Examkin

Question

Difficulty: EasyLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

Match each Cisco Layer 2 security feature to its primary function in mitigating network attacks.

  • Port SecurityLimits and identifies authorized MAC addresses permitted to send traffic on an access switch port.
  • DHCP SnoopingFilters untrusted DHCP messages and constructs an IP-to-MAC binding database.
  • Dynamic ARP Inspection (DAI)Intercepts ARP requests and responses on untrusted ports to verify IP-to-MAC bindings against a database.

Answer

Port Security pairs with restricting MAC addresses allowed on an interface. DHCP Snooping pairs with filtering rogue DHCP server packets and maintaining the DHCP binding database. Dynamic ARP Inspection pairs with validating ARP packets against the DHCP binding database.
Port Security controls frame forwarding by restricting access to specified MAC addresses. DHCP Snooping protects against rogue DHCP servers and creates the IP-to-MAC binding table. Dynamic ARP Inspection inspects ARP packets against this binding table to stop ARP poisoning.

Step-by-Step Solution

1
Determine the primary operational role of Port Security.
Port Security restricts interface access based on learned or configured MAC addresses.
It prevents unauthorized devices from attaching to switch ports and limits MAC flooding.
2
Determine the primary operational role of DHCP Snooping.
DHCP Snooping acts as a L2 firewall between untrusted hosts and DHCP servers.
It drops unauthorized DHCP server offers on untrusted ports and populates the IP-to-MAC binding table.
3
Determine the primary operational role of Dynamic ARP Inspection (DAI).
DAI inspects ARP packets on untrusted switch interfaces.
It uses the binding database established by DHCP Snooping to validate ARP requests and responses, mitigating man-in-the-middle attacks.

Key Concept

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic