Examkin

Question

Difficulty: Very hardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An network administrator is troubleshooting traffic drops on switch port GigabitEthernet1/0/10. The interface is configured with Layer 2 security features including DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security in restrict mode. The output of `show ip dhcp snooping binding` displays a valid IP-to-MAC entry for the connected client on GigabitEthernet1/0/10. However, executing `show port-security interface g1/0/10` shows that the `SecurityViolation` counter is actively incrementing every time the host attempts to transmit data, while the port status remains operational (`secure-up`). Which scenario accounts for these symptoms?

  1. The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.Answer
  2. B
    The switch was rebooted after host MAC addresses were learned via sticky configuration, but the running configuration was never saved to startup-config.
  3. C
    Dynamic ARP Inspection is dropping frames because GigabitEthernet1/0/10 was incorrectly configured as a trusted interface for DHCP Snooping.
  4. D
    Native VLAN mismatch on the access link is causing DHCP Snooping to discard incoming frame headers prior to port security processing.

Answer

The host interface card was recently replaced, generating a new source MAC address that causes a Port Security violation while DHCP successfully issued a lease for the new MAC.
The correct answer accounts for both symptoms: a valid DHCP Snooping entry and an incrementing Port Security violation counter. When a host NIC is replaced, the new MAC address successfully requests a DHCP lease (creating a valid DHCP Snooping database entry and allowing DAI validation to pass). However, because Port Security was configured with sticky MAC learning or a explicit MAC limit, the newly introduced MAC address violates port security parameters. In restrict mode, Port Security drops non-matching frames and increments the SecurityViolation counter without disabling the port.

Step-by-Step Solution

1
Analyze the reported operational symptoms
Port status is secure-up, SecurityViolation counter is incrementing, and DHCP Snooping binding table contains a valid entry.
Identify which security feature is actively dropping traffic.
2
Evaluate Port Security violation mode behavior
Restrict mode drops frames from unauthorized source MAC addresses, increments the violation counter, and logs a Syslog message while keeping the interface up.
The incrementing violation counter indicates Port Security is triggering, not DAI or DHCP Snooping.
3
Correlate DHCP Snooping binding presence with Port Security failure
The host successfully completed a DHCP exchange (populating the binding table), but its source MAC address does not match the statically or dynamically learned sticky MAC address on the port security database.
A replaced network interface card generates a new MAC address. DHCP Snooping will grant an IP and record the new MAC, but Port Security will block the frame if the maximum MAC address limit or specific sticky MAC entry is exceeded.

Key Concept

Port Security violation modes and multi-feature Layer 2 security interaction
Estimated Time:2m 0s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic