Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

Match each Cisco Layer 2 security feature or interface trust state on the left with its correct operational behavior or dependency on the right.

  • Dynamic ARP Inspection (DAI)Intercepts and validates incoming ARP requests and responses against valid IP-to-MAC mappings before forwarding.
  • DHCP Snooping Untrusted InterfaceDrops incoming DHCP server message types (such as OFFER, ACK, and LEASEQUERY) to prevent rogue DHCP server attacks.
  • Port Security Sticky MAC LearningDynamically learns connected source MAC addresses and adds them directly to the running configuration.
  • DHCP Snooping Binding DatabaseTracks IP address assignments, MAC addresses, VLAN IDs, and interface bindings required by DAI and IP Source Guard.

Answer

Dynamic ARP Inspection matches with validating ARP packets against IP-to-MAC mappings. DHCP Snooping Untrusted Interface matches with dropping unauthorized DHCP server responses. Port Security Sticky MAC Learning matches with adding dynamically learned MAC addresses to the running configuration. DHCP Snooping Binding Database matches with tracking IP, MAC, VLAN, and interface bindings.
Dynamic ARP Inspection operates by validating incoming ARP packets against trusted IP-to-MAC bindings stored in the DHCP snooping binding database. An untrusted DHCP snooping interface blocks incoming server response messages (OFFER/ACK) to prevent rogue DHCP server deployment. Port Security sticky MAC learning writes dynamically learned host MAC addresses directly into the running configuration. The DHCP Snooping Binding Database stores client IP, MAC, VLAN, and port associations which are referenced by security features like DAI.

Step-by-Step Solution

1
Analyze Dynamic ARP Inspection (DAI) functionality
DAI inspects ARP packets on untrusted ports and compares their source MAC and IP against trusted database entries.
DAI mitigates ARP spoofing by verifying ARP packet payload integrity.
2
Analyze DHCP Snooping interface trust states
Untrusted ports only permit DHCP client requests (DISCOVER, REQUEST); server responses (OFFER, ACK) are dropped.
Access ports default to untrusted to prevent unauthorized rogue DHCP servers.
3
Analyze Port Security sticky MAC learning behavior
Learned MAC addresses are written to the running configuration under the interface context.
Sticky MAC allows automatic MAC learning while preserving learned entries across link resets without manual static entry.
4
Identify the role of the DHCP Snooping Binding Database
It holds the IP-MAC-VLAN-Port binding entries populated by DHCP ACK messages.
Other L2 security mechanisms like DAI rely on this database to validate packets.

Key Concept

Layer 2 Security Mechanisms and Dependencies (Port Security, DHCP Snooping, DAI)
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic