Cisco CCNA Cisco CCNA Network Security Fundamentals

Question 1

Which command enables port security on a Cisco switch interface and sets the maximum number of MAC addresses to 2?

Accepted Answer

switchport port-security maximum 2

Answer

After enabling 'switchport port-security', the 'switchport port-security maximum 2' command limits the port to two learned MAC addresses.

Question 2

What is the default violation mode for Cisco switch port security?

Accepted Answer

Shutdown

Answer

By default, port security uses the Shutdown violation mode, which places the port in an err-disabled state when a violation occurs.

Question 3

Which attack does DHCP snooping protect against on a switched network?

Accepted Answer

Rogue DHCP server attacks

Answer

DHCP snooping prevents rogue DHCP servers by only forwarding DHCP offers from trusted (uplink) ports, blocking unauthorized IP assignments.

Question 4

What security feature does Dynamic ARP Inspection (DAI) rely on to validate ARP packets?

Accepted Answer

DHCP snooping binding table

Answer

DAI uses the DHCP snooping binding table to verify that ARP packets contain valid IP-to-MAC address mappings.

Question 5

Which command hardens a Cisco IOS device by encrypting all plaintext passwords currently in the running configuration?

Accepted Answer

service password-encryption

Answer

'service password-encryption' applies a weak reversible Type 7 encryption to plaintext passwords in the configuration.

Cisco CCNA Practice Test