Infrastructure Security and Services

CCIE · 45 questions

• A museums and culture department sees SNMP and SSH floods driving high CPU on civic core routers while transit forwarding still matters. Which feature most directly rate-limits abusive traffic to the route processor?
• A county IT team wants switch administrators to authenticate with individual accounts and centralized authorization instead of shared local passwords. Which approach meets that goal?
• A city public-works user VLAN shows lateral SMB scanning between endpoints that share the same L2 segment. Which control filters that east-west traffic inside the VLAN?
• A municipal library consortium’s parking-garage switch is overwhelmed by broadcasts from a failing IoT NIC. What feature limits that storm on the access port?
• A township board finds a contractor’s rogue DHCP appliance answering on an access port. What DHCP snooping trust model stops offers from that port while allowing the real server path?
• A transit authority wants the DHCP server to assign addresses based on which switch and port a rider Wi-Fi or kiosk attaches to. Which relay feature supplies that location context?
• A water utility wants access ports to forward only traffic sourced from IP addresses learned via legitimate DHCP for that port. Which feature depends on the DHCP snooping binding table to enforce that?
• A school district needs to block ARP poisoning between kiosk VLAN hosts. Which feature validates ARP against the DHCP snooping database?
• A parks department lobby port was overloaded after someone daisy-chained a hub with many MACs. What access-layer control limits learned MAC count and defines a violation action?
• An emergency-management office places cameras on one subnet but must stop east-west traffic between them while still reaching a shared gateway. Which Private VLAN roles fit that design?
• A county courts edge router should accept management protocols only from the jump-host subnet as defense in depth. What ACL pattern best supports that goal?
• A city clerk’s peering edge receives packets with source addresses that do not match a plausible reverse path. Which feature drops many of those spoofed sources?
• An airport authority must stop rogue IPv6 Router Advertisements from appearing on access ports serving passenger and staff devices. Which feature is designed for that threat?
• A port authority needs to block unauthorized DHCPv6 servers on the same Layer-2 segment as legitimate clients. Which control parallels IPv4 DHCP snooping’s goal for IPv6?
• A housing authority uses IPv6 device tracking to build binding tables and wants to constrain which source addresses may leave an access port. Which conceptual control applies those bindings?
• A sanitation department sees rogue IPv6 Neighbor Advertisements claiming city gateway MACs on access VLANs. Which switch feature should the team enable to inspect and validate Neighbor Discovery messages and mitigate ND spoofing?
• A fire district is documenting wired 802.1X at closet switches. Which role mapping is correct for the endpoint, the access switch, and the RADIUS/ISE server?
• A police records bureau needs one authenticated IP phone plus an attached PC on desk drops, but open conference rooms must allow several devices after the first success. Which 802.1X host-mode pairing fits those layouts?
• A municipal hospital campus sees a new laptop fail wired 802.1X before any authorization ACL is applied. Where should engineers first confirm the EAP exchange is progressing?
• A community college district is retiring cleartext device management. Which change best replaces insecure protocols for civic network device access and file transfer?
• A regional planning commission wants automation to manage IOS XE boxes with YANG models while operators keep CLI for break-glass work. What should the team enable alongside CLI?
• A 911 PSAP is migrating NMS polling off SNMPv2c community strings. Which SNMPv3 security level best protects credentials and payload confidentiality for civic monitoring?
• An election office must centralize device logs after an incident and keep timelines trustworthy while cutting noise. Which operational practice best fits?
• A tax assessor must classify civic voice and SCADA into DiffServ PHBs on IOS XE edge routers. Which MQC structure correctly implements that classification and marking?
• A building permits desk marks voice with CoS on campus Catalyst switches, but the routed WAN edge forwards IP. What must operators ensure at the L2/L3 boundary?
• A fleet garage must mark popular SaaS applications for QoS even when clients use ephemeral destination ports. Which approach recognizes those applications beyond static port ACLs?
• A wastewater plant’s Metro-E handoff is sub-rate to a CIR below line rate. Mid-day drops spike when the edge hard-polices bursts. Which behavior should they prefer at the civic edge?
• A stormwater bureau needs low-latency treatment for voice while bulk backup flows share remaining bandwidth fairly on the same uplink. Which congestion-management approach fits?
• A public health clinic receives a 1 Gbps Ethernet handoff but buys only a 200 Mbps CIR from the carrier. How should hierarchical QoS typically be applied?
• An animal control HQ wants first-hop redundancy for city VLANs on a pair of distribution switches with a virtual gateway IP. Which FHRP choice and behavior match a classic active/standby design?
• A museums and culture department needs first-hop redundancy for IPv6 clients that learn default routers from Router Advertisements. Which approach aligns with dual distribution switches?
• A county IT team needs device clocks to agree so syslog and AAA records correlate, and they want protection against rogue time sources. Which practice best meets both goals?
• A city public-works campus uses centralized DHCP servers while dual distribution switches run HSRP for access VLANs. How should DHCP relay typically be designed?
• A municipal library consortium is dual-stacking a staff VLAN and must choose how hosts obtain IPv6 addressing and options. Which statement correctly contrasts SLAAC and stateful DHCPv6?
• A township board needs a remote clinic firewall to receive a delegated IPv6 block from upstream so it can number internal VLANs without manual per-site prefixes. Which mechanism fits?
• A transit authority must let guest users share a public IPv4 address outbound while publishing one civic web portal on a fixed public IP. Which NAT combination matches those goals?
• A water utility runs overlapping RFC1918 spaces in separate VRFs that both need Internet egress. Why enable VRF-aware NAT?
• A school district steers a floating static default via a primary Metro path and must withdraw it when that path fails end-to-end. Which feature pairing drives that change?
• A parks department must identify which internal host is saturating a public-safety WAN link during an incident. Which visibility tool best exports flow records for top-talker analysis?
• An emergency-management office must mirror a suspect access port to a packet broker. The broker sits across a Layer-3 boundary from the source switch. Which capture method applies?
• A county courts site needs packet captures on a remote branch router where no SPAN destination switch exists. Which on-box approach best meets that need without hauling traffic to a distant analyzer?
• A city clerk reports that a policy on an IOS XE edge router drops a specific flow, but show access-lists counters are inconclusive. Which diagnostic best shows where in the forwarding path the drop occurs?
• An airport authority must enable platform debugs on a busy Catalyst during an intermittent guest-Wi-Fi incident without hammering production CPU. Which practice best keeps troubleshooting safe?
• After an external scan of the civic ASN, a port authority wants layered protection for router control planes without turning the project into a full firewall-centric Security redesign. Which combination best reflects EI defense-in-depth on the network devices?
• A housing authority dual-homes a staff VLAN behind two first-hop routers and must keep DHCP, time sync, and gateway failover coordinated during maintenance. Which integration best supports clean failover?