JN0-351 Practice Questions

A  is correct because dynamic ARP inspection (DAI) is a Layer 2 security feature that prevents ARP spoofing attacks. ARP spoofing is a technique that allows an attacker to send fake ARP messages to associate a spoofed MAC address with a legitimate IP address. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks.  DAI validates ARP packets by checking the source MAC address and IP address against a trusted database, which is usually built by DHCP snooping 1 .  DAI discards any ARP packets that do not match the database or have invalid formats 1 .

C  is correct because DHCP snooping is a Layer 2 security feature that prevents DHCP spoofing attacks. DHCP spoofing is a technique that allows an attacker to act as a rogue DHCP server and offer fake IP addresses and other network parameters to unsuspecting clients. This can result in traffic redirection, man-in-the-middle attacks, or denial-of-service attacks. DHCP snooping filters DHCP messages by classifying switch ports as trusted or untrusted.  Trusted ports are allowed to send and receive any DHCP messages, while untrusted ports are allowed to send only DHCP requests and receive only valid DHCP replies from trusted ports 2 .  DHCP snooping also builds a database of MAC addresses, IP addresses, lease times, and binding types for each client 2 .

A  is correct because RSTP alternate ports block traffic while receiving superior BPDUs from a neighboring switch.  An alternate port is a backup port for a root port, which means it receives better BPDUs from another bridge than the current root port 1 .  However, an alternate port does not forward any traffic, as it is in a discarding state 2 . It only listens to BPDUs and waits for the root port to fail.  If the root port fails, the alternate port can immediately transition to a forwarding state and become the new root port 1 .

C  is correct because RSTP alternate ports provide an alternate higher cost path to the root bridge.  An alternate port is selected based on the same criteria as the root port, which are the lowest bridge ID, the lowest path cost, the lowest sender port ID, and the lowest receiver port ID 3 .  However, an alternate port receives a higher cost BPDU than the root port, otherwise it would be the root port itself 1 . Therefore, an alternate port provides an alternate higher cost path to the root bridge than the root port.

Option A is correct. For traffic to be sent through a GRE tunnel, there must be a route that directs the traffic into the tunnel. This is typically accomplished through the use of a static route or a dynamic routing protocol.

Option B is correct. All intermediary devices must have a route to the tunnel endpoints34. In real-world scenarios, the tunnel endpoints for a tunnel going over the Internet must have globally reachable internet addresses. Otherwise, intermediate routers in the Internet cannot forward the tunneled packets.

IS-IS (Intermediate System to Intermediate System) is a routing protocol that is designed to move information efficiently within a computer network 1 2 .  It supports multiple protocol topologies, including IPv4, IPv6, and multicast 1 2 . Therefore, options C, E, and D are correct.