SWRE Unit 10

Which Cisco solution helps prevent ARP spoofing and ARP poisoning attacks?

• • Dynamic ARP Inspection

• • IP Source Guard

• • DHCP Snooping

• • Port Security

Which mitigation technique would prevent rogue servers from providing false IPv6 configuration parameters to clients?

• • enabling RA Guard

• • enabling DHCPv6 Guard

• • implementing port security on edge ports

• • disabling CDP on edge ports

Answer explanation

DHCPv6 Guard is a feature designed to ensure that rogue DHCPv6 servers are not able to hand out addresses to clients, redirect client traffic, or starve out the DHCPv6 server and cause a DoS attack. DHCPv6 Guard requires a policy to be configured in DHCP Guard configuration mode, and DHCPv6 Guard is enabled on an interface-by-interface basis.

What is a method to launch a VLAN hopping attack?

• • sending spoofed native VLAN information

• • sending spoofed IP addresses from the attacking host

• • introducing a rogue switch and enabling trunking

• • flooding the switch with MAC addresses

A cybersecurity analyst is using the macof tool to evaluate configurations of switches deployed in the backbone network of an organization. Which type of LAN attack is the analyst targeting during this evaluation?

• • VLAN hopping

• • DHCP spoofing

• • MAC address table overflow

• • VLAN double-tagging

Answer explanation

Macof is a network attack tool and is mainly used to flood LAN switches with MAC addresses.

Which network attack is mitigated by enabling BPDU guard?

• • rogue DHCP servers on a network

• • MAC address spoofing

• • CAM table overflow attacks

• • rogue switches on a network

Answer explanation

There are several recommended STP stability mechanisms to help mitigate STP manipulation attacks:
PortFast – used to immediately bring an interface configured as an access or trunk port to the forwarding state from a blocking state. Applied to all end-user ports.
BPDU guard – immediately error-disables a port that receives a BPDU. Applied to all end-user ports.The receipt of BPDUs may be part of an unauthorized attempt to add a switch to the network.
Root guard – prevents a switch from becoming the root switch. Applied to all ports where the root switch should not be located.
Loop guard – detects unidirectional links to prevent alternate or root ports from becoming designated ports. Applied to all ports that are or can become nondesignated.

A network administrator has found a user sending a double-tagged 802.1Q frame to a switch. What is the best solution to prevent this type of attack?

• • The native VLAN number used on any trunk should be one of the active data VLANs.

• • The VLANs for user access ports should be different VLANs than any native VLANs used on trunk ports.

• • Trunk ports should be configured with port security.

• • Trunk ports should use the default VLAN as the native VLAN number.

During the AAA process, when will authorization be implemented?

• • Immediately after the determination of which resources a user can access

• • Immediately after an AAA client sends authentication information to a centralized server

• • Immediately after successful authentication against an AAA data source

• • Immediately after AAA accounting and auditing receives detailed reports

Answer explanation

AAA authorization is implemented immediately after the user is authenticated against a specific AAA data source.

Which two protocols are used to provide server-based AAA authentication? (Choose two.)

• • 802.1x

• TACACS+

• SNMP

• RADIUS

• SSH

Answer explanation

Server-based AAA authentication uses an external TACACS or RADIUS authentication server to maintain a username and password database. When a client establishes a connection with an AAA enabled device, the device authenticates the client by querying the authentication servers.

What is a drawback of the local database method of securing device access that can be solved by using AAA with centralized servers?

• • There is no ability to provide accountability.

• • User accounts must be configured locally on each device, which is an unscalable authentication solution.

• • It is very susceptible to brute-force attacks because there is no username.

• • The passwords can only be stored in plain text in the running configuration.

Answer explanation

The local database method of securing device access utilizes usernames and passwords that are configured locally on the router. This allows administrators to keep track of who logged in to the device and when. The passwords can also be encrypted in the configuration. However, the account information must be configured on each device where that account should have access, making this solution very difficult to scale.

Which term describes the role of a Cisco switch in the 802.1X port-based access control?

• • agent

• • supplicant

• • authenticator

• • authentication server