Exam Bundle

Excess learned addresses trigger the configured action without impacting approved devices. This would be relevant evidence for a different failure: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries, usually addressed by Configure port-security limits and a suitable violation response on untrusted edge ports. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

A crafted trunk-negotiation attempt cannot create an unauthorized trunk. This would be relevant evidence for a different failure: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack, usually addressed by Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

A rogue offer on an access port is discarded and genuine clients obtain correct leases. This would be relevant evidence for a different failure: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server, usually addressed by Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. That action fits another problem: A loop-inducing switch appears on an edge port and influences spanning-tree topology. It does not directly remediate the current finding at Oak River Energy: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. The relevant corrective control for this case is: Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation.

Apply storm control with measured thresholds on relevant Layer 2 interfaces. That action fits another problem: A broadcast storm on one access segment disrupts unrelated devices. It does not directly remediate the current finding at Oak River Energy: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. The relevant corrective control for this case is: Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation.

Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. That action fits another problem: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. It does not directly remediate the current finding at Oak River Energy: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. The relevant corrective control for this case is: Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation.

Unexpected BPDUs disable the offending edge port without changing the protected root. This would be relevant evidence for a different failure: A loop-inducing switch appears on an edge port and influences spanning-tree topology, usually addressed by Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

A crafted trunk-negotiation attempt cannot create an unauthorized trunk. This would be relevant evidence for a different failure: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack, usually addressed by Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Oak River Energy was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. That action fits another problem: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. It does not directly remediate the current finding at Westlake Retail: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. The relevant corrective control for this case is: Configure port-security limits and a suitable violation response on untrusted edge ports.

Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. That action fits another problem: A loop-inducing switch appears on an edge port and influences spanning-tree topology. It does not directly remediate the current finding at Westlake Retail: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. The relevant corrective control for this case is: Configure port-security limits and a suitable violation response on untrusted edge ports.

Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation. That action fits another problem: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. It does not directly remediate the current finding at Westlake Retail: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. The relevant corrective control for this case is: Configure port-security limits and a suitable violation response on untrusted edge ports.

A crafted trunk-negotiation attempt cannot create an unauthorized trunk. This would be relevant evidence for a different failure: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack, usually addressed by Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Excess learned addresses trigger the configured action without impacting approved devices.

Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted. This would be relevant evidence for a different failure: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database, usually addressed by Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Excess learned addresses trigger the configured action without impacting approved devices.

Unexpected BPDUs disable the offending edge port without changing the protected root. This would be relevant evidence for a different failure: A loop-inducing switch appears on an edge port and influences spanning-tree topology, usually addressed by Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. It does not demonstrate that the current problem at Westlake Retail was resolved. The specific required evidence is: Excess learned addresses trigger the configured action without impacting approved devices.

Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. That action fits another problem: Two application teams share the same routed infrastructure but must not exchange traffic by default. It does not directly remediate the current finding at Blue Haven Media: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. The relevant corrective control for this case is: Configure port-security limits and a suitable violation response on untrusted edge ports.

Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. That action fits another problem: A loop-inducing switch appears on an edge port and influences spanning-tree topology. It does not directly remediate the current finding at Blue Haven Media: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. The relevant corrective control for this case is: Configure port-security limits and a suitable violation response on untrusted edge ports.

Apply storm control with measured thresholds on relevant Layer 2 interfaces. That action fits another problem: A broadcast storm on one access segment disrupts unrelated devices. It does not directly remediate the current finding at Blue Haven Media: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. The relevant corrective control for this case is: Configure port-security limits and a suitable violation response on untrusted edge ports.

Inter-team traffic is blocked until an approved rule permits a specific flow. This would be relevant evidence for a different failure: Two application teams share the same routed infrastructure but must not exchange traffic by default, usually addressed by Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: Excess learned addresses trigger the configured action without impacting approved devices.

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: Excess learned addresses trigger the configured action without impacting approved devices.

Unexpected BPDUs disable the offending edge port without changing the protected root. This would be relevant evidence for a different failure: A loop-inducing switch appears on an edge port and influences spanning-tree topology, usually addressed by Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. It does not demonstrate that the current problem at Blue Haven Media was resolved. The specific required evidence is: Excess learned addresses trigger the configured action without impacting approved devices.

Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. That action fits another problem: A loop-inducing switch appears on an edge port and influences spanning-tree topology. It does not directly remediate the current finding at Linden Manufacturing: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. The relevant corrective control for this case is: Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene.

Apply storm control with measured thresholds on relevant Layer 2 interfaces. That action fits another problem: A broadcast storm on one access segment disrupts unrelated devices. It does not directly remediate the current finding at Linden Manufacturing: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. The relevant corrective control for this case is: Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene.

Configure port-security limits and a suitable violation response on untrusted edge ports. That action fits another problem: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. It does not directly remediate the current finding at Linden Manufacturing: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. The relevant corrective control for this case is: Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene.

Excess learned addresses trigger the configured action without impacting approved devices. This would be relevant evidence for a different failure: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries, usually addressed by Configure port-security limits and a suitable violation response on untrusted edge ports. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

Unexpected BPDUs disable the offending edge port without changing the protected root. This would be relevant evidence for a different failure: A loop-inducing switch appears on an edge port and influences spanning-tree topology, usually addressed by Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. That action fits another problem: Two application teams share the same routed infrastructure but must not exchange traffic by default. It does not directly remediate the current finding at Lakeview Insurance: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. The relevant corrective control for this case is: Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene.

Apply storm control with measured thresholds on relevant Layer 2 interfaces. That action fits another problem: A broadcast storm on one access segment disrupts unrelated devices. It does not directly remediate the current finding at Lakeview Insurance: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. The relevant corrective control for this case is: Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene.

Define SGT classification and enforce appropriate SGACL policy at supported points. That action fits another problem: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts. It does not directly remediate the current finding at Lakeview Insurance: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. The relevant corrective control for this case is: Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene.

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

Inter-team traffic is blocked until an approved rule permits a specific flow. This would be relevant evidence for a different failure: Two application teams share the same routed infrastructure but must not exchange traffic by default, usually addressed by Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.