N10-009 Network Security Practice Test 7 — 15 Questions

Question 1

A security auditor discovers that an unauthorized switch has been connected to an access port in the wiring closet. The rogue switch caused a network loop and disrupted connectivity. Which security feature, if enabled on the access port, would have prevented this by disabling the port when a BPDU is received?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BPDU guard. BPDU guard is the correct answer because it is specifically designed to protect against rogue switch connections on access ports. When enabled, if a port receives any Bridge Protocol Data Unit (BPDU), it immediately places the port into an errdisable state, effectively disabling it and preventing a potential network loop. This directly addresses the scenario where an unauthorized switch connected to an access port caused a loop.

Answer

Root guard

Answer

Loop guard

Answer

UDLD

Question 2

Which attack technique involves an attacker intercepting and potentially modifying the communication between two parties without their knowledge?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack is correct because it specifically involves an attacker secretly intercepting and potentially altering communications between two parties who believe they are directly communicating with each other. This is achieved by the attacker inserting themselves into the communication path, often by ARP spoofing, DNS spoofing, or rogue access points, allowing them to capture, decrypt, or modify packets in transit.

Answer

Replay attack

Answer

Smurf attack

Answer

Phishing

Question 3

A network administrator discovers that client workstations are receiving IP addresses from an unknown device, causing network connectivity issues. Which security feature should be configured on switches to prevent rogue DHCP servers from assigning IP addresses?

Accepted Answer

DHCP snooping. DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. By configuring ports as trusted (where legitimate DHCP servers are connected) and untrusted (client-facing ports), the switch drops all DHCP server messages (OFFER, ACK, NAK) received on untrusted ports, effectively blocking rogue DHCP servers from assigning IP addresses.

Answer

Dynamic ARP Inspection

Answer

Port security

Answer

BPDU guard

Question 4

A network administrator is experiencing issues where unauthorized devices are offering IP addresses to clients, causing connectivity problems. Which security feature should be enabled on switches to prevent this?

Accepted Answer

DHCP Snooping. C is correct because DHCP Snooping is a security feature that filters untrusted DHCP messages on a per-port basis, preventing unauthorized DHCP servers from offering IP addresses to clients. By configuring trusted ports (typically uplinks to legitimate DHCP servers) and untrusted ports (access ports), the switch drops DHCPOFFER and DHCPACK messages received on untrusted ports, directly stopping rogue DHCP server attacks.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard

Answer

Port Security

Question 5

A network administrator wants to ensure that only a specific laptop can connect to a particular switch port. The laptop's MAC address is known. Which security feature should be configured?

Accepted Answer

Port security. Port security is the correct feature because it allows the administrator to statically configure the allowed MAC address on a specific switch port. Once configured, the switch will only forward traffic from that MAC address, dropping frames from any other source MAC. This directly fulfills the requirement to restrict access to a single known laptop.

Answer

802.1X

Answer

DHCP snooping

Answer

BPDU guard

Question 6

An attacker intercepts communication between two parties and is able to modify the data in transit without either party's knowledge. Which type of attack is this?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an adversary secretly intercepts and potentially alters the communication between two parties who believe they are directly communicating with each other. The attacker can modify data in transit without either party's knowledge by placing themselves in the logical or physical path of the data flow, often by exploiting weaknesses in authentication or encryption. This matches the scenario described, where the attacker both intercepts and modifies the data.

Answer

ARP spoofing

Answer

DNS poisoning

Answer

Replay attack

Question 7

An attacker is launching a DHCP starvation attack by sending a large number of DHCP discover messages with spoofed MAC addresses. This exhausts the DHCP pool and causes legitimate clients to fail to obtain IP addresses. Which security feature should be implemented on the switch to mitigate this attack?

Accepted Answer

DHCP snooping. DHCP snooping is the correct mitigation because it filters untrusted DHCP messages on access ports. By default, it only allows DHCP server responses (OFFER, ACK, etc.) on trusted ports (typically uplinks to the legitimate DHCP server) and drops them on untrusted ports, preventing a rogue or spoofed server from replying. Additionally, DHCP snooping builds a DHCP snooping binding table that tracks valid MAC-to-IP address mappings, which can be used to rate-limit DHCP discover messages and detect starvation attacks.

Answer

Port security

Answer

Dynamic ARP Inspection (DAI)

Answer

802.1X

Question 8

A security auditor recommends implementing a solution that authenticates users and devices before granting network access, regardless of the physical port they connect to. Which technology should be deployed?

Accepted Answer

802.1X. 802.1X is the correct technology because it provides port-based network access control (PNAC) that authenticates users and devices before granting network access, regardless of the physical port they connect to. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to communicate with a RADIUS server, ensuring that only authenticated endpoints are allowed on the network. This meets the auditor's requirement for authentication at the port level, independent of the switch port used.

Answer

Port security

Answer

VLAN hopping

Answer

DHCP snooping

Question 9

An attacker is eavesdropping on network traffic to capture sensitive data sent over an unencrypted HTTP connection. Which technology should be implemented to protect data in transit between clients and web servers?

Accepted Answer

SSL/TLS. SSL/TLS (Secure Sockets Layer/Transport Layer Security) operates at the application layer to encrypt HTTP traffic, creating HTTPS. This ensures that data transmitted between clients and web servers is encrypted, preventing eavesdroppers from reading sensitive information like passwords or credit card numbers. TLS is the standard protocol for securing HTTP communications, as defined in RFC 8446.

Answer

IPSec

Answer

SSH

Answer

SNMPv3

Question 10

A company wants to enforce network access control such that only authenticated users can connect to the wired network. The authentication server will use RADIUS. Which IEEE standard should be implemented?

Accepted Answer

802.1X. 802.1X is the IEEE standard for port-based network access control (PNAC). It provides a framework for authenticating devices before granting access to a wired or wireless LAN, using an authentication server such as RADIUS. This directly meets the requirement to enforce network access control so that only authenticated users can connect to the wired network.

Answer

802.11i

Answer

802.3af

Answer

802.1Q

Question 11

A network administrator is concerned about DHCP security. To prevent rogue DHCP servers from offering incorrect IP addresses, the administrator enables DHCP snooping on the switches. Additionally, the administrator wants to prevent DHCP starvation attacks that exhaust the DHCP pool. Which feature should be enabled on the switch to specifically mitigate DHCP starvation?

Accepted Answer

Rate limiting on DHCP packets. Rate limiting on DHCP packets (option D) is the correct feature to mitigate DHCP starvation attacks. DHCP starvation works by flooding the network with fake DHCP discover messages, each using a different MAC address, to exhaust the DHCP server's address pool. By limiting the rate at which DHCP packets are accepted from a given interface, the switch can drop excessive requests before they reach the DHCP server, preventing pool exhaustion without blocking legitimate traffic.

Answer

Dynamic ARP Inspection (DAI)

Answer

IP Source Guard (IPSG)

Answer

Port Security

Question 12

Drag and drop the steps to configure a VLAN on a managed switch into the correct order.

Accepted Answer

Access the switch and enter privileged EXEC mode, then enter global configuration mode, then create the VLAN, then assign interfaces to the VLAN.. VLAN creation involves entering config mode, creating the VLAN, and assigning ports.

Answer

Access the switch and enter privileged EXEC mode, then create the VLAN, then enter global configuration mode, then assign interfaces to the VLAN.

Answer

Enter global configuration mode, then access the switch and enter privileged EXEC mode, then create the VLAN, then assign interfaces to the VLAN.

Answer

Access the switch and enter privileged EXEC mode, then enter global configuration mode, then assign interfaces to the VLAN, then create the VLAN.

Question 13

Drag and drop the steps for a disaster recovery procedure after a server failure into the correct order.

Accepted Answer

Assess damage, then rebuild server, then restore from backup, then apply patches, then test functionality. The correct disaster recovery order begins with assessing the damage to understand the scope of the failure. Next, rebuild the server (hardware/OS), then restore data from backup. After restoration, apply any necessary patches to bring the system up to date, and finally test functionality to confirm successful recovery. This sequence ensures data integrity and minimizes downtime.

Answer

Assess damage, then restore from backup, then rebuild server, then apply patches, then test functionality

Answer

Restore from backup, then rebuild server, then test functionality, then apply patches, then assess damage

Answer

Test functionality, then assess damage, then restore from backup, then apply patches, then rebuild server

Question 14

Match each network attack to its description.

Accepted Answer

Distributed Denial-of-Service (DDoS): Overwhelms a network or server with a flood of traffic from multiple sources. DDoS attacks flood systems with traffic, MitM attacks intercept communications, phishing tricks users into revealing info, and ransomware encrypts files for ransom.

Answer

Distributed Denial-of-Service (DDoS): Intercepts communication between two parties

Answer

Phishing: Malware that encrypts data for ransom

Question 15

A network administrator is configuring a new firewall rule set and wants to ensure that all remote administration traffic to the firewall itself is encrypted. The administrator plans to use SSH for command-line access. Which security principle is being applied when SSH is used instead of Telnet for firewall management?

Accepted Answer

Confidentiality. Using SSH instead of Telnet for firewall management encrypts the entire session, protecting credentials and configuration commands from interception. This directly enforces confidentiality, as the primary goal is to prevent unauthorized reading of sensitive administrative traffic. Integrity, availability, and non-repudiation are separate security goals that SSH may partially support, but they are not the driving principle for this specific requirement.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation