Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

Following an unexpected reboot of an enterprise access switch, users connected to interface GigabitEthernet1/0/12 report a complete loss of network connectivity. Upon investigation, the network administrator discovers that the dynamically learned MAC address added to the port security table prior to the switch reload is missing, causing the switch to reject traffic from the connected workstation. Which administrative action was omitted prior to the reboot that resulted in the loss of the sticky MAC address?

  1. Saving the running configuration to the startup configuration in NVRAM using the command `copy running-config startup-config`.Answer
  2. B
    Manually converting each learned MAC address into a static port-security entry using `switchport port-security mac-address MAC_ADDRESS`.
  3. C
    Configuring the interface native VLAN to match the trunk encapsulation parameter on uplink interfaces.
  4. D
    Adding an `ip helper-address` statement on the access switch port to forward binding database updates to non-volatile memory.

Answer

Saving the running configuration to the startup configuration in NVRAM using the command `copy running-config startup-config`.
The correct answer identifies that executing `copy running-config startup-config` is required to save dynamically learned sticky MAC entries from volatile RAM into NVRAM. Enabling sticky port security causes the switch to dynamically append learned MAC addresses into the running configuration. However, because RAM contents are lost during a reboot, failing to save the running configuration causes the switch to start up without those learned MAC addresses.

Step-by-Step Solution

1
Analyze how Port Security sticky MAC learning functions during switch operation.
When sticky learning is enabled with `switchport port-security mac-address sticky`, dynamically learned MAC addresses are converted into standard `switchport port-security mac-address sticky <MAC>` lines in the running configuration (RAM).
Sticky MAC learning dynamically converts dynamically learned addresses into running configuration statements so they behave similarly to statically configured addresses.
2
Evaluate the volatility of RAM versus non-volatile RAM (NVRAM) across switch reboots.
The running configuration stored in RAM is cleared whenever the switch reboots or loses power.
Changes in RAM must be explicitly copied to startup-config in NVRAM using `copy running-config startup-config` or `write memory` to survive a system reload.
3
Determine the root cause of the missing MAC address post-reboot.
Because the administrator failed to save the running configuration after the MAC address was learned, the running configuration reverted back to the startup configuration without the learned sticky MAC address entries.
Failing to save running-config to startup-config causes all dynamically learned sticky entries to be wiped upon switch reboot.

Key Concept

Port Security Sticky MAC Persistence across Reboots
Estimated Time:1m 15s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic