Intrusion Prevention Fundamentals

An introduction to network attack mitigation with IPS

• Where did IPS come from? How has it evolved?
• How does IPS work? What components does it have?
• What security needs can IPS address?
• Does IPS work with other security products? What is the “big picture”?
• What are the best practices related to IPS?
• How is IPS deployed, and what should be considered prior to a deployment?

Intrusion Prevention Fundamentals offers an introduction and in-depth overview of Intrusion Prevention Systems (IPS) technology. Using real-world scenarios and practical case studies, this book walks you through the lifecycle of an IPS project–from needs definition to deployment considerations. Implementation examples help you learn how IPS works, so you can make decisions about how and when to use the technology and understand what “flavors” of IPS are available. The book will answer questions like:

Whether you are evaluating IPS technologies or want to learn how to deploy and manage IPS in your network, this book is an invaluable resource for anyone who needs to know how IPS technology works, what problems it can or cannot solve, how it is deployed, and where it fits in the larger security marketplace.

• Understand the types, triggers, and actions of IPS signatures
• Deploy, configure, and monitor IPS activities and secure IPS communications
• Learn the capabilities, benefits, and limitations of host IPS
• Examine the inner workings of host IPS agents and management infrastructures
• Enhance your network security posture by deploying network IPS features
• Evaluate the various network IPS sensor types and management options
• Examine real-world host and network IPS deployment scenarios

This book is part of the Cisco Press® Fundamentals Series. Books in this series introduce networking professionals to new networking technologies, covering network topologies, example deployment concepts, protocols, and management techniques.

Includes a FREE 45-Day Online Edition

http://www.ciscopress.com/bookstore/product.asp?isbn=1587052393

Content Networking Fundamentals

A comprehensive introduction to the theory and practical applications of content networking

• Get a strong introduction to the basic networking concepts necessary for content networking, including network address translation, IP multicast content delivery, quality of service, and streaming media
• Master the application-layer protocols, including HTTP, SSL, RSTP, RTP and FTP
• Design redundancy and high availability by using server load balancing, Domain Name System (DNS) directory services, Cisco DistributedDirector software, proximity-based load balancing, and global sticky databases
• Learn to switch and offload encrypted content by importing, creating, and configuring certificates and keys in Secure Sockets Layer (SSL) termination devices
• Examine how to configure routers with Web Cache Communication Protocol (WCCP) and to switch content requests to content engines for serving frequently requested objects
• Learn how to configure caching, live push- and pull-splitting, content acquisitioning, and pre-positioning using Cisco Application and Content Networking System (ACNS) software

Content networking is the most popular technology used to enhance network and application performance. The growth of content networking has been driven by end-user demands for richer content and lowered response times. These demands have caused the field of content networking to flourish with technological advances. Today many companies use content networking to add a layer of intelligence to their systems, scaling server availability and optimizing content delivery.

Content Networking Fundamentals introduces you to content networking solutions and the underlying networking technologies that content networking uses to accelerate your applications in new and unique ways. You’ll discover various algorithms behind content networking and learn how the Cisco Systems® product suite implements them.

In this comprehensive guide, you start with a review of the protocols required for content networking, building your knowledge of introductory concepts and applications. From there, you delve into the components specific to content networking, with a focus on the content-aware Open Systems Interconnection (OSI) Layers 4 through 7. Numerous deployment examples help you understand the more advanced topics. You can use the configuration snapshots in this book as skeletal configurations for your production network.

Following the valuable lessons taught in Content Networking Fundamentals, you’ll be able to effectively design, deploy, maintain, and troubleshoot content networks.

http://www.ciscopress.com/bookstore/product.asp?isbn=1587052407

Firewall Fundamentals

The essential guide to understanding and using firewalls to protect personal computers and your network

• An easy-to-read introduction to the most commonly deployed network security device
• Understand the threats firewalls are designed to protect against
• Learn basic firewall architectures, practical deployment scenarios, and common management and troubleshooting tasks
• Includes configuration, deployment, and management checklists

Increasing reliance on the Internet in both work and home environments has radically increased the vulnerability of computing systems to attack from a wide variety of threats. Firewall technology continues to be the most prevalent form of protection against existing and new threats to computers and networks. A full understanding of what firewalls can do, how they can be deployed to maximum effect, and the differences among firewall types can make the difference between continued network integrity and complete network or computer failure. Firewall Fundamentals introduces readers to firewall concepts and explores various commercial and open source firewall implementations--including Cisco, Linksys, and Linux--allowing network administrators and small office/home office computer users to effectively choose and configure their devices. Firewall Fundamentals is written in clear and easy-to-understand language and helps novice users understand what firewalls are and how and where they are used. It introduces various types of firewalls, first conceptually and then by explaining how different firewall implementations actually work. It also provides numerous implementation examples, demonstrating the use of firewalls in both personal and business-related scenarios, and explains how a firewall should be installed and configured. Additionally, generic firewall troubleshooting methodologies and common management tasks are clearly defined and explained.

http://www.ciscopress.com/bookstore/product.asp?isbn=1587052210

ESwitching Final Exam - CCNA Exploration: LAN Switching and Wireless (Version 4.0) #2

26


Refer to the exhibit. A network administrator has segmented the network into two VLANs and configured Router1 for inter-VLAN routing. A test of the network, however, shows that hosts on each VLAN can only access local resources and not resources on the other VLAN. What is the most likely cause of this problem?

Switch port Fa0/1 is not trunking.
Router interface Fa0/0 is possibly down.
No routing protocol is configured on Router1.
One of the router subinterfaces is possibly down.




27 What will be the effect of the command S1# copy system:running-config tftp://172.16.2.155/tokyo-config?

The IOS will be copied to the TFTP server.
The configuration file named tokyo-config will overwrite the startup configuration file on S1.
The running configuration file on S1 will be saved via TFTP to a file named tokyo-config.
The contents of NVRAM on S1 will become the startup configuration file on the tokyo switch.




28 Using the command copy tftp:backup.cfg startup-config, an administrator downloaded a saved configuration from a TFTP server to a switch. Why does the administrator not detect any changes in the switch configuration after the download completes?

The command should have been copy startup-config tftp:backup.cfg.
A backup configuration from a TFTP server cannot be copied directly into the startup-config.
The command copy running-config startup-config should be used to save the changes on the switch.
Downloading to the startup-config requires the switch to be reloaded in order for the configuration to take effect.




29 What are two benefits of the IEEE 802.11n standard over the IEEE 802.11G? (Choose two.)

requires less equipment
provides improved range
permits increased data rates
has a single-input and a single-output
needs no hardware upgrade for compatibility




30


Refer to the exhibit. Switch SW2 was tested in a lab environment and then inserted into a production network without reloading its configuration. After the trunk link between SW1 and SW2 was brought up, all users lost connectivity to the network. What could be the source of the problem?

All the VLANs were pruned from the trunk port between SW1 and SW2.
SW1 and SW2 cannot be both set as VTP servers in the same VTP domain.
VTP configuration revision number of SW2 was higher than the configuration revision number of SW1.
The additional VLANs from SW2 created more VLANs than the VLAN database of SW1 could contain.

Assessment System

Take Assessment - ESwitching Final Exam - CCNA Exploration: LAN Switching and Wireless (Version 4.0)

31


Refer to the exhibit. Both switches are interconnected via a trunk link. Host A and host B are on the default VLAN but are not able to exchange traffic. What should be done to fix the problem?

Allow all VLANs on the trunk link.
Remove the native VLAN from the trunk.
Include a router or switch with Layer 3 capabilities.
Configure the same native VLAN on both ends of the trunk.




32 Which three statements are true regarding router-on-a-stick inter-VLAN routing? (Choose three.)

requires the use of subinterfaces on the router
requires an access link between the router and Layer 2 switch
more cost-efficient and scalable than using multiple physical interfaces
requires each subinterface to be configured with the no shutdown command
can impact performance if many VLANs compete for bandwidth on a single router interface
makes troubleshooting the inter-VLAN routing configuration much less complex than when using multiple physical interfaces




33


Refer to the exhibit. R1 is configured for traditional inter-VLAN routing. R1 can ping computer 3 but cannot ping computer 1. What is a possible cause for this failure?

S1 port Fa0/11 is in the wrong VLAN.
R1 does not have an active routing protocol.
The IP address of computer 1 is in the wrong logical network.
Router interface Fa0/0 has the wrong trunk encapsulation type configured.




34 While configuring a new switch, a network administrator configures the switch as an HTTP server. What benefits does this configuration provide?

This allows the switch to host web pages for the network.
This allows remote VPN connections to the switch over the Internet.
This is required if a web server or web farm is attached to the switch.
This allows web-based configuration tools to be used with the switch.




35


Refer to the exhibit. A new host needs to be connected to VLAN 1. Which IP address should be assigned to this new host?

192.168.1.11 /28
192.168.1.22 /28
192.168.1.33 /28
192.168.1.44 /28
192.168.1.55 /28




36


Refer to the exhibit. What does “LEARNING” mean as it relates to the Spanning Tree Protocol?

The switch is sending and receiving data frames.
The switch is not receiving BPDUs, but is sending and receiving data.
The switch is participating in the election process by forwarding the BPDUs it receives.
The switch is receiving BPDUs and populating the MAC address table, but not sending data.




37 Which two statements about a service set identifier (SSID) are true? (Choose two.)

provides strong wireless security
responsible for determining the signal strength
tells a wireless device to which WLAN it belongs
used to encrypt data sent across the wireless network
all wireless devices on the same WLAN must have the same SSID




38


Refer to the exhibit. The hosts connected to switch SW1 are not able to communicate with the hosts in the same VLANs connected to switch SW2. What should be done to fix the problem?

Configure VLANs with different VLAN IDs on switch SW2.
Reconfigure the trunk port on switch SW2 with static trunk configuration.
Introduce a Layer 3 device or a switch with Layer 3 capability in the topology.
Apply IP addresses that are in the same subnet to the interfaces used to connect SW1 and SW2.




39 When configuring a router to act as an SSH server, what should be configured before issuing the crypto key generate rsa command?

the security domain name
the VTP domain name
the IP domain name
the host name




40


Refer to the exhibit. Which switch will be elected as the root bridge of the spanning tree topology?

