HP HPE7-A01 Practice Test 25
Question 240
A campus access layer allows an unauthorized mini-router to distribute leases after DHCP snooping trust was enabled on every port. The review requires TWO complementary actions: one diagnostic check and one controlled configuration remedy. Select TWO actions that together meet those requirements.
- Review dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port.
- Review snooping enabled VLANs, trusted-port assignment and DHCP offer source interfaces.
- Activate compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment.
- Trust only legitimate server-facing paths while leaving user-facing ports untrusted under the supported snooping policy for the affected campus deployment.
Explanation
Correct Answers
B:Review snooping enabled VLANs, trusted-port assignment and DHCP offer source interfaces. DHCP snooping relies on a precise trust boundary; trusting a client port permits unauthorized DHCP servers to inject offers. This is the required diagnosis or controlled remedy; the other keyed action supplies the complementary role. The decision applies to the described dhcp snooping trust boundary situation.
D:Trust only legitimate server-facing paths while leaving user-facing ports untrusted under the supported snooping policy for the affected campus deployment. DHCP snooping relies on a precise trust boundary; trusting a client port permits unauthorized DHCP servers to inject offers. This is the required diagnosis or controlled remedy; the other keyed action supplies the complementary role. The decision applies to the described dhcp snooping trust boundary situation.
Incorrect Answers
A:Review dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port. This instead concerns dynamic arp inspection bindings. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. It is not one of the requested paired diagnosis and configuration actions. The immediate problem concerns dhcp snooping trust boundary.
C:Activate compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It is not one of the requested paired diagnosis and configuration actions. The immediate problem concerns dhcp snooping trust boundary.
Question 241
A guest device attempts ARP spoofing while a switch has DHCP snooping bindings but no corresponding ARP validation policy. Which investigation would best isolate the immediate network dependency?
- Inspect IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN.
- Inspect dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port.
- Inspect interface and path MTUs, oversized drop counters and ICMP packet-too-big handling.
- Inspect VLAN membership, switched-port state, SVI IP address and whether Layer 3 forwarding is enabled on the intended device.
Explanation
Correct Answer
B:Inspect dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The evidence check isolates the relevant prerequisite before a disruptive change. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
A:Inspect IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It does not isolate the cause of the stated incident. The immediate problem concerns dynamic arp inspection bindings.
C:Inspect interface and path MTUs, oversized drop counters and ICMP packet-too-big handling. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It does not isolate the cause of the stated incident. The immediate problem concerns dynamic arp inspection bindings.
D:Inspect VLAN membership, switched-port state, SVI IP address and whether Layer 3 forwarding is enabled on the intended device. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It does not isolate the cause of the stated incident. The immediate problem concerns dynamic arp inspection bindings.
Question 242
A guest device attempts ARP spoofing while a switch has DHCP snooping bindings but no corresponding ARP validation policy. Which specific corrective design step best meets the stated campus requirement?
- Enable validated ARP inspection against trustworthy bindings or supported static exceptions without trusting all client ports.
- Enable compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment.
- Set compatible MTU on each required link and routed path while respecting device and application limits.
- Create or restore the authorized routed VLAN interface and its routing or ACL context, keeping access ports Layer 2.
Explanation
Correct Answer
A:Enable validated ARP inspection against trustworthy bindings or supported static exceptions without trusting all client ports. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The proposed configuration targets the stated dependency without broadening unrelated access. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
B:Enable compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It would not implement the specifically required change. The immediate problem concerns dynamic arp inspection bindings.
C:Set compatible MTU on each required link and routed path while respecting device and application limits. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It would not implement the specifically required change. The immediate problem concerns dynamic arp inspection bindings.
D:Create or restore the authorized routed VLAN interface and its routing or ACL context, keeping access ports Layer 2. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It would not implement the specifically required change. The immediate problem concerns dynamic arp inspection bindings.
Question 243
A guest device attempts ARP spoofing while a switch has DHCP snooping bindings but no corresponding ARP validation policy. Following a targeted change, which acceptance test would most directly demonstrate success?
- Verify only subscribed receiver ports receive the test stream while membership survives the query interval.
- Test payloads near the intended path size and confirm large frames pass without fragmentation-related loss.
- Verify same-VLAN switching and permitted cross-VLAN routing through the intended SVI without unexpected leakage.
- Confirm forged ARP replies are rejected and legitimate bound hosts continue reaching the correct gateway MAC.
Explanation
Correct Answer
D:Confirm forged ARP replies are rejected and legitimate bound hosts continue reaching the correct gateway MAC. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The result tests actual working behavior, not merely a saved configuration. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
A:Verify only subscribed receiver ports receive the test stream while membership survives the query interval. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It would not establish that this function actually works. The immediate problem concerns dynamic arp inspection bindings.
B:Test payloads near the intended path size and confirm large frames pass without fragmentation-related loss. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It would not establish that this function actually works. The immediate problem concerns dynamic arp inspection bindings.
C:Verify same-VLAN switching and permitted cross-VLAN routing through the intended SVI without unexpected leakage. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It would not establish that this function actually works. The immediate problem concerns dynamic arp inspection bindings.
Question 244
A guest device attempts ARP spoofing while a switch has DHCP snooping bindings but no corresponding ARP validation policy. The change fails acceptance. What is the safest targeted restoration action?
- Restore a working querier and last known multicast forwarding configuration to recover legitimate receivers.
- Restore the previously working end-to-end MTU and revert the isolated change if large traffic still fails.
- Restore valid DHCP bindings or tightly scoped exceptions for affected static devices while keeping spoofed frames blocked.
- Restore the last valid SVI address and routing policy to reestablish gateway functionality before retrying migration.
Explanation
Correct Answer
C:Restore valid DHCP bindings or tightly scoped exceptions for affected static devices while keeping spoofed frames blocked. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The focused rollback restores a known safe baseline before another change attempt. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
A:Restore a working querier and last known multicast forwarding configuration to recover legitimate receivers. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It would not safely roll back the relevant failed change. The immediate problem concerns dynamic arp inspection bindings.
B:Restore the previously working end-to-end MTU and revert the isolated change if large traffic still fails. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It would not safely roll back the relevant failed change. The immediate problem concerns dynamic arp inspection bindings.
D:Restore the last valid SVI address and routing policy to reestablish gateway functionality before retrying migration. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It would not safely roll back the relevant failed change. The immediate problem concerns dynamic arp inspection bindings.
Question 245
A client with a new lease reports duplicate-gateway symptoms because an attacker sends forged ARP replies on its access VLAN. Before implementing a remedy, what should the engineer check first?
- Review IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN.
- Review dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port.
- Review interface and path MTUs, oversized drop counters and ICMP packet-too-big handling.
- Review VLAN membership, switched-port state, SVI IP address and whether Layer 3 forwarding is enabled on the intended device.
Explanation
Correct Answer
B:Review dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The evidence check isolates the relevant prerequisite before a disruptive change. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
A:Review IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It does not isolate the cause of the stated incident. The immediate problem concerns dynamic arp inspection bindings.
C:Review interface and path MTUs, oversized drop counters and ICMP packet-too-big handling. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It does not isolate the cause of the stated incident. The immediate problem concerns dynamic arp inspection bindings.
D:Review VLAN membership, switched-port state, SVI IP address and whether Layer 3 forwarding is enabled on the intended device. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It does not isolate the cause of the stated incident. The immediate problem concerns dynamic arp inspection bindings.
Question 246
A client with a new lease reports duplicate-gateway symptoms because an attacker sends forged ARP replies on its access VLAN. After the root cause is confirmed, which narrowly scoped configuration action should be selected?
- Activate validated ARP inspection against trustworthy bindings or supported static exceptions without trusting all client ports.
- Activate compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment.
- Apply compatible MTU on each required link and routed path while respecting device and application limits.
- Establish or restore the authorized routed VLAN interface and its routing or ACL context, keeping access ports Layer 2.
Explanation
Correct Answer
A:Activate validated ARP inspection against trustworthy bindings or supported static exceptions without trusting all client ports. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The proposed configuration targets the stated dependency without broadening unrelated access. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
B:Activate compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It would not implement the specifically required change. The immediate problem concerns dynamic arp inspection bindings.
C:Apply compatible MTU on each required link and routed path while respecting device and application limits. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It would not implement the specifically required change. The immediate problem concerns dynamic arp inspection bindings.
D:Establish or restore the authorized routed VLAN interface and its routing or ACL context, keeping access ports Layer 2. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It would not implement the specifically required change. The immediate problem concerns dynamic arp inspection bindings.
Question 247
A client with a new lease reports duplicate-gateway symptoms because an attacker sends forged ARP replies on its access VLAN. The review requires TWO complementary actions: one diagnostic check and one controlled configuration remedy. Select TWO actions that together meet those requirements.
- Review IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN.
- Review dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port.
- Apply compatible MTU on each required link and routed path while respecting device and application limits.
- Activate validated ARP inspection against trustworthy bindings or supported static exceptions without trusting all client ports.
Explanation
Correct Answers
B:Review dynamic ARP inspection VLAN scope, DHCP snooping bindings and drop counters for the offending ingress port. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. This is the required diagnosis or controlled remedy; the other keyed action supplies the complementary role. The decision applies to the described dynamic arp inspection bindings situation.
D:Activate validated ARP inspection against trustworthy bindings or supported static exceptions without trusting all client ports. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. This is the required diagnosis or controlled remedy; the other keyed action supplies the complementary role. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
A:Review IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It is not one of the requested paired diagnosis and configuration actions. The immediate problem concerns dynamic arp inspection bindings.
C:Apply compatible MTU on each required link and routed path while respecting device and application limits. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It is not one of the requested paired diagnosis and configuration actions. The immediate problem concerns dynamic arp inspection bindings.
Question 248
A client with a new lease reports duplicate-gateway symptoms because an attacker sends forged ARP replies on its access VLAN. If the revised setting disrupts users, which controlled rollback would be most relevant?
- Reinstate a working querier and last known multicast forwarding configuration to recover legitimate receivers.
- Reinstate the previously working end-to-end MTU and revert the isolated change if large traffic still fails.
- Reinstate valid DHCP bindings or tightly scoped exceptions for affected static devices while keeping spoofed frames blocked.
- Reinstate the last valid SVI address and routing policy to reestablish gateway functionality before retrying migration.
Explanation
Correct Answer
C:Reinstate valid DHCP bindings or tightly scoped exceptions for affected static devices while keeping spoofed frames blocked. Dynamic ARP inspection can enforce IP-to-MAC bindings and reduce forged neighbor claims; DHCP snooping alone does not inspect every ARP reply. The focused rollback restores a known safe baseline before another change attempt. The decision applies to the described dynamic arp inspection bindings situation.
Incorrect Answers
A:Reinstate a working querier and last known multicast forwarding configuration to recover legitimate receivers. This instead concerns igmp snooping multicast membership. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. It would not safely roll back the relevant failed change. The immediate problem concerns dynamic arp inspection bindings.
B:Reinstate the previously working end-to-end MTU and revert the isolated change if large traffic still fails. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It would not safely roll back the relevant failed change. The immediate problem concerns dynamic arp inspection bindings.
D:Reinstate the last valid SVI address and routing policy to reestablish gateway functionality before retrying migration. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It would not safely roll back the relevant failed change. The immediate problem concerns dynamic arp inspection bindings.
Question 249
A campus IPTV service floods all access ports because the switches do not track multicast listener membership. Which investigation would best isolate the immediate network dependency?
- Inspect interface and path MTUs, oversized drop counters and ICMP packet-too-big handling.
- Inspect VLAN membership, switched-port state, SVI IP address and whether Layer 3 forwarding is enabled on the intended device.
- Inspect IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN.
- Inspect trunk allowed VLANs, tag state and the connected device's matching VLAN expectations.
Explanation
Correct Answer
C:Inspect IGMP querier availability, learned group memberships and multicast forwarding ports on the VLAN. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. The evidence check isolates the relevant prerequisite before a disruptive change. The decision applies to the described igmp snooping multicast membership situation.
Incorrect Answers
A:Inspect interface and path MTUs, oversized drop counters and ICMP packet-too-big handling. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It does not isolate the cause of the stated incident. The immediate problem concerns igmp snooping multicast membership.
B:Inspect VLAN membership, switched-port state, SVI IP address and whether Layer 3 forwarding is enabled on the intended device. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It does not isolate the cause of the stated incident. The immediate problem concerns igmp snooping multicast membership.
D:Inspect trunk allowed VLANs, tag state and the connected device's matching VLAN expectations. This instead concerns vlan tagging on an 802.1q trunk. An IEEE 802.1Q trunk carries multiple VLANs by tags; permitted VLAN membership and native-tag treatment must agree across the link. It does not isolate the cause of the stated incident. The immediate problem concerns igmp snooping multicast membership.
Question 250
A campus IPTV service floods all access ports because the switches do not track multicast listener membership. Which specific corrective design step best meets the stated campus requirement?
- Set compatible MTU on each required link and routed path while respecting device and application limits.
- Enable compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment.
- Create or restore the authorized routed VLAN interface and its routing or ACL context, keeping access ports Layer 2.
- Permit the approved tagged VLAN IDs on both ends and set compatible native or untagged VLAN handling.
Explanation
Correct Answer
B:Enable compatible IGMP snooping with a reachable querier and approved multicast groups for the affected segment. IGMP snooping constrains multicast delivery based on reported listeners, and a querier maintains membership state over time. The proposed configuration targets the stated dependency without broadening unrelated access. The decision applies to the described igmp snooping multicast membership situation.
Incorrect Answers
A:Set compatible MTU on each required link and routed path while respecting device and application limits. This instead concerns mtu mismatch in a campus path. A single low-MTU hop can disrupt large packets even while small connectivity probes succeed; end-to-end sizing matters. It would not implement the specifically required change. The immediate problem concerns igmp snooping multicast membership.
C:Create or restore the authorized routed VLAN interface and its routing or ACL context, keeping access ports Layer 2. This instead concerns svi versus layer 2 access interface. A Layer 2 VLAN groups frames, whereas an SVI provides an IP routing interface; one does not automatically create the other. It would not implement the specifically required change. The immediate problem concerns igmp snooping multicast membership.
D:Permit the approved tagged VLAN IDs on both ends and set compatible native or untagged VLAN handling. This instead concerns vlan tagging on an 802.1q trunk. An IEEE 802.1Q trunk carries multiple VLANs by tags; permitted VLAN membership and native-tag treatment must agree across the link. It would not implement the specifically required change. The immediate problem concerns igmp snooping multicast membership.
