Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator configures port security on access interface GigabitEthernet0/1 of a Cisco Catalyst switch by executing `switchport port-security` and `switchport port-security mac-address sticky`. Hosts connect successfully and their MAC addresses are dynamically learned by the switch. However, after an unscheduled switch reboot, the administrator discovers that the dynamically learned MAC addresses were removed and hosts must re-trigger learning. Which operational step was omitted prior to the switch restart?

  1. Saving the running configuration to the startup configuration in NVRAM using the `copy running-config startup-config` command.Answer
  2. B
    Configuring static aging with the `switchport port-security aging type static` interface command.
  3. C
    Setting the port security violation mode to restrict using the `switchport port-security violation restrict` command.
  4. D
    Enabling DHCP Snooping globally to populate the Layer 2 port security binding table automatically.

Answer

The network administrator omitted saving the running configuration to the startup configuration using the `copy running-config startup-config` command.
When `switchport port-security mac-address sticky` is configured, the switch dynamically adds learned MAC addresses into the active `running-config` file. Because `running-config` resides in volatile RAM memory, any dynamically learned MAC addresses are lost upon a reboot unless the administrator explicitly copies the running configuration to the startup configuration using `copy running-config startup-config` (or `write memory`).

Step-by-Step Solution

1
Analyze how sticky MAC addresses operate in Cisco Port Security.
When sticky MAC learning is enabled (`switchport port-security mac-address sticky`), the switch dynamically learns MAC addresses and writes them directly into the running configuration (`running-config`) as static-like entries.
Sticky MAC learning converts dynamically learned addresses into running configuration entries.
2
Evaluate the behavior of running-config during a switch reload.
RAM memory housing `running-config` is volatile. Unless `running-config` is saved to `startup-config` in NVRAM, all unsaved dynamic sticky MAC entries are erased when the switch reboots.
Volatile memory contents do not survive system reboots.
3
Identify the missing command required for persistence.
Executing `copy running-config startup-config` (or `write memory`) copies the learned sticky MAC entries into non-volatile memory so they load automatically upon boot.
Saving the configuration persists sticky MAC addresses across reboots.

Key Concept

Port Security Sticky MAC Persistence across Switch Reboots
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic