CCNA Network Security Questions

Port security limits the number of MAC addresses per port but does not inspect DHCP messages or prevent DHCP pool exhaustion from spoofed MAC addresses.

Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing and man-in-the-middle attacks, but it does not prevent DHCP starvation attacks, which target DHCP address exhaustion.

802.1X is an authentication protocol that controls network access at the port level, but it does not prevent DHCP starvation attacks because it does not monitor or rate-limit DHCP messages.

Placing the printer in the HR VLAN would allow HR devices to access it without routing, but it would not block other traffic between VLANs, and the printer would lose access to Finance resources if needed.

Creating a separate VLAN for the printer does not solve the requirement to permit only HR-to-printer traffic while blocking all other inter-VLAN traffic; it would still require routing and ACLs to control access, and it adds unnecessary complexity.

The attack described involves incomplete TCP connection requests exhausting server resources, which is a SYN flood, not a ping flood. Ping floods use ICMP echo requests, not TCP connections, and rate limiting is a mitigation for ICMP-based floods, not for SYN floods.

The question describes incomplete TCP connection requests exhausting server resources, which is a SYN flood, not a Smurf attack. A Smurf attack uses ICMP echo requests sent to a network's broadcast address with a spoofed source IP, causing amplification and targeting the victim with ICMP replies.

ARP poisoning targets the Address Resolution Protocol to intercept traffic on a local network, not to exhaust server resources via incomplete TCP connections. The described attack is a SYN flood, which exploits the TCP three-way handshake.

DNS poisoning involves corrupting DNS cache to redirect traffic to malicious sites, not establishing a covert channel via encrypted queries over TCP 853.

DNS amplification is a DDoS attack that uses open resolvers to flood a target with large responses, not a technique for establishing covert communication channels via encrypted DNS queries.

DNS zone transfer is a mechanism for replicating DNS databases between authoritative servers, typically using TCP port 53, not port 853. It does not involve encrypted queries or covert channels.

Inline placement introduces latency and creates a single point of failure, contradicting the requirement to avoid both.

Connecting the IDS directly to the internet router would place it inline with all internet traffic, but this creates a single point of failure and introduces latency, contradicting the requirement to avoid both.

Connecting the IDS to the management network would only allow it to see management traffic, not all network traffic entering and exiting the network, failing to meet the requirement to analyze all traffic.

802.1X is an authentication protocol that requires a RADIUS server and is not used for simple MAC-based allowlisting on a single switch port; it controls network access at the user/device level via EAP, not by a static list of MAC addresses.

MAC address filtering is typically implemented on wireless access points or as a general network access control, not specifically on a switch port to limit devices per port. Port security is the Cisco-specific feature that binds MAC addresses to a switch port and can restrict the number of allowed MACs.

VLAN hopping prevention is a security measure to prevent traffic from jumping between VLANs, not to restrict device access based on MAC addresses on a single switch port.

A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, not sending a large volume of SYN packets without completing the handshake.

A DDoS amplification attack involves sending small queries to a server with a spoofed source IP, causing the server to send large responses to the victim. The question describes the internal server sending SYN packets, not receiving amplified responses, so this does not match.

A Smurf attack involves sending ICMP echo requests with a spoofed source IP to a network's broadcast address, causing all hosts to reply to the victim. The question describes TCP SYN packets, not ICMP, and the server is the source, not the target of amplification.

The question describes ARP replies mapping the default gateway IP to an unknown MAC, which is ARP poisoning, not MAC flooding. MAC flooding overwhelms a switch's MAC table to force fail-open mode, causing frames to flood, but does not involve spoofing ARP replies.

The question describes ARP replies mapping the default gateway IP to an unknown MAC, which is ARP poisoning, not DHCP starvation. DHCP starvation exhausts IP addresses, not ARP mappings.

DNS poisoning manipulates DNS records, not ARP tables. The question describes ARP replies mapping a gateway IP to a wrong MAC, which is ARP poisoning, not DNS poisoning.

Port security limits MAC addresses per port but does not inspect ARP packets, so it cannot prevent forged ARP replies that map the gateway IP to an attacker's MAC.

BPDU guard is used to prevent bridge loops by disabling ports that receive BPDUs, not to validate ARP packets or prevent ARP spoofing attacks.

802.3af is a Power over Ethernet (PoE) standard that defines how power is delivered over Ethernet cabling, not a network access control mechanism for authenticating users.

802.11i is a wireless security standard (WPA2) that provides encryption and authentication for Wi-Fi networks, not for wired network access control.

802.1Q is a standard for VLAN tagging, not for network access control or authentication. It does not provide any mechanism to authenticate users before granting network access.

A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP, causing all hosts to reply to the victim. This question describes packets with the same source IP as the internal DNS server, which is IP spoofing, not a Smurf attack.

A man-in-the-middle attack involves intercepting and potentially altering communications between two parties, but the question describes a flood of packets with a spoofed source IP, which is characteristic of IP spoofing, not MITM.

ARP poisoning involves manipulating ARP tables to associate a malicious MAC address with a legitimate IP address, but the question describes packets with a spoofed source IP address, not ARP table manipulation.

Port security limits MAC addresses on a port but does not inspect ARP packets; it cannot prevent forged ARP replies that poison ARP caches.