Cat-A
Cat-B
Cat-C
Cat-D

41 In which mode is a VTP switch operating if it has been configured to only forward VTP advertisements?

client
root
server
transparent

42 What is an efficient and cost effective way to minimize the frequency and effects of broadcast storms on an Ethernet LAN?

Connect each PC directly to a router port.
Use access control lists to filter broadcasts from the network.
Divide the computers into separate VLANs on the existing switches.
Divide the computers into separate workgroups using different physical switches.

43
Refer to the exhibit. The configuration steps that are listed in the exhibit have been entered in switch S1 via the console. Subsequent attempts to telnet to the switch are not successful. What is causing the problem?

The switch must be configured with SSH version 1.
The transport input command must specify Telnet access.
The RSA keys must be returned to zero before SSH will permit Telnet access.
The ip domain-name command must also be entered in line configuration mode for the vty lines.

44 Which device must be installed in each computer to allow a wireless connection to be established?

DSL modem
wireless NIC
wireless router
wireless access point

45
Refer to the exhibit. The Layer 2 switching design that is shown has been implemented in a campus environment that is using Spanning Tree Protocol. All inter-switch links that are shown are trunks. Whenever an inter-switch link fails, the network takes nearly a minute to completely converge. How can the convergence time be reduced?

Increase the capacity of the distribution and core trunk links to 10 Gb/s.
Add a trunk link that directly connects D1 and D2.
Use Layer 3 switching on the core switch.
Implement Rapid Spanning Tree Protocol.


Assessment System

Take Assessment - ESwitching Final Exam - CCNA Exploration: LAN Switching and Wireless (Version 4.0)

46
Refer to the exhibit. Router R-West and switch S-West1 are connected via a single ethernet cable between the router interface fa0/0 and the switch interface fa0/1. The router and switch have been configured with the commands that are displayed in the exhibit. The network administrator enters the show interfaces trunk command and receives the output as shown. What is the cause of the "not-trunking" status for switch port Fa0/1?

The trunk is established, but no VLANs have been configured to use it.
The router is missing the dynamic trunking protocol statements necessary to form a trunk.
Because the router does not support Dynamic Trunking Protocol, the trunk has not been established.
The router, the switch, or both must be configured with the dynamic desirable option for Dynamic Trunking Protocol to establish a trunk.


47 Which statement about STP network diameter is correct?

STP diameters are restricted by convergence times.
Layer 2 root elections should be optimized by adjusting BPDU timers to match network diameter.
Using lower bandwidth connections between switches will allow STP to have a larger network diameter.
Portfast can be used to increase the allowable switched network diameter because it disables the forward delay and maximum age timers.


48 Which statement is correct about STP architecture?

Spanning Tree Protocol will guarantee a loop free Layer 2 topology.
Spanning Tree Protocol guarantees the shortest path to destination networks.
The switch with the highest priority will be assigned the lowest BID in the root election.
The first step in the spanning-tree election process is to determine the root port.
To select designated ports, the spanning-tree algorithm must determine the longest contiguous path from the root bridge.


49


Refer to the exhibit. What will allow a host on VLAN 40 on switch X to communicate with a host in VLAN 40 on switch Y?

QoS
routing
trunking
VPN


50

Refer to the exhibit. The network administrator is planning five additional VLANs to be shared throughout the VTP domain on S3. What action should the administrator take before creating the additional VLANs?

Create the VLANs on a switch in VTP server mode and allow them to propogate to the other switches in the domain.
Modify the configuration revision to 10 to support the additional VLANs.
Enable the VTP pruning mode in order to create the VLANs on S3.
Enable the VTP v2 mode.

51 What identifier in the BPDU creates a unique BID for a switch?

IP address
MAC address
bridge priority
VLAN ID
port priority
52 What is the purpose of the switch command switchport access vlan 99?
to enable port security
to make the port operational
to assign the port to a particular VLAN
to designate the VLAN that does not get tagged
to assign the port to the native VLAN (VLAN 99)

ESwitching Final Exam - CCNA Exploration: LAN Switching and Wireless (Version 4.0) #1

1
Refer to the exhibit. This switch is to be added to the production network. Which two facts about VLANs and VTP operation can be confirmed by this output? (Choose two.)
The network administrator will be able to configure VLANs of local significance on this switch.
VLANs can only be added to the VLAN database on this switch by a VTP advertisement.
All VLANs that are configured on this switch will be sent to all other switches in the same VTP domain.
This switch will drop all VTP advertisements that come from switches that are configured in the same VTP domain.
Adding this switch to the network will cause no disruption in the VTP domain operations if the rest of the switches in the same VTP domain have a higher configuration revision number.
2 Which statement correctly describes the spanning-tree path cost?
It is calculated based on the total number of switches connected in a loop.
It is calculated based on the utilization of all the switches along a given path.
It is calculated based on the bridge priority of the switches along a given path.
It is calculated based on the sum of the port cost value, determined by link speed, for each switch port along a given path.

3 Which method establishes an administrative connection for configuring the Linksys WRT300N wireless access point?
Associate with the access point and then open a HyperTerminal session with the access point.
Physically connect to the access point and then reboot the computer to launch the configuration software.
From a computer in the same IP subnet as the access point, enter the default IP address of the access point in a web browser.
Modify the TCP/IP properties of the computer connected to the access point so that it exists on the same network, and then reboot your computer to establish a connection.

