Cisco
Exam Name: Implementing Cisco IP Switched Networks
642-813 PDF
http://www.examcertify.co.uk/642-813.html
Click the link below to buy full version as Low as $39
One of the most
essential means on how you can prepare for Implementing
Cisco IP Switched Networks exam is by acquiring the right 642-813 study materials. This is
essential for the reason that not getting the right study materials will not
surely help you prepare and eventually passing the Implementing Cisco IP Switched Networks certification exam.
Getting wrong study material will just waste your time and money. Some of the
common forms of the 642-813 PDF study material are pdf, CDs and books as well as other
journals. As there are numerous Implementing
Cisco IP Switched Networks materials available out there, be sure to
acquire the right one that offers you the most recent and applicable 642-813 materials. It would be best if
you can get some 642-813 samples
because getting sample will able to help you determine if the Microsoft
materials you have are designed or intended with the certification you wish to
obtain.
|
Question:
1
|
Which statement is true
about RSTP topology changes?
A. Any change in the state
of the port generates a TC BPDU.
B. Only nonedge ports
moving to the forwarding state generate a TC BPDU.
C. If either an edge port
or a nonedge port moves to a block state, then a TC BPDU is generated.
D. Only edge ports moving
to the blocking state generate a TC BPDU.
E. Any loss of connectivity
generates a TC BPDU.
|
Answer: B
|
Explanation:
The IEEE 802.1D Spanning
Tree Protocol was designed to keep a switched or bridged network loop free,
with adjustments made to the network topology dynamically. A topology change
typically takes 30 seconds, where a port moves from the Blocking state to the
Forwarding state after two intervals of the Forward Delay timer. As technology
has improved, 30 seconds has become an unbearable length of time to wait for a
production network to failover or "heal" itself during a problem.
Topology Changes and RSTP Recall that when an 802.1D switch detects a port
state change (either up or down), it signals the Root Bridge by sending
topology change notification (TCN) BPDUs. The Root Bridge must then signal a
topology change by sending out a TCN message that is relayed to all switches in
the STP domain. RSTP detects a topology change only when a nonedge port
transitions to the Forwarding state. This might seem odd because a link failure
is not used as a trigger. RSTP uses all of its rapid convergence mechanisms to
prevent bridging loops from forming. Therefore, topology changes are detected
only so that bridging tables can be updated and corrected as hosts appear first
on a failed port and then on a different functioning port. When a topology
change is detected, a switch must propagate news of the change to other
switches in the network so they can correct their bridging tables, too. This
process is similar to the convergence and synchronization mechanism-topology change
(TC) messages propagate through the network in an everexpanding wave.
Reference:
CCNP BCMSN Official Exam
Certification Guide, Fourth Edition, Chapter 11: Advanced Spanning Tree
Protocol, Rapid Spanning Tree Protocol, Topology Changes and RSTP, p. 269
|
Question:
2
|
Refer to the exhibit.
Which four statements
about this GLBP topology are true? (Choose four.)
A. Router A is responsible
for answering ARP requests sent to the virtual IP address.
B. If router A becomes
unavailable, router B forwards packets sent to the virtual MAC address of
router A.
C. If another router is
added to this GLBP group, there would be two backup AVGs.
D. Router B is in GLBP
listen state.
E. Router A alternately
responds to ARP requests with different virtual MAC addresses.
F. Router B transitions
from blocking state to forwarding state when it becomes the AVG.
|
Answer: A,B,C,E
|
Explanation:
With GLBP the following is
true:
With GLB, there is 1 AVG
and 1 standby VG. In this case Company1 is the AVG and Company2 is the standby.
Company2 would act as a VRF and would already be forwarding and routing
packets. Any additional routers would be in a listen state. As the role of the
Active VG and load balancing, Company1 responds to ARP requests with different
virtual MAC addresses. In this scenario, Company2 is the Standby VF for the
VMAC 0008.b400.0101 and would become the Active VF if Company1 were down. As
the role of the Active VG, the primary responsibility is to answer ARP requests
to the virtual IP address. As an AVF router Company2 is already
forwarding/routing packets Reference:
http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_exa
mple09186a00807d2520.shtml
|
Question:
3
|
Refer to the exhibit.
