You've reached the end of your free preview.
Want to read all 9 pages?
Unformatted text preview: 8/6/2019 TestOut LabSim Exam Report: 6.6.9 Practice Questions Date: 8/6/2019 10:50:14 pm
Time Spent: 1:19 Candidate: London, Omar Overall Performance
Your Score: 27%
Passing Score: 80%
View results by: Objective Analysis Individual Responses Individual Responses
Question 1: Correct This question includes an image to help you answer the question. Close Use the Exhibit to answer the following question.
You are the network administrator for a city library. Throughout the library are several groups of
computers that provide public access to the Internet. Supervision of these computers has been
difficult. You've had problems with patrons bringing personal laptops into the library and
disconnecting the network cables from the library computers to connect their laptops to the
Internet.
The library computers are in groups of four. Each group of four computers is connected to a hub
that is connected to the library network through an access port on a Catalyst 2960 switch. You
want to restrict access to the network so only the library computers are permitted connectivity to
the Internet.
What can you do?
Create a VLAN for each group of four computers.
Configure port security on the switch.
Remove the hub and place each library computer on its own access port.
Create static MAC addresses for each computer and associate it with a VLAN.
… 1/9 8/6/2019 TestOut LabSim Explanation
Configuring port security on the Catalyst 2950 switch can restrict access so that only specific
MAC addresses can connect to the configured switch port. This would prevent the laptop
computers from being permitted connectivity.
Placing each library computer on its own access port would have no affect.
VLANs are used to group broadcast traffic and do not restrict connectivity of devices as needed
in this scenario. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_01]
Question 2: Incorrect You've just enabled port security on an interface of a Catalyst 2950 switch. You want to generate
an SNMP trap whenever a violation occurs. Which feature should you enable?
protect
shutdown
secure
restrict Explanation
The feature restrict configures two actions whenever a violation occurs:
1. The interface will not forward any frames from source addresses not assigned to the port.
2. The switch generates a console message and sends an SNMP trap to a designated
network management station whenever a violation occurs.
When the feature protect is enabled, the interface will not forward any frames from source
addresses not assigned to the port. The shutdown feature shuts down the port when a
violation occurs requiring it to be re-enabled by an administrator. There is no secure feature
in the switchport port-security violation command. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_03]
Question 3: Incorrect What are the default port security settings on a 2960 switch? (Select two.)
A maximum of 1 MAC address per port is allowed.
Violation action is set to restrict.
Violation action is set to protect.
A maximum of 5 MAC addresses per port are allowed.
A maximum of 3 MAC addresses per port are allowed.
Violation action is set to shutdown. Explanation
On a new 2960 switch, the default port security settings allow a single MAC address per port,
… 2/9 8/6/2019 TestOut LabSim with shutdown being the default port violation action. References LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_04||/]
Question 4: Correct You are configuring a new 2960 switch. You issue the following commands:
switch(config)#interface fast 0/15
switch(config-if)#switchport mode access
switch(config-if)#switchport port-security
switch(config-if)#switchport port-security maximum 1
switch(config-if)#switchport port-security mac-address sticky
switch(config-if)#switchport port-security violation protect
You connect a hub with two workstations to port Fa0/15. You power on first Device1 and then
Device2.
What will be the result?
Frames from both Device1 and Device2 will be allowed.
Frames from Device1 will be allowed; frames from Device2 will be dropped.
Port Fa0/15 will be disabled and no frames will be accepted or forwarded.
Frames from Device2 will be allowed; frames from Device1 will be dropped. Explanation
Based on this configuration, frames from Device1 will be allowed while frames from Device2
will be dropped. The switch allows a single MAC address to connect to each switch port. The
switch is configured to learn the MAC address of the first device that connects, and grants
access only to that device. When a second device is attached to the port, the protect
parameter drops packets from unauthorized devices.
To allow both Device1 and Device2 to connect, set the maximum to 2. To disable a port when
a violation occurs, configure shutdown as the violation method. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_05]
Question 5: Incorrect You have a Catalyst 2960 switch on a small local area network with one server and five
workstations. The file server is named SrvFS and is connected to port Fa0/17 on the switch.
You want to make sure that only this server can connect to port Fa0/17, but that it can send and
receive frames from the five workstations on the network.
What should you do?
Configure switchport security on Fa0/17 to allow only the MAC address of SrvFS.
Apply an access list to Fa0/17 that allows outgoing traffic only to SrvFS.
Apply an access list to Fa0/17 that allows incoming traffic only from SrvFS.
Configure switchport security on Fa0/17 to allow the MAC address of the server and the
five workstations. Explanation
To control which devices can connect to a switch port, configure switch port security. In this
scenario, set the maximum devices to 1, then configure Fa0/17 with the MAC address of the
server. Only the server will be able to connect to this switch port.
… 3/9 8/6/2019 TestOut LabSim Configuring the MAC address of all devices on the Fa0/17 port would enable any of the five
workstations to connect to that port. An access list is a security mechanism applied to routers.