4
Refer to the exhibit. Hosts PC_A and PC_B send traffic simultaneously, and the frames from the transmitting stations collide. What is the last device to receive the collision?

hub HB1
switch SW1
router R1
switch SW2
router R2
switch SW4
5
Refer to the exhibit. A network administrator is configuring RT1 for inter-VLAN routing. The switch is configured correctly and is functional. Host1, Host2, and Host3 cannot communicate with each other. Based on the router configuration, what is causing the problem?

Interface Fa0/0 is missing IP address configuration information.
IP addresses on the subinterfaces are incorrectly matched to the VLANs.
Each subinterface of Fa0/0 needs separate no shutdown commands.
Routers do not support 892.1Q encapsulation on subinterfaces.
6
Refer to the exhibit. Switch SW2 has been newly purchased and added to the network. What configuration should be applied to SW2 so that it participates in the same VTP domain as switch SW1, receives VLAN information from SW1, and synchronizes VLAN information?

Disable VTP pruning on SW2.
Configure SW2 in VTP transparent mode.
Configure SW2 with the VTP domain password.
Configure SW2 as a VTP server with a higher revision number.

7 Where is the information of newly created VLANs stored on a switch?

CPU
flash
NVRAM
RAM

8 Which statement correctly describes a function of a Layer 2 switch?

It routes packets between different LAN segments.
It uses the destination MAC address to selectively forward a frame.
It performs switching and filtering based on the destination network layer address.
It drops a frame whose destination MAC address is not in the MAC address table.

9 What is the purpose of the Spanning Tree algorithm?

It propagates VLAN configurations to other switches.
It restricts broadcast packets to a single VLAN.
It segments a network into multiple broadcast domains.
It prevents loops in a switched network with redundant paths.

10

Refer to the exhibit. VTP pruning is enabled in the VTP domain that is shown. How will switch ST-1 handle Layer 2 broadcast traffic originating from host A on switch ST-C?

It will be dropped.
It will be forwarded out port Fa0/5 only.
It will be forwarded out ports Fa0/5 and Fa0/10.
It will be forwarded out ports Fa0/5, Fa0/10, and Fa0/15.

11


Refer to the exhibit. If switch SW1 is configured with the four VLANs as shown in the exhibit, how many physical interfaces are needed on router R1 to configure inter-VLAN routing using subinterfaces?

zero
one
two
four


12


Refer to the exhibit. Which three options correctly identify information that could be associated with this output?(Choose three.)

Interface FastEthernet3/0/0 is subinterfaced.
A non-proprietary trunking protocol is in use.
The configuration is appropriate for a router-on-a-stick network design.
A shutdown command has been applied to interface FastEthernet3/0/0.
Interface FastEthernet3/0/0.3 is mapped to the default management VLAN.
An IP address should be applied to FastEthernet3/0/0 for correct data routing.


13


Refer to the exhibit. Computer D sends a broadcast message. Which devices will process the broadcast message?

computer E
computer D and computer E
computer D, computer E, and Router1
computer B and computer E
computer B, computer E, and Router1
computer C, computer D, and computer E
computer C, computer D, computer E, and Router1
computer A, computer B, computer C, computer D, computer E, and Router1


14


Refer to the exhibit. What would happen if the network administrator moved the network cable of Host A from interface Fa0/1 to Fa0/3 on switch SW1?

Host A remains a member of VLAN 10, because the router is routing traffic between VLANs.
Host A is no longer a member of VLAN 10, because port Fa0/3 has been manually assigned to VLAN 30.
Host A remains a member of VLAN 10, because the switch provides dynamic VLAN assignment for the port.
Host A maintains connectivity to all members of VLAN 10, because it is connected to the same physical network.
Host A is no longer a member of VLAN 10, but because port Fa0/3 was unused, it is now a member of VLAN 1

15


Refer to the exhibit. What does STATIC indicate in the output that is shown?

Switch port Fa0/24 can only work in VLAN 99.
VLAN 99 was manually added to the VLAN database.
MAC address 0001.637b.b267 was learned from the source address of a frame that was received on switch port Fa0/24.
MAC address 0001.637b.b267 was manually associated with the switch port Fa0/24.

All contents copyright 1992-2010 Cisco Systems, Inc. Privacy Statement and Trademarks
Assessment System

Take Assessment - ESwitching Final Exam - CCNA Exploration: LAN Switching and Wireless (Version 4.0)

Time Remaining:
Showing 2 of 4 Next> Page: Introduction 1 2 3 4 Submit GO

16 Which parameter is used to uniquely identify one wireless network from another?

SSID
OFDM
WEP
DSSS




17


Refer to the exhibit. Hosts B and C attempt to transmit a frame at the same time, but a collision occurs. Which hosts will receive the collision jamming signal?

all hosts that are shown
only hosts B and C
only hosts A, B, and C
only hosts A, B, C, and D
only hosts A, D, E, and F
only hosts D, E, and F




18 Which statement is true about open authentication when it is enabled on an access point?

requires no authentication
uses a 64-bit encryption algorithm
requires the use of an authentication server
requires a mutually agreed upon password




19


Refer to the exhibit. A network administrator configures HyperTerminal with the parameters shown but is unable to connect to a switch via the console port. The administrator is using a tested rollover cable attached to the only COM port on the computer, and the connections have been verified. What is the likely problem?

