Securing Local Area Networks

Which of the following is NOT a component of traditional endpoint security?

In the context of modern endpoint security, what is the purpose of Cisco AMP?

Which of the following is a primary function of Cisco NAC?

What is the primary goal of securing LAN elements?

In a borderless network, what is a key consideration when securing endpoints after a malware attack?

Which of the following is a method of Host-Based Protection?

Which of the following is NOT a modern endpoint security solution?

What is the primary function of a Cisco Email Security Appliance (ESA)?

What is the primary function of a Cisco Web Security Appliance (WSA)?

Which of the following best describes a CAM table overflow attack?

What type of Layer 2 attack involves manipulating the Spanning Tree Protocol (STP) to become the root bridge?

Which of the following Layer 2 attack mitigation techniques involves limiting the number of MAC addresses that can be learned on a port?

What is the purpose of DHCP snooping?

Which command enables port security on an interface?

Which port security violation mode drops traffic from unknown MAC addresses and increments the violation counter?

What is the effect of setting a port security violation mode to 'Shutdown'?

What type of attack attempts to consume all available IP addresses on a DHCP server?

What is the purpose of the command ip dhcp snooping trust when configuring DHCP snooping?

An attacker is flooding a switch with packets containing different source MAC addresses. What type of attack is this, and what is its likely outcome?

What are the key phases within the "Advanced Malware Protection" (AMP) framework that illustrate its continuous security approach?

If a network administrator configures port security with the violation mode set to 'protect', what will the switch do when a MAC address that exceeds the maximum limit attempts to access the port?

A network technician is tasked with implementing port security on a switch. They configure the maximum number of allowed MAC addresses to 1 and set the violation mode to ’shutdown.’ A user connects a hub to this port, and then connects two computers to the hub. What will happen?

What are the implications of a successful DHCP starvation attack on a network?

A disgruntled employee wants to disrupt the company's network. They decide to launch a CAM table overflow attack. What tool could the employee use?

An administrator needs to configure a Cisco switch interface connected to an IP phone and a computer. They want to ensure that the phone and computer can both connect, but also limit the number of MAC addresses allowed on the port for security. What is the most appropriate configuration approach?

An attacker launches a DHCP spoofing attack by setting up a rogue DHCP server on the network. The rogue server is configured to hand out invalid IP addresses, a default gateway pointing to the attacker's machine, and a DNS server also controlled by the attacker. What are the potential consequences?

A network administrator discovers a series of security violations on a switch port, with the violation mode set to 'restrict.' Upon investigation, it is found that users are frequently moving their devices between different ports, causing new MAC addresses to be learned and triggering the violation alerts. What is the most suitable approach to address this issue while maintaining security?

Which command would you use to dynamically learn and retain MAC addresses on a port, and what are the implications of using this command in a port security configuration?

If an attacker wanted to perform a DHCP starvation attack, which of the following actions would most likely be taken?

A network administrator is tasked with securing a network against CAM table overflow attacks. They decide to implement port security but are unsure about the best violation mode to use. They need a solution that will prevent unauthorized devices from accessing the network while also minimizing administrative overhead. Which port security violation mode would be the most suitable?

You are troubleshooting a network issue where users in VLAN 10 are unable to obtain IP addresses. After some investigation, you discover that a rogue DHCP server is present on the network. Which of the following actions would best mitigate the issue?

What is the purpose of DAI

Why is it important to enable DHCP Snooping on all VLANs?

A Security Engineer performs an analysis of AMP Threat Grid and discovers a zero-day exploit. Given this discovery, what actions MUST be taken by the Security Engineer?

Can Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) analyze encrypted traffic?

What is the most important countermeasure that should be in place for a large company that experiences a successful CAM attack in the LOCAL AREA NETWORK (LAN)?

Why can it be said that network threats are constantly evolving?

Why is Endpoint Detection and Response (EDR) a major improvement to previous endpoint protections (such as Antivirus)?

Which of the following is a typical feature of a Cisco Email Security Appliance (ESA)?

What is the primary purpose of URL filtering in host-based protection?

What is the purpose of the switchport port-security mac-address sticky command?

In the context of DHCP, what is the purpose of configuring a 'trusted port'?

An administrator needs to ensure that devices connecting to a switch port are authenticated before gaining network access. Which technology should be implemented?

What is the potential impact of insufficient endpoint security in a borderless network?

Which of the following accurately describes the function of a Cisco Web Security Appliance (WSA) in securing a network?

A network administrator observes a high volume of DHCP requests originating from a single host, rapidly depleting the DHCP scope. Besides enabling DHCP Snooping, what additional mitigation strategy can be deployed on the switch to address this specific issue?