Access lists filter on IP address or port or protocol; they do filter based on MAC address and
are not used on Layer 2 switches. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_07]
Question 6: Incorrect You have a Catalyst 2960 switch on a small local area network with one server and five
workstations. The file server is named SrvFS and is connected to port Fa0/17 on the switch.
You want to make sure that only this server can connect to port Fa0/17. If any unauthorized
devices attempt to attach, you want to disable the port until you manually re-enable it.
On Fa0/17, you use the switchport port-security mac-address command to identify the MAC
address of the server. What else should you include in your configuration? (Select two.)
switchport port-security maximum 5
switchport port-security maximum 1
switchport port-security maximum 6
switchport port-security violation restrict
switchport port-security violation protect
switchport port-security violation shutdown Explanation
To allow only a single device to connect, use the switchport port-security maximum 1
command. To disable the port when a violation occurs, use shutdown for the violation mode.
Setting the maximum higher than 1 would allow multiple devices to connect to the switch port.
Using protect or restrict as the violation mode drops frames from unauthorized devices, but
continues to allow the authorized device to use the port. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_08]
Question 7: Incorrect You have a switch that has port security enabled on the Fa0/3 interface. The output of the show
port-security interface fa0/3 command is shown below:
Port Security : Enabled
Port Status : Secure-up
Violation Mode : Protect
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 2
Total MAC Addresses : 1
Configured MAC Addresses : 0
Sticky MAC Addresses : 1
Last Source Address:Vlan : 0800.46f5.491c:1
Security Violation Count : 0
What is true of this configuration? (Select two.)
One MAC address entry has been statically configured for the port.
… 4/9 8/6/2019 TestOut LabSim If the port detects MAC addresses over the allowed limit, the port will become disabled.
Two devices have connected to the port.
The port has learned one MAC address and saved that address in the running-config
file.
The port allows up to two connected devices. Explanation
In this example:
• The maximum number of MAC addresses for this port is 2 (indicated by the Maximum
MAC Addresses line).
• The port has learned one MAC address and saved that address in the running-config file
(indicated by the number on the Sticky MAC Addresses line).
• The port has a record of 1 MAC address (indicated by the Total MAC Addresses line).
• When the maximum MAC addresses is reached, the port will drop frames from additional
hosts. The Violation Mode is set to protect. A mode of shutdown would disable the port
when other MAC addresses are detected. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_09]
Question 8: Correct You have a switch that has port security enabled on the Fa0/3 interface. The output of the show
port-security interface fa0/3 command is shown below:
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 0 mins
Aging Type : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses : 2
Total MAC Addresses : 2
Configured MAC Addresses : 1
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0800.46f5.491c:1
Security Violation Count : 1
What is true of this configuration?
The port is up and can be used by the two devices whose MAC addresses have been
identified.
The port has been disabled because too many MAC addresses have been detected.
The port is up. One additional MAC address can connect to the port and be allowed.
The port is up and can be used by any device. Explanation
This port has been disabled because of a security violation. The Port Status entry indicates
Secure-shutdown, with the Security Violation Count indicating that too many MAC
addresses have been detected on the port. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_10]
… 5/9 8/6/2019 TestOut LabSim Question 9:
Incorrect
You have configured port security for the Fa0/3 interface. To test the security settings, you
connect two workstations to the same port. Both are allowed to connect. You check the runningconfig file and find the following for the interface:
interface FastEthernet0/3
switchport mode access
switchport port-security mac-address sticky
You want to allow only a single device to connect to this port. What should you do?
For the interface, use the switchport port-security mac-address command and
identify the allowed MAC address.
For the interface, use the switchport port-security violation shutdowncommand.
For the interface, use the switchport port-security command.
For the interface, use the switchport port-security maximum 1 command.
For the interface, use the switchport port-security mac-address command with the
MAC address of the allowed host and including the sticky keyword. Explanation
Before port security settings are enforced, you must include the switchport port-security
command in the configuration. This enables port security on the interface. Other port security
settings can be configured with port security disabled, but the settings won't be enforced until
it is enabled.
By default, a maximum of 1 device can connect to each port and the violation mode is set to
shutdown. Setting either value to the default does not result in an entry in the configuration
file. Identifying MAC addresses, with or without the sticky keyword, would not restrict access
unless port security is enabled. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_11||/]
Question 10: Incorrect Which of the following are true of port security sticky addresses? (Select two.)
They are only learned automatically.
They are placed in the startup-config file.
They are held in RAM, but not in a configuration file.
They are placed in the running-config file, and can be saved to the startup-config file.
They can be learned automatically or manually configured. Explanation
Sticky addresses can be learned automatically or manually configured. When sticky addresses
are learned, they are automatically placed in the running-config file. To make these addresses
immediately available when the system restarts, save the running-config file.
The switch learns MAC addresses automatically and can use these dynamic addresses for port
security. Dynamic addresses that are not sticky are held in RAM, but not added to the
configuration file. Static addresses are manually configured and appear in the running-config
file. References
… 6/9 8/6/2019 TestOut LabSim LabSim
for Routing and Switching
Pro, Section 6.6.
[CCNA_AllQuestions.exm
SWITCH_SEC_12]
Question 11: Incorrect You have just enabled port security on a switch port. What are the default settings? (Select
three.)
Restrict violation mode
Maximum of 1 device
Protect violation mode
Maximum of 2 devices
Dynamically-learned allowed addresses
Statically-configured MAC addresses
Shutdown violation mode
Sticky learn MAC addresses Explanation
Default port security settings are:
• A maximum of 1 device per port
• Violation mode set to shutdown
• Addresses are dynamically learned, but not sticky References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_13]
Question 12: Incorrect This question includes an image to help you answer the question. Close You have two IP phone daisy chains as shown in the exhibit.
Which of the following commands correctly configures port security on both FastEthernet 0/5 and
0/6? (Select two.)
Switch(config-if)#switchport port-security
Switch(config-if)#switchport port-security maximum 2
Switch(config-if)#switchport port-security maximum 3
… 7/9 8/6/2019 TestOut LabSim Switch(config-if)#switchport port-security mac-address sticky Explanation
When you enable port security on an interface that is also configured with a voice VLAN, you
must set the maximum allowed secure addresses on the port to two
the maximum
number of secure addresses allowed on the access VLAN. The recommended maximum
allowed value is 3 when a voice VLAN is configured on the interface. plus • When the port is connected to a Cisco IP Phone, the phone requires up to two MAC
addresses. The phone address is learned on the voice VLAN and might also be learned on
the access VLAN.
• Connecting a PC to the phone requires additional MAC addresses.
You can enter port security commands for an interface without port security being enabled.
However, port security will not be enforced (enabled) if the switchport port-security entry
is missing.
You cannot configure static secure or sticky secure MAC addresses on the voice VLAN. If any
type of port security is enabled on the access VLAN, dynamic port security is automatically
enabled on the voice VLAN. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_14]
Question 13: Incorrect In which of the following situations would you use port security?
You wanted to control the packets sent and received by a router.
You wanted to prevent sniffing attacks on the network.
You wanted to restrict the devices that could connect through a switch port.
You wanted to prevent MAC address spoofing. Explanation
Use port security on a switch to restrict the devices that can connect to a switch. Port security
uses the MAC address to identify allowed and denied devices. When an incoming frame is
received, the switch examines the source MAC address to decide whether to forward or drop
the frame.
Port security cannot prevent sniffing or MAC address spoofing attacks. Use an access list on a
router to control sent and received packets. References
LabSim for Routing and Switching Pro, Section 6.6.
[CCNA_AllQuestions.exm SWITCH_SEC_15]
Question 14: Correct This question includes a lab to help you answer the question. View Lab You are troubleshooting the connections on a switch. Which would you do to correct the status
shown for Fa0/12?
Note: You will not be able to use the show run or show start commands in this lab.
Use the no shutdown command.
Replace the cable.
… 8/9 8/6/2019 TestOut LabSim Disable port security.
Nothing. The interface is working correctly. Explanation
To discover the problem with the FastEthernet0/12 interface, use the show interface fa0/12
command. The status of FastEthernet0/12 is administratively down, line protocol is
down (disabled). This means the port is administratively disabled with the shutdown
command. To change the status of this port, issue the no shutdown command.
Replace the cable if the port status is down, line protocol is down (notconnect). Disable
port security if the port status is down, line protocol is down (err-disabled). If the port
status is up, line protocol is up (connected), the port is working correctly. References
LabSim for Routing and Switching Pro, Section 4.7.
[SimQuestions.exm SWITCHTEST1]
Question 15: Incorrect This question includes a lab to help you answer the question. View Lab You are troubleshooting the connections on a switch. The device connected to the switch on
fa0/8 is powered on. Which would you do to correct the status of Fa0/8?
Note: You will not be able to use the show run or show start commands in this lab.
Use the no shutdown command.
Replace the cable.
Disable port security.
Nothing. The interface is working correctly. Explanation
To discover the problem with the FastEthernet0/8 interface, use the show interface fa0/8
command. The status of FastEthernet0/8 is down, line protocol is down (notconnect).
This status indicates there is a hardware or network connection problem (Physical layer), such
as:
• No cable or bad cable
• The device on the other end of the cable is powered off or the other interface is
administratively shutdown (with the shutdown command)
The third line in the show interface fa0/8 command indicates the port is connected to
workstation #5. You now know this device is powered on and is not a Cisco device, so the
cable may be bad.
Issue the no shutdown command if the port status is administratively down, line
protocol is down (disabled). Disable port security if the port status is down, line protocol
is down (err-disabled). If the port status is up, line protocol is up (connected), the port
is working correctly. References
LabSim for Routing and Switching Pro, Section 4.7.
[SimQuestions.exm SWITCHTEST2] … 9/9 ...
View
Full Document
- Fall '19
