Soru

Zorluk: OrtaLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator is implementing Layer 2 security controls on a Cisco Catalyst access switch to defend against rogue DHCP servers, ARP poisoning, and unauthorized MAC address access. Match each Layer 2 security configuration command or feature component on the left to its corresponding operational behavior on the right.

  • DHCP Snooping Binding DatabaseStores dynamically learned client MAC-to-IP bindings from untrusted interfaces to validate DHCP and ARP traffic.
  • switchport port-security violation restrictDrops unauthorized frames, increments the security violation counter, and generates a syslog message without placing the port in err-disabled state.
  • ip arp inspection validate src-macCompares the source MAC address in the Layer 2 Ethernet header against the sender MAC address inside the ARP payload.
  • ip dhcp snooping trustConfigures an interface to allow incoming DHCP server responses such as DHCP OFFER and DHCP ACK packets.

Cevap

DHCP Snooping Binding Database matches storing dynamically learned client MAC-to-IP bindings from untrusted interfaces to validate DHCP and ARP traffic. 'switchport port-security violation restrict' matches dropping unauthorized frames, incrementing the violation counter, and sending syslog alerts without shutting down the interface. 'ip arp inspection validate src-mac' matches checking that the Ethernet header source MAC matches the ARP payload sender MAC. 'ip dhcp snooping trust' matches designating an interface allowed to receive DHCP server responses like DHCP OFFER and ACK.
The correct pairings align each command or component to its exact technical operation under Cisco IOS Layer 2 security. DHCP Snooping Binding Database stores client MAC-to-IP mappings. Restrict mode drops offending traffic while logging alerts. DAI src-mac validation compares Ethernet header MAC with ARP payload MAC. Interface DHCP snooping trust allows server messages through uplink ports.

Adım Adım Çözüm

1
Analyze DHCP Snooping Database role
Identify that the binding database stores client IP, MAC, VLAN, and port mapping collected from untrusted ports during DHCP transactions.
This database serves as the authoritative source for validating future IP traffic and ARP inspection requests.
2
Evaluate Port Security Restrict mode behavior
Differentiate restrict mode from protect mode (which drops quietly without logging) and shutdown mode (which disables the port).
Restrict mode drops non-matching MAC frames while generating a log notification and incrementing the violation counter.
3
Examine DAI src-mac validation criteria
Recognize that 'ip arp inspection validate src-mac' explicitly verifies header consistency between Ethernet source MAC and ARP payload sender MAC.
This prevents spoofed MAC attacks where the frame header MAC differs from the internal ARP packet contents.
4
Determine DHCP Snooping Trust configuration requirement
Associate interface-level 'ip dhcp snooping trust' with permitting server-originated messages.
Untrusted ports drop DHCP server packets (OFFER, ACK) by default to prevent rogue DHCP server insertion.

Anahtar Kavram

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)
Bu soruyu puanla