Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

Match each Layer 2 security mechanism or feature component on the left with its corresponding operational behavior on the right.

  • DHCP Snooping Binding DatabaseTracks client MAC addresses, assigned IP addresses, lease times, VLAN IDs, and interface bindings.
  • Dynamic ARP Inspection (DAI)Intercepts and validates IP-to-MAC address bindings in ARP packets received on untrusted ports.
  • Port Security Sticky MAC LearningConverts dynamically learned source MAC addresses into running configuration entries on an interface.
  • DAI Interface Rate LimitingPrevents ARP flooding attacks by enforcing a maximum threshold of incoming ARP packets per second.

Answer

DHCP Snooping Binding Database maps to tracking client MAC, IP, lease, VLAN, and interface details. Dynamic ARP Inspection matches intercepting and validating IP-to-MAC bindings in ARP packets on untrusted ports. Port Security Sticky MAC Learning matches dynamically converting learned MAC addresses into running configuration entries. DAI Interface Rate Limiting matches enforcing a maximum threshold of incoming ARP packets per second.
Each feature component directly performs its specified security role: DHCP Snooping creates the authoritative binding database; DAI utilizes that database to validate ARP packets on untrusted interfaces; Sticky MAC learning writes dynamically learned MACs into the running configuration; and DAI rate limiting protects switch hardware by capping incoming ARP frames per second.

Step-by-Step Solution

1
Analyze the operational function of DHCP Snooping.
DHCP snooping acts as a firewall between untrusted hosts and DHCP servers, building a binding database containing IP address, MAC address, lease time, bind type, VLAN number, and interface information.
This database serves as the authoritative mapping reference for other Layer 2 features such as DAI and IP Source Guard.
2
Analyze the operational function of Dynamic ARP Inspection (DAI).
DAI inspects ARP packets on untrusted interfaces to prevent ARP poisoning and man-in-the-middle attacks.
DAI discards invalid ARP packets where the Sender IP and Sender MAC do not match an entry in the DHCP snooping binding database.
3
Analyze the function of sticky MAC learning in Port Security.
Sticky MAC learning dynamically converts learned MAC addresses into sticky addresses that are automatically added to the running-config file.
This eliminates the need to manually enter static MAC addresses on switchports while maintaining MAC persistence across reboots if saved.
4
Analyze DAI interface rate limiting.
Enforcing an ARP rate limit drops excess ARP packets when incoming packet rates exceed the configured threshold per second.
Rate limiting protects the switch CPU from control plane starvation caused by ARP flooding attacks.

Key Concept

Layer 2 Security Feature Operation and Interdependencies
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic