9 - Securing Layer 2 Devices

Front 1

Which is the primary Layer 2 mechanism that allows multiple devices in the same VLAN to communicate with each other even though those devices are physically connected to different switches?

a. IP address

b. Default gateway
c. Trunk

d. 802.1D

Back 1

c

Front 2

How does a switch know about parallel Layer 2 paths?

a. 802.1Q

b. BPDU

c. CDP

d. NTP

Back 2

b

Front 3

When implemented, which of the following helps prevent CAM table overflows?

a. 802.1w

b. BPDU Guard

c. Root Guard

d. Port security

Back 3

d

Front 4

Which of the following is not a best practice for security?

a. Leaving the native VLAN as VLAN 1

b. Shutting down all unused ports and placing them in an unused VLANc. Limiting the number of MAC addresses learned on a specific portd. Disabling negotiation of switch port mode

Back 4

a

Front 5

What is the default number of MAC addresses allowed on a switch port that is configuredwith port security?a. 1b. 5c. 15d. Depends on the switch model

Back 5

a

Front 6

Which two items normally have a one-to-one correlation?a. VLANsb. Classful IP networksc. IP subnetworksd. Number of switchese. Number of routers

Back 6

a & C

Front 7

What is a typical method used by a device in one VLAN to reach another device in a second VLAN?a. ARP for the remote device’s MAC addressb. Use a remote default gatewayc. Use a local default gatewayd. Use trunking on the PC

Back 7

C

Front 8

Which two configuration changes prevent users from jumping onto any VLAN they choose to join?a. Disabling negotiation of trunk portsb. Using something else other than VLAN 1 as the “native” VLANc. Configuring the port connecting to the client as a trunkd. Configuring the port connecting to the client as an access port

Back 8

A & D

Front 9

If you limit the number of MAC addresses learned on a port to five, what benefits do you get from the port security feature? (Choose all that apply.)a. Protection for DHCP servers against starvation attacksb. Protection against IP spoofingc. Protection against VLAN hoppingd. Protection against MAC address spoofinge. Protection against CAM table overflow attacks

Back 9

A & E

Front 10

Why should you implement Root Guard on a switch?a. To prevent the switch from becoming the rootb. To prevent the switch from having any root portsc. To prevent the switch from having specific root portsd. To protect the switch against MAC address table overflows

Back 10

C

Front 11

Why should CDP be disabled on ports that face untrusted networks?a. CDP can be used as a DDoS vector.b. CDP can be used as a reconnaissance tool to determine information about the device.c. Disabling CDP will prevent the device from participating in spanning tree with untrusted devices.d. CDP can conflict with LLDP on ports facing untrusted networks.

Back 11

B

Front 12

Which of the following is not a true statement for DHCP snooping?

a. DHCP snooping validates DHCP messages received from untrusted sources and filters out invalid messages

b. DHCP snooping information is stored in a binding database.

c. DHCP snooping is enabled by default on all VLANs.

d. DHCP snooping rate-limits DHCP traffic from trusted and untrusted sources.

Back 12

C

Front 13

Which of the following is not a true statement regarding dynamic ARP inspection (DAI)?
a. DAI intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings.

b. DAI helps to mitigate MITM attacks.

c. DAI determines validity of ARP packets based on IP-to-MAC address bindings found in the DHCP snooping database.

d. DAI is enabled on a per-interface basis.

Back 13

D

Front 14

Another name for a layer 2 broadcast domain is:

Back 14

VLAN

Front 15

What is the 802.1 suffix for VLAN tagging?

Back 15

802.1Q

Front 16

If there is no 802.1Q tag on the the frame, what will the switch assume?

Back 16

That the frame originates from the native VLAN

Front 17

Why is autonegotiation risky?

Back 17

An attacker can negotiate a trunk with a switch then access any available VLANs.

Front 18

How do we get 2 devices on a VLAN to communicate with devices outside?

Back 18

Inter-VLAN Routing

Front 19

How to use virtual Subinterfaces to route.

Back 19

Trunk from switch to router, on the router we set sub-interfaces and tell it to pay attention to the dot1q tags.The PCs then need to configure a default gateway.

Front 20

What is the 802.1 suffix for authenticating users before allowing their data frames on the network?

Back 20

802.1X

Front 21

What is the 802.1 suffix for spanning tree protocol?

Back 21

802.1D

Front 22

What is the purpose of spanning tree?

Back 22

Stops loops from occurring in switches

Front 23

What switch becomes the root bridge?>

Back 23

The one with the lowest bridge ID

Front 24

How does spanning tree communicate? With what protocol?

Back 24

BPDU. Bridge Protocol data units

Front 25

If you have 5 VLANs, how many instances of STP do you have?

Back 25

5. aka Per-VLAN Spanning Tree Plus (PVST+)

Front 26

What is the 802.1 suffix for Rapid Spanning Tree?

Back 26

802.1w

Front 27

A common security practice would be to not use which VLAN and why?

Back 27

We should not use VLAN 1, because it is the default native VLAN and all it's traffic is untagged.

Front 28

How should we configure our ports to ensure that users cannot negotiate a trunk.

Back 28

Ports facing the end users should be set to access, and those to other switches/routers should be trunk ports.

Front 29

What is a good way to ensure port security?

Back 29

Limiting the number of MAC addresses that can be learned on an access switchport. Implemented on a port-by-port basis. Can shut down the port, restrict the port (generates syslog and blocks) or protect (just blocks)

Front 30

What is root guard?

Back 30

Controls which ports are not allowed to become root ports to remote switches.

Front 31

What is BPDU Guard?

Back 31

If a BPDU is seen inbound on a port then the switchport disables the port. Prevents another switch, which would send out BPDUs from connecting.

Front 32

Why would you configure root guard?

Back 32

Your switch might be connected to a switch that you don't manage. You don't want that remote switch tampering with your STP topology, or learning about other root ports.

Front 33

What is a best practice for CPD?

Back 33

Disable CDP on ports facing untrusted networks.

Front 34

What does DHCP snooping do?

Back 34

Acts like a firewall between unrusted hosts and trusted DHCP servers. Validates DHCP messages from untrusted sources, rate-limits traffic, builds and maintains DHCP snooping binding database, and utilizes that database to validate requests from untrusted hosts.

Front 35

How is DHCP snooping enabled?

Back 35

Enabled on a per-VLAN basis. configure DHCP server, enable on at least one VLAN. Ensure DHCP server is connected through a trusted interface. Config the DHCP snooping database agent. Enable globally.