All 30 users on a single floor of a building are complaining about network slowness. After investigating the access switch, the network administrator notices that the MAC address table is full (10,000 entries) and all traffic is being flooded out of every port. Which action can the administrator take to prevent this from occurring? A.Configure port-security to limit the number of mac-addresses allowed on each portB.Upgrade the switch to one that can handle 20,000 entriesC.Configure private-vlans to prevent hosts from communicating with one anotherD.Enable storm-control to limit the traffic rateE.Configure a VACL to block all IP traffic except traffic to and from that subnet
Answer and explanation
Correct answer: A
Q2Question 2
Intermediate
A network printer has a DHCP server service that cannot be disabled. How can a layer 2 switch be configured to prevent the printer from causing network issues? A.Remove the ip helper-addressB.Configure a Port-ACL to block outbound TCP port 68C.Configure DHCP snoopingD.Configure port-security
Answer and explanation
Correct answer: C
Q3Question 3
Intermediate
A switch is being configured at a new location that uses statically assigned IP addresses. Which will ensure that ARP inspection works as expected? A.Configure the 'no-dhcp' keyword at the end of the ip arp inspection commandB.Enable static arp inspection using the command 'ip arp inspection static vlan vlan-numberC.Configure an arp access-list and apply it to the ip arp inspection commandD.Enable port security
Answer and explanation
Correct answer: C
Q4Question 4
Intermediate
Which of the following would need to be created to configure an application-layer inspection of SMTP traffic operating on port 2525? A.A class-map that matches port 2525 and applying an inspect ESMTP policy-map for that class in the global inspection policyB.A policy-map that matches port 2525 and applying an inspect ESMTP class-map for that policyC.An access-list that matches on TCP port 2525 traffic and applying it on an interface with the inspect optionD.A class-map that matches port 2525 and applying it on an access-list using the inspect option
Answer and explanation
Correct answer: A
Q5Question 5
Intermediate
Threat Defense · Implement Firewall (ASA or IOS)
A financial institution is deploying a Cisco ASA 5500-X series firewall at the internet edge. The security policy requires that all internal hosts in the 10.10.10.0/24 subnet be hidden behind a single public IP address (203.0.113.10) when accessing the internet. Additionally, a specific internal web server (10.10.10.50) must be accessible from the internet on port 80 using the IP 203.0.113.11. The administrator observes that the web server is reachable, but internal hosts cannot access the internet. A review of the configuration shows the following:
Which configuration change resolves the issue while maintaining the required access?
Answer and explanation
Correct answer: C
The current configuration has a static NAT for the web server but lacks a rule for the rest of the subnet. On Cisco ASA, NAT rules are processed in order. Adding a dynamic NAT (or PAT) rule for the 10.10.10.0/24 subnet to use the interface IP or a specific public IP is necessary for outbound connectivity. Since the web server needs a specific static mapping, that rule (Auto NAT or Manual NAT) typically takes precedence if specific, but a separate dynamic rule is required for the remaining hosts.
Q6Question 6
IntermediateMultiple answers
Threat Defense · Implement Layer 2 Security
A network architect is designing a Layer 2 security strategy for a campus network. The design must prevent a user from connecting a rogue DHCP server to a wall jack and assigning incorrect IP addresses to other users in the same VLAN. The switch is a Cisco Catalyst 9300. Which three steps are required to implement the solution? (Select THREE)
Answer and explanation
Correct answers: A, D, E
After global enablement, the feature must be activated for the specific VLANs requiring protection.
By default, all ports are untrusted when DHCP snooping is enabled. The uplink to the valid DHCP server must be explicitly trusted to allow DHCP Offer and Ack packets to pass.
DHCP snooping must be enabled globally before it can be active on specific VLANs.
Q7Question 7
Advanced
Management Services on Cisco Devices · Configure AAA
A security engineer is configuring the Cisco ASA to integrate with a Cisco ISE server for administrative access control. The requirement is that network administrators must have full access (privilege level 15) while helpdesk staff should only have read-only access (privilege level 2). The ISE server is configured to return the Cisco-AV-Pair attribute 'shell:priv-lvl=15' for admins. Which command on the ASA ensures this attribute is honored during the authorization process?
Answer and explanation
Correct answer: C
The command 'aaa authorization exec authentication-server' configures the ASA to use the authorization attributes (like privilege level) retrieved during the authentication phase from the RADIUS/TACACS+ server. Without this command (or specifying 'auto'), the ASA might default to local authorization or not apply the privilege level sent by ISE.
Q8Question 8
Beginner
Threat Defense · Describe threat detection features
While investigating a reported network slowdown, an administrator discovers a large volume of TCP SYN packets targeting the web server farm. The traffic appears to be spoofed. To mitigate this on the Cisco ASA, the administrator enables TCP Intercept. Which Threat Defense feature is being utilized?
Answer and explanation
Correct answer: C
TCP Intercept on the ASA is typically implemented by setting embryonic connection limits within the Modular Policy Framework (MPF) policy map. When the limit is reached, the ASA proxies the connection (intercepts the SYN) to verify the source is legitimate before forwarding to the server, preventing SYN flood attacks.
Register free for 9 more questions
Or unlock all 270 300-206 questions with explanations, timed mode and flashcards.
