640-554 Latest Exam Braindumps
Question 9: Which two countermeasures can mitigate STP root bridge attacks? (Choose two.)A. root guard
B. BPDU filtering
C. Layer 2 PDU rate limiter
D. BPDU guard
Correct Answer: A,D
Explanation:
The BPDU guard feature is designed to allow network designers to keep the active network topology
predictable. BPDU guard is used to protect the switched network from the problems that may be
caused by the receipt of BPDUs on ports that should not be receiving them. The receipt of
unexpected BPDUs may be accidental or may be part of an unauthorized attempt to add a switch to
the network. BPDU guard is best deployed toward user-facing ports to prevent rogue switch network
extensions by an attacker. The root guard feature of Cisco switches is designed to provide a way to
enforce the placement of root bridges in the network. Root guard limits the switch ports out of which
the root bridge may be negotiated. If a root-guard-enabled port receives BPDUs that are superior to
those that the current root bridge is sending, then that port is moved to a root-inconsistent state,
which is effectively equal to an STP listening state, and no data traffic is forwarded across that port.
