CCNP - final exam 3 questions & answers 2023/2024

CCNP - final exam 3 questions & answers 2023/2024 All access ports on a switch are configured with the administrative mode of dynamic auto. An attacker, connected to one of the ports, sends a malicious DTP frame. What is the intent of the attacker? - ANSWER-VLAN hopping A network engineer is securing a network against DHCP spoofing attacks. On all switches, the engineer applied the ip dhcp snooping command and enabled DHCP snooping on all VLANs with the ip dhcp snooping vlan command. What additional step should be taken to configure the security required on the network? - ANSWER-Issue the ip dhcp snooping trust command on all uplink interfaces on SW1, SW2 and SW3. Which countermeasure can be implemented to determine the validity of an ARP packet, based on the valid MAC-address-to-IP address bindings stored in a DHCP snooping database? - ANSWER-Dynamic ARP inspection How should unused ports on a switch be configured in order to prevent VLAN hopping attacks? - ANSWER-Configure them as access ports and associate them with an unused VLAN. Given the configuration on the ALSwitch, what is the end result? - ANSWER-disables 802.1x port-based authentication and causes the port to allow normal traffic without authenticating the client Network policy dictates that security functions should be administered using AAA. Which configuration would create a default login authentication list that uses RADIUS as the first authentication method, the enable password as the second method, and the local database as the final method? - ANSWER-SW-1(config)# aaa new-model SW-1(config)# radius-server host 10.10.10.12 key secret SW-1(config)# aaa authentication login default group radius enable local A switch is being configured to support AAA authentication on the console connection. Given the information in the exhibit, which three statements are correct? - ANSWER-- The login authentication admin line console command is required.