Exam Bundle

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

Inter-team traffic is blocked until an approved rule permits a specific flow. This would be relevant evidence for a different failure: Two application teams share the same routed infrastructure but must not exchange traffic by default, usually addressed by Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. It does not demonstrate that the current problem at Lakeview Insurance was resolved. The specific required evidence is: A crafted trunk-negotiation attempt cannot create an unauthorized trunk.

Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. That action fits another problem: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. It does not directly remediate the current finding at Evermere Health: A loop-inducing switch appears on an edge port and influences spanning-tree topology. The relevant corrective control for this case is: Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles.

Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. That action fits another problem: Two application teams share the same routed infrastructure but must not exchange traffic by default. It does not directly remediate the current finding at Evermere Health: A loop-inducing switch appears on an edge port and influences spanning-tree topology. The relevant corrective control for this case is: Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles.

Apply storm control with measured thresholds on relevant Layer 2 interfaces. That action fits another problem: A broadcast storm on one access segment disrupts unrelated devices. It does not directly remediate the current finding at Evermere Health: A loop-inducing switch appears on an edge port and influences spanning-tree topology. The relevant corrective control for this case is: Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles.

A crafted trunk-negotiation attempt cannot create an unauthorized trunk. This would be relevant evidence for a different failure: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack, usually addressed by Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: Unexpected BPDUs disable the offending edge port without changing the protected root.

Inter-team traffic is blocked until an approved rule permits a specific flow. This would be relevant evidence for a different failure: Two application teams share the same routed infrastructure but must not exchange traffic by default, usually addressed by Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: Unexpected BPDUs disable the offending edge port without changing the protected root.

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: Unexpected BPDUs disable the offending edge port without changing the protected root.

Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. That action fits another problem: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. It does not directly remediate the current finding at Brightstone Legal: A loop-inducing switch appears on an edge port and influences spanning-tree topology. The relevant corrective control for this case is: Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles.

Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. That action fits another problem: Two application teams share the same routed infrastructure but must not exchange traffic by default. It does not directly remediate the current finding at Brightstone Legal: A loop-inducing switch appears on an edge port and influences spanning-tree topology. The relevant corrective control for this case is: Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles.

Define SGT classification and enforce appropriate SGACL policy at supported points. That action fits another problem: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts. It does not directly remediate the current finding at Brightstone Legal: A loop-inducing switch appears on an edge port and influences spanning-tree topology. The relevant corrective control for this case is: Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles.

A rogue offer on an access port is discarded and genuine clients obtain correct leases. This would be relevant evidence for a different failure: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server, usually addressed by Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: Unexpected BPDUs disable the offending edge port without changing the protected root.

Inter-team traffic is blocked until an approved rule permits a specific flow. This would be relevant evidence for a different failure: Two application teams share the same routed infrastructure but must not exchange traffic by default, usually addressed by Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: Unexpected BPDUs disable the offending edge port without changing the protected root.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Brightstone Legal was resolved. The specific required evidence is: Unexpected BPDUs disable the offending edge port without changing the protected root.

Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. That action fits another problem: Two application teams share the same routed infrastructure but must not exchange traffic by default. It does not directly remediate the current finding at Vantage Travel: A broadcast storm on one access segment disrupts unrelated devices. The relevant corrective control for this case is: Apply storm control with measured thresholds on relevant Layer 2 interfaces.

Define SGT classification and enforce appropriate SGACL policy at supported points. That action fits another problem: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts. It does not directly remediate the current finding at Vantage Travel: A broadcast storm on one access segment disrupts unrelated devices. The relevant corrective control for this case is: Apply storm control with measured thresholds on relevant Layer 2 interfaces.

Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. That action fits another problem: A loop-inducing switch appears on an edge port and influences spanning-tree topology. It does not directly remediate the current finding at Vantage Travel: A broadcast storm on one access segment disrupts unrelated devices. The relevant corrective control for this case is: Apply storm control with measured thresholds on relevant Layer 2 interfaces.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: The controlled flood is rate-limited while normal broadcast services still function.

Unexpected BPDUs disable the offending edge port without changing the protected root. This would be relevant evidence for a different failure: A loop-inducing switch appears on an edge port and influences spanning-tree topology, usually addressed by Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: The controlled flood is rate-limited while normal broadcast services still function.

Inter-team traffic is blocked until an approved rule permits a specific flow. This would be relevant evidence for a different failure: Two application teams share the same routed infrastructure but must not exchange traffic by default, usually addressed by Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: The controlled flood is rate-limited while normal broadcast services still function.

Define SGT classification and enforce appropriate SGACL policy at supported points. That action fits another problem: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts. It does not directly remediate the current finding at Evergreen Hospital: A broadcast storm on one access segment disrupts unrelated devices. The relevant corrective control for this case is: Apply storm control with measured thresholds on relevant Layer 2 interfaces.

Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. That action fits another problem: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. It does not directly remediate the current finding at Evergreen Hospital: A broadcast storm on one access segment disrupts unrelated devices. The relevant corrective control for this case is: Apply storm control with measured thresholds on relevant Layer 2 interfaces.

Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation. That action fits another problem: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. It does not directly remediate the current finding at Evergreen Hospital: A broadcast storm on one access segment disrupts unrelated devices. The relevant corrective control for this case is: Apply storm control with measured thresholds on relevant Layer 2 interfaces.

Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted. This would be relevant evidence for a different failure: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database, usually addressed by Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: The controlled flood is rate-limited while normal broadcast services still function.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: The controlled flood is rate-limited while normal broadcast services still function.

A rogue offer on an access port is discarded and genuine clients obtain correct leases. This would be relevant evidence for a different failure: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server, usually addressed by Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. It does not demonstrate that the current problem at Evergreen Hospital was resolved. The specific required evidence is: The controlled flood is rate-limited while normal broadcast services still function.

Define SGT classification and enforce appropriate SGACL policy at supported points. That action fits another problem: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts. It does not directly remediate the current finding at Aspen Digital: Two application teams share the same routed infrastructure but must not exchange traffic by default. The relevant corrective control for this case is: Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways.

Apply storm control with measured thresholds on relevant Layer 2 interfaces. That action fits another problem: A broadcast storm on one access segment disrupts unrelated devices. It does not directly remediate the current finding at Aspen Digital: Two application teams share the same routed infrastructure but must not exchange traffic by default. The relevant corrective control for this case is: Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways.

Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. That action fits another problem: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. It does not directly remediate the current finding at Aspen Digital: Two application teams share the same routed infrastructure but must not exchange traffic by default. The relevant corrective control for this case is: Use separate VRFs or VLAN boundaries with explicit policy at inter-segment gateways.

A rogue offer on an access port is discarded and genuine clients obtain correct leases. This would be relevant evidence for a different failure: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server, usually addressed by Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: Inter-team traffic is blocked until an approved rule permits a specific flow.

The controlled flood is rate-limited while normal broadcast services still function. This would be relevant evidence for a different failure: A broadcast storm on one access segment disrupts unrelated devices, usually addressed by Apply storm control with measured thresholds on relevant Layer 2 interfaces. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: Inter-team traffic is blocked until an approved rule permits a specific flow.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: Inter-team traffic is blocked until an approved rule permits a specific flow.