Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator is implementing Layer 2 security controls across corporate access switches. Which TWO operational characteristics correctly describe how DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security function on untrusted interfaces? (Select TWO.)

  1. DHCP Snooping drops incoming DHCP server messages, such as DHCPOFFER and DHCPACK, when received on untrusted ports.Answer
  2. Dynamic ARP Inspection intercept and validate ARP packets on untrusted ports by comparing source IP and MAC addresses against the DHCP snooping binding database.Answer
  3. C
    Port security automatically saves dynamically learned sticky MAC addresses directly into the NVRAM startup-config file upon link establishment.
  4. D
    Dynamic ARP Inspection permits all ARP traffic on untrusted ports without binding validation as long as native VLAN settings match across interswitch trunks.

Answer

The correct operational behaviors are that DHCP Snooping drops DHCP server messages on untrusted ports and Dynamic ARP Inspection uses the DHCP snooping binding database to validate ARP packets on untrusted ports.
DHCP Snooping designates user-facing access ports as untrusted by default, causing any DHCP server responses (DHCPOFFER, DHCPACK) to be discarded to prevent rogue server deployment. Furthermore, Dynamic ARP Inspection (DAI) checks incoming ARP packets on untrusted ports against the IP-to-MAC bindings in the DHCP snooping table to stop ARP spoofing attacks.

Step-by-Step Solution

1
Analyze the operational rules of DHCP Snooping on untrusted interfaces.
Untrusted interfaces are designated for end-user devices. Server responses such as DHCPOFFER, DHCPACK, and DHCPLEASEQUERY are dropped to block unauthorized DHCP servers.
Ensures rogue DHCP servers cannot distribute incorrect IP addresses or gateway information.
2
Analyze how Dynamic ARP Inspection (DAI) operates on untrusted interfaces.
DAI intercepts incoming ARP requests and replies on untrusted interfaces and validates their source MAC and IP against the DHCP snooping database.
Prevents ARP poisoning and man-in-the-middle attacks.
3
Evaluate sticky MAC address storage behavior in Port Security.
Sticky MACs are placed into the running configuration in volatile memory and will be lost upon reboot if not saved.
Port security does not automatically update NVRAM.

Key Concept

Layer 2 Security Integration (DHCP Snooping, DAI, Port Security)
Estimated Time:1m 30s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic