Question

Difficulty: MediumKey Security Concepts, Threats, Vulnerabilities, and Mitigations

An administrator configures port security on an enterprise access switch interface using the switchport port-security mac-address sticky command to restrict network access to authorized devices. Endpoints connect successfully and their hardware addresses are added to the active configuration as sticky entries. Following an unexpected power maintenance event, the switch reboots. When the authorized endpoints attempt to reconnect, port security violation alerts are triggered and traffic is blocked. Which administrative oversight caused this issue after the switch rebooted?

  1. The administrator failed to save the running configuration to the startup configuration after the sticky MAC addresses were learned.Answer
  2. B
    The administrator failed to append an explicit permit statement to override the default interface port security implicit deny clause.
  3. C
    The administrator selected TACACS+ authentication instead of RADIUS, which prevented local MAC address persistence across reboots.
  4. D
    The administrator omitted the overload parameter when enabling port security on the physical switch interface.

Answer

The administrator failed to copy the running configuration containing the learned sticky MAC addresses to the startup configuration prior to the reboot.
The command switchport port-security mac-address sticky dynamically learns connected MAC addresses and converts them into sticky secure MAC address entries in the running configuration (stored in volatile RAM). If the administrator does not save the running configuration to the startup configuration (stored in NVRAM) using copy running-config startup-config or write memory, all learned MAC addresses are lost upon reboot. When the switch comes back online, its sticky MAC table is empty, causing returning authorized devices to be flagged as unknown/unauthorized and triggering security violations.

Step-by-Step Solution

1
Analyze how sticky MAC address learning operates in Cisco IOS port security.
When sticky MAC learning is enabled, dynamically learned MAC addresses are automatically added to the running configuration (RAM).
Sticky MAC entries allow dynamic learning without requiring manual static MAC entry CLI typing.
2
Evaluate the effect of a device reboot on RAM vs. NVRAM.
Unsaved changes stored only in RAM (running configuration) are erased when the switch reboots.
Only startup configuration stored in NVRAM persists across switch reboots.
3
Determine why violations occurred post-reboot.
Because the sticky MAC entries were erased during the reboot, reconnecting devices were treated as unauthorized MAC addresses, triggering port security violations.
Saving the configuration with copy running-config startup-config is mandatory to persist sticky MAC entries across reboots.

Key Concept

Port Security Sticky MAC Address Persistence
Rate this question