Cisco CCNA Cisco CCNA Network Security Fundamentals 1 — Questions and Answers
Question 1: Which command enables port security on a Cisco switch interface and sets the maximum number of MAC addresses to 2?
- switchport port-security maximum 2 (Correct answer)
- port-security max-addresses 2
- switchport security limit 2
- ip port-security maximum 2
Correct answer: switchport port-security maximum 2
After enabling 'switchport port-security', the 'switchport port-security maximum 2' command limits the port to two learned MAC addresses.
Question 2: What is the default violation mode for Cisco switch port security?
- Shutdown (Correct answer)
- Restrict
- Protect
- Err-disable
Correct answer: Shutdown
By default, port security uses the Shutdown violation mode, which places the port in an err-disabled state when a violation occurs.
Question 3: Which attack does DHCP snooping protect against on a switched network?
- Rogue DHCP server attacks (Correct answer)
- MAC flooding attacks
- ARP spoofing attacks
- VLAN hopping attacks
Correct answer: Rogue DHCP server attacks
DHCP snooping prevents rogue DHCP servers by only forwarding DHCP offers from trusted (uplink) ports, blocking unauthorized IP assignments.
Question 4: What security feature does Dynamic ARP Inspection (DAI) rely on to validate ARP packets?
- DHCP snooping binding table (Correct answer)
- Static MAC address table
- Port security database
- ARP cache on the router
Correct answer: DHCP snooping binding table
DAI uses the DHCP snooping binding table to verify that ARP packets contain valid IP-to-MAC address mappings.
Question 5: Which command hardens a Cisco IOS device by encrypting all plaintext passwords currently in the running configuration?
- service password-encryption (Correct answer)
- enable secret level 5
- password encrypt all
- crypto password enable
Correct answer: service password-encryption
'service password-encryption' applies a weak reversible Type 7 encryption to plaintext passwords in the configuration.
Question 6: Which type of VLAN attack allows a rogue device to send frames on a VLAN other than the one it is assigned to?
- VLAN hopping (Correct answer)
- MAC spoofing
- ARP poisoning
- STP manipulation
Correct answer: VLAN hopping
VLAN hopping exploits trunk negotiation (DTP) or double-tagging to inject frames into a target VLAN without authorization.
Cisco CCNA Cisco CCNA Network Security Fundamentals 1
Which command enables port security on a Cisco switch interface and sets the maximum number of MAC addresses to 2?