100-150 Practice Test 2 — 10 Questions

Question 1

Which feature is best suited to prevent VLAN hopping attacks where an attacker sends double-tagged 802.1Q frames to reach a restricted VLAN?

Accepted Answer

Disabling DTP and setting ports to 'switchport mode access'.. VLAN hopping via double-tagging occurs when an attacker sends a frame with two tags to a switch, tricking it into bypassing port restrictions. By explicitly configuring ports as access ports and disabling DTP negotiation, administrators prevent the switch from automatically forming trunks with unauthorized devices. This is a critical hardening step because it removes the possibility of a device negotiating a trunk link, which is required for VLAN hopping to succeed.

Answer

Implementing a standard Access Control List.

Answer

Configuring PortFast on all access ports.

Answer

Enabling VTP pruning on the switch.

Question 2

When connecting a modern PC directly to a modern Cisco switch port, the technician uses a standard straight-through cable and the link comes up immediately. Which feature enabled this connection to work?

Accepted Answer

Auto-MDIX. Historically, connecting like-devices required crossover cables, while unlike-devices used straight-through cables. Modern networking equipment simplifies this with a feature that automatically detects the required cable type and adjusts the internal transmit and receive pairs accordingly, allowing for greater flexibility and fewer specialized cables in a technician's kit.

Answer

Full-Duplex Negotiation

Answer

PoE Autonegotiation

Answer

CSMA/CD

Question 3

Refer to the exhibit. A technician is verifying the hardware installed in a switch. What type of media is required to connect to the 'Te1/1/1' interface based on the SFP type shown?

Accepted Answer

Multi-mode fiber optic cable. The 'Te1/1/1' interface naming indicates a 10 Gigabit Ethernet port, and the SFP type shown in the exhibit is a multi-mode fiber SFP (typically with an OM3/OM4 LC connector and a wavelength like 850 nm). Multi-mode fiber is used for short-reach 10G connections up to ~300–400 m, which matches the SFP's design. Therefore, a multi-mode fiber optic cable is required.

Answer

Single-mode fiber optic cable

Answer

Category 6a copper cable

Answer

Twinaxial (DAC) copper cable

Question 4

An organization is upgrading its cabling infrastructure to support Gigabit Ethernet over a distance of 85 meters. Which twisted-pair cable category is the minimum requirement to reliably support 1000 Mbps speeds at this specific distance?

Accepted Answer

Category 5e (Cat5e). Selecting the correct copper cabling category is vital for meeting bandwidth requirements while adhering to distance limitations defined by TIA/EIA standards. Understanding the capabilities of different categories ensures that the network infrastructure can support modern data rates without signal degradation or excessive crosstalk, which could lead to retransmissions and degraded user experiences across the enterprise.

Answer

Category 3 (Cat3)

Answer

Category 5 (Cat5)

Answer

Category 2 (Cat2)

Question 5

Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?

Accepted Answer

Restricting unauthorized network access. ACLs are essential tools for traffic filtering and network segmentation. By controlling which packets are permitted or denied based on source, destination, and protocol, administrators enforce security policies at the network edge or between VLANs. Understanding how ACLs manage traffic flow is critical for maintaining network integrity and preventing unauthorized data access, as they provide the fundamental mechanism for restricting communication between sensitive network segments in a controlled and highly audit-able manner.

Answer

Encrypting sensitive data traffic

Answer

Automatically updating firmware

Answer

Providing hardware redundancy

Question 6

Which of the following is a primary goal of the 'Accounting' component in the AAA security framework?

Accepted Answer

Recording user activities. Accounting tracks the actions performed by users on the network, including the time they logged in and the commands they executed. This data is critical for auditing and compliance, providing a clear record of activity. By maintaining an audit trail, administrators can investigate security incidents, identify misuse, and ensure that individuals remain accountable for their actions during their network session, which is vital for forensic analysis.

Answer

Encrypting all user traffic

Answer

Verifying user identities

Answer

Assigning permissions to users

Question 7

A network designer is planning to use the 10.50.0.0/16 address space. Which TWO of the following represent valid network IDs for subnets created by further dividing this space into /24 segments?

Accepted Answer

10.50.1.0. Options A (10.50.1.0) and B (10.50.255.0) are correct because when 10.50.0.0/16 is divided into /24 subnets, the third octet becomes the subnet identifier and the fourth octet must be 0, giving valid network IDs such as 10.50.0.0, 10.50.1.0, and 10.50.255.0, all of which fall within the 10.50.0.0–10.50.255.0 range. Option C (10.51.0.0) is outside the 10.50.0.0/16 block, since 10.51.x.x belongs to a different /16. Option D (10.50.0.255) is a host address within 10.50.0.0/24, not a network ID, because the host portion is non-zero. Option E (10.50.1.1) is also a host address in the 10.50.1.0/24 subnet, not a valid network ID.

Answer

10.51.0.0

Answer

10.50.0.255

Answer

10.50.1.1

Question 8

A network administrator is connecting a Cisco switch to another Cisco switch using a copper cable. The administrator wants to avoid manual crossover configuration and ensure the link works regardless of cable type. Which technology should be enabled on the switch ports?

Accepted Answer

Auto-MDIX. Auto-MDIX is the correct feature because it automatically adjusts the port's transmit and receive pins to match the cable type, whether straight-through or crossover. This eliminates the need for manual crossover cables on switch-to-switch links. Port security, STP, and LACP serve different purposes and do not resolve cable pinout issues.

Answer

Spanning Tree Protocol

Answer

Port security

Answer

Link Aggregation Control Protocol

Question 9

Which security feature is used to mitigate DHCP starvation attacks by limiting the number of DHCP messages per port?

Accepted Answer

DHCP Snooping. DHCP starvation attacks deplete the available IP address pool by requesting numerous leases. DHCP Snooping protects the network by acting as a firewall between untrusted hosts and DHCP servers, limiting the rate of DHCP messages. This is a critical enterprise security control, as DHCP is often an overlooked vector that can lead to DoS or man-in-the-middle attacks if left entirely unprotected on access-layer switches.

Answer

Port Security

Answer

IP Source Guard

Answer

Dynamic ARP Inspection

Question 10

Which TWO methods are considered effective for securing the control plane of Cisco networking devices? (Choose two.)

Accepted Answer

Implementation of Control Plane Policing (CoPP). Securing the control plane is essential to protect the CPU from resource exhaustion and unauthorized access. By limiting access to management interfaces and protecting the CPU from excessive traffic, administrators ensure the stability of the device routing and switching functions. These practices are critical because the control plane is the 'brain' of the network device; if it is compromised or overwhelmed, the entire network segment may experience service outages.

Answer

Enabling SNMPv1 for remote monitoring

Answer

Disabling the use of SSH for remote management

Answer

Increasing the size of the routing table