Suggested Answer: Explanation

Port Security and Port Types –
You can configure port security only on Layer 2 interfaces. Details about port security and different types of interfaces or ports are as follows:
Access ports–You can configure port security on interfaces that you have configured as Layer 2 access ports. On an access port, port security applies only to

the access VLAN. Trunk ports–You can configure port security on interfaces that you have configured as Layer 2 trunk ports. VLAN maximums are not useful for access ports. The device allows VLAN maximums only for VLANs associated with the trunk port.
SPAN ports–You can configure port security on SPAN source ports but not on SPAN destination ports.

Ethernet Port Channels–Port security is not supported on Ethernet port channels. Reference: http://www.cisco.com/c/en/us/td/docs/switches/datacenter/

<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n18881000001.png” alt=”Reference Image” />
sw/4_1/nx- os/security/configuration/guide/sec_nx-os-cfg/sec_portsec.html

Suggested Answer:

Suggested Answer: B

The native VLAN is used for untagged frames sent along a trunk. By issuing the “show interface trunk” command on SW1 and SW2 we see the native VLAN is 99.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27518000000.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27518000002.jpg” alt=”Reference Image” />

Suggested Answer: Explanation

Within any VTP, the VTP domain name must match. So, step one is to find the correct VTP name on the other switches. Logging in to SW1 and using the “show vtp status” command we see this:
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n18888000005.png” alt=”Reference Image” />
So we know that the VTP domain must be CCNP. This leaves only choice D and E. We also see from the topology diagram that eth 0/0 of the new switch connects to a PC in VLNA 100, so we know that this port must be an access port in VLAN 100, leaving only choice D as correct. Note that the VTP versions supported in this network are 1, 2, 3 so either VTP version 2 or 3 can be configured on the new switch.

Suggested Answer: B

Suggested Answer: C

Suggested Answer: C

The VSS is made up of the following:
✑ Virtual switch members: Cisco Catalyst 6500 Series Switches (up to two switches with initial release) deployed with the Virtual Switching Supervisor 720 10GE
✑ Virtual switch link (VSL): 10 Gigabit Ethernet connections (up to eight using EtherChannel) between the virtual switch members.
Reference: http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html

Suggested Answer: B

Suggested Answer: B

Suggested Answer: C

To create private VLANs, you will need to only disable pruning on the switch that contains the private VLANs. In this case, only SW4 will connect to servers in a private VLAN.
Topic 2, Infrastructure Security

Suggested Answer: Explanation

Pruning unnecessary VLANs from the trunk can be performed with one of two methods:
Manual pruning of the unnecessary VLAN on the trunk–This is the best method, and it avoids the use of the spanning tree. Instead, the method runs the

pruned VLAN on trunks.
VTP pruning–Avoid this method if the goal is to reduce the number of STP instances. VTP- pruned VLANs on a trunk are still part of the spanning tree.

Therefore, VTP-pruned VLANs do not reduce the number of spanning tree port instances.
Since the question asked for the choice that is an enhancement to the STP design, VTP pruning is the best choice.
Reference:
http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a0080890613.shtml

Suggested Answer: C

Suggested Answer: C

When first powered on, each port goes through 4 states to ensure that there are no physical loops in the layer 2 broadcast domain. These steps are outlined as follows. With the initial version of spanning tree, this process could take from 30-60 seconds.
1.Blocking A port that would cause a switching loop, no user data is sent or received but it may go into forwarding mode if the other links in use were to fail and the spanning tree algorithm determines the port may transition to the forwarding state. BPDU data is still received in blocking state.
2.Listening The switch processes BPDUs and awaits possible new information that would cause it to return to the blocking state.
3.Learning While the port does not yet forward frames (packets) it does learn source addresses from frames received and adds them to the filtering database
(switching database)
4.Forwarding A port receiving and sending data, normal operation. STP still monitors incoming BPDUs that would indicate it should return to the blocking state to prevent a loop.
STP PortFast causes a Layer 2 LAN interface configured as an access port to enter the forwarding state immediately, bypassing the listening and learning states.
Reference: http://net.cmed.us/Home/ethernet-and-ip/spanning-tree-protocol

Suggested Answer: BC

Support for automatic load balancing and support for multiple gateways are two features that are provided by Gateway Load Balancing Protocol (GLBP) but not by
Hot Standby Routing Protocol (HSRP) or Virtual Router Redundancy Protocol (VRRP).
GLBP, HSRP, and VRRP provide a redundant and fault-tolerant solution in case of first-hop router failure in a network. The basic operation of these three protocols is the same. In all three protocols, a group of routers on the same LAN is formed. One of the routers is selected as the active router and another as the standby router. The router with the highest priority is automatically selected as the active router. If the active router fails, the standby router assumes the responsibilities of the active router. The role of the active router is to forward the packets from the hosts to the virtual router (default gateway).
GLBP provides automatic load balancing between multiple routers by configuring multiple MAC addresses but a single virtual IP address. Every active virtual forwarder (AVF) in the group is configured with the virtual IP address but with different MAC addresses. All such AVFs can then participate in the packet- forwarding process. Multiple gateways then can share the load. On the contrary, HSRP and VRRP do not support automatic load balancing. Both these protocols require additional configuration on all the routers that need to load balance. The additional configuration involves using multiple groups on the routers or assignment of different default gateways for the hosts.
Note that GLBP and VRRP are supported by both Cisco and non-Cisco routers, whereas, HSRP is supported only by Cisco routers.
Single active router and interface tracking both are supported by GLBP, HSRP, and VRRP.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Home > End-of-Sale and End-of-Life Products > Cisco IOS Software Releases 12.2.T > Product Literature > White Papers > GLBP Gateway Load Balancing
Protocol > Information About Gateway Load Balancing Protocol
Home > Support > Technology Support > IP > IP Application Services > Design > Design Technotes > Hot Standby Router Protocol Features and Functionality >
HSRP Background and Operations > HSRP Operation

Suggested Answer: BD

Suggested Answer: B

Based on the configuration output, we see that authentication is configured on R2, but not on R1:
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n44089800001.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n44089800002.jpg” alt=”Reference Image” />
This can be further verified by issuing the “show standby” command on each router.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n44089800004.jpg” alt=”Reference Image” />

Suggested Answer: B

Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is 4000.0000.0010 as shown below:
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/0019800001.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/0019900001.jpg” alt=”Reference Image” />

Suggested Answer: ACE

Suggested Answer: AB

Restrictions for IP Source Guard
Because the IP source guard feature is supported only in hardware, IP source guard is not applied if there are insufficient hardware resources available. These hardware resources are shared by various other ACL features that are configured on the system. The following restrictions apply to IP source guard:
✑ Supported only on ingress Layer 2 ports.
✑ Supported only in hardware; not applied to any traffic that is processed in software.
✑ Does not support filtering of traffic based on MAC address.
✑ Is not supported on private VLANs.
Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/ip_source_guard.html

Suggested Answer: Explanation

If POS 1/0 and POS 2/0 go down, Router 5 will relinquish its role as active virtual gateway (AVG). The example indicates that Router 5 is configured a member of
Gateway Load Balancing Protocol (GLBP) group 156 and that it is tracking the state of two of interfaces, POS 1/0 and 2/0. An initial weighting value of 120 has been assigned to the router in line 4, and upper and lower thresholds of 95 and 110 have been configured, respectively.
In lines 5 and 6, decrement values of 20 and 10 have assigned to the tracking of interface POS 1/0 and POS2/0, respectively. If either of the tracked interfaces goes down, the weight value of the router will be decreased by the amount of the decrement value. If the weight falls below the lower threshold (95), the router will relinquish its role as the AVG. If either single interface that is being tracked goes down, the weight value will not fall below the lower threshold, and the router will maintain its role of AVG. This occurs because 120 – 20 = 100, which is higher than 95 (the lowest threshold), and 120 – 10 = 110, which is also higher than 95. If both interfaces go down, the value will fall below the lower threshold (120 – 10 – 20 = 90, which is lower than 95), and the router will give up its role as the AVG.
The loss of interfaces will never cause a router to become the AVG. That can only occur if the router functioning as the current AVG in the group loses its interfaces.
The loss of either of the interfaces alone will not decrement the initial weighting value enough for it to fall below the lower threshold, and therefore will not cause the router to relinquish its role as AVG.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Cisco > Home > End-of-Sale and End-of-Life Products > Cisco IOS Software Releases > 12.2T > Product Literature > White Papers > GLBP – Gateway Load
Balancing Protocol –
Cisco > Cisco IOS IP Application Services Command Reference > threshold metric through weight (real server) > track

Suggested Answer: A

The interface subcommand:
Switch(config-if)# switchport voice vlan {vlan-id | dot1p | untagged | none} is used to select the voice VLAN mode that will be used when PC is connected to the switch port through Cisco IP phone.
Reference:
http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_20_se/configuration/guide/swvoip.html

Suggested Answer: A

By issuing the “show vtp status command on SW2, SW2, and SW4 we see that both SW1 and SW2 are operating in VTP server mode, but SW4 is a client, so we will need to add both VLANs to SW1 and SW2.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/0011500001.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/0011600001.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/0011700001.jpg” alt=”Reference Image” />

Suggested Answer: C

By default, a switch will have a domain name of NULL and no password. If the switch hears a VTP advertisement it will automatically learn the VTP domain name,
VLANs, and the configuration revision number.
Summary advertisements sent out every 300 seconds and every time a change occurs on the VLAN database. Contained in a summary advertisement:
✑ VTP version
✑ Domain name
✑ Configuration revision number
✑ Time stamp
✑ MD5 encryption hash code
Reference: https://rowell.dionicio.net/configuring-cisco-vtp/

Suggested Answer: D

Suggested Answer: A

Suggested Answer: B

Issuing the “show standby” command on either router shows us that the virtual MAC used by HSRP group 1 is 4000.0000.0010 as shown below:
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27558700001.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27558700000.jpg” alt=”Reference Image” />

Suggested Answer: A

Suggested Answer: AD

Dynamic ARP inspection (DAI) and DHCP snooping are Cisco features designed to work together to mitigate ARP spoofing attacks. DAI validates ARP packets in a network. DAI determines the validity of an ARP packet based on the valid MAC address-to-IP-address bindings stored in the DHCP snooping database. This capability protects the network from some man-in-the-middle attacks. The following global configuration command instructs the switch to intercept, log, and discard packets with invalid IP-to-MAC address bindings for the specified VLANs. switch(config)# ip arp inspection vlan 10-12,15
When configuring DAI, ports are configured as either trusted or untrusted. DAI forwards all packets received on a trusted interface without checks but intercepts all packets on an untrusted port.
DHCP snooping creates an IP address to MAC address database that DAI uses to validate ARP packets. It compares the MAC address and IP address in ARP packets and only permits the traffic if the addresses match. This eliminates attackers spoofing MAC addresses. The following command enables DHCP MAC address verification: router(config)# ip dhcp snooping verify mac-address
DHCP Authorized ARP can also be used to mitigate ARP spoofing. When implemented, the server assigns an IP address to a client and then creates a static mapping. The DHCP server then sends periodic ARPs to clients to make sure that the clients are still active. Clients respond with an ARP reply. Unauthorized clients cannot respond to these periodic ARPs. The unauthorized ARP responses are blocked at the DHCP server.
DHCP snooping also is used to define ports as trusted for DHCP server connections. The purpose of DHCP snooping is to mitigate DHCP spoofing attacks.
DHCP snooping can be used to determine what ports are able to send DHCP server packets such as DHCPOFFER, DHCPACK, and DHCPNAK. DHCP snooping can also cache the MAC address to IP address mapping for clients receiving DHCP addresses from a valid DHCP server.
Port security is a method of only permitting specified MAC addresses access to a switch port. This can be used to define what computer or device can be connected to a port, but not eliminate ARP spoofing.
802.1x is a method of determining authentication before permitting access to a switch port. This is useful in restricting who can connect to the switch; it does not inspect ARP packets.
Objective:
Infrastructure Security –
Sub-Objective:
Configure and verify switch security features
References:
Catalyst 6500 Release 12.2SXF and Rebuilds Software Configuration Guide > Configuring Dynamic ARP Inspection (DAI)
Cisco > Cisco IOS IP Addressing Services Command Reference > ARP Commands > ip arp inspection vlan

Suggested Answer:

Suggested Answer: B

The native VLAN is used for untagged frames sent along a trunk. By issuing the “show interface trunk” command on SW1 and SW2 we see the native VLAN is 99.
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27553200006.jpg” alt=”Reference Image” />
<img src=”https://www.examtopics.com/assets/media/exam-media/01585/n27553200004.jpg” alt=”Reference Image” />

Suggested Answer: BE

The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics:
All traffic in the RSPAN VLAN is always flooded.
No MAC address learning occurs on the RSPAN VLAN.
RSPAN VLAN traffic only flows on trunk ports.
RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command.
STP can run on RSPAN VLAN trunks but not on SPAN destination ports.
An RSPAN VLAN cannot be a private-VLAN primary or secondary VLAN.
For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP), the VLAN ID and its associated RSPAN characteristic are propagated by VTP. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094), you must manually configure all intermediate switches.
It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session. That is, multiple
RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session. It is also possible to have multiple RSPAN destination sessions throughout the network, monitoring the same RSPAN VLAN and presenting traffic to the user. The RSPAN VLAN ID separates the sessions. https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_40_se/configuration/guide/scg/swspan.pdf

Suggested Answer: BD

Suggested Answer: C

Suggested Answer: C

To create private VLANs, you will need to only disable pruning on the switch that contains the private VLANs. In this case, only SW4 will connect to servers in a private VLAN.

Suggested Answer: D

Suggested Answer: AD

protect – The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value. restrict – The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the security violation counter to increment. shutdown – Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.
Restrict increments the counter and sends an SNMP trap. And shutdown puts the interface in err-disabled state.

Suggested Answer: D

Suggested Answer: BC

Suggested Answer: Answer: Here are steps:

hostname SWITCH_B
!
!
vlan 21
name Marketing
vlan 22
name Sales
vlan 23
name Engineering
!
!
interface FastEthernet0/3
switchport trunk allowed vlan 1,21-23
channel-protocol lacp
channel-group 1 mode passive
switchport mode trunk
!
interface FastEthernet0/4
switchport trunk allowed vlan 1,21-23
channel-protocol lacp
channel-group 1 mode passive
switchport mode trunk
!
interface FastEthernet0/9
switchport access vlan 21
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/10
switchport access vlan 21
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/13
switchport access vlan 22
switchport mode access
spanning-tree portfast
!
!
interface FastEthernet0/14
switchport access vlan 22
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/15
switchport access vlan 23
switchport mode access
spanning-tree portfast
!
interface FastEthernet0/16
switchport access vlan 23
switchport mode access
spanning-tree portfast
!
!
interface GigabitEthernet1/1
!
interface GigabitEthernet1/2
!
interface Port-channel 1
switchport mode trunk
switchport trunk encapsulation dot1q
spanning-tree allowed vlans 1,21-23
!
interface Vlan1
ip address 192.168.1.11 255.255.255.0
!
end
SWITCH_B(config)#
hostname SWITCH_A
!
panning-tree vlan 11 root primary
spanning-tree vlan 12 root primary
spanning-tree vlan 13 root primary
spanning-tree vlan 21 root primary
spanning-tree vlan 22 root primary
spanning-tree vlan 23 root primary
!
interface FastEthernet0/3
switchport trunk allowed vlan 1,21-23
channel-protocol lacp
channel-group 1 mode active
switchport mode trunk
!
interface FastEthernet0/4
switchport trunk allowed vlan 1,21-23
channel-protocol lacp
channel-group 1 mode active
switchport mode trunk
!
interface FastEthernet0/21
switchport access vlan 21
switchport mode access
!
interface FastEthernet0/22
switchport access vlan 22
switchport mode access
!
interface FastEthernet0/23
switchport access vlan 23
switchport mode access
!
interface GigabitEthernet1/1
!
interface GigabitEthernet1/2
!
interface Port-channel 1
!
interface Vlan1
no ip address
shutdown
!
ip default-gateway 192.168.1.1
!
!
End

Suggested Answer: C

Suggested Answer: A

Here the console has been configured with the NO_AUTH name, which lists none as the authentication method. None means no authentication, meaning that credentials are not required and all sessions are allowed access immediately.

Suggested Answer: D

VTP should never need to have the switch reloaded or the VTP process to restart in order for it to work. The first thing that should be done is to verify that the trunk ports are connected and up.

Suggested Answer: C

Suggested Answer: D

Suggested Answer:

Suggested Answer: A

Suggested Answer: AD

Reference:
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html

Suggested Answer: AD

Suggested Answer: A

Suggested Answer: D

The command show standby produces the output displayed in the exhibit. This command displays information about HSRP on all configured interfaces and for all
HSRP groups. Important information in the exhibit includes that this router is the active router, the virtual IP address for the HSRP group is 172.16.1.20, the address of the standby router is 172.16.1.6, and the router is configured to preempt.
The command show running-config will display the complete configuration of the device, including the configuration of HSRP, but will not display the current status of HSRP on the switch.
The command show standby vlan 1 active brief provides a summary display of all HSRP groups on the switch that are in the active state. This output would provide basic information, not nearly the detail indicated in the exhibit. The following is an example of output for show standby vlan 1 active brief:
Interface Grp Prio P State Active addr Standby addr Group addr
Vlan1 0 120 Active 172.16.1.5 Unknown 172.16.1.20
The command show hsrp 1 is not valid due to incorrect syntax.
Objective:
Infrastructure Services –
Sub-Objective:
Configure and verify first-hop redundancy protocols
References:
Cisco > Cisco IOS IP Application Services Command Reference > show ip sockets through standby name > show standby
Cisco > Cisco IOS IP Application Services Configuration Guide, Release 12.4 > Part 1: First Hop Redundancy Protocols > Configuring HSRP