DHCP snooping prevents rogue DHCP servers and IP spoofing by filtering DHCP messages, but it does not inspect ARP packets. Forged ARP replies are mitigated by Dynamic ARP Inspection, which validates ARP packets against the DHCP snooping binding table.

STP BPDU guard is used to prevent unauthorized switches from participating in Spanning Tree Protocol by disabling ports that receive BPDUs, but it does not prevent forged ARP replies or ARP cache poisoning.

Port security limits MAC addresses on a port but does not inspect or validate ARP packets, so it cannot prevent forged ARP messages used in ARP spoofing attacks.

DHCP snooping validates DHCP messages and builds a binding database, but it does not inspect or filter ARP messages. It cannot prevent forged ARP attacks directly.

VLAN segmentation isolates network traffic into separate broadcast domains but does not inspect or validate ARP messages, so it cannot prevent forged ARP attacks that redirect traffic within the same VLAN.

A ping flood directly targets a victim by overwhelming it with ICMP echo request packets, not echo replies. The question states the server receives echo replies without sending requests, which is characteristic of a Smurf attack that amplifies replies from many hosts.

A Fraggle attack uses UDP echo (port 7) or chargen (port 19) traffic, not ICMP echo reply packets. The question specifies ICMP echo replies, which are characteristic of a Smurf attack.

Dynamic ARP Inspection (DAI) is designed to validate ARP packets and prevent ARP spoofing attacks, not to block rogue DHCP servers. It does not inspect DHCP traffic or filter unauthorized DHCP offers.

Port Security limits the number of MAC addresses per port but does not inspect DHCP messages or prevent unauthorized DHCP servers from offering IP addresses.

IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not directly prevent rogue DHCP servers from offering IP addresses.

Port security restricts access based on MAC addresses but does not require user authentication; it controls which devices can connect, not who uses them.

ACLs (Access Control Lists) filter traffic based on IP addresses, protocols, or ports, but they do not require user authentication before granting network access at a switch port.

MAC authentication (typically MAC address bypass or MAC authentication bypass) allows devices to authenticate based on their MAC address, but it does not require user authentication; it is often used as a fallback when 802.1X is not supported. The question specifically requires user authentication, which 802.1X provides via EAP.

WPA2-Enterprise provides authentication and encryption for wireless networks, but it does not restrict access based on MAC addresses. The question specifically asks for a feature that allows only devices with known MAC addresses to connect, which is MAC filtering, not an authentication protocol.

802.1X is an authentication framework used with enterprise Wi-Fi (e.g., WPA2-Enterprise) to authenticate users via credentials, not devices by MAC address. It does not restrict access based on MAC addresses.

WPA3-Personal is a wireless encryption standard that provides secure authentication and data encryption, but it does not restrict access based on device MAC addresses. The question specifically asks for a feature to allow only known MAC addresses, which is MAC filtering, not an encryption protocol.

The attack described involves ICMP echo requests to a broadcast address, which is characteristic of a Smurf attack, not ARP spoofing. ARP spoofing involves sending falsified ARP messages to associate the attacker's MAC address with the IP of a legitimate host, enabling man-in-the-middle attacks.

MAC flooding targets switch MAC address tables by sending many frames with different source MAC addresses, not by sending ICMP echo requests to a broadcast address.

A DNS amplification attack uses open DNS servers to flood a target with large DNS responses, not ICMP echo requests to a broadcast address.

Dynamic ARP inspection (DAI) validates ARP packets to prevent ARP spoofing, but it does not inspect DHCP messages. The attack described involves rogue DHCP servers, which is mitigated by DHCP snooping, not DAI.

Port security limits MAC addresses on switch ports but does not inspect DHCP messages; it cannot prevent a rogue DHCP server from offering invalid IP addresses.

802.1X authentication controls network access at the port level by requiring user/device authentication, but it does not prevent rogue DHCP servers from offering IP addresses. The attack described involves unauthorized DHCP offers, which 802.1X does not filter.

A DHCP server assigns IP addresses but does not authenticate users against Active Directory or enforce network access control, which is required for 802.1X authentication.

802.1X authentication uses RADIUS to verify credentials against Active Directory; a certificate authority is not required unless EAP-TLS is used, but the question does not specify certificate-based authentication.

TACACS+ is used for device administration (e.g., switch/router login) and separates authentication, authorization, and accounting, but it is not the standard RADIUS protocol required for IEEE 802.1X port-based network access control.

MAC flooding involves sending many frames with different source MAC addresses to overflow the switch's CAM table, not forging ARP replies to associate a MAC with a gateway IP.

DHCP snooping is a security feature that filters untrusted DHCP messages to prevent rogue DHCP servers, not a method for forging ARP replies to associate a MAC with a gateway IP.

DNS spoofing involves corrupting DNS resolution to redirect traffic to malicious sites, not forging ARP replies to associate a MAC address with a gateway IP.

Root guard is used to enforce the root bridge position in a spanning-tree topology, not to disable ports upon receiving BPDUs. It does not prevent unauthorized switches from causing loops by disabling the port.

Loop guard is designed to prevent alternate or root ports from becoming designated ports in the absence of BPDUs, not to disable a port upon receiving a BPDU. It does not protect against rogue switches sending BPDUs.

UDLD (Unidirectional Link Detection) detects unidirectional links but does not disable a port upon receiving BPDUs; it is not designed to prevent rogue switches or loops caused by BPDU reception.