100-150 Security Practice Test 3 — 15 Questions

Question 1

Which of the following describes the primary purpose of a security policy in a network environment?

Accepted Answer

To define organizational standards and expected behaviors for security.. A security policy defines the formal rules, procedures, and expectations for all users and systems within an organization. It provides the legal and operational framework for network security management. Establishing a policy is critical because it ensures that security practices are consistent, measurable, and enforceable across the enterprise, preventing ambiguity when handling sensitive data or responding to security incidents effectively.

Answer

To automatically configure firewall rules on all network devices.

Answer

To encrypt all traffic flowing between internal network segments.

Answer

To identify all potential vulnerabilities in the network infrastructure.

Question 2

Which TWO methods are considered effective for securing the control plane of Cisco networking devices? (Choose two.)

Accepted Answer

Implementation of Control Plane Policing (CoPP). Securing the control plane is essential to protect the CPU from resource exhaustion and unauthorized access. By limiting access to management interfaces and protecting the CPU from excessive traffic, administrators ensure the stability of the device routing and switching functions. These practices are critical because the control plane is the 'brain' of the network device; if it is compromised or overwhelmed, the entire network segment may experience service outages.

Answer

Enabling SNMPv1 for remote monitoring

Answer

Disabling the use of SSH for remote management

Answer

Increasing the size of the routing table

Question 3

Refer to the exhibit. Why is the interface fa0/1 currently in the 'Secure-shutdown' state?

Accepted Answer

The device connected has an unauthorized MAC address.. The interface is in 'Secure-shutdown' because a violation occurred. The port security configuration allowed for a maximum of one MAC address, and a device with a different MAC address than the one learned or configured attempted to connect. The violation mode was set to 'shutdown', which forces the port to disable itself to protect the network from the unauthorized device, requiring manual intervention to restore connectivity to the interface.

Answer

The port is configured for 'protect' mode.

Answer

The aging time has expired for the port.

Answer

The switch has lost power to the interface.

Question 4

Which feature is best suited to prevent VLAN hopping attacks where an attacker sends double-tagged 802.1Q frames to reach a restricted VLAN?

Accepted Answer

Disabling DTP and setting ports to 'switchport mode access'.. VLAN hopping via double-tagging occurs when an attacker sends a frame with two tags to a switch, tricking it into bypassing port restrictions. By explicitly configuring ports as access ports and disabling DTP negotiation, administrators prevent the switch from automatically forming trunks with unauthorized devices. This is a critical hardening step because it removes the possibility of a device negotiating a trunk link, which is required for VLAN hopping to succeed.

Answer

Implementing a standard Access Control List.

Answer

Configuring PortFast on all access ports.

Answer

Enabling VTP pruning on the switch.

Question 5

A network technician is reviewing a Cisco switch configuration and sees that PortFast and BPDU Guard are enabled on an access port that connects to a user's desktop. The user calls and reports that they accidentally plugged a small unmanaged switch into that wall jack so they could connect both a PC and a printer. Shortly afterward, the port stopped forwarding traffic. What is the most likely explanation for this behavior?

Accepted Answer

The unmanaged switch sent BPDUs that were received on the PortFast port, and BPDU Guard placed the port into the err-disabled state.. When PortFast is enabled on an access port, it allows the port to transition immediately to the forwarding state, bypassing the listening and learning states. To prevent loops, BPDU Guard is often enabled alongside PortFast. If a BPDU is received on a PortFast-enabled port, BPDU Guard err-disables the port. In this scenario, connecting an unmanaged switch causes BPDUs to be sent, triggering BPDU Guard and disabling the port.

Answer

The switch detected a MAC address flapping condition and applied a default port security violation.

Answer

The unmanaged switch negotiated a speed of 10 Mbps, which is unsupported on the access port.

Answer

The unmanaged switch caused a duplex mismatch, and the port was automatically disabled by the switch fabric.

Question 6

A user at a branch office reports that when they browse to their bank's website, the browser displays a certificate warning and the address bar shows a lock with a red line through it. The help desk confirms the user's PC has the correct date and time. Which security concept is MOST likely being violated in this scenario?

Accepted Answer

Authenticity of the website's identity. A browser certificate warning means the TLS certificate presented by the site could not be validated against a trusted certificate authority, the hostname did not match, or the certificate is expired or revoked. Because the user's system clock is correct, the failure points to the authenticity of the website's identity, which is the security property that digital certificates are designed to guarantee.

Answer

Data integrity of the website content

Answer

Confidentiality of the user's credentials

Answer

Availability of the banking web service

Question 7

A small office has a single Cisco wireless router providing both employee and guest access. The manager wants guests to reach the internet but must not be able to reach the internal file server or the printer on the office LAN. Which feature should be enabled on the wireless router to meet this requirement?

Accepted Answer

Guest SSID mapped to a separate VLAN with an ACL that blocks access to internal subnets. Guests need internet access without any path to internal resources. Placing guest traffic on a dedicated VLAN and applying an ACL that denies access to internal subnets enforces that boundary at the network layer. Encryption, MAC lists, and SSID hiding all control who joins the wireless network, not what an already-connected guest can reach, so only proper segmentation solves the problem.

Answer

WPA2-Personal with a strong pre-shared key on the guest network

Answer

Disabling SSID broadcast on the guest wireless network

Answer

MAC address filtering with a list of approved guest devices

Question 8

A network administrator wants to prevent users on the corporate LAN from connecting unauthorized wireless access points and switches to wall jacks in conference rooms. The administrator needs a feature that restricts which MAC addresses are allowed to send traffic on each access port. Which Cisco switch feature should be configured?

