Timedora
Free Practice Quiz Question List

2 Layer 2 Security Online Quiz Questions

Use this free practice quiz with 20 questions to review 2 Layer 2 Security, test your knowledge, and prepare for your next test or exam.

20 questions
01
Choose one
1 point

A desk port should accept traffic from only a limited number of devices. Which Layer 2 control directly limits the number of source MAC addresses the port accepts?

  1. A

    Dynamic ARP Inspection validates ARP messages against IP-to-MAC bindings.

  2. B

    Port security limits which source MAC addresses a switch port accepts.

  3. C

    Root Guard blocks a port whenever it receives any BPDU.

  4. D

    DHCP snooping shuts down ports that learn too many MAC addresses.

02
Choose one
1 point

You are hardening a trunk between switches. Which configuration best reduces unnecessary VLAN exposure while following the recommended native-VLAN practice?

  1. A

    Allow every VLAN and use the user VLAN with the most traffic as the native VLAN.

  2. B

    Allow only user VLANs, but leave the native VLAN selection to trunk negotiation.

  3. C

    Explicitly permit only required VLANs and select a native VLAN that carries no user traffic.

  4. D

    Configure the trunk as an access port in the management VLAN.

03
Choose one
1 point

A switch uses DHCP snooping to block rogue DHCP offers. Which interface should be marked trusted?

  1. A

    Trust only the interface leading to the authorized DHCP server or trusted network path.

  2. B

    Trust every client-facing access port so clients can send DHCP requests.

  3. C

    Trust all ports in VLANs where DHCP snooping is enabled.

  4. D

    Trust only ports that have port security disabled.

04
Choose one
1 point

A switch interface has no connected device and is not expected to be used. Which action best follows the recommended unused-port policy?

  1. A

    Leave the interface active in the default VLAN so it can be used quickly.

  2. B

    Configure it as a trusted DHCP and DAI infrastructure interface.

  3. C

    Enable trunk negotiation so the interface can discover its intended role.

  4. D

    Place it in an unused VLAN and administratively shut it down.

05
Choose one
1 point

A team is preparing to rely on Dynamic ARP Inspection for clients that receive addresses through DHCP. What should it verify first to reduce the risk of dropping legitimate ARP traffic?

  1. A

    Enable DAI on every VLAN immediately; it does not rely on bindings.

  2. B

    Confirm the DHCP binding table is populated and legitimate clients obtain addresses.

  3. C

    Mark every access port trusted so DAI will not drop client ARP traffic.

  4. D

    Disable DHCP snooping because DAI creates all bindings independently.

06
Choose all
1 point

Which statements correctly describe DHCP snooping? Select all that apply.

  1. A

    It filters DHCP messages and can help block rogue DHCP offers.

  2. B

    It validates ARP messages by itself against manually learned switch-port roles.

  3. C

    It builds bindings associating leased IP addresses with MAC addresses, VLANs, and interfaces.

  4. D

    It prevents Layer 2 loops by selecting the spanning-tree root.

07
Choose all
1 point

Which statements correctly describe the roles of Root Guard and Loop Guard? Select all that apply.

  1. A

    Root Guard is the recommended control for disabling a workstation port when it sends any BPDU.

  2. B

    Root Guard prevents a designated port from accepting superior BPDUs that could move the root role.

  3. C

    Loop Guard is a substitute for BPDU Guard on endpoint ports.

  4. D

    Loop Guard helps prevent a non-designated port from mistakenly forwarding when expected BPDUs stop arriving.

08
True or false
1 point

Dynamic ARP Inspection can use bindings learned through DHCP snooping to check ARP messages on untrusted ports, and static-address devices may require suitable ARP ACLs or bindings. Is this statement true or false?

  1. A

    True

  2. B

    False

09
True or false
1 point

Root Guard is the recommended safeguard for a workstation edge port because it disables the port if the workstation sends a BPDU. Is this statement true or false?

  1. A

    True

  2. B

    False

10
Written response
1 point

For a statically addressed device without a DHCP-learned binding, name one supported configuration mechanism that can provide DAI with appropriate ARP validation information.

11
Written response
1 point

What switch feature checks ARP messages arriving on untrusted ports against valid IP-to-MAC bindings to help prevent ARP spoofing?

12
Fill in the blank
1 point

DHCP snooping builds a associating leased IP addresses with MAC addresses, VLANs, and interfaces.

13
Fill in the blank
1 point

Loop Guard helps prevent a non-designated port from mistakenly when expected BPDUs stop arriving.

14
Open ended
1 point

A port is intended for a workstation, but it unexpectedly receives an STP BPDU. Which STP safeguards should be configured for this port, what should happen when the BPDU arrives, and what should an administrator do before restoring service?

15
Choose one
1 point

A switch has several physical interfaces that are not assigned to any endpoint. Which policy best reduces the risk that someone will use one of these interfaces for unauthorized access?

  1. A

    Leave the interfaces enabled in the user VLAN so they can be used without delay.

  2. B

    Place the interfaces in an unused VLAN and administratively shut them down.

  3. C

    Configure the interfaces as trusted DHCP snooping ports.

  4. D

    Enable PortFast and BPDU Guard while leaving the interfaces enabled.

16
Choose one
1 point

A switch interface connects directly to a workstation that belongs in a single user VLAN. Which configuration choice best limits VLAN exposure on this interface?

  1. A

    Configure it as a trunk that permits every VLAN.

  2. B

    Leave trunk negotiation enabled so the workstation can select its VLAN.

  3. C

    Configure it as an access port in the intended user VLAN.

  4. D

    Mark it as a trusted interface for DHCP snooping and DAI.

17
Written response
1 point

Which switch feature limits the source MAC addresses accepted on a port and can enforce a maximum number of addresses?

18
True or false
1 point

A switch interface trusted for Dynamic ARP Inspection has its ARP packets checked against the DHCP snooping binding table just like packets arriving on an untrusted interface.

  1. A

    True

  2. B

    False

19
Choose one
1 point

You are enabling DHCP snooping on a user VLAN. One switch interface connects to a workstation, and another leads toward the authorized DHCP server. How should you set the trust boundary?

  1. A

    Trust every interface in the VLAN so DHCP replies are not delayed.

  2. B

    Keep the client port untrusted and trust only the interface toward the authorized DHCP server or trusted network path.

  3. C

    Disable DHCP snooping on the VLAN and trust the client port for DAI.

  4. D

    Trust the client port for DHCP snooping but leave the uplink untrusted.

20
Written response
1 point

What port-security method learns device MAC addresses and adds them to the switch configuration?