Which VRRP statement about
the roles of the master virtual router and the backup virtual router is true?
A. Router A is the master
virtual router, and router B is the backup virtual router. When router A fails,
router B becomes the master virtual router. When router A recovers, router B
maintains the role of master virtual router.
B. Router A is the master
virtual router, and Router B is the backup virtual router. When Router A fails,
Router B will become the master virtual router. When Router A recovers, it will
regain the master virtual router role.
C. Router B is the master
virtual router, and router A is the backup virtual router. When router B fails,
router A becomes the master virtual router. When router B recovers, router A
maintains the role of master virtual router.
D. Router B is the master
virtual router, and router A is the backup virtual router. When router B fails,
router A becomes the master virtual router. When router B recovers, it regains
the master virtual router role.
|
Answer: B
|
Explanation:
An important aspect of the
VRRP redundancy scheme is VRRP router priority.
Priority determines the
role that each VRRP router plays and what happens if the master virtual router
fails. If a VRRP router owns the IP address of the virtual router and the IP
address of the physical interface, this router functions as a master virtual
router. Priority also determines if a VRRP router functions as a backup virtual
router and determines the order of ascendancy to becoming a master virtual
router if the master virtual router fails. You can configure the priority of
each backup virtual router with a value of 1 through 254, using the vrrp
priority command. For example, if Router A, the master virtual router in a LAN
topology, fails, an election process takes place to determine if backup virtual
Routers B or C should take over. If Routers B and C are configured with the
priorities of 101 and 100, respectively, Router B is elected to become master
virtual router because it has the higher priority. If Routers B and C are both
configured with the priority of 100, the backup virtual router with the higher
IP address is elected to become the master virtual router. By default, a
preemptive scheme is enabled whereby a higher-priority backup virtual router
that
becomes available takes
over for the backup virtual router that was elected to become master virtual
router. You can disable this preemptive scheme using the no vrrp preempt
command. If preemption is disabled, the backup virtual router that is elected
to become master virtual router remains the master until the original master
virtual router recovers and becomes master again.
Reference: Implementing
VRRP on Cisco IOS XR Software
http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.5/addr_serv/configuration/guide/ic35vrrp.html
|
Question:
4
|
Which description
correctly describes a MAC address flooding attack?
A. The attacking device
crafts ARP replies intended for valid hosts. The MAC address of the attacking
device then becomes the destination address found in the Layer 2 frames sent by
the valid network device.
B. The attacking device
crafts ARP replies intended for valid hosts. The MAC address of the attacking
device then becomes the source address found in the Layer 2 frames sent by the
valid network device.
C. The attacking device
spoofs a destination MAC address of a valid host currently in the CAM table.
The switch then forwards frames destined for the valid host to the attacking
device.
D. The attacking device
spoofs a source MAC address of a valid host currently in the CAM table. The
switch then forwards frames destined for the valid host to the attacking
device.
E. Frames with unique,
invalid destination MAC addresses flood the switch and exhaust CAM table space.
The result is that new entries cannot be inserted because of the exhausted CAM table
space, and traffic is subsequently flooded out all ports.
F. Frames with unique,
invalid source MAC addresses flood the switch and exhaust CAM table space. The
result is that new entries cannot be inserted because of the exhausted CAM
table space, and traffic is subsequently flooded out all ports.
|
Answer: F
|
Explanation:
A common Layer 2 or switch
attack is MAC flooding, resulting in a switch’s CAM
table overflow, which
causes flooding of regular data frames out all switch ports. This attack can be
launched for the malicious purpose of collecting a broad sample of traffic or
as a denial of service (DoS) attack. A switch’s CAM tables are limited in size
and therefore can contain only a limited number of entries at any one time. A
network intruder can maliciously flood a switch with a large number of frames
from a range of invalid source MAC addresses. If enough new entries are made
before old ones expire, new valid entries will not be accepted. Then, when
traffic arrives at the switch for a legitimate device that is located on one of
the switch ports that was not able to create a CAM table entry, the switch must
flood frames to that address out all ports. This has two adverse effects:
• The switch traffic
forwarding is inefficient and voluminous.
• An intruding device can
be connected to any switch port and capture traffic that is not normally seen
on that port. If the attack is launched before the beginning of the day, the
CAM table would be full when the majority of devices are powered on. Then frames
from those legitimate devices are unable to create CAM table entries as they
power on. If this represents a large number of network devices, the number of
MAC addresses for which traffic will be flooded will be high, and any switch
port will carry flooded frames from a large number of devices.
Reference:
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_paper_c11_603836.html
|
Question:
5
|
Refer to the exhibit.
An attacker is connected
to interface Fa0/11 on switch A-SW2 and attempts to establish a DHCP server for
a man-in-middle attack. Which recommendation, if followed, would mitigate this
type of attack?
A. All switch ports in the
Building Access block should be configured as DHCP trusted ports.
B. All switch ports in the
Building Access block should be configured as DHCP untrusted ports.
C. All switch ports
connecting to hosts in the Building Access block should be configured as DHCP
trusted ports.
D. All switch ports
connecting to hosts in the Building Access block should be configured as DHCP
untrusted ports.
E. All switch ports in the
Server Farm block should be configured as DHCP untrusted ports.
F. All switch ports
connecting to servers in the Server Farm block should be configured as DHCP
untrusted ports.
|
Answer: D
|
Explanation:
One of the ways that an
attacker can gain access to network traffic is to spoof responses that would be
sent by a valid DHCP server. The DHCP spoofing device replies to client DHCP
requests. The legitimate server may reply also, but if the spoofing device is
on the same segment as the client, its reply to the client may arrive first.
The intruder’s DHCP reply offers an IP address and supporting information that
designates the intruder as the default gateway or Domain Name System (DNS)
server. In the case of a gateway, the clients will then forward packets to the
attacking device, which will in turn send them to the desired destination. This
is referred to as a “man-in-the-middle” attack, and it may go entirely
undetected as the intruder intercepts the data flow through the network.
Untrusted ports are those that are not explicitly configured as trusted. A DHCP
binding table is built for untrusted ports. Each entry contains the client MAC
address, IP address, lease time, binding type, VLAN number, and port ID
recorded as clients make DHCP requests. The table is then used to filter
subsequent DHCP traffic. From a DHCP snooping perspective, untrusted access
ports should not send any DHCP server responses, such as DHCPOFFER, DHCPACK,
DHCPNAK.
Reference: Understanding
and Configuring DHCP Snooping
(http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/13ew/configuration/guide/dhcp.html)
|
Question:
6
|
Refer to the exhibit.
The web servers WS_1 and
WS_2 need to be accessed by external and internal users. For security reasons,
the servers should not communicate with each other, although they are located
on the same subnet. However, the servers do need to communicate with a database
server located in the inside network. Which configuration isolates the servers
from each other?
A. The switch ports 3/1
and 3/2 are defined as secondary VLAN isolated ports. The ports connecting to
the two firewalls are defined as primary VLAN promiscuous ports.
B. The switch ports 3/1
and 3/2 are defined as secondary VLAN community ports. The ports connecting to
the two firewalls are defined as primary VLAN promiscuous ports.
C. The switch ports 3/1
and 3/2 and the ports connecting to the two firewalls are defined as primary
VLAN promiscuous ports.
D. The switch ports 3/1
and 3/2 and the ports connecting to the two firewalls are defined as primary
VLAN community ports.
|
Answer: A
|
Explanation:
Service providers often
have devices from multiple clients, in addition to their own servers, on a
single Demilitarized Zone (DMZ) segment or VLAN. As security issues
proliferate, it becomes necessary to provide traffic isolation between devices,
even though they may exist on the same Layer 3 segment and VLAN. Catalyst
6500/4500 switches implement PVLANs to keep some switch ports shared and some
switch ports isolated, although all ports exist on the same VLAN. The 2950 and
3550 support “protected ports,” which are functionality similar to PVLANs on a
per-switch basis.
A port in a PVLAN can be
one of three types:
Isolated: An isolated port
has complete Layer 2 separation from other ports within the same PVLAN, except
for the promiscuous port. PVLANs block all traffic to isolated ports, except
the traffic from promiscuous ports. Traffic received from an isolated port is
forwarded to only promiscuous ports.
Promiscuous:
A promiscuous port can
communicate with all ports within the PVLAN, including the community and
isolated ports. The default gateway for the segment would likely be hosted on a
promiscuous port, given that all devices in the PVLAN will need to communicate
with that port. Community: Community ports communicate among themselves and
with their promiscuous ports. These interfaces are isolated at Layer 2 from all
other interfaces in other communities, or in isolated ports within their PVLAN.
Reference: Configuring
Private VLANs
(http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sga/configuration/guide/pvlans.html)
|
Question:
7
|
What does the command udld
reset accomplish?
A. allows a UDLD port to automatically
reset when it has been shut down
B. resets all UDLD enabled
ports that have been shutdown
C. removes all UDLD
configurations from interfaces that were globally enabled
D. removes all UDLD
configurations from interfaces that were enabled per-port
|
Answer: B
|
Explanation:
When unidirectional link
condition is detected the UDLD set port in error-disabled state. To reinable
all ports that UDLD has errdiabled the command:
Switch# udld reset is
used.
Reference:
CCNP Self-Study, CCNP
BCMSN Official Exam Certification Guide, Fourth Edition, Protecting Against
Sudden Loss of BPDUs, UDLD, p. 251
|
Question:
8
|
Refer to the exhibit.
Dynamic ARP Inspection is
enabled only on switch SW_A . Host_A and Host_B acquire their IP addresses from
the DHCP server connected to switch SW_A. What would the outcome be if Host_B
initiated an ARP spoof attack toward Host_A?
A. The spoof packets are
inspected at the ingress port of switch SW_A and are permitted.
B. The spoof packets are
inspected at the ingress port of switch SW_A and are dropped.
C. The spoof packets are
not inspected at the ingress port of switch SW_A and are permitted.
D. The spoof packets are
not inspected at the ingress port of switch SW_A and are dropped.
|
Answer: C
|
Explanation:
When configuring DAI,
follow these guidelines and restrictions:
• DAI is an ingress
security feature; it does not perform any egress checking.
• DAI is not effective for
hosts connected to routers that do not support DAI or that do not have this
feature enabled. Because man-in-the-middle attacks are limited to a single
Layer 2 broadcast domain, separate the domain with DAI checks from the one with
no checking. This action secures the ARP caches of hosts in the domain enabled
for DAI.
• DAI depends on the
entries in the DHCP snooping binding database to verify IP-to-MAC address
bindings in incoming ARP requests and ARP responses. Make sure to enable DHCP
snooping to permit ARP packets that have dynamically assigned IP addresses.
• When DHCP snooping is
disabled or in non-DHCP environments, use ARP ACLs to permit or to deny
packets.
• DAI is supported on
access ports, trunk ports, EtherChannel ports, and private VLAN ports. In our
example, since Company2 does not have DAI enabled (bullet point 2 above)
packets will not be inspected and they will be permitted.
Reference
http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SXF/configuration/guide/dynarp.html
|
Question:
9
|
Which statement is true
about Layer 2 security threats?
A. MAC spoofing, in
conjunction with ARP snooping, is the most effective counter-measure against
reconnaissance attacks that use Dynamic ARP Inspection to determine vulnerable
attack points.
B. DHCP snooping sends
unauthorized replies to DHCP queries.
C. ARP spoofing can be
used to redirect traffic to counter Dynamic ARP Inspection.
D. Dynamic ARP Inspection
in conjunction with ARP spoofing can be used to counter DHCP snooping attacks.
E. MAC spoofing attacks
allow an attacking device to receive frames intended for a different network
host.
F. Port scanners are the
most effective defense against Dynamic ARP Inspection.
|
Answer: E
|
Explanation:
First of all, MAC spoofing
is not an effective counter-measure against any reconnaissance attack; it IS an
attack! Furthermore, reconnaissance attacks don't use dynamic ARP inspection
(DAI); DAI is a switch feature used to prevent attacks.
