MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. What is VLAN hopping in networking?
   a. A technique for sending traffic across VLANs to bypass segmentation
   b. A method for encrypting VLAN traffic
   c. A type of load balancing between VLANs
   d. A way to assign dynamic IP addresses in VLANs
   Answer: awikipedia+2
2. Which of the following VLAN hopping attack types involves manipulating the Dynamic Trunking Protocol?
   a. Switch spoofing
   b. Double tagging
   c. IP spoofing
   d. ARP poisoning
   Answer: aimperva+2
3. What is the function of a VLAN in networking?
   a. Provides logical segmentation of network resources
   b. Encrypts all network traffic
   c. Prevents all types of network attacks
   d. Forwards only broadcast packets
   Answer: ajumpcloud+1
4. In a double-tagging VLAN hopping attack, what does the attacker do?
   a. Adds two VLAN tags inside the Ethernet frame
   b. Disables all trunk ports
   c. Initiates ARP poisoning
   d. Changes switch firmware
   Answer: azenarmor+2
5. Why are VLAN hopping attacks dangerous?
   a. They bypass network segmentation and access restricted data
   b. They slow down network performance
   c. They can replace default gateway addresses
   d. They cause power failure in switches
   Answer: apacketlabs+2
6. Which protocol is commonly exploited in switch spoofing attacks?
   a. Dynamic Trunking Protocol (DTP)
   b. Routing Information Protocol (RIP)
   c. Spanning Tree Protocol (STP)
   d. Border Gateway Protocol (BGP)
   Answer: aidc-online+2
7. What must an attacker’s device do to perform a switch spoofing attack?
   a. Emulate switch trunking protocols
   b. Simulate link aggregation
   c. Assign itself the lowest MAC address
   d. Disable VLAN pruning
   Answer: anetworklessons+2
8. Which setting should be disabled to prevent automatic trunk negotiation?
   a. Dynamic Trunking Protocol (DTP)
   b. Spanning Tree Protocol (STP)
   c. VLAN Access List (VACL)
