Examkin

Question

Difficulty: HardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer is hardening an enterprise access layer switch using Cisco Layer 2 security features. Match each specific Layer 2 security feature configuration component on the left with its exact operational behavior or validation requirement on the right.

  • Dynamic ARP Inspection (DAI) on an untrusted access portIntercepts incoming ARP packets and validates the sender MAC/IP binding against the DHCP snooping database or ARP ACL.
  • DHCP Snooping Option 82 handling on an untrusted portDrops incoming DHCP request packets that contain a non-zero GIADDR or Option 82 payload by default.
  • Port Security sticky MAC address learning (`switchport port-security mac-address sticky`)Dynamically converts learned MAC addresses into running configuration entries that require manual configuration copy to survive switch reboots.
  • DHCP Snooping Rate Limiting (`ip dhcp snooping limit rate`)Monitors incoming DHCP packet frequency on untrusted ports and moves the interface to an err-disabled state if exceeded.

Answer

Dynamic ARP Inspection matches validating ARP sender MAC/IP pairings against the DHCP snooping binding table. DHCP Snooping Option 82 handling on untrusted ports matches dropping incoming DHCP packets containing non-zero GIADDR or Option 82 payloads by default. Port Security sticky MAC learning matches adding dynamically learned MACs to running-config requiring an explicit copy to startup-config for boot persistence. DHCP Snooping rate limiting matches tracking incoming DHCP packet frequency and err-disabling interfaces that exceed configured thresholds.
Each feature is correctly matched to its functional behavior: Dynamic ARP Inspection validates ingress ARP packets against the DHCP snooping database; DHCP Snooping drops untrusted packets containing Option 82 or non-zero GIADDR fields; Sticky Port Security writes learned MACs to running-config (requiring manual saving for persistence); and DHCP Snooping rate limiting places interfaces in an err-disabled state upon threshold violations.

Step-by-Step Solution

1
Analyze Dynamic ARP Inspection (DAI) operation on untrusted interfaces.
DAI inspects all incoming ARP packets on untrusted ports and compares the sender MAC address and sender IP address against valid entries in the DHCP snooping binding database.
This prevents man-in-the-middle ARP spoofing attacks across Layer 2 VLANs.
2
Analyze DHCP Snooping Option 82 untrusted port enforcement.
DHCP snooping drops incoming packets on untrusted interfaces if the packet contains Option 82 information or a non-zero GIADDR value.
Untrusted access ports are intended for end hosts, which should not generate relay agent information fields.
3
Analyze sticky MAC address persistence in Port Security.
Configuring sticky MAC learning adds dynamically discovered MAC addresses into the active running-configuration.
Because these MAC addresses reside only in running-config, administrators must save the configuration (`copy running-config startup-config`) to make them permanent across switch reboots.
4
Analyze DHCP Snooping Rate Limiting behavior.
Enforcing `ip dhcp snooping limit rate` places an untrusted interface in the `err-disabled` state if incoming DHCP frames exceed the configured rate limit.
This protects switch CPU resources and DHCP infrastructure against denial-of-service starvation attacks.

Key Concept

Layer 2 Security Feature Operations and Verification (DAI, DHCP Snooping, Port Security)
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic