Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Layer 2 SecuritySwitch
All CCNP topics

5.0 Security

Layer 2 Security Practice Questions

DAI, DHCP Snooping, IP Source Guard, and Port Security.

One solved question, so you can see how these are marked

Which modular QoS CLI (MQC) feature is explicitly applied under control-plane configuration mode to safeguard the switch CPU against Denial of Service (DoS) floods?

Control Plane Policing (CoPP)

CoPP treats control plane CPU traffic as a service interface, allowing admins to police, rate-limit, or drop excessive management/routing traffic bound for the CPU.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 14 Layer 2 Security questions in this set

Answers and explanations appear when you work through the set above.

  1. Which feature validates incoming IP packets on an interface by verifying that the packet's source IP address exists in the switch FIB table and arrives on the expected interface?

    • DHCP Snooping with option 82 insertion
    • Unicast Reverse Path Forwarding (uRPF)
    • IP Source Guard (IPSG) port ACLs
    • Dynamic ARP Inspection (DAI) validate ip

  2. When configuring Dynamic ARP Inspection (DAI) on a switch interface connected directly to a router, how should the interface be configured?

    • ip arp inspection trust
    • ip arp inspection validate src-mac
    • ip dhcp snooping limit rate 15
    • ip arp inspection untrusted

  3. Which feature prevents IP address spoofing on untrusted Layer 2 ports by filtering traffic based on the DHCP Snooping Binding Table?

    • Dynamic ARP Inspection (DAI)
    • IP Source Guard (IPSG)
    • Port Security
    • Control Plane Protection (CPPr)

  4. To protect a switch CPU against ARP flooding attacks, what interface configuration command sets a threshold limit for incoming ARP packets on an untrusted interface?

    • ip arp inspection limit rate <pps>
    • storm-control broadcast level <percent>
    • ip dhcp snooping limit rate <pps>
    • mac address-table limit <number>

  5. What security action is taken by a switch running DHCP Snooping when a DHCP server response frame (DHCPOFFER or DHCPACK) is received on an untrusted port?

    • The switch forwards the frame to the default gateway for routing.
    • It is dropped, since DHCP server messages are not allowed on untrusted ports.
    • The switch rewrites the response into a DHCPREQUEST and relays it upstream.
    • The server address is added to the DHCP snooping binding table as trusted.

  6. Which feature monitors IPv6 Router Advertisement (RA) messages on untrusted Layer 2 ports, blocking unauthorized routers from broadcasting invalid IPv6 prefixes and default gateways?

    • DHCPv6 Guard
    • IPv6 RA Guard
    • IPv6 Source Guard
    • IPv6 Destination Guard

  7. Which Port Security violation mode drops packets from unassigned MAC addresses, increments the security violation counter, and generates a Syslog alert without shutting down the switch interface?

    • Protect
    • Restrict
    • Shutdown
    • Disabled

  8. What action is taken by a switch when the rate of incoming ARP packets on a Dynamic ARP Inspection (DAI) untrusted interface exceeds its configured rate limit?

    • The switch disables IP routing globally until the ARP flood stops.
    • The interface is placed in the err-disabled state.
    • Excess ARP packets are queued for 60 seconds and then processed.
    • The switch sends an SNMP set to the endpoint to shut its NIC down.

  9. Which packet types are automatically dropped if received on an untrusted interface when DHCP Snooping is enabled on a switch?

    • DHCPDISCOVER packets sent by workstations looking for an address
    • DHCPOFFER, DHCPACK, and DHCPNAK messages from servers
    • ICMP echo requests sent to the DHCP server's address
    • EAPOL-Start frames sent by 802.1X supplicants on the port

  10. What action does a switch port take when a Port Security violation occurs while configured in Restrict mode?

    • The interface is placed in err-disabled state and stops forwarding all traffic.
    • Violating frames are dropped, the counter increments, and a syslog/SNMP alert is sent.
    • Violating frames are silently dropped, with no counter increment or any alert sent.
    • The port renegotiates as an 802.1Q trunk so the extra MAC addresses fit on it.

  11. What happens when Port Security is configured with switchport port-security mac-address sticky on a switch interface?

    • Learned MAC addresses become sticky entries in the running configuration.
    • The interface drops all frames that come from locally attached wireless clients.
    • The learned entries are deleted from the table as soon as the link goes down.
    • The interface converts into a trunk that learns MACs on every allowed VLAN.

  12. Dynamic ARP Inspection (DAI) validates ARP requests and responses on an untrusted switch port against which security database?

    • TACACS+ Server Database
    • DHCP Snooping Binding Table
    • MAC Address Table
    • IP Source Guard port ACL entries

  13. In addition to validating IP-to-MAC bindings against the DHCP Snooping database, which extra validation checks can DAI perform on ARP packets using the ip arp inspection validate command?

    • IP header checksum, BGP AS path length, and OSPF area ID
    • Source MAC, destination MAC, and invalid IP addresses
    • RADIUS user group, ISE profile tag, and TACACS+ shared key
    • TLS certificate validity and the hostnames in DNS queries

  14. How does IPv6 Router Advertisement Guard (RA Guard) protect access layer switches from rogue IPv6 routers?

    • It encrypts every Router Advertisement with IPsec so hosts can verify the sender.
    • It drops RAs that arrive on untrusted access ports, allowing them only from router ports.
    • It translates IPv6 RAs into DHCPv4 offers that the snooping table can validate.
    • It blocks multicast ICMPv6 on trunk links, including neighbor solicitations.