   d. Storm Control
   Answer: aitexamanswers+2
9. On Cisco switches, which configuration command prevents DTP negotiation?
   a. switchport nonegotiate
   b. vlan shutdown
   c. disable portfast
   d. spanning-tree portfast bpduguard
   Answer: alearningnetwork.cisco+2
10. A double-tagging attack is most effective when the attacker is connected to which VLAN?
    a. Native VLAN
    b. Management VLAN
    c. Guest VLAN
    d. Isolated VLAN
    Answer: accoe.dsci+2
11. What happens to the outer VLAN tag during a double-tagging attack after the frame enters the first switch?
    a. It is removed
    b. It is encrypted
    c. It is replaced with a random tag
    d. It is broadcast on all VLANs
    Answer: ajumpcloud+2
12. What type of port should end-user devices be connected to in order to prevent VLAN hopping?
    a. Access port
    b. Trunk port
    c. Hybrid port
    d. Monitor port
    Answer: awikipedia+2
13. Why should unused switch ports be disabled when securing against VLAN hopping?
    a. To prevent them being used as entry points for attacks
    b. To increase switch throughput
    c. To reduce multicast traffic
    d. To enable VLAN pruning
    Answer: areddit+2
14. Which VLAN is typically assigned as the native VLAN on switch trunks?
    a. VLAN 1
    b. VLAN 10
    c. VLAN 100
    d. VLAN 999
    Answer: accoe.dsci+2
15. What is the preferred practice for a trunk port’s native VLAN to prevent double-tagging attacks?
    a. Assign it to an unused VLAN
    b. Use VLAN 1
    c. Assign it to the management VLAN
    d. Assign it dynamically
    Answer: alevelblue+2
16. What is the main reason VLANs are used in organizational networks?
    a. To separate and secure different segments of the network
    b. To perform automatic routing between devices
    c. To enable multicast traffic for all devices
    d. For remote VPN access
    Answer: ajumpcloud+1
17. Which attack involves adding two VLAN tags to an Ethernet frame?
    a. Double tagging
    b. Switch spoofing
    c. MAC flooding
    d. DHCP starvation
    Answer: azenarmor+2
18. What feature should be enabled to restrict the number of devices allowed to connect per switch port?
    a. Port security
    b. Dynamic ARP Inspection
    c. Link aggregation
    d. Jumbo frames
    Answer: alevelblue+1
19. What configuration should be avoided to reduce switch spoofing risk?
    a. Dynamic port trunking
    b. Static VLAN assignments
    c. Portfast on all ports
    d. Explicit VLAN pruning
    Answer: aimperva+2
20. Traffic from which VLAN should NOT be allowed on native trunks to prevent double tagging?
    a. User VLAN
    b. Unused VLAN
    c. Management VLAN
    d. Default VLAN (VLAN 1)
    Answer: ditexamanswers+2
21. How does switch spoofing provide an attacker access to multiple VLANs?
    a. By forming a trunk link with the switch
    b. By assigning a random MAC address
    c. By changing the switch’s hostname
    d. By enabling link-state routing
    Answer: aimperva+2
22. Which mitigation technique applies specifically to double-tagging attacks?
    a. Changing native VLAN from VLAN 1 to an unused VLAN
    b. Enabling DTP on all switch ports
    c. Allowing trunk negotiation on all access ports
    d. Using ISL encapsulation
    Answer: areddit+2
23. What is a consequence of improper VLAN configuration?
    a. Increased vulnerability to VLAN hopping attacks
    b. Lower switch operating temperature
    c. More efficient multicast routing
    d. Improved wireless coverage
    Answer: acisco+2
24. Which protocol is proprietary to Cisco and is related to VLAN hopping risks?
    a. Dynamic Trunking Protocol (DTP)
    b. Multiple Spanning Tree Protocol (MSTP)
    c. Virtual Router Redundancy Protocol (VRRP)
    d. Link Layer Discovery Protocol (LLDP)
    Answer: aidc-online+1
25. What kind of traffic should an access port accept to prevent VLAN hopping?
    a. Untagged frames only
    b. Tagged frames only
    c. Both untagged and tagged
    d. Multicast only
    Answer: alearningnetwork.cisco+2
26. Which feature is used to filter inter-VLAN traffic and block unauthorized communications?
    a. VLAN Access Control Lists (VACLs)
