Examkin

Question

Difficulty: HardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An administrator hardens interface GigabitEthernet1/0/5 on a Cisco Catalyst switch by executing `switchport port-security`, `switchport port-security maximum 2`, and `switchport port-security mac-address sticky`. During business hours, two authorized workstations connect to the switch port and successfully transmit data. However, following a scheduled power outage that causes an ungraceful switch reload, users report that connecting the exact same workstations to GigabitEthernet1/0/5 triggers a security violation, placing the port into an err-disabled state. Inspection via `show port-security interface gigabitEthernet1/0/5` shows a Total MAC Addresses count of 0. Which administrative oversight directly caused this loss of MAC address bindings?

  1. The administrator failed to execute `copy running-config startup-config` after the sticky MAC addresses were dynamically learned into the active configuration.Answer
  2. B
    The administrator failed to configure `ip dhcp snooping information option` on the interface to retain sticky MAC address entries across switch reboots.
  3. C
    The switch port was left in the default `protect` violation mode, which automatically flushes sticky MAC addresses upon link-down state events.
  4. D
    A native VLAN mismatch on the uplink trunk interface triggered an automatic clearing of the switch port-security dynamic address table.

Answer

The administrator failed to save the running configuration to NVRAM after the sticky MAC addresses were dynamically learned.
When port security is configured with the `mac-address sticky` feature, learned MAC addresses are dynamically added to the switch's volatile running configuration (RAM). If the administrator does not save the running configuration to the startup configuration using `copy running-config startup-config` or `write memory`, any switch reload or power cycle will restore the previous startup configuration, losing all dynamically learned sticky MAC addresses. Consequently, when endpoints reconnect after the reboot, the switch sees them as unknown MAC addresses, resulting in a port security violation.

Step-by-Step Solution

1
Analyze the operational mechanics of sticky MAC address learning.
When `switchport port-security mac-address sticky` is configured, the switch dynamically learns connected MAC addresses up to the configured maximum and appends them as `switchport port-security mac-address sticky <MAC>` lines directly into the running configuration in RAM.
Understanding where sticky MAC addresses are stored during runtime is critical to diagnosing reboot persistence issues.
2
Evaluate the effect of an ungraceful switch reload on volatile memory (RAM).
Because running-config resides in RAM, any switch reboot or reload clears all unsaved runtime entries unless they have been explicitly saved to startup-config in NVRAM.
If `copy running-config startup-config` (or `write memory`) is not executed, the running configuration reverts to the last saved startup configuration upon reload, removing all learned sticky MAC entries.
3
Correlate MAC count 0 and port security violation after reboot.
With 0 sticky MAC addresses saved, the switch treats the returning endpoints as unrecognized devices. Because maximum allowed MACs was reached or default security policies triggered, the incoming frames violate port security, driving the port into err-disabled state.
Confirms that missing configuration persistence in NVRAM is the root cause of the violation.

Key Concept

Port Security Sticky MAC Address Persistence
Estimated Time:2m 0s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic