An administrator is configuring a DHCP server to better secure their environment. They need to be able to ratelimit the traffic and ensure that legitimate requests are not dropped. How would this be accomplished?

• A.Set a trusted interface for the DHCP server
• B.Set the DHCP snooping bit to 1
• C.Add entries in the DHCP snooping database
• D.Enable ARP inspection for the required VLAN

Correct Answer: A

To understand DHCP snooping we need to learn about DHCP spoofing attack first.

DHCP spoofing is a type of attack in that the attacker listens for DHCP Requests from clients and answers them with fake DHCP Response before the authorized DHCP Response comes to the clients. The fake DHCP Response often gives its IP address as the client default gateway -> all the traffic sent from the client will go through the attacker computer, the attacker becomes a "man-in-the-middle".
The attacker can have some ways to make sure its fake DHCP Response arrives first. In fact, if the attacker is "closer" than the DHCP Server then he doesn't need to do anything. Or he can DoS the DHCP Server so that it can't send the DHCP Response.
DHCP snooping can prevent DHCP spoofing attacks. DHCP snooping is a Cisco Catalyst feature that determines which switch ports can respond to DHCP requests. Ports are identified as trusted and untrusted.

Only ports that connect to an authorized DHCP server are trusted, and allowed to send all types of DHCP messages. All other ports on the switch are untrusted and can send only DHCP requests. If a DHCP response is seen on an untrusted port, the port is shut down.

Comment: *

Name: *

Email: *

Verification: *

How does Cisco Stealthwatch Cloud provide security for cloud environments?

• A.It delivers visibility and threat detection.
• B.It prevents exfiltration of sensitive data.
• C.It assigns Internet-based DNS protection for clients and servers.
• D.It facilitates secure connectivity between public and private networks.

Comment: *

Name: *

Email: *

Verification: *

An organization received a large amount of SPAM messages over a short time period. In order to take action on the messages, it must be determined how harmful the messages are and this needs to happen dynamically.
What must be configured to accomplish this?

• A.Configure the Cisco WSA to modify policies based on the traffic seen.
• B.Configure the Cisco ESA to receive real-time updates from Talos
• C.Configure the Cisco WSA to receive real-time updates from Talos.
• D.Configure the Cisco ESA to modify policies based on the traffic seen.

Comment: *

Name: *

Email: *

Verification: *

Which telemetry data captures variations seen within the flow, such as the packets TTL, IP/TCP flags, and payload length?

• A.interpacket variation
• B.software package variation
• C.flow insight variation
• D.process details variation

Comment: *

Name: *

Email: *

Verification: *

Which kind of API that is used with Cisco DNA Center provisions SSIDs, QoS policies, and update software versions on switches?

• A.Event
• B.Integration
• C.Intent
• D.Multivendor

Comment: *

Name: *

Email: *

Verification: *