A network security engineer suspects that a CAM table overflow attack is being launched against a critical switch in the network. While port security is configured, the engineer notices that the switch is still flooding traffic. Further investigation reveals that the attacker is rapidly changing the source MAC addresses in the attack packets at a rate exceeding the switch's MAC address learning rate, even with port security enabled with a violation mode of 'restrict'. What is the MOST effective mitigation step the engineer can take immediately to contain the attack?

A network administrator is tasked with hardening the network's defenses against Layer 2 attacks. They have already implemented port security and DHCP snooping. To further enhance security, they want to prevent attackers from exploiting ARP to conduct man-in-the-middle attacks, especially in VLANs where sensitive data is transmitted. Given these constraints, which additional security mechanism provides the MOST direct and effective mitigation against ARP spoofing?

Endpoint security focuses solely on antivirus software.

Cisco AMP is designed to only detect malware before it enters the network.

Cisco NAC authenticates devices but does not enforce network security policies.

Traditional endpoint security primarily relies on perimeter-based protection.

In a borderless network, security threats are solely contained within the internal network.

URL filtering is a component of Host-Based Protection.

Modern endpoint security solutions do not include web security.

Email Security Appliances only provide inbound message control.

NAC uses both credentials and posture assessment to grant network access.

Layer 2 security vulnerabilities are a concern primarily at the Physical layer of the OSI model.

A CAM table overflow attack aims to flood the switch with legitimate MAC addresses.

VLAN hopping attacks exploit vulnerabilities in VLAN trunking protocols.

DHCP Snooping mitigates ARP poisoning attacks.

IP Source Guard is used to prevent MAC address spoofing.

Compromise at the Application Layer always occurs after a compromise at the Data Link Layer.

STP Attacks target the Spanning Tree Protocol to manipulate the network topology.

Using the macof tool, it's possible to simulate a DoS attack against a network switch.

Enabling port security increases the number of dynamic ports on a switch.

With port security, setting the violation mode to 'protect' shuts down the port immediately upon a violation.

Enabling DHCP snooping prevents man-in-the-middle attacks by validating DHCP messages.

The primary goal of securing the local area network (LAN) is to allow any device to freely access network resources.

Endpoint security solutions are only necessary for devices physically connected to the network.

Cisco Advanced Malware Protection (AMP) is solely a signature-based antivirus solution.

Cisco Network Admission Control (NAC) ensures that all devices accessing the network comply with the organization's security policies.

In a traditional endpoint security model, host-based firewalls primarily protect against network-based attacks.

In the context of securing a borderless network, preventing malware infections is the only important consideration.

Modern endpoint security solutions like NAC focus on perimeter security rather than host-based security.

Cisco Email Security Appliance only filter inbound spam.

Cisco Web Security Appliance (WSA) is a solution designed to prevent phishing attacks.

Network Access Control (NAC) functions without any user authentication.

Layer 2 security vulnerabilities only affect wireless networks.

A CAM table overflow attack exploits vulnerabilities at Layer 3 of the OSI model.

Configuring port security on a switch aims to prevent ARP spoofing attacks.

Implementing DHCP snooping on a network helps prevent VLAN hopping attacks.

IP Source Guard operates at Layer 3 of the OSI model to protect against IP address spoofing.

In a CAM table overflow attack, the attacker's intention is to cause the switch to act like a hub, flooding traffic to all ports.

Disabling unused ports on a switch is an effective mitigation technique against DHCP starvation attacks.

Setting the port security violation mode to 'restrict' provides the least visibility into security incidents.

DHCP snooping requires all ports connected to DHCP clients to be configured as trusted ports.

Denying all outbound internet traffic from your internal LAN is an effective solution for all security concerns.

Cisco's Advanced Malware Protection (AMP) only functions after a malware attack.

A host-based firewall is an example of traditional endpoint security.

$Talos$ teams collect near-time threat intelligence from approximately 16 million deployed security devices.

URL Filtering is a method of host-based protection.

In the context of network security, 'blacklisting' refers to a method of blocking network communications from or to specific IP addresses or domains known to be malicious.

A CAM table overflow attack aims to flood the switch's MAC address table to impair its ability to forward network traffic effectively.

Implementing VLAN Truck security is a method to defend against MAC address spoofing attempts on a network.

In port security, setting the violation mode to 'restrict' will prevent traffic from an unknown MAC address, but will not increment the violation counter.

Cisco's Web Security Appliance (WSA) is positioned in the network to directly handle client web requests, filtering malicious content.

DHCP starvation attacks can be entirely prevented by implementing strict MAC address filtering on all network switches, ensuring only known devices can request IP addresses.