Securing Local Area Network: Endpoint Security Quiz
30 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What feature enables a router to keep a secure local copy of running image and config files in Cisco IOS?

  • Role-Based CLI access
  • Resilient Configuration (correct)
  • AutoSecure
  • Cisco AMP

    • Which technology can be used to lock down a router mentioned in the text?

  • AutoSecure (correct)
  • Secure Copy Protocol (SCP)
  • Role-Based CLI access
  • Dynamic Arp Inspection

    • What is used to shut down logins and log messages if a password attack is suspected as per the text?

  • Role-Based CLI access
  • VLAN Truck security
  • Cisco NAC
  • AutoSecure (correct)

    • Which technology can be implemented to mitigate VLAN hopping attacks as mentioned in the text?

    <p>VLAN Truck security</p> Signup and view all the answers

    What is used to mitigate ARP attacks according to the text?

    <p>Dynamic Arp Inspection</p> Signup and view all the answers

    Which technique can be used to mitigate address spoofing based on the text?

    <p>IP Source Guard</p> Signup and view all the answers

    What is the purpose of VLAN hopping attacks?

    <p>To allow an attacker to become a member of all VLANs</p> Signup and view all the answers

    How does a VLAN Double-Tagging attack work?

    <p>By tagging transmitted frames with multiple 802.1q headers</p> Signup and view all the answers

    What is a mitigation strategy for VLAN hopping attacks?

    <p>Manually enabling trunk link only on required ports</p> Signup and view all the answers

    What could be a method used to mitigate double 802.1Q encapsulation VLAN attacks?

    <p>Using the native VLAN 1 for all trunk ports</p> Signup and view all the answers

    What action should be taken on unused switch ports to help mitigate VLAN attacks?

    <p>Disable all unused switch ports and place them in an unused VLAN</p> Signup and view all the answers

    Why is it essential to disable Dynamic Trunk Protocol (DTP) negotiations on ports?

    <p>To prevent an attacker from spoofing a switch and becoming a member of all VLANs</p> Signup and view all the answers

    What is the purpose of Dynamic ARP Inspection (DAI)?

    <p>To prevent ARP poisoning attacks by intercepting and verifying ARP packets</p> Signup and view all the answers

    How does DAI mitigate ARP poisoning?

    <p>By dropping or logging ARP replies from invalid devices</p> Signup and view all the answers

    Which step is a recommended best practice for configuring Dynamic ARP Inspection?

    <p>Configuring all uplink ports as untrusted</p> Signup and view all the answers

    What is the role of rate limiting in Dynamic ARP Inspection?

    <p>To automatically disable interfaces when the limit is exceeded</p> Signup and view all the answers

    Why does DAI require DHCP snooping?

    <p>To determine the validity of an ARP packet based on MAC-address-to-IP-address bindings</p> Signup and view all the answers

    How does DAI differentiate between valid and invalid devices in preventing ARP spoofing?

    <p>By verifying IP-to-MAC binding in intercepted packets</p> Signup and view all the answers

    What does DAI check when configured to verify destination MAC addresses?

    <p>Destination MAC address in Ethernet header against target MAC address in ARP body</p> Signup and view all the answers

    Why is IP address spoofing difficult to mitigate, especially inside the same subnet?

    <p>Switches overwrite MAC table entries</p> Signup and view all the answers

    How does IP Source Guard (IPSG) differ from Dynamic ARP Inspection (DAI)?

    <p>IPSG protects against IP and MAC spoofing, while DAI focuses only on IP addresses</p> Signup and view all the answers

    What is a consequence of MAC address spoofing attacks on a switch?

    <p>The switch assigns the attacker's MAC to the target host's port</p> Signup and view all the answers

    Why must an attacker constantly send frames with spoofed addresses in a MAC address spoofing attack?

    <p>To ensure frames continue to be incorrectly forwarded</p> Signup and view all the answers

    How does DAI differ from IPSG in terms of packet inspection?

    <p>DAI inspects only ARP packets, while IPSG examines every packet</p> Signup and view all the answers

    What practice immediately brings an interface configured as an access or trunk port to forwarding state from a blocking state?

    <p>PortFast</p> Signup and view all the answers

    Which practice prevents an inappropriate switch from becoming the root bridge?

    <p>Root Guard</p> Signup and view all the answers

    What feature immediately error disables a port that receives a BPDU?

    <p>BPDU Guard</p> Signup and view all the answers

    Which practice prevents alternate or root ports from becoming designated ports due to a unidirectional link failure?

    <p>Loop Guard</p> Signup and view all the answers

    In what scenario should Root Guard be applied?

    <p>All ports which should not become root ports</p> Signup and view all the answers

    Where can PortFast be configured globally on all non-trunking ports?

    <p>Via the spanning-tree portfast default command</p> Signup and view all the answers

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser