Practice Test GeeksCisco CCNA Practice Test
← All Cisco CCNA Flashcard Decks

Cisco CCNA Network Security Fundamentals Flashcards

6 cards from real Cisco CCNA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 Cisco CCNA Network Security Fundamentals flashcards as text

  1. Which command enables port security on a Cisco switch interface and sets the maximum number of MAC addresses to 2?

    Answer: switchport port-security maximum 2

    After enabling 'switchport port-security', the 'switchport port-security maximum 2' command limits the port to two learned MAC addresses.

  2. What is the default violation mode for Cisco switch port security?

    Answer: Shutdown

    By default, port security uses the Shutdown violation mode, which places the port in an err-disabled state when a violation occurs.

  3. Which attack does DHCP snooping protect against on a switched network?

    Answer: Rogue DHCP server attacks

    DHCP snooping prevents rogue DHCP servers by only forwarding DHCP offers from trusted (uplink) ports, blocking unauthorized IP assignments.

  4. What security feature does Dynamic ARP Inspection (DAI) rely on to validate ARP packets?

    Answer: DHCP snooping binding table

    DAI uses the DHCP snooping binding table to verify that ARP packets contain valid IP-to-MAC address mappings.

  5. Which command hardens a Cisco IOS device by encrypting all plaintext passwords currently in the running configuration?

    Answer: service password-encryption

    'service password-encryption' applies a weak reversible Type 7 encryption to plaintext passwords in the configuration.

  6. Which type of VLAN attack allows a rogue device to send frames on a VLAN other than the one it is assigned to?

    Answer: VLAN hopping

    VLAN hopping exploits trunk negotiation (DTP) or double-tagging to inject frames into a target VLAN without authorization.