Examkin

Question

Difficulty: Very hardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer hardens an enterprise access switch by enabling DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security. Host A acquires an IPv4 address dynamically via DHCP on interface GigabitEthernet1/0/5, where Port Security is configured with the `switchport port-security mac-address sticky` command. The engineer executes `write memory` to save the running configuration. Later, the switch experiences a power outage and reboots. DHCP Snooping database persistence was not configured with `ip dhcp snooping database`. Upon bootup, Host A attempts to communicate using its active DHCP lease without re-initiating a DHCP DORA sequence. However, all ARP traffic from Host A is dropped by the switch. What is the root cause of these frame drops?

  1. The DHCP snooping binding table was stored in volatile RAM and cleared upon reboot, leaving Dynamic ARP Inspection with no valid IP-to-MAC binding entry to validate Host A's ARP traffic.Answer
  2. B
    The sticky MAC address learned on interface GigabitEthernet1/0/5 was cleared from the startup configuration because `write memory` does not save dynamically learned sticky MAC entries.
  3. C
    Dynamic ARP Inspection dropped the ARP traffic because an untrusted port native VLAN mismatch prevented the DAI engine from performing database lookups.
  4. D
    PortFast enabled on access port GigabitEthernet1/0/5 entered a blocking state after reload, preventing Dynamic ARP Inspection from processing broadcast ARP requests.

Answer

The DHCP snooping binding database was stored in volatile RAM and cleared upon reboot, leaving Dynamic ARP Inspection with no valid IP-to-MAC binding entry to validate Host A's ARP traffic.
Dynamic ARP Inspection (DAI) relies directly on the DHCP Snooping binding database to validate ARP requests and responses arriving on untrusted ports. By default, the binding table is kept in volatile RAM. If database persistence is not configured via `ip dhcp snooping database <url>`, a switch reload erases all binding entries. When Host A retains its existing IP assignment without issuing a new DHCP request after the switch reboots, DAI finds no matching IP-to-MAC mapping in the binding table and drops Host A's ARP packets.

Step-by-Step Solution

1
Analyze the operational dependency between Dynamic ARP Inspection (DAI) and DHCP Snooping.
DAI inspects ARP packets on untrusted ports by matching their source IP and MAC addresses against the active DHCP Snooping binding table.
DAI cannot make forwarding decisions without a valid binding entry or a manually configured ARP ACL.
2
Evaluate the storage location and persistence of the DHCP Snooping database.
By default, the DHCP Snooping binding table is maintained exclusively in volatile system RAM unless `ip dhcp snooping database` is configured with a persistent URL (such as flash or TFTP/FTP).
A switch reload flushes volatile memory, completely erasing all dynamically learned bindings.
3
Correlate post-reboot client behavior with DAI validation logic.
Because Host A did not perform a new DHCP exchange after the reboot, no new entry was written to the restored empty binding table. DAI compared Host A's ARP traffic against the empty table and dropped the frames.
Saving the running configuration with `write memory` preserves CLI settings and sticky MACs, but it does not store dynamic DHCP Snooping binding database entries.

Key Concept

DAI and DHCP Snooping Database Persistence
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic