Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CCNA > Security Fundamentals > Flashcards

Security Fundamentals Flashcards

(91 cards)

Start Studying
1
Q

Enable port security on an interface:
SW1(config-if)# […]

A

switchport port-security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Manually configure a secure MAC address on the interface.
SW1(config-if)# […]

A

switchport port-security mac-address mac-address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Enable sticky secure MAC address learning:
SW1(config-if)# […]

A

switchport port-security mac-address sticky

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Configure the port security violation mode:
SW1(config-if)# […]

A

switchport port-security violation {shutdown | restrict | protect}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Configure the port security aging time:
SW1(config-if)# […]

A

switchport port-security aging time minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Configure the port security aging type:
SW1(config-if)# […]

A

switchport port-security aging type {absolute | inactivity}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Enable aging of static secure MAC addresses
SW1(config-if)# […]

A

switchport port-security aging static

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Enable errdisable recovery for port security violations:
SW1(config)# […]

A

errdisable recovery cause psecure-violation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Configure the errdisable recovery interval:
SW1(config)# […]

A

errdisable recovery interval seconds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Show all secure MAC addresses on the switch:
SW1# […]

A

show mac address-table secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Show a summary of port security-enabled switchports
SW1# […]

A

show port-security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Show port security information for an individual switchport
SW1# […]

A

show port-security interface interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Show a summary of errdisable recovery information:
SW1# […]

A

show errdisable recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Port security [can/can’t] be enabled on an interface configured as switchport mode dynamic auto

A

can’t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Port security [can/can’t] be enabled on an interface configured as switchport mode dynamic desirable

A

can’t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When an interface is shutdown by port security, its status in the output of show interfaces status will be […]

A

err-disabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Manually re-enable an interface disabled by port security:
SW1(config-if)# […]
SW1(config-if)# […]

A

shutdown
no shutdown

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The default errdisable recovery timer is […]

A

300 seconds (5 minutes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Errdisable recovery is [enabled/disabled] by default for all causes.

A

disabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the default port security violation mode?

A

Shutdown

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Port security shutdown violation mode:
Syslog/SNMP messages [are/aren’t] generated.

A

are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Port security restrict violation mode:
Syslog/SNMP messages [are/aren’t] generated.

A

are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Port security protect violation mode:
Syslog/SNMP messages [are/aren’t] generated.

A

aren’t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Port security shutdown violation mode:
The interface [is/isn’t] disabled.

A

is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Port security restrict violation mode: The interface [is/isn't] disabled.
isn't
26
Port security protect violation mode: The interface [is/isn't] disabled.
isn't
27
Port security shutdown violation mode: The violation counter [is/isn't] incremented.
is
28
Port security restrict violation mode: The violation counter [is/isn't] incremented.
is
29
Port security protect violation mode: The violation counter [is/isn't] incremented.
isn't
30
The default port security aging type is [...].
absolute
31
Port security secure static address aging is [enabled/disabled] by default.
disabled
32
Enable DHCP Snooping on the switch: SW1(config)# [...]
ip dhcp snooping
33
Enable DHCP Snooping on a VLAN: SW1(config)# [...]
ip dhcp snooping vlan vlan-number
34
Enable errdisable recovery for DHCP rate limiting violations: SW1(config)# [...]
errdisable recovery cause dhcp-rate-limit
35
Configure the DHCP snooping-enabled switch to not add option 82 to DHCP messages: SW1(config)# [...]
no ip dhcp snooping information option
36
Configure a DHCP snooping trusted port: SW1(config-if)# [...]
ip dhcp snooping trust
37
Limit the rate that DHCP messages are allowed on a DHCP snooping enabled interface: SW1(config-if)# [...]
ip dhcp snooping limit rate packets-per-second
38
Show the DHCP snooping binding table: SW1# [...]
show ip dhcp snooping binding
39
When DHCP snooping is enabled, all interfaces are [trusted/untrusted] by default.
untrusted
40
DHCP snooping untrusted port: If a DHCP [...] message is received, discard it with no further checks.
Server
41
DHCP snooping untrusted port: If a DHCP [...] message is received, inspect the message to determine if it should be forwarded or discarded.
client
42
DHCP Snooping: When a client successfully leases an IP address from a server, create a new entry in the [...]
DHCP Snooping Binding Table
43
If DHCP snooping rate-limiting is configured and the rate is exceeded, what happens?
The interface is err-disabled
44
DHCP Option [...] is also known as the DHCP Relay Agent Information Option.
82
45
By default, Cisco switches will drop DHCP messages with Option 82 that are received on an [...] port.
untrusted
46
Enable DAI for a VLAN: SW1(config)# [...]
ip arp inspection vlan vlan
47
Enable err-disable recovery for DAI rate limiting: SW1(config)# [...]
errdisable recovery cause arp-inspection
48
Enable additional DAI validation checks: SW1(config)# [...]
ip arp inspection validate (src-mac | dst-mac | ip)
49
Configure a DAI trusted interface: SW1(config-if)# [...]
ip arp inspection trust
50
Configure DAI rate limiting: SW1(config-if)# [...]
ip arp inspection limit rate packets [burst interval seconds]
51
Create an ARP ACL: SW1(config)# [...]
arp access-list name
52
Configure an ARP ACL entry mapping an IP address to a MAC address (permit) SW1(config-arp-nacl)# [...]
permit ip host ip-address mac host mac-address
53
Apply an ARP ACL to DAI: SW1(config)# [...]
ip arp inspection filter arp-acl-name vlan vlan
54
Show a summary of DAI configuration and statistics: SW1# [...]
show ip arp inspection
55
Show a summary of DAI interfaces: SW1# [...]
show ip arp inspection interfaces
56
DAI: All ports are [trusted/untrusted] by default.
untrusted
57
DAI checks ARP messages' [...] and [...] fields against the DHCP snooping binding table and ARP ACLs.
sender MAC / sender IP
58
DAI checks ARP messages' sender MAC and sender IP fields against the [...] and [...].
DHCP snooping binding table / ARP ACLs
59
DAI inspects ARP messages received on [...] ports.
untrusted
60
DAI rate limiting is enabled on [...] ports by default.
untrusted
61
DAI rate limiting is enabled on untrusted ports with a rate of [...] by default.
15 packets per second
62
ACLs are an ordered sequence of [...]
ACEs (Access Control Entries)
63
ACLs must be [...] to take effect.
applied to an interface
64
How many ACLs can be applied to a single interface?
Two: one inbound one outbound
65
What will happen if a packet doesn’t match any of the entries in an ACL?
It will be dropped ('implicit deny')
66
The [...] tells the router to deny all traffic that doesn’t match any of the configured entries in the ACL.
implicit deny
67
What ranges of numbers can be used to identify standard numbered ACLs?
1-99, 1300-1999
68
Configure a standard numbered ACL entry, specifying the IP/mask. R1(config)# [...]
access-list number {deny | permit} ip wildcard-mask
69
Configure a standard numbered ACL entry, permitting or denying all source IPs. R1(config)# [...]
access-list number {deny | permit} any
70
Configure a remark for standard numbered ACL: R1(config)# [...]
access-list number remark remark
71
View all IP ACLs on the router: R1# [...]
show ip access-lists
72
View all ACLs on the router: R1# [...]
show access-lists
73
Standard ACLs should be applied as close to the [...] as possible.
destination
74
[...] ACLs should be applied as close to the destination as possible.
Standard
75
Apply an ACL to an interface: R1(config-if)# [...]
ip access-group acl {in | out}
76
Enter standard named ACL config mode: R1(config)# [...]
ip access-list standard acl-name
77
Configure a permit or deny entry for a standard named ACL: R1(config-std-nacl)# [...]
[entry-number] {deny | permit} ip wildcard-mask
78
Delete an ACL entry by specifying the sequence number: R1(config-std-nacl)# [...]
no sequence-number
79
You [can/can't] delete individual ACL entries in global config mode.
can't
80
You [can/can't] delete individual ACL entries in named ACL config mode.
can
81
Resequence an ACL: R1(config)# [...]
ip access-list resequence acl-id starting-seq-num increment
82
Extended numbered ACL ranges:
100-199, 2000-2699
83
Configure an extended ACL entry, specifying protocol, source IP, and destination IP: R1(config-ext-nacl)#
{permit | deny} protocol src-ip dest-ip (use either host before each IP address for /32, or specify a wildcard mask)
84
Enter extended named ACL config mode: R1(config)# [...]
ip access-list extended {name | number}
85
OSPF = IP protocol number [...]
89
86
Which extended ACL entry command option? [...] matches a single port.
eq port-num
87
Which extended ACL entry command option? [...] matches all ports greater than the specified number.
gt port-num
88
Which extended ACL entry command option? [...] matches all ports less than the specified number.
lt port-num
89
Which extended ACL entry command option? [...] matches all ports except the specified number.
neq port-num
90
Which extended ACL entry command option? [...] matches the specified range of ports.
range lowest-number highest-number
91
Which command can be used to view which ACLs are applied to an interface? R1# [...]
show ip interface interface-id

CCNA (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions