router(config-if)#storm-control action shutdown
router(config-if)#storm-control action trap
router(config-if)#storm-control action error
router(config-if)#storm-control action enable

Explanation

Question 27 of 31

1

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Select one of the following:

It allows port security to secure the MAC address that 802.1x authenticates.
It allows port security to secure the IP address that 802.1x authenticates.
It allows 802.1x to secure the MAC address that port security authenticates.
It allows 802.1x to secure the IP address that port security authenticates.

Explanation

Question 28 of 31

1

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

Select one of the following:

sticky
dynamic
static
secure

Explanation

Question 29 of 31

1

On which interface can port security be configured?

Select one of the following:

static trunk ports
destination port for SPAN
EtherChannel port group
dynamic access point

Explanation

Question 30 of 31

1

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

Select one of the following:

promiscuous
community
isolated
trunked

Explanation

Question 31 of 31

1

When you configure a private VLAN, which type of port must you configure the gateway router port
as?

Select one of the following:

promiscuous port
isolated port
community port
access port

	Created by Alexander Gomez about 9 years ago

topic security

CCNP 300-115 TOPIC SEGURIDAD

Question 1 of 31

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping database. What is the solution to avoid the snooping database from being rebuilt after every device reboot?

Select one of the following:

Explanation

Question 2 of 31

Which portion of AAA looks at what a user has access to?

Select one of the following:

Explanation

Question 3 of 31

Which command creates a login authentication method named “login” that will primarily use RADIUS and fail over to the local user database?

Select one of the following:

Explanation

Question 4 of 31

Select one of the following:

Explanation

Question 5 of 31

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN. Which configuration must be made before the private VLAN is configured?

Select one of the following:

Explanation

Question 6 of 31

DHCP snooping and IP Source Guard have been configured on a switch that connects to several client workstations. The IP address of one of the workstations does not match any entries found in the DHCP binding database. Which statement describes the outcome of this scenario?

Select one of the following:

Explanation

Question 7 of 31

Select one of the following:

Explanation

Question 8 of 31

A switch is added into the production network to increase port capacity. A network engineer is configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip verify source under several of the interfaces. Which option is the cause of the problem?

Select one of the following:

Explanation

Question 9 of 31

The command storm-control broadcast level 75 65 is configured under the switch port connected to the corporate mail server. In which three ways does this command impact the traffic? (Choose three.)

Select one or more of the following:

Explanation

Question 10 of 31

After port security is deployed throughout an enterprise campus, the network team has been overwhelmed with port reset requests. They decide to configure the network to automate the process of re-enabling user ports. Which command accomplishes this task?

Select one of the following:

Explanation

Question 11 of 31

The network monitoring application alerts a network engineer of a client PC that is acting as a rogue DHCP server. Which two commands help trace this PC when the MAC address is known? (Choose two.)

Select one or more of the following:

Explanation

Question 12 of 31

While troubleshooting a network outage, a network engineer discovered an unusually high level of broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of bandwidth used by broadcast traffic?

Select one of the following:

Explanation

Question 13 of 31

Which command globally enables AAA on a device?

Select one of the following:

Explanation

Question 14 of 31

Which AAA Authorization type includes PPP, SLIP, and ARAP connections?

Select one of the following:

Explanation

Question 15 of 31

Which authentication service is needed to configure 802.1x?

Select one of the following:

Explanation

Question 16 of 31

Refer to the exhibit. Which login credentials are required when connecting to the console port in this output?

Select one of the following:

Explanation

Question 17 of 31

Refer to the exhibit. When a network administrator is attempting an SSH connection to the device, in which order does the device check the login credentials?

Select one of the following:

Explanation

Question 18 of 31

Which type of information does the DHCP snooping binding database contain?

Select one of the following:

Explanation

Question 19 of 31

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a trusted database?

Select one of the following:

Explanation

Question 20 of 31

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP server?

Select one of the following:

Explanation

A Cisco Catalyst switch that is prone to reboots continues to rebuild the DHCP snooping
database. What is the solution to avoid the snooping database from being rebuilt after every
device reboot?

Which command creates a login authentication method named “login” that will primarily use
RADIUS and fail over to the local user database?

A network engineer wants to ensure Layer 2 isolation of customer traffic using a private VLAN.
Which configuration must be made before the private VLAN is configured?

DHCP snooping and IP Source Guard have been configured on a switch that connects to several
client workstations. The IP address of one of the workstations does not match any entries found in
the DHCP binding database. Which statement describes the outcome of this scenario?

A switch is added into the production network to increase port capacity. A network engineer is
configuring the switch for DHCP snooping and IP Source Guard, but is unable to configure ip
verify source under several of the interfaces. Which option is the cause of the problem?

The command storm-control broadcast level 75 65 is configured under the switch port
connected to the corporate mail server. In which three ways does this command impact the traffic?
(Choose three.)

After port security is deployed throughout an enterprise campus, the network team has been
overwhelmed with port reset requests. They decide to configure the network to automate the
process of re-enabling user ports. Which command accomplishes this task?

The network monitoring application alerts a network engineer of a client PC that is acting as a
rogue DHCP server. Which two commands help trace this PC when the MAC address is known?
(Choose two.)

While troubleshooting a network outage, a network engineer discovered an unusually high level of
broadcast traffic coming from one of the switch interfaces. Which option decreases consumption of
bandwidth used by broadcast traffic?

Refer to the exhibit.
Which login credentials are required when connecting to the console port in this output?

Refer to the exhibit.
When a network administrator is attempting an SSH connection to the device, in which order does
the device check the login credentials?

Which switch feature determines validity based on IP-to-MAC address bindings that are stored in a
trusted database?

Which command is needed to enable DHCP snooping if a switchport is connected to a DHCP
server?

Which private VLAN access port belongs to the primary VLAN and can communicate with all
interfaces, including the community and isolated host ports?

Which private VLAN can have only one VLAN and be a secondary VLAN that carries unidirectional
traffic upstream from the hosts toward the promiscuous ports and the gateway?

Which database is used to determine the validity of an ARP packet based on a valid IP-to-MAC
address binding?

When IP Source Guard with source IP filtering is enabled on an interface, which feature must be
enabled on the access VLAN for that interface?

Which switch feature prevents traffic on a LAN from being overwhelmed by continuous multicast or
broadcast traffic?

A network engineer configures port security and 802.1x on the same interface. Which option
describes what this configuration allows?

Which feature describes MAC addresses that are dynamically learned or manually configured,
stored in the address table, and added to the running configuration?

When you configure private VLANs on a switch, which port type connects the switch to the
gateway router?

When you configure a private VLAN, which type of port must you configure the gateway router port
as?