SECURITY IN NETWORK DESIGN CHAPTER 10
CORE NETWORK SECURITY CONCEPTS
REVIEW 2026
◉ CoPP.
Answer: Control Plane Policing, the control plane is the decision-
making layer of connected networking devices
- An adaptation of QoS (quality of service) filters used to rate-limit
traffic on the control plane and management plane of routers and
switches.
control plane functionality can become overwhelmed in times of
high traffic or during an attack
◉ Router Advertisement (RA) Guard.
Answer: switch specific,
- IPv6 clients receive RA (router advertisement) messages to
determine network information; However, IPv6 clients are a bit
gullible - if several devices send RA messages, clients don't know
which advertisements to believe. Clients have no way of
authenticating RA messages to know which of these messages come
,from legitimate sources and which might come from a network
attacker
- malicious RA messages can be misconfigured to hijack the network
- high volumes of RA messages can create a network DoS attack
RA Guard - A feature that can be configured on switches to filter RA
messages according to interface, MAC or IP address, router priority,
or other factors.
◉ What is the command to configure a RA guard on Cisco switches?.
Answer: raguard
◉ Rogue DHCP Server.
Answer: A DHCP service running on a client device that could be
used to implement an on-path attack by configuring the attacker's IP
address as the victim computers' default gateway or DNS server.
- DHCP messages are allowed to flow freely through ports on
switches so that clients can request and receive DHCP assignments
◉ DHCP snooping.
Answer: A security feature on switches whereby DHCP messages on
the network are checked and filtered.
, - this way, switch ports connected to clients won't be allowed to
transmit DHCP responses that should only come from a trusted
DHCP server
- when enabled, the switch snoops, or listens to, DHCP messages
exchanged between the network's DHCP server and its clients. The
switch then gathers legitimate IP-to-MAC address pairings as
assigned by DHCP and collects this information in a DHCP snooping
binding database
◉ What command configures DHCP snooping on a Cisco switch?.
Answer: ip dhcp snooping
◉ Dynamic ARP Inspection (DAI).
Answer: ARP tables map IP addresses to MAC addresses on the LAN
but it preforms no authentication and it is highly vulnerable to
attack
- configured on a switch to protect against ARP spoofing attacks.
With DAI enabled, the switch compares incoming messages with its
DHCP snooping binding table to determine whether the message's
source IP address is appropriately matched with its source MAC
address according to DHCP assignments on the network
CORE NETWORK SECURITY CONCEPTS
REVIEW 2026
◉ CoPP.
Answer: Control Plane Policing, the control plane is the decision-
making layer of connected networking devices
- An adaptation of QoS (quality of service) filters used to rate-limit
traffic on the control plane and management plane of routers and
switches.
control plane functionality can become overwhelmed in times of
high traffic or during an attack
◉ Router Advertisement (RA) Guard.
Answer: switch specific,
- IPv6 clients receive RA (router advertisement) messages to
determine network information; However, IPv6 clients are a bit
gullible - if several devices send RA messages, clients don't know
which advertisements to believe. Clients have no way of
authenticating RA messages to know which of these messages come
,from legitimate sources and which might come from a network
attacker
- malicious RA messages can be misconfigured to hijack the network
- high volumes of RA messages can create a network DoS attack
RA Guard - A feature that can be configured on switches to filter RA
messages according to interface, MAC or IP address, router priority,
or other factors.
◉ What is the command to configure a RA guard on Cisco switches?.
Answer: raguard
◉ Rogue DHCP Server.
Answer: A DHCP service running on a client device that could be
used to implement an on-path attack by configuring the attacker's IP
address as the victim computers' default gateway or DNS server.
- DHCP messages are allowed to flow freely through ports on
switches so that clients can request and receive DHCP assignments
◉ DHCP snooping.
Answer: A security feature on switches whereby DHCP messages on
the network are checked and filtered.
, - this way, switch ports connected to clients won't be allowed to
transmit DHCP responses that should only come from a trusted
DHCP server
- when enabled, the switch snoops, or listens to, DHCP messages
exchanged between the network's DHCP server and its clients. The
switch then gathers legitimate IP-to-MAC address pairings as
assigned by DHCP and collects this information in a DHCP snooping
binding database
◉ What command configures DHCP snooping on a Cisco switch?.
Answer: ip dhcp snooping
◉ Dynamic ARP Inspection (DAI).
Answer: ARP tables map IP addresses to MAC addresses on the LAN
but it preforms no authentication and it is highly vulnerable to
attack
- configured on a switch to protect against ARP spoofing attacks.
With DAI enabled, the switch compares incoming messages with its
DHCP snooping binding table to determine whether the message's
source IP address is appropriately matched with its source MAC
address according to DHCP assignments on the network