Accepted Answer

Port security. Port security is the Cisco feature designed to control which source MAC addresses are permitted on a switch port. By configuring the maximum number of MAC addresses and using sticky learning or static entries, the administrator can ensure only authorized corporate devices communicate through conference room jacks, blocking rogue switches and access points from attaching to the network.

Answer

DHCP snooping

Answer

Private VLAN edge

Answer

Dynamic ARP Inspection

Question 9

A small office wants to keep its wireless network traffic private so that neighbors cannot read the data being transmitted. Which technology should be enabled on the wireless access point to encrypt traffic between clients and the access point?

Accepted Answer

WPA2 with AES. Enabling WPA2 with AES on the access point encrypts the wireless frames so that only authorized clients with the correct pre-shared key or credentials can decrypt them. Neighbors capturing the radio signal see only ciphertext. The other listed measures either hide information or filter clients but leave the actual data readable.

Answer

DHCP snooping

Answer

MAC address filtering

Answer

SSID broadcast disabled

Question 10

A user at a branch office receives a phone call from someone claiming to be a help desk technician. The caller already knows the user's employee ID, manager's name, and the model of laptop issued to the user, and asks the user to read back the six-digit code that was just texted to their phone so the technician can 'verify the device.' The user complies, and minutes later the attacker logs into the corporate VPN using the user's credentials. Which type of attack has occurred?

Accepted Answer

Vishing. The attacker used a telephone call, impersonated support staff, and leveraged previously gathered personal details to pressure the user into revealing a one-time password. That combination of voice channel plus pretexting plus credential harvesting is the textbook definition of vishing. The texted code was genuine, so no SMS link was clicked and no wireless or in-path manipulation occurred.

Answer

Evil twin

Answer

On-path attack

Answer

Smishing

Question 11

A network administrator is reviewing a Cisco switch configuration and sees that a port in the employee area has been configured with the 'switchport port-security' command and a maximum of one MAC address. A user unplugs their laptop and connects a different laptop to the same port. Assuming the default violation mode, what happens?

Accepted Answer

Frames from the new laptop are dropped and a violation counter is incremented.. When port security is enabled with the default settings, the violation mode is restrict. A second MAC address on a port limited to one secure address triggers a violation, and the switch drops the frames from the offending device while keeping the port operational. The violation counter increments and logging may occur, but the interface is not disabled unless shutdown mode is explicitly configured.

Answer

The port is placed into a VLAN that quarantines the new device.

Answer

The port shuts down and must be manually re-enabled or recovered.

Answer

The new laptop is allowed but its MAC address replaces the existing secure MAC.

Question 12

A security team is reviewing how to protect a small office network from common Layer 2 attacks. The team wants to implement features that specifically prevent MAC address table overflow and ARP cache poisoning. Which two Cisco switch features should the team deploy? (Choose two.)

Accepted Answer

Port security to limit MAC addresses per port. MAC address table overflow attacks are mitigated by port security, which caps the number of source MAC addresses a port can learn and takes a configured action on violation. ARP cache poisoning is mitigated by Dynamic ARP Inspection, which validates ARP packets against the DHCP snooping binding table and drops spoofed mappings. Together they address both attack types named in the scenario.

Answer

Storm control to limit broadcast traffic

Answer

BPDU Guard to disable ports receiving BPDUs

Answer

Root Guard to prevent rogue root bridge election

Question 13

A network administrator must ensure that only specific management stations can reach the management VLAN on a Cisco switch, while ordinary user traffic on other VLANs flows unrestricted. The administrator wants a mechanism that filters traffic based on source IP addresses and can log denied attempts. Which feature should be configured?

Accepted Answer

An IP access control list applied to the management VLAN interface. Filtering by source IP address while leaving other VLANs untouched points to an IP access control list bound to the management switched virtual interface. The list permits only the designated management subnets and denies everything else, and log entries record rejected attempts. Layer 2 protections such as port security, Dynamic ARP Inspection, and BPDU Guard address different threats entirely.

Answer

Port security with sticky MAC address learning

Answer

Dynamic ARP Inspection on all user-facing ports

Answer

BPDU Guard enabled on access ports

Question 14

A network administrator is configuring a Cisco switch and wants to ensure that only the designated uplink port can send DHCP server replies, while all other ports are prevented from acting as DHCP servers. Which command should be applied to the uplink port?

Accepted Answer

ip dhcp snooping trust. DHCP snooping treats all ports as untrusted by default, dropping DHCP server messages such as OFFER and ACK. Marking the uplink with ip dhcp snooping trust allows replies from the legitimate DHCP server to reach clients while rogue servers on access ports remain blocked. This is the standard way to permit only the designated port to act as a DHCP server path.

Answer

ip dhcp snooping limit rate 10

Answer

ip dhcp snooping vlan 10

Answer

switchport port-security

Question 15

A network team is hardening a Cisco Catalyst switch that will be deployed at the edge of the corporate network. They want to reduce the risk of Layer 2 attacks such as MAC flooding and unauthorized device attachment. Which two actions should they take? (Choose two.)

Accepted Answer

Enable port security on access ports to limit the number of MAC addresses.. MAC flooding is countered by limiting learned MAC addresses per port, which port security accomplishes. Unauthorized physical attachment is reduced by disabling unused ports and parking them in an unused VLAN. Together these measures harden the access edge. The other options either misplace a feature, depend on missing prerequisites, or actively weaken trunk security, so they do not serve the team's stated objectives.

Answer

Enable Dynamic ARP Inspection on all access ports without DHCP snooping.

Answer

Configure the native VLAN on all trunk ports to match VLAN 1.

Answer

Enable IP source guard on routed uplinks only.