總結挑戰 · Summary Challenge

Summary Challenge Questions

總結挑戰問題

What is the purpose of shutting down a VLAN?關閉（shutdown）VLAN 的目的為何？

Shutting down a VLAN disables all interfaces that are part of the VLAN.關閉 VLAN 會停用該 VLAN 中的所有介面。Shutting down a VLAN prevents data exchange between the ports in a VLAN.關閉 VLAN 會阻止該 VLAN 中連接埠之間的資料交換。Shutting down a VLAN makes all the ports routed ports.關閉 VLAN 會使所有連接埠變成路由連接埠。Shutting down a VLAN disables all interfaces that are not part of that VLAN.關閉 VLAN 會停用所有不屬於該 VLAN 的介面。

You plan to implement an iACL on the internet router in your company to protect the infrastructure devices. Which three options should you use when configuring the iACL? (Choose three.)你計畫在公司的網際網路路由器上實作基礎設施存取控制清單（iACL），以保護基礎設施裝置。設定 iACL 時應使用以下哪三個選項？（選三項。）

Deny all noninitial fragments.拒絕所有非初始分段（fragment）。Permit all noninitial fragments.允許所有非初始分段（fragment）。Permit RFC 1918 IPv4 address space.允許 RFC 1918 IPv4 位址空間。Implement ingress filtering according to RFC 2827.依 RFC 2827 實作入向過濾。Deny the flow of transit traffic to noninfrastructure destinations.拒絕流向非基礎設施目的地的傳輸流量。Permit protocols that are used on the devices, such as BGP, SSH, and SNMP, from specific source addresses.允許裝置上使用的通訊協定（如 BGP、SSH 與 SNMP）從特定來源位址通過。

Which two statements are true about Cisco Discovery Protocol? (Choose two.)關於 Cisco Discovery Protocol，以下哪兩項敘述是正確的？（選兩項。）

It enables Cisco network devices to announce themselves to their neighbors.它讓 Cisco 網路裝置能夠向鄰居宣告自己的存在。It is disabled by default.它預設是停用的。It provides an easy reconnaissance vector to any attacker with an Ethernet connection.它為任何具有乙太網路連線的攻擊者提供了簡易的偵察管道。It can be useful for network troubleshooting when checking connectivity to non Cisco devices.在檢查與非 Cisco 裝置的連線狀況時，它有助於網路疑難排解。You can use the no cdp enable command to disable it globally.你可以使用 no cdp enable 命令全域停用它。

An attacker has bypassed physical security and was able to connect a laptop to an Ethernet interface on a switch. If all the switch ports are configured with port security and the violation mode is set to the default, which action is taken against the attacker?攻擊者已繞過實體安全防護，成功將筆記型電腦連接到交換器上的乙太網路介面。若所有交換器連接埠都已設定連接埠安全性，且違規模式設為預設值，將對攻擊者採取哪個動作？

Packets with unknown source addresses are dropped and there is no notification that a security violation has occurred.來源位址未知的封包會被丟棄，且不會有安全違規發生的通知。Packets with unknown source addresses are dropped and there is a notification that a security violation has occurred.來源位址未知的封包會被丟棄，且會有安全違規發生的通知。Packets with unknown source addresses are dropped, there is a notification that a security violation has occurred, and the interface becomes error-disabled.來源位址未知的封包會被丟棄，會有安全違規發生的通知，且該介面會變成錯誤停用狀態。Packets with unknown source addresses are forwarded and there is a notification to the syslog server.來源位址未知的封包會被轉送，且會有通知傳送到 syslog 伺服器。

The administrator is configuring a switch and chooses to enable port security on several ports. The configuration for the interface GigabitEthernet1/0/1 is shown below. Based on this configuration, is the administrator planning to connect a network extension device, such as a switch or access point, to the interface? interface GigabitEthernet1/0/1
< --- output omitted --- >
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
< --- output omitted --- >管理員正在設定交換器，並選擇在數個連接埠上啟用連接埠安全性。介面 GigabitEthernet1/0/1 的設定如下所示。根據此設定，管理員是否打算在該介面上連接網路擴充裝置（例如交換器或無線基地台）？interface GigabitEthernet1/0/1
< --- output omitted --- >
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
< --- output omitted --- >

No, based on the aging time and type, he is limiting access to other devices.不是，根據老化時間與老化類型判斷，他是在限制其他裝置的存取。Yes, based on the limited aging time, the administrator expects many different MAC addresses on the port.是的，根據較短的老化時間判斷，管理員預期該連接埠上會出現許多不同的 MAC 位址。No, because port security is never set on interfaces that connect to other network intermediary devices.不是，因為連接到其他網路中介裝置的介面上絕不會設定連接埠安全性。Yes, because the violation mode is set to restrict and not left to default shutdown.是的，因為違規模式設為 restrict，而非保留為預設的 shutdown。No, because the administrator has not issued a port-security maximum command.不是，因為管理員並未下達 port-security maximum 命令。

Referring to the command output, in what state is the port? SwitchX# show port-security interface FastEthernet 0/5
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : fc99.47e5.2598:1
Security Violation Count : 0根據以下命令輸出，該連接埠處於什麼狀態？SwitchX# show port-security interface FastEthernet 0/5
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 0
Last Source Address:Vlan : fc99.47e5.2598:1
Security Violation Count : 0

forwarding轉送中error-disabled錯誤停用shutdown已關閉listeninglistening

Which two practices would you follow to prevent VLAN attacks on a network? (Choose two.)為防止網路上的 VLAN 攻擊，你會採取以下哪兩項作法？（選兩項。）

Set all ports to STP PortFast.將所有連接埠設為 STP PortFast。Disable DTP on all ports.在所有連接埠上停用 DTP。Disable Cisco Discovery Protocol on all ports.在所有連接埠上停用 Cisco Discovery Protocol。Change the default VLAN settings.變更預設 VLAN 設定。Disable the HTTP service.停用 HTTP 服務。

Which of these options is a mitigation technique to prevent rogue DHCP servers from providing false IP configuration parameters?以下哪個選項是用來防止流氓 DHCP 伺服器提供錯誤 IP 設定參數的緩解技術？

Dynamic ARP Inspection depends on which of the following options in environments that use DHCP?在使用 DHCP 的環境中，動態 ARP 檢查依賴以下哪個選項？

Port Security連接埠安全性DHCP snooping bindingDHCP 窺探綁定Cisco Discovery ProtocolCisco Discovery ProtocolHTTP ServicesHTTP 服務

Which command protects a switched network from a hacker who is trying to preempt an election of STP?哪個命令可以保護交換式網路，避免駭客搶先當選 STP 根橋接器？

spanning-tree portfast defaultspanning-tree portfast defaultspanning-tree guard rootspanning-tree guard rootswitchport port-security violationswitchport port-security violationspanning-tree guardspanning-tree guard

Summary Challenge總結挑戰

Summary Challenge Questions

總結挑戰問題