The cable is connected to the wrong port.
The wrong connection speed is selected.
The cable is the wrong type.
The flow control setting is not correct.
The stop bits should be set to zero.




20


Refer to the exhibit. What is true of the configuration of switch S1?

A Cisco proprietary protocol is in use for ports Fa0/1 and Fa0/3.
Switch ports Fa0/1 and Fa0/3 have been configured with the switchport mode access command.
Untagged frames received on ports Fa0/1 and Fa0/3 will be placed on VLAN 1.
Switch ports Fa0/1 and Fa0/3 are configured to carry data from multiple VLANs.




21 What are two benefits of a hierarchical network model over a flat network design? (Choose two.)

reduced cost of equipment
increased network availability
elimination of equipment downtime
reduced size of the physical network layout
simplification of management and troubleshooting
elimination of the need for Layer 3 functionality




22


Refer to the exhibit. The network administrator wants to allow both SSH and Telnet connections to Switch1. However, the SSH connections fail. What is the most likely cause of this problem?

The RSA key has been removed.
SSH has been configured on the wrong line.
The transport input command is applied incorrectly.
The domain name has been configured in the wrong configuration mode.




23


Refer to the exhibit. Users A and B are reporting intermittent connectivity problems. Pre-installation surveys showed strong signal strength from the AP locations to the client locations. Outside electrical interference has been eliminated. What will fix the problem?

Relocate the APs closer to each other.
Increase the distance between the clients.
Change the channel on AP-B to 6 or 11.
Place AP-A and AP-B on the same wireless channel.




24


Refer to the exhibit. The devices in the network are operational and configured as indicated in the exhibit. However, hosts A and D cannot ping each other. What is the most likely cause of this problem?

The link between the switches is up but not trunked.
The Fa0/11 interface of Switch1 is not configured as a trunk.
Hosts A and D are configured with IP addresses from different subnets.
VLAN 20 and VLAN 30 are not allowed on the trunk between the switches.




25


Refer to the exhibit. How does SW1 manage traffic coming from Host A?

SW1 drops the traffic because it is untagged.
SW1 leaves the traffic untagged and forwards it over the trunk.
SW1 tags the traffic with the lowest VLAN ID value and forwards it over the trunk link.
SW1 encapsulates the traffic with 802.1Q encapsulation and forwards it over the trunk link.

CCNA3 Final - March 2010 #5

41
Refer to the exhibit. Switches S2 and S3 are properly connected using an ethernet cable. A network administrator has configured both
switches with VTP, but S3 is unable to propagate VLANs to S2. What could be the reason for this?
The VTP configuration revision is different on both switches.
The VTP domains are different on both switches.
VTP pruning is disabled.
VTP v2 is disabled.
42
Refer to the exhibit. What is true of the configuration of switch S1?
Only VLAN 99 will be allowed to use the trunk links.
Switch ports Fa0/1 and Fa0/3 are configured with a standard trunking protocol.
Switch ports Fa0/1 and Fa0/3 should be configured as access ports to allow data from multiple VLANs to access switch S1.
The switch negotiated trunk links for interfaces Fa0/1 and Fa0/3 because all connected interfaces have been configured with the
switchport mode dynamic auto command.
43
What is an efficient and cost effective way to minimize the frequency and effects of broadcast storms on an Ethernet LAN?
Connect each PC directly to a router port.
Use access control lists to filter broadcasts from the network.
Divide the computers into separate VLANs on the existing switches.
Divide the computers into separate workgroups using different physical switches.
44

Refer to the exhibit. The configuration steps that are listed in the exhibit have been entered in switch S1 via the console. Subsequent
attempts to telnet to the switch are not successful. What is causing the problem?
The switch must be configured with SSH version 1.
The transport input command must specify Telnet access.
The RSA keys must be returned to zero before SSH will permit Telnet access.
The ip domain-name command must also be entered in line configuration mode for the vty lines.
45 Why is it important that the network administrator consider the spanning-tree network diameter when choosing the root bridge?
The network diameter limitation is 9.
BPDUs may be discarded because of expiring timers.
The cabling distance between the switches is 100 meters.
The network diameter must be set to the number of meters of the cable between the root bridge and its farthest connected switch.
Showing 3 of 4
Close Window

Assessment System
1. Assessment Selection 2. Assessment Settings 3. Take Assessment
Take Assessment - ESwitching Final Exam - CCNA Exploration: LAN Switching and
Wireless (Version 4.0)
Time Remaining:
46
Refer to the exhibit. The commands are entered into switch SW1 as shown, and an 802.1q trunk is successfully established. How does
switch SW1 handle the untagged traffic that is destined for the trunk?
SW1 will drop all untagged traffic.
SW1 will send all untagged traffic to VLAN 1.
SW1 will send all untagged traffic to VLAN 25.
SW1 will send untagged traffic to all VLANs that are configured on the trunk.
47
Refer to the exhibit. All hosts are in listen mode. Host 1 and Host 4 both transmit data at the same time. How do the hosts respond the network? (Choose two.)
After the end of the jam signal, a backoff algorithm is invoked.
Hosts 1 and 4 are operating full duplex so no collision will exist.
The hub will block the port connected to Host 4 to prevent a collision.
Hosts 1 and 4 are assigned shorter backoff values to provide them priority to access the media.
If a host has data to transmit after the backoff period of that host, the host checks to determine if the line is idle before transmitting.
48

Refer to the exhibit. Hosts PC_A and PC_B send traffic simultaneously, and the frames from the transmitting stations collide. What last device to receive the collision?
hub HB1
switch SW1
router R1
switch SW2
router R2
switch SW4
49
What provides an authentication mechanism for 802.11-based wireless networks?
DSSS
OFDM
SSID
WPA
50 What are two benefits of the IEEE 802.11n standard over the IEEE 802.11G? (Choose two.)
requires less equipment
provides improved range
permits increased data rates
has a single-input and a single-output
needs no hardware upgrade for compatibility
51
Refer to the exhibit. Users A and B are reporting intermittent connectivity problems. Pre-installation surveys showed strong signal
strength from the AP locations to the client locations. Outside electrical interference has been eliminated. What will fix the problem?
Relocate the APs closer to each other.
Increase the distance between the clients.
Change the channel on AP-B to 6 or 11.
Place AP-A and AP-B on the same wireless channel.
52 Why is MAC address filtering considered a poor choice in securing a WLAN?
Available bandwidth is reduced.
MAC addresses are easily spoofed.
APs are more susceptible to DoS attacks.
The payload encryption is easily broken.
Showing 4 of 4
Close Window
http://www.ccna4u.org

CCNA3 Final - March 2010 #4

31
Refer to the exhibit. An administrator documented the output of a CAM table from an Ethernet switch as shown. What action will the
switch take when it receives the frame shown at the bottom of the exhibit?
discard the frame
forward the frame out port 2
forward the frame out port 3
forward the frame out all ports
forward the frame out all ports except port 3
add station 00-00-3D-1F-11-05 to port 2 in the forwarding table
32
What are two requirements for configuring inter-VLAN routing using the router-on-a-stick model? (Choose two.)
Each subinterface should be configured with its own IP address, subnet mask, and unique VLAN assignment.
The physical interface of the router must be connected to a trunk link on the adjacent switch.The number of physical interfaces on the router should match the number of VLANs.
Different static VLANs should be assigned to different interfaces of the router.
The router should be configured as the VTP server.
33
Refer to the exhibit. The switch VTY lines have been properly configured, but PC1 is unable to remotely manage the switch. How can
this problem be resolved?
Configure the Fa0/1 interface of the switch in trunk mode.
Configure a default gateway on the switch.Configure the native VLAN on the switch.
Configure the Fa0/1 interface of the switch to allow all VLANs.
34
Refer to the exhibit. After entering the commands in the exhibit, the administrator receives a "password required, but none set" message
when attempting to connect to S1. What is the problem?
The enable secret password was not set.
S1 does not have login configured on the vty lines.
S1 does not have a password configured for the vty lines.The crypto key is not properly configured to generate passwords.
The VLAN1 interface has not be enabled with the no shutdown command.
35
Refer to the exhibit. After the listed commands are entered into router R1 and switch S1, the administrator enters the show interface
fa0/1 trunk and gets the results shown. What is the likely problem?
The trunk is established, but no VLANs have been configured to use it.
The router is missing the dynamic trunking protocol statements necessary to form a trunk.
The trunk has not been established because the router does not support dynamic trunking protocol.The router, the switch, or both must be configured with the dynamic desirable option for dynamic trunking protocol to establish trunk.
36
Which parameter is used to uniquely identify one wireless network from another?
SSIDOFDM
WEP
DSSS
37
Refer to the exhibit. Switch SW2 has been newly purchased and added to the network. What configuration should be applied to SW2 that it participates in the same VTP domain as switch SW1, receives VLAN information from SW1, and synchronizes VLAN information?
Disable VTP pruning on SW2.
Configure SW2 in VTP transparent mode.
Configure SW2 with the VTP domain password.
Configure SW2 as a VTP server with a higher revision number.
38

Refer to the exhibit. In what two ways will the router handle VLAN traffic that is received on the trunk? (Choose two.)
Traffic to VLAN 1 received by the router interface Fa0/0 will be dropped by the router.Because interface Fa0/0 requires an IP address, the router will not be able to route between the VLANs.
Packets that are received from network 192.168.20.0 /24 will be handled by subinterface Fa0/0.20.The router will use subinterface MAC addresses to identify the VLAN traffic that is received on the physical interface.
The router will continue to process traffic from the attached VLANs even if the physical interface goes down.
http://www.ccna4u.org
39
In which mode is a VTP switch operating if it does not allow for the creation of local VLANs but it does accept VLAN updates from other
switches in the same domain?
client
root
server
transparent
40
Which configuration changes will increment the configuration revision number on the VTP server?
configuring trunk links on the VTP server
configuring or changing the VTP password
configuring or changing the VTP domain name
configuring or changing the VTP version number
configuring or deleting a VLAN or creating a VLAN name

CCNA3 Final - March 2010 #3

21
Refer to the exhibit. What will allow a host on VLAN 40 on switch X to communicate with a host in VLAN 40 on switch Y?
QoS
routing
trunking
VPN
22 When implementing a router-on-a-stick, what must be configured on the router to ensure connectivity between different VLANs?
subinterfaces
routing protocol
switched virtual circuits
dynamic trunking protocol
23
Refer to the exhibit. Users complain that they do not have connectivity to the web server that is connected to SW1. What should be to remedy the problem?
Allow all VLANs on the trunk link.
Configure VLAN 100 as the native VLAN for SW1.
Configure the trunk port in trunk mode on SW1.
Attach the web server to a router and configure inter-VLAN routing.
24 Which method establishes an administrative connection for configuring the Linksys WRT300N wireless access point?
Associate with the access point and then open a HyperTerminal session with the access point.
Physically connect to the access point and then reboot the computer to launch the configuration software.
From a computer in the same IP subnet as the access point, enter the default IP address of the access point in a web browser.
Modify the TCP/IP properties of the computer connected to the access point so that it exists on the same network, and then reboot
your computer to establish a connection.
25
Company policy requires disabling the command history buffer on network devices. An administrator enters terminal no history size
the command prompt on a Cisco Catalyst switch and receives no error messages back, but the command history buffer is still available.What is the problem?
The command contained a syntax error.
The Cisco IOS version does not support disabling the command history buffer.
The command history can only be disabled on a router, not a switch.
The size parameter reset the default buffer size but did not disable access to the buffer.
26
Refer to the exhibit. What does "FORWARDING" mean in the command output shown?
The switch is sending and receiving data frames.The switch is receiving BPDUs, but not sending data frames.
The switch is participating in an election process by forwarding the BPDUs it receives.
The switch is receiving BPDUs and populating the MAC address table, but not sending data.
27
Refer to the exhibit. Which switch will be elected as the root bridge of the spanning tree topology?
Cat-A
Cat-B
Cat-C
Cat-D
28
Refer to the exhibit. A new host needs to be connected to VLAN 1. Which IP address should be assigned to this new host?
192.168.1.11 /28
192.168.1.22 /28192.168.1.33 /28
192.168.1.44 /28
192.168.1.55 /28
29
Refer to the exhibit. All trunk links are operational and all VLANs are allowed on all trunk links. An ARP request is sent by computer Which device or devices will receive this message?
only computer 4
computer 3 and RTR-Acomputer 4 and RTR-A
computer 1, computer 2, computer 4, and RTR-A
computer 1, computer 2, computer 3, computer 4, and RTR-A
all of the computers and the router
30
Refer to the exhibit. The switches in the exhibit have VTP pruning enabled. What will be pruned in the VTP advertisements from switch
ST-C to switch ST-1?
VLAN 30
VLAN 20 and VLAN 30
VLAN 1, VLAN 20, and VLAN 30
VLAN 2 through VLAN 29, and VLAN 31 through VLAN 1000

CCNA3 Final - March 2010 #2

11
Refer to the exhibit. Hosts A and B, connected to hub HB1, attempt to transmit a frame at the same time but a collision occurs. Which
hosts will receive the collision jamming signal?
only hosts A and B
only hosts A, B, and C
only hosts A, B, C, and D
only hosts A, B, C, and E
12
What are three benefits of employing a hierarchical network design? (Choose three.)
Hierarchically designed networks can more easily be expanded to suit future needs.
Hierarchical design models enhance existing bandwidth through the use of link aggregation.
The hierarchical model allows for specialized functionality at each layer, simplifying device management.Use of a hierarchical design allows replacement of redundant devices with high-capacity network equipment.
A hierarchical design uses firewalls instead of complicated port-based and distribution layer security policies.
The hierarchical model allows the use of high-performance switches at all design layers, thus allowing for a fully-meshed topology.

13
A network administrator implements inter-VLAN routing by configuring subinterfaces on a router. What is one important fact that must considered?
The physical interface must have an IP address configured.
The subinterface numbers must match the VLAN ID number.
The no shutdown command must be issued on each subinterface.
The IP address of each router subinterface must be used as the default gateway for hosts on the corresponding VLAN.
14
Which type of frame contains information that is used in the election of the spanning tree root bridge?
BID
LSA
LSU
BPDU

15
Refer to the exhibit. Each switch is shown with its MAC address. Which switch will be elected as the spanning-tree root bridge if the
switches are configured with their default priority values?
switch A
switch B
switch C
switch D
switch E
switch F
Close Window
Assessment System
1. Assessment Selection 2. Assessment Settings 3. Take Assessment
Take Assessment - ESwitching Final Exam - CCNA Exploration: LAN Switching and
Wireless (Version 4.0)
Time Remaining:
16

Refer to the exhibit. What will happen when frames with a source address other than 0019.d2e4.d9f7 enters interface Fa0/24?
Fa0/24 will become error-disabled.
The incoming frames will be dropped.
The Fa0/24 port LED will be turned off.
The security violation count will be incremented.