    b. DHCP snooping
    c. EtherChannel
    d. IGMP snooping
    Answer: azenarmor+1
27. What best describes a dynamic trunking port?
    a. Negotiates trunking automatically
    b. Only allows tagged frames
    c. Is for management VLAN only
    d. Is dedicated to access control
    Answer: awikipedia+2
28. For maximum security, what should all unused switch ports have?
    a. Shutdown status and registered in an unused VLAN
    b. Spanning tree enabled
    c. BPDU guard active
    d. Multicast traffic disabled
    Answer: accoe.dsci+2
29. Which setting prevents an attacker from negotiating a trunk link?
    a. Explicitly configure all non-trunk ports as access ports
    b. Assign all ports to native VLAN 1
    c. Enable all ports by default
    d. Set portfast on all ports
    Answer: anetworklessons+2
30. Which attack vector involves sending DTP packets to dynamically form trunk links?
    a. Switch spoofing
    b. Double tagging
    c. MAC flooding
    d. DHCP starvation
    Answer: anetworklessons+2
31. DTP should be disabled on which types of switch ports?
    a. Access ports
    b. Trunk ports
    c. Monitor ports
    d. Routing ports
    Answer: aitexamanswers+2
32. The risk of VLAN hopping can increase if which default configuration remains unchanged?
    a. All ports belong to VLAN 1
    b. All routing is static
    c. IGMP snooping is enabled
    d. Portfast is disabled by default
    Answer: areddit+2
33. In a double-tagging attack, which tag is visible to the first switch only?
    a. Outer VLAN tag
    b. Inner VLAN tag
    c. Neither tag
    d. Both tags
    Answer: ajumpcloud+2
34. What is the default behavior of a trunk port if the native VLAN is not specified?
    a. Uses VLAN 1 as native VLAN
    b. Disables all trunking
    c. Uses the highest numbered VLAN
    d. Blocks all traffic
    Answer: awikipedia+2
35. How often should VLAN configurations be reviewed to ensure security?
    a. Regularly as part of security audits
    b. Once during initial setup only
    c. After every network outage
    d. Only when adding new devices
    Answer: ajumpcloud+1
36. Which Cisco IOS command configures a port as an access port?
    a. switchport mode access
    b. vlan enable
    c. switchport trunk active
    d. access-list permit vlan
    Answer: alearningnetwork.cisco+2
37. In double-tagging attacks, frames are specially crafted with how many 802.1Q tags?
    a. Two
    b. One
    c. Three
    d. Zero
    Answer: ajumpcloud+2
38. What is the safest status for unused switch ports?
    a. Shut down and placed in a “parking lot” VLAN
    b. Left in default VLAN
    c. Routed to the management interface
    d. Set as trunk by default
    Answer: azenarmor+1
39. Which network segment can double-tagging attacks compromise if configured improperly?
    a. Any segment using the native VLAN
    b. Isolated VLAN only
    c. Only the management VLAN
    d. Wireless VLANs
    Answer: anetworklessons+2
40. What does setting trunk port native VLAN to an unused value mitigate?
    a. Double-tagging attacks
    b. ARP spoofing
    c. DHCP starvation
    d. MAC flooding
    Answer: alevelblue+2
41. Switch spoofing is less effective if which switchport mode is not used?
    a. Dynamic
    b. Static
    c. Disabled
    d. Hybrid
    Answer: aimperva+2
42. Which protocol manipulations are central to switch spoofing attacks?
    a. DTP and 802.1Q
    b. ARP and ICMP
    c. IGMP and EIGRP
    d. TCP and UDP
    Answer: aidc-online+2
43. How can VACLs help protect against VLAN hopping?
    a. By filtering and limiting VLAN-to-VLAN traffic
    b. By enabling trunk negotiation
    c. By configuring spanning tree priority
    d. By aggregating links
    Answer: alevelblue+1
44. The best approach for VLAN hopping prevention is:
    a. Layered defense with configuration and monitoring
    b. Trusting all connected devices
    c. Disabling all VLANs
    d. Using only wireless technology
    Answer: ajumpcloud+2
45. What is the result of enabling trunking manually instead of relying on dynamic negotiation?
    a. Reduces risk of unauthorized trunk formation
    b. Increases traffic congestion
    c. Prevents access from all VLANs
    d. Disables all ports by default
    Answer: aitexamanswers+2
46. The most effective mitigations for VLAN hopping include all EXCEPT:
    a. Assigning all ports to trunk by default
    b. Disabling DTP on all ports
    c. Setting native VLAN to unused ID
    d. Configuring all user ports as access ports
    Answer: awikipedia+2
47. VLAN hopping presents the highest risk in networks with:
    a. Poorly configured switch ports
    b. End-to-end security monitoring
    c. No dynamic trunking
    d. Strict VLAN access control
    Answer: acisco+2
48. Which configuration disables a port for dynamic trunking?
    a. switchport mode access
    b. switchport mode trunk
    c. vlan shutdown
    d. portfast enable
    Answer: accoe.dsci+2
49. Which term describes the process of traffic leaving the attacker’s VLAN and arriving at the target VLAN during VLAN hopping?
    a. Hopping
    b. Bridging
    c. Routing
    d. Segmentation
    Answer: ajumpcloud+1
50. On which type of VLAN does switch spoofing become ineffective?
    a. Access VLAN ports only
    b. Dynamic trunk ports
    c. Management VLAN only
    d. Default VLAN only
    Answer: alearningnetwork.cisco+2

1. https://en.wikipedia.org/wiki/VLAN_hopping
2. https://jumpcloud.com/it-index/what-is-vlan-hopping
3. https://www.zenarmor.com/docs/network-security-tutorials/what-is-vlan-hopping
4. https://www.imperva.com/learn/availability/vlan-hopping/
5. https://ccoe.dsci.in/blog/vlan-hopping-and-how-to-mitigate-an-attack
6. https://networklessons.com/switching/vlan-hopping
7. https://jumpcloud.com/it-index/what-is-a-double-tagging-attack
8. https://www.packetlabs.net/posts/what-is-vlan-hopping/
9. https://www.idc-online.com/technical_references/pdfs/data_communications/VLAN_Hopping.pdf
10. https://itexamanswers.net/question/what-are-three-techniques-for-mitigating-vlan-hopping-attacks-choose-three
11. https://levelblue.com/blogs/security-essentials/vlan-hopping-and-mitigation
12. https://learningnetwork.cisco.com/s/blogs/a0D3i000002SKPREA4/vlan1-and-vlan-hopping-attack
13. https://www.reddit.com/r/DataHoarder/comments/zue761/vlan_hopping_mitigation/
14. https://www.cisco.com/c/dam/global/fr_ca/training-events/pdfs/L2-security-Bootcamp-final.pdf
15. https://www.n-able.com/de/blog/vlan-hopping-security
16. https://www.youtube.com/watch?v=hcaGiWteVTM
17. https://www.professormesser.com/professor-messer-archives/n10-007/vlan-hopping-2/
18. https://www.webasha.com/blog/vlan-hopping-attack-explained-techniques-real-world-risks-and-prevention
19. https://www.claranet.com/us/blog/2020-10-30-exploiting-vlan-double-tagging