Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Match each Layer 2 security feature on the left with its primary mitigation purpose or operation on the right.

An enterprise network topology consists of Access-Switch-1 linked via trunk interface GigabitEthernet1/0/24 to Distribution-Switch-1, where the network DHCP server resides. DHCP Snooping is enabled globally and on VLAN 20 across both switches. End hosts connected to access ports on Access-Switch-1 fail to acquire dynamic IPv4 addresses. System logs on Distribution-Switch-1 indicate that incoming DHCP Discover packets arriving on interface GigabitEthernet1/0/24 are being dropped upon arrival. Which configuration oversight is the root cause of these packet drops?

Match each Cisco Layer 2 security feature to its primary function in mitigating network attacks.

A network engineer deploys Dynamic ARP Inspection (DAI) and DHCP Snooping on VLAN 30 of a Cisco Catalyst switch. A workstation connected to an untrusted access port is configured with a static IPv4 address rather than obtaining one via DHCP. When the workstation attempts to communicate with the default gateway, all of its traffic is dropped at the switch port. Which command sequence should be configured on the switch to permit ARP traffic from this statically configured host while maintaining DAI protection?

An administrator hardens interface GigabitEthernet1/0/5 on a Cisco Catalyst switch by executing `switchport port-security`, `switchport port-security maximum 2`, and `switchport port-security mac-address sticky`. During business hours, two authorized workstations connect to the switch port and successfully transmit data. However, following a scheduled power outage that causes an ungraceful switch reload, users report that connecting the exact same workstations to GigabitEthernet1/0/5 triggers a security violation, placing the port into an err-disabled state. Inspection via `show port-security interface gigabitEthernet1/0/5` shows a Total MAC Addresses count of 0. Which administrative oversight directly caused this loss of MAC address bindings?

A network administrator enables Dynamic ARP Inspection (DAI) on a switch access VLAN to mitigate ARP spoofing attacks. Which database does DAI consult by default to validate ARP requests and responses received on untrusted ports?

When DHCP snooping is enabled globally on a Cisco switch, what default trust state is assigned to all Layer 2 interfaces across the switch?

A network technician configures port security on an access switch interface using the command `switchport port-security mac-address sticky`. Which TWO statements accurately describe how sticky MAC address learning operates on this interface?

A network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to prevent ARP spoofing. DHCP snooping is enabled and functioning properly. However, several servers connected to untrusted access ports use statically assigned IP addresses, causing DAI to drop their legitimate ARP requests because they lack entries in the DHCP snooping binding database. Which configuration action should the administrator perform to permit ARP traffic from these static servers while maintaining DAI protection on VLAN 10?

A network administrator wants to restrict access on a switch port to an authorized end device. If an unauthorized MAC address sends traffic to the port, the interface must drop the frames, avoid incrementing the security violation counter, and avoid disabling the port. Which port security violation mode meets this requirement?

An enterprise network administrator configures Dynamic ARP Inspection (DAI) on VLAN 10 using the command `ip arp inspection vlan 10`. Host devices dynamically receiving IPv4 configuration via DHCP operate without issue. However, a critical server connected to access switchport GigabitEthernet0/2 in VLAN 10 is configured with a static IPv4 address ($192.168.10.50/24$) and MAC address ($0011.2233.4455$). Network telemetry indicates that all network traffic from this server is dropped because DAI marks its ARP packets as invalid. Which configuration step correctly resolves the ARP packet drop for this static host while maintaining active DAI protection on VLAN 10?

Match each Layer 2 security mechanism or feature component on the left with its corresponding operational behavior on the right.

An network administrator is troubleshooting traffic drops on switch port GigabitEthernet1/0/10. The interface is configured with Layer 2 security features including DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security in restrict mode. The output of `show ip dhcp snooping binding` displays a valid IP-to-MAC entry for the connected client on GigabitEthernet1/0/10. However, executing `show port-security interface g1/0/10` shows that the `SecurityViolation` counter is actively incrementing every time the host attempts to transmit data, while the port status remains operational (`secure-up`). Which scenario accounts for these symptoms?

A network administrator is deploying Layer 2 security controls on a Cisco Catalyst switch. Which two statements accurately describe the operational requirements and default behaviors of DHCP Snooping? (Select two.)

A network administrator configures switchport port security on a Cisco Catalyst switch access port using the command 'switchport port-security mac-address sticky'. An end device is connected to the port, and the switch dynamically learns its MAC address into the running configuration. The administrator verifies full network connectivity, but does not enter any additional CLI commands before the switch undergoes an unexpected reboot. Which outcome occurs regarding the port security bindings after the switch reboots?

A network engineer completes the configuration of Layer 2 security features on a Cisco Catalyst switch connecting client workstations to an upstream router. After enabling DHCP snooping and Dynamic ARP Inspection (DAI) globally and on VLAN 20, client devices on untrusted access ports fail to obtain IPv4 addresses from the DHCP server, and ARP packets arriving from the default gateway on interface GigabitEthernet0/1 are discarded by DAI. Which two configuration steps are required on interface GigabitEthernet0/1 to resolve these issues? (Select two.)

A network engineer hardens an enterprise access switch by enabling DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security. Host A acquires an IPv4 address dynamically via DHCP on interface GigabitEthernet1/0/5, where Port Security is configured with the `switchport port-security mac-address sticky` command. The engineer executes `write memory` to save the running configuration. Later, the switch experiences a power outage and reboots. DHCP Snooping database persistence was not configured with `ip dhcp snooping database`. Upon bootup, Host A attempts to communicate using its active DHCP lease without re-initiating a DHCP DORA sequence. However, all ARP traffic from Host A is dropped by the switch. What is the root cause of these frame drops?

A network engineer is analyzing connectivity failures on a Cisco Catalyst switch serving VLAN 20. DHCP Snooping and Dynamic ARP Inspection (DAI) are globally enabled and configured on VLAN 20. Users connected to access ports report that they fail to receive DHCP IP addresses, valid ARP requests from hosts are dropped by the switch engine, and port-security sticky MAC addresses learned on access port GigabitEthernet0/2 were lost following a switch reboot.

Which TWO administrative actions are required to resolve the DHCP/DAI packet drops and permanently persist the learned sticky MAC addresses across switch reboots? (Select TWO.)

A network administrator is implementing Layer 2 security controls on a Cisco Catalyst access switch to defend against rogue DHCP servers, ARP poisoning, and unauthorized MAC address access. Match each Layer 2 security configuration command or feature component on the left to its corresponding operational behavior on the right.

A network engineer is configuring Layer 2 security controls on access switches to protect against man-in-the-middle attacks and rogue server deployments. Which two statements accurately describe the operational behaviors of DHCP Snooping and Dynamic ARP Inspection (DAI)? (Select two.)