17

Refer to the exhibit. The network administrator has just added VLAN 50 to Switch1 and Switch2. Hosts A, B, C, and D are correctly
configured with IP addresses in the subnet range for VLAN 50. Host A can communicate with host B, but cannot communicate with C or host D. What is the cause of this problem?
There is a native VLAN mismatch.
The Fa0/11 interface of Switch1 is not configured as a trunk.
The link between Switch1 and Switch2 is up but not trunked.
VLAN 50 is not allowed on the trunk link between Switch1 and Switch2.

18
Refer to the exhibit. A network administrator enters the displayed commands to configure VLAN 30. What is the result of running these
commands?
VLAN 30 will be added to S1, S2, and S3, but not to S4.
VLAN 30 will be pruned from the VLAN database of S3.
VLAN 30 will be added to the VLAN database of S3 but will not be propagated to S4, S2 or S1.
VLAN 30 will not be added to the VLAN database of S3 and an error message will be displayed.

19
Refer to the exhibit. R1 is configured for traditional inter-VLAN routing. R1 can ping computer 3 but cannot ping computer 1. What is possible cause for this failure?
S1 port Fa0/11 is in the wrong VLAN.
R1 does not have an active routing protocol.
The IP address of computer 1 is in the wrong logical network.
Router interface Fa0/0 has the wrong trunk encapsulation type configured.

20
Refer to the exhibit. How does SW1 manage traffic coming from Host A?
SW1 drops the traffic because it is untagged.
SW1 leaves the traffic untagged and forwards it over the trunk.
SW1 tags the traffic with the lowest VLAN ID value and forwards it over the trunk link.
SW1 encapsulates the traffic with 802.1Q encapsulation and forwards it over the trunk link.

CCNA3 Final - March 2010 #1

1
Which value determines if a switch becomes the central point of reference in the spanning tree topology?
lowest bridge ID
highest revision number
lowest numeric IP address
highest numeric MAC address
2
Refer to the exhibit. What is the purpose of the configuration commands that are shown?
to activate port Fa0/10
to make the port a member of VLAN 30
to activate port security on port Fa0/10
to add VLAN 30 to the trunk that is connected to port Fa0/10
3
Refer to the exhibit. What would happen if the network administrator moved the network cable of Host A from interface Fa0/1 to Fa0/switch SW1?
Host A remains a member of VLAN 10, because the router is routing traffic between VLANs.
Host A is no longer a member of VLAN 10, because port Fa0/3 has been manually assigned to VLAN 30.
Host A remains a member of VLAN 10, because the switch provides dynamic VLAN assignment for the port.
Host A maintains connectivity to all members of VLAN 10, because it is connected to the same physical network.
Host A is no longer a member of VLAN 10, but because port Fa0/3 was unused, it is now a member of VLAN 1.


4
Which device or devices should have the Spanning Tree Protocol enabled to prevent host traffic from creating a broadcast storm?
Core_S1
Access_S2 and Access_S3
Core_S1, Access_S2, and Access_S3
Core_S1, Access_S2, Access_S3, and R1
5
Refer to the exhibit. The hosts connected to switch SW1 are not able to communicate with the hosts in the same VLANs connected switch SW2. What should be done to fix the problem?
Configure VLANs with different VLAN IDs on switch SW2.
Reconfigure the trunk port on switch SW2 with static trunk configuration.
Introduce a Layer 3 device or a switch with Layer 3 capability in the topology.
Apply IP addresses that are in the same subnet to the interfaces used to connect SW1 and SW2.
6

Refer to the exhibit. The Layer 2 switching design that is shown has been implemented in a campus environment that is using Spanning
Tree Protocol. All inter-switch links that are shown are trunks. Whenever an inter-switch link fails, the network takes nearly a minute completely converge. How can the convergence time be reduced?
Increase the capacity of the distribution and core trunk links to 10 Gb/s.
Add a trunk link that directly connects D1 and D2.
Use Layer 3 switching on the core switch.
Implement Rapid Spanning Tree Protocol.

7
What will be the effect of the command S1# copy system:running-config tftp://172.16.2.155/tokyo-config?
The IOS will be copied to the TFTP server.
The configuration file named tokyo-config will overwrite the startup configuration file on S1.
The running configuration file on S1 will be saved via TFTP to a file named tokyo-config.
The contents of NVRAM on S1 will become the startup configuration file on the tokyo switch.
8
Refer to the exhibit. What does the term DYNAMIC indicate in the output that is shown?
This entry can only be removed from the MAC address table by a network administrator.
When forwarding a frame to the device with address 0060.5c5b.cd23, the switch does not have to perform a lookup to determine
the final destination port.
Only the device with MAC address 0060.5c5b.cd23 will be allowed to connect to port Fa0/18.
The switch learned this MAC address from the source address in a frame received on Fa0/18.

9
Which two statements are correct about wireless infrastructure components? (Choose two.)
An AP converts the TCP/IP data packets from their 802.11 frame encapsulation format to the 802.3 Ethernet frame format on the
wired Ethernet network.
A wireless AP does not require any physical connection to allow wireless clients to access the Internet.
An AP is a layer 2 device, similar to a switch, that provides dedicated bandwidth to each connected wireless host.
Collisions do not occur between wireless NICs and APs.
The wireless router performs the roles of AP and router.

10

Which service should be disabled on a Cisco switch or router to prevent packet sniffers from capturing information about the device?
SSH
VTP
CDP
SNMP