A network administrator is implementing Layer 2 security controls on a Cisco Catalyst access switch to defend against rogue DHCP servers, ARP poisoning, and unauthorized MAC address access. Match each Layer 2 security configuration command or feature component on the left to its corresponding operational behavior on the right.
- DHCP Snooping Binding DatabaseStores dynamically learned client MAC-to-IP bindings from untrusted interfaces to validate DHCP and ARP traffic.
- switchport port-security violation restrictDrops unauthorized frames, increments the security violation counter, and generates a syslog message without placing the port in err-disabled state.
- ip arp inspection validate src-macCompares the source MAC address in the Layer 2 Ethernet header against the sender MAC address inside the ARP payload.
- ip dhcp snooping trustConfigures an interface to allow incoming DHCP server responses such as DHCP OFFER and DHCP ACK packets.
Cevap
DHCP Snooping Binding Database matches storing dynamically learned client MAC-to-IP bindings from untrusted interfaces to validate DHCP and ARP traffic. 'switchport port-security violation restrict' matches dropping unauthorized frames, incrementing the violation counter, and sending syslog alerts without shutting down the interface. 'ip arp inspection validate src-mac' matches checking that the Ethernet header source MAC matches the ARP payload sender MAC. 'ip dhcp snooping trust' matches designating an interface allowed to receive DHCP server responses like DHCP OFFER and ACK.
The correct pairings align each command or component to its exact technical operation under Cisco IOS Layer 2 security. DHCP Snooping Binding Database stores client MAC-to-IP mappings. Restrict mode drops offending traffic while logging alerts. DAI src-mac validation compares Ethernet header MAC with ARP payload MAC. Interface DHCP snooping trust allows server messages through uplink ports.
Adım Adım Çözüm
Anahtar Kavram
Layer 2 Security Features (Port Security, DHCP Snooping, DAI)