Module 11 Flashcards
(46 cards)
What command is used to verify if PortFast is enabled globally?
show spanning-tree summary
Alternatively, you can use show running-config | begin span.
What are the three ways a VLAN hopping attack can be launched?
- Spoofing DTP messages to cause trunking mode
- Introducing a rogue switch enabling trunking
- Performing a double-tagging attack
What is the first step to mitigate VLAN hopping attacks?
Disable DTP negotiations on non-trunking ports using the switchport mode access command.
What command is used to display all secure MAC addresses?
show port-security address
This command shows both manually configured and dynamically learned MAC addresses.
What does DHCP snooping do?
Filters DHCP messages and rate-limits DHCP traffic on untrusted ports.
What is the goal of a DHCP starvation attack?
To create a Denial of Service (DoS) for connecting clients.
How can DHCP spoofing attacks be mitigated?
By using DHCP snooping on trusted ports.
What command is used to enable DHCP snooping?
ip dhcp snooping
What happens when a port is in the error-disabled state?
No traffic is sent or received on that port.
What command is used to re-enable a port in the error-disabled state?
shutdown followed by no shutdown.
What is the function of Dynamic ARP Inspection (DAI)?
Prevents ARP spoofing and ARP poisoning by verifying IP-to-MAC bindings.
What command is used to configure DAI to drop invalid ARP packets?
ip arp inspection validate {src-mac | dst-mac | ip}
What does BPDU Guard do?
Immediately error disables a port that receives a BPDU.
How can BPDU Guard be enabled globally?
spanning-tree portfast bpduguard default
What command is used to verify port security settings for a specific interface?
show port-security interface
Fill in the blank: To manually enable the trunk link on a trunking port, use the _______ command.
switchport mode trunk
What are the three port security violation modes?
- shutdown
- restrict
- protect
What does the ‘restrict’ mode do in port security?
Drops packets with unknown source addresses and increments the violation counter.
True or False: PortFast can be enabled on inter-switch links.
False
PortFast should only be enabled on access ports.
What is the purpose of the DHCP snooping binding table?
It binds the source MAC address to the IP address assigned by the DHCP server.
What command is used to view the clients that have received DHCP information?
show ip dhcp snooping binding
What should be configured as trusted interfaces for DHCP snooping and ARP inspection?
Uplink ports connected to other switches.
What is the default mode for port security violations?
shutdown
What command is used to limit the number of DHCP discovery messages on untrusted interfaces?
ip dhcp snooping limit rate packets-per-second