Reference: Layer 2
Security Features on Cisco Catalyst Layer 3 Fixed Configuration Switches
Configuration Example
(http://www.cisco.com/en/US/products/hw/switches/ps5023/products_configuration_example09186a00807c4101.shtml)
|
Question:
10
|
On a Company switch named
R1 you configure the following:
ip arp inspection vlan
10-12, 15
What is the purpose of
this global configuration command made on R1?
A. Discards ARP packets
with invalid IP-to-MAC address bindings on trusted ports
B. Validates outgoing ARP
requests for interfaces configured on VLAN 10, 11, 12, or 15
C. Intercepts, logs, and
discards ARP packets with invalid IP-to-MAC address bindings
D. Intercepts all ARP
requests and responses on trusted ports
E. None of the other
alternatives apply
|
Answer: C
|
Explanation:
The “ip arp inspection”
command enables Dynamic ARP Inspection (DAI) for the specified VLANs. DAI is a
security feature that validates Address Resolution Protocol (ARP) packets in a
network. DAI allows a network administrator to intercept, log, and discard ARP
packets with invalid MAC address to IP address bindings. This capability
protects the network from certain "man-in-themiddle" attacks.
Reference: Understanding
and Configuring Dynamic ARP Inspection
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/20ew/configuration/guide/dynarp.html
|
Question:
11
|
Refer to the exhibit.
Host A has sent an ARP
message to the default gateway IP address 10.10.10.1. Which statement is true?
A. Because of the invalid
timers that are configured, DSw1 does not reply.
B. DSw1 replies with the
IP address of the next AVF.
C. DSw1 replies with the
MAC address of the next AVF.
D. Because of the invalid
timers that are configured, DSw2 does not reply.
E. DSw2 replies with the
IP address of the next AVF.
F. DSw2 replies with the
MAC address of the next AVF.
|
Answer: F
|
Explanation:
The Gateway Load Balancing
Protocol (GLBP) is a Cisco-proprietary protocol designed to overcome the
limitations of existing redundant router protocols. Some of the concepts are
the same as with HSRP/VRRP, but the terminology is different and the behavior is
much more dynamic and robust. The trick behind this load balancing lies in the
GLBP group. One router is elected the active virtual gateway (AVG). This router
has the highest priority value, or the highest IP address in the group, if
there is no highest priority. The AVG answers all ARP requests for the virtual
router address. Which MAC address it returns depends on which load-balancing
algorithm it is configured to use. In any event, the virtual MAC address
supported by one of the routers in the group is returned. According to exhibit,
Router Company2 is the Active Virtual Gateway (AVG) router because it has
highest IP address even having equal priority. When router Company1 sends the
ARP message to 10.10.10.1 Router Company2 will reply to Company1 as a Active
Virtual Router.
Reference: Configuring
GLBP
(http://www.cisco.com/en/US/docs/ios/ipapp/configuration/guide/ipapp_glbp.html)
|
Question:
12
|
What are two methods of
mitigating MAC address flooding attacks? (Choose two.)
A. Place unused ports in a
common VLAN.
B. Implement private
VLANs.
C. Implement DHCP
snooping.
D. Implement port
security.
E. Implement VLAN access
maps
|
Answer: D,E
|
Explanation:
You can use the port
security feature to limit and identify MAC addresses of the stations allowed to
access the port. This restricts input to an interface. When you assign secure
MAC addresses to a secure port, the port does not forward packets with source
addresses outside the group of defined addresses. If you limit the number of
secure MAC addresses to one and assign a single secure MAC address, the
workstation attached to that port is assured the full bandwidth of the port. If
a port is configured as a secure port and the maximum number of secure MAC
addresses is reached, when the MAC address of a station that attempts to access
the port is different from any of the identified secure MAC addresses, a
security violation occurs. Also, if a station with a secure MAC address
configured or learned on one secure port attempts to access another secure
port, a violation is flagged. By default, the port shuts down when the maximum
number of secure MAC addresses is exceeded. Vlan accesss-map can match frame by
MAC addresses and in combination with vlan filter it can be used to mitigate
MAC flooding attacks.
Reference:
http://www.cisco.com/en/US/products/hw/switches/ps5023/products_configuration_example09186a00807c4101.shtml#portsecurity
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.1_11_ax/command/reference/cli3.html#wp1906956
No comments:
Post a Comment