6 questions · Security · All types, answers revealed
Drag and drop the steps to configure port security on a Cisco switch in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Port security limits unauthorized MAC addresses; violation mode defines action on violation.
Which TWO of the following are valid methods to mitigate VLAN hopping attacks?
Prevents trunk negotiation.
Why this answer
Disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.
Exam trap
Cisco often tests the misconception that simply using 802.1Q trunking (Option E) or setting the native VLAN to VLAN 1 (Option C) provides security, when in fact the key mitigations are disabling DTP on access ports and using an unused native VLAN on trunk ports.
Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?
DHCP snooping drops DHCP server responses on untrusted ports.
Why this answer
The DHCP snooping feature treats all ports as untrusted by default, which means DHCP server messages (DHCPOFFER, DHCPACK, DHCPNAK) are dropped on untrusted ports. Since the DHCP server is connected to a trunk port and DHCPACK messages are being dropped, that trunk port must be explicitly configured as a trusted port for DHCP snooping using the 'ip dhcp snooping trust' interface command. This allows legitimate DHCP server responses to reach clients, resolving the duplicate IP address issue caused by clients not receiving their assigned addresses.
Exam trap
Cisco often tests the default untrusted behavior of DHCP snooping on all ports, tricking candidates into thinking that only access ports need trust configuration, when in fact the port facing the DHCP server (even a trunk) must be explicitly trusted to allow server messages through.
How to eliminate wrong answers
Option A is wrong because manually shutting down access ports with unknown MAC addresses in the binding table does not address the root cause—DHCPACK messages being dropped on the trunk port—and would cause unnecessary outages for potentially legitimate clients. Option B is wrong because disabling Dynamic ARP Inspection (DAI) on VLAN 10 would remove ARP validation, which could allow ARP spoofing attacks, and it does not fix the DHCP server message filtering issue. Option D is wrong because disabling IP Source Guard (IPSG) on all access ports in VLAN 10 would remove IP spoofing protection on those ports, and it does not address the DHCP snooping trust configuration on the trunk port where the DHCP server is connected.
Which TWO features are part of Cisco TrustSec for providing role-based access control?
SGACLs enforce policies based on SGTs.
Why this answer
Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.
Exam trap
Cisco often tests the distinction between the authentication mechanism (802.1X) and the authorization/enforcement components (SGTs and SGACLs), leading candidates to mistakenly select 802.1X as a TrustSec RBAC feature.
Match each Spanning Tree Protocol (STP) variant to its key characteristic.
Drag a concept onto its matching description — or click a concept then click the description.
Original standard, slow convergence
Fast convergence, backward compatible
Multiple spanning trees per VLAN group
Cisco proprietary, per-VLAN STP
Cisco proprietary, per-VLAN RSTP
Why these pairings
STP (802.1D) is the original slow-converging standard; RSTP (802.1w) provides rapid convergence; MSTP (802.1s) maps multiple VLANs to fewer spanning tree instances; PVST+ runs per-VLAN STP. Common confusions include equating STP with per-VLAN and RSTP with multiple instances.
Which THREE of the following are characteristics of Cisco TrustSec (CTS) security architecture?
SGTs are used for classification.
Why this answer
C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.
Exam trap
Cisco often tests the misconception that TrustSec uses VLANs or IPsec for segmentation and encryption, when in fact it uses SGTs for classification and MACsec for Layer 2 encryption.
Ready to test yourself?
Try a timed practice session using only Security questions.