Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-CCNA > 15 - Security Services III - DHCP and ARP Inspection > Flashcards

15 - Security Services III - DHCP and ARP Inspection Flashcards

1
Q

What 2 key things do clients use DHCP protocol to do?

A
  • Discover a DHCP server

- Request to lease an address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 4 message types exchanged between a DHCP client and server?

A
  • Discover
  • Offer
  • Request
  • Acknowledgement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a DHCP acknowledgement message?

A

Sent by the DHCP server to assign the address and also list the following:

  • Mask
  • Default router
  • DNS server IPs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What 2 special IP addresses does DHCP make use of for hosts that don’t yet have an IP?

A
  1. 0.0.0 as a source IP

255. 255.255.255 local broadcast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Where are DHCP Offer messages addressed to?

A

255.255.255.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is included in a DHCP Discover messages to uniquely identify a client?

A

The client ID which is it’s MAC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How do DHCP Offer messages identify who they are intended for, given all hosts receive them?

A

The client ID (MAC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How can you allow messages from a centralized DHCP server to traverse beyond the local subnet and back?

A

Make the device a DHCP Relay

ip helper-address {server ip}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What effects does the ip helper-address command have on messages coming in from DHCP clients?

A
  1. Look for incoming DHCP messages with destination 255.255.255.255
  2. Change said packets source IP to the routers incoming interface IP
  3. Change said packets destination IP to the address of the DHCP server (as configured with ip helper-address command)
  4. Route the packet to the DHCP server
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the name of the feature enabled by the ip helper-address command?

A

DHCP Relay

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What settings must a DHCP server be configured with?

A
  • Subnet ID and Mask
  • Reserved (excluded) addresses
  • Default router(s)
  • DNS IPs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 3 DHCP Allocation modes?

A
  • Dynamic
  • Automatic
  • Static
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does Automatic DHCP allocation mode do?

A

Sets the DHCP lease time to infinite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does Static DHCP allocation mode do?

A

Pre-configures an IP for a client based on a specific MAC address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What 2 criteria identify interfaces that need to have DHCP Relay enabled?

A
  • DHCP Clients exist in the subnet

- DHCP Servers do NOT exist in the subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How would you configure a switch to use DHCP to lease an address?

A

interface vlan 1
ip address dhcp
no shutdown

show interfaces vlan 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can you view details about DHCP configuration for interfaces on that device?

A

show dhcp lease

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How can Routers distribute default routes learned on its internet facing interface from the ISP into the network?

A

Using an interior routing protocol such as OSPF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How do you configure an IP to be obtained from DHCP on an interface?

A

ip address dhcp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does IOS display default routes learned from DHCP as?

A

A static route with an administrative distance of 254

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does IOS use to identify routes that are DHCP learned default routes?

A

An administrative distance of 254

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What settings does a host need to work correctly for IPv4?

A
  • Self IP and Subnet mask
  • DNS IPs
  • Default gateway (router) IP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How would you view the IP routing table on a Windows or MAC host?

A

netstat -rn

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How would you view the default gateway and DNS servers on a Mac given the ifconfig command doesn’t?

A

networksetup-getinfo

networksetup-getdnsservers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How does DHCP Snooping work?

A

Switch analyzes incoming messages on specified subset of ports in VLAN depending on if it is a trusted or untrusted port.

If messages appear on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What layer does DHCP Snooping operate at?

A

Layer 2

27
Q

What are DHCP RELEASE and DECLINE messages?

A

Clients can use DHCP RELEASE to tell the server they don’t need the IP assigned to them anymore

Clients can use DHCP DECLINE to turn down the use of an IP during the DORA flow

28
Q

What are the DHCP Snooping rules for an Untrusted interface

A
  • If normally sent by servers, discard the message
  • Filter client DISCOVER and REQUEST messages to check for MAC address consistency between Ethernet frame and DHCP message
  • Filter client RELEASE and DECLINE checking the incoming interface + IP vs the DHCP Snooping binding table
  • For messages not filtered that result in a DHCP release, add a new entry to the binding table
29
Q

What is the chaddr?

A

Client Hardware Address field in a DHCP message

30
Q

What is the DHCP Snooping Binding Table?

A

A table that keeps track of DHCP addresses that are assigned through switch ports. A map of MACs to IPs

31
Q

What is in a DHCP Snooping Binding Table entry?

A
  • Client MAC
  • IP
  • DHCP Lease time
  • VLAN number
  • Interface
32
Q

How do you enable DHCP Snooping on a switch?

A

ip dhcp snooping
ip dhcp snooping vlan 11
no ip dhcp snooping information option

OPTIONAL
interface Ge0/1
ip dhcp snooping trust

33
Q

How do you enable an interface to be trusted by DHCP Snooping?

A

ip dhcp snooping trust

34
Q

How do you show DHCP Snooping config information?

A

show ip dhcp snooping

35
Q

What does “Insertion of option 82 is disabled” mean?

A

That Option 82 DHCP header field that is inserted by DHCP Relay agents is disabled, which is necessary when the device is not acting as a relay agent (L3 switch too)

36
Q

How do you make DHCP Snooping work on a switch that is NOT also a DHCP relay agent?

A

Disabled Option 82 feature

no ip dhcp snooping information option

37
Q

How does DHCP Snooping prevent attacks that involve it being overwhelmed by large volumes of messages?

A

Optional feature that tracks the number of incoming DHCP messages over a 1 second period and if the limit is exceeded moves the port into err-disabled state

38
Q

How can you set the DHCP Snooping rate limit?

A

Interface subcommand:

ip dhcp snooping limit rate {number}

39
Q

How do you allow an interface to automatically recover from being moved into err-disabled by DHCP Snooping rate limit trigger?

A

errdisable recovery cause dhcp-rate-limit

errdisable recovery interval 30

40
Q

What two sources of data does DAIs core feature compare incoming ARP messages with?

A
  • DHCP Snooping binding table

- ARP ACLs

41
Q

What is gratuitous ARP?

A

An ARP reply message sent without having received a request. Essentially a host informing all hosts in the subnet about its MAC address

42
Q

What do gratuitous ARPs allow attackers to do?

A

Make other hosts change their ARP tables

43
Q

What does the DHCP Snooping feature record about a DHCP message?

A

The IP address leased to a host and that hosts MAC

44
Q

What does DAI do for untrusted ports?

A

Compares the ARP message’s origin IP and MAC to entries in the DHCP Snooping binding table.

It lets the ARP through if the IP and MAC matches an entry in the table

45
Q

What type of ports should be trusted by DAI?

A

Anything other than links to end user devices

46
Q

What are ARP ACLs?

A

Used by DAI as lists of statically configured correct pairs of IP and MACs.

DAI looks in both the DHCP Snooping binding data and these ARP ACLs

47
Q

What other message comparisons can be made that cause an ARP message to be discarded?

A
  • Ethernet header Source MAC != Origin MAC
  • ARP Replies where Destination MAC != Target MAC
  • Messages with unexpected IPs in the two ARP IP fields
48
Q

True/False: DAI does it’s work in the Switch CPU and DHCP does it’s work in the Switch ASIC

A

False. They both do their work on the CPU

49
Q

What is the downside of DAI with respects to DoS?

A

Because it uses the CPU it is susceptible to DoS attacks

50
Q

True/False: DAI defaults to the ‘untrusted’ setting

A

True

51
Q

How do you enable ARP inspection?

A

ip arp inspection vlan 11

interface Ge0/1
ip arp inspection trust

52
Q

What happens if you just enable DAI but not DHCP Snooping or configure ARP ACLs?

A

The switch would filter all ARPs entering all untrusted ports in the configured VLAN

53
Q

How do you show ARP inspection information including variables and counters?

A

show ip arp inspection

54
Q

How do you show the DHCP Snooping binding table?

A

show ip dhcp snooping binding

55
Q

How do you show ARP inspection statistics?

A

show ip arp inspection statistics

56
Q

What is a key difference between DAI and DHCP Snooping rate limiting with respect to defaults?

A

DAI defaults to use rate limits for all interfaces (trusted and untrusted)

DHCP Snooping defaults to not using rate limits

57
Q

What is a key difference between DAI and DHCP Snooping rate limiting with respect to intervals?

A

DAI allows configuration of the burst interval (number of seconds over which the rate is measured)

DHCP Snooping does not define a burst setting

58
Q

How do you allow automatic recovery from the errdisable state when ARP inspection was the cause?

A

errdisable recovery cause arp-inspection

errdisable recovery interval 30

59
Q

How do you modify the rate limit settings for ARP inspection?

A

ip arp inspection limit rate 8 burst interval 4

60
Q

What is the default rate limit and burst settings for ARP inspection?

A

15 messages over a 1 second burst

61
Q

How do you view ARP inspection settings for each interface?

A

show ip arp inspection interfaces

62
Q

How do you enable additional ARP inspection options?

A

ip arp inspection validate { dst-mac | ip | src-mac }

63
Q

True/False: DHCP Snooping could be implemented on L2 switches

A

True

ag-CCNA (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions