CCNP Switch Chapter 16 Exam
Questions with 100% Correct
Answers
Which two of the following methods does a switch use to detect spoofed addresses
when IP Source Guard is enabled?
a. ARP entries
b. DHCP database
c. DHCP snooping database
d. Static IP source binding entries
e. Reverse path-forwarding entries - Answer-C (DHCP snooping database) and D
(Static IP source binding entries)
Which one of the following should be configured as a trusted port for dynamic ARP
inspection?
a. The port where the ARP server is located.
b. The port where an end-user host is located.
c. The port where another switch is located.
d. None; all ports are untrusted. - Answer-C: The port where another switch is located.
Which two of the following methods should you use to secure inbound CLI sessions to a
switch?
a. Disable all inbound CLI connections.
b. Use SSH only.
c. Use Telnet only.
d. Apply an access list to the vty lines. - Answer-B (Use SSH only) and D (Apply an
access list to the vty lines)
Suppose you need to disable CDP advertisements on a switch port so that untrusted
devices cannot learn anything about your switch. Which one of the following interface
configuration commands should be used?
a. cdp disable
b. no cdp
c. no cdp enable
, d. no cdp trust - Answer-C: no cdp enable
What is the port security feature based on? - Answer-MAC addresses
What command do you use to enable port security? - Answer-switchport port-security
What command do you use to configure the maximum number of MAC addresses that
will be allowed access (24 for example)? - Answer-switchport port-security maximum 24
What's the default number of MAC addresses that are allowed access on each switch
port? What is the range number of addresses? - Answer-the default is 1, but it can go
up to 1024
How does port security learn MAC addresses by default? Do you have to program them
or are they dynamically picked-up? - Answer-they are picked up dynamically (sticky
MAC addresses)
Do learned sticky MAC addresses ever expire? - Answer-They can be aged out of the
table if those hosts are silent for a period of time. By default, no aging occurs.
What command would you use to statically define a MAC address on an interface
(0006.5b02.acd9 for example)? - Answer-switchport port-security mac-address
0006.5b02.acd9
What are the names of the three different ways port-security can be violated? - Answer-
1. Shutdown mode
2. Restrict mode
3. Protect mode
What does the port-security Shutdown mode mean? - Answer-The port immediately is
put into the Errdisable state, which effectively shuts it down. It must be reenabled
manually or through errdisable recovery to be used again.
What does the port-security Restrict mode mean? - Answer-The port is allowed to stay
up, but all packets from violating MAC addresses are dropped. The switch keeps a
running count of the number of violating packets and can send an SNMP trap and a
syslog message as an alert of the violation.
What does the port-security Protect mode mean? - Answer-The port is allowed to stay
up, as in the restrict mode. Although packets from violating addresses are dropped, no
record of the violation is kept.
What command do you use to pick the port-security violation mode for a port? - Answer-
switchport port-security violation {shutdown | restrict | protect}
Questions with 100% Correct
Answers
Which two of the following methods does a switch use to detect spoofed addresses
when IP Source Guard is enabled?
a. ARP entries
b. DHCP database
c. DHCP snooping database
d. Static IP source binding entries
e. Reverse path-forwarding entries - Answer-C (DHCP snooping database) and D
(Static IP source binding entries)
Which one of the following should be configured as a trusted port for dynamic ARP
inspection?
a. The port where the ARP server is located.
b. The port where an end-user host is located.
c. The port where another switch is located.
d. None; all ports are untrusted. - Answer-C: The port where another switch is located.
Which two of the following methods should you use to secure inbound CLI sessions to a
switch?
a. Disable all inbound CLI connections.
b. Use SSH only.
c. Use Telnet only.
d. Apply an access list to the vty lines. - Answer-B (Use SSH only) and D (Apply an
access list to the vty lines)
Suppose you need to disable CDP advertisements on a switch port so that untrusted
devices cannot learn anything about your switch. Which one of the following interface
configuration commands should be used?
a. cdp disable
b. no cdp
c. no cdp enable
, d. no cdp trust - Answer-C: no cdp enable
What is the port security feature based on? - Answer-MAC addresses
What command do you use to enable port security? - Answer-switchport port-security
What command do you use to configure the maximum number of MAC addresses that
will be allowed access (24 for example)? - Answer-switchport port-security maximum 24
What's the default number of MAC addresses that are allowed access on each switch
port? What is the range number of addresses? - Answer-the default is 1, but it can go
up to 1024
How does port security learn MAC addresses by default? Do you have to program them
or are they dynamically picked-up? - Answer-they are picked up dynamically (sticky
MAC addresses)
Do learned sticky MAC addresses ever expire? - Answer-They can be aged out of the
table if those hosts are silent for a period of time. By default, no aging occurs.
What command would you use to statically define a MAC address on an interface
(0006.5b02.acd9 for example)? - Answer-switchport port-security mac-address
0006.5b02.acd9
What are the names of the three different ways port-security can be violated? - Answer-
1. Shutdown mode
2. Restrict mode
3. Protect mode
What does the port-security Shutdown mode mean? - Answer-The port immediately is
put into the Errdisable state, which effectively shuts it down. It must be reenabled
manually or through errdisable recovery to be used again.
What does the port-security Restrict mode mean? - Answer-The port is allowed to stay
up, but all packets from violating MAC addresses are dropped. The switch keeps a
running count of the number of violating packets and can send an SNMP trap and a
syslog message as an alert of the violation.
What does the port-security Protect mode mean? - Answer-The port is allowed to stay
up, as in the restrict mode. Although packets from violating addresses are dropped, no
record of the violation is kept.
What command do you use to pick the port-security violation mode for a port? - Answer-
switchport port-security violation {shutdown | restrict | protect}
