Examkin

Soru

Zorluk: Çok zorLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

In enterprise Cisco switch implementations, Layer 2 security controls govern frame processing, metadata insertion, and hardware lookup behaviors. Match each Layer 2 security operation or feature context to its exact functional mechanism.

  • Port Security Restrict Violation ModeDrops frames with unauthorized source MAC addresses, increments the violation counter, and generates Syslog/SNMP messages without disabling the interface.
  • Dynamic ARP Inspection (DAI) Payload ValidationIntercepts packets on untrusted ports and compares the sender IP and MAC addresses embedded inside the ARP packet payload against valid bindings.
  • DHCP Snooping Option 82 InsertionAppends relay agent information (circuit ID and remote ID sub-options) to client requests received on untrusted ports before forwarding to trusted ports.
  • DAI ARP Access Control List (ARP ACL) Inspection FilterEvaluates incoming ARP packets against explicitly configured static IP-to-MAC rules before checking the DHCP snooping binding database for non-DHCP hosts.

Cevap

Port Security Restrict Violation Mode matches with dropping frames, incrementing violation counters, and logging syslogs without err-disabling the port. Dynamic ARP Inspection Payload Validation matches with intercepting ARP packets on untrusted ports and inspecting payload sender IP/MAC pairs against bindings. DHCP Snooping Option 82 Insertion matches with appending relay agent circuit/remote ID metadata to client requests on untrusted ports. DAI ARP ACL Inspection Filter matches with evaluating static IP-to-MAC rules prior to checking the DHCP snooping database.
Each feature pair matches its fundamental operational behavior. Port Security restrict mode drops frames and logs alerts without placing the port in err-disabled status. DAI inspects inner ARP payload fields on untrusted ports against the binding database. DHCP Snooping Option 82 appends relay agent sub-options to requests arriving on untrusted ports. DAI ARP ACL filters allow manually configured static IP-to-MAC checks before querying dynamic DHCP bindings.

Adım Adım Çözüm

1
Analyze Port Security Restrict Violation Mode
Identify that restrict mode drops unauthorized frames, increments the violation counter, and generates SNMP/syslog alerts while maintaining interface link state up/up.
Differentiates restrict mode from protect mode (which drops silently without logging) and shutdown mode (which disables the interface).
2
Analyze Dynamic ARP Inspection (DAI) Payload Validation
Identify that DAI inspects the inner ARP payload fields (sender MAC and sender IP) on untrusted ports against the DHCP snooping binding database.
Prevents ARP poisoning attacks by verifying MAC-to-IP resolution integrity at Layer 2.
3
Analyze DHCP Snooping Option 82 Insertion
Identify that Option 82 appends circuit ID and remote ID sub-options to DHCP requests on untrusted ports before forwarding toward trusted DHCP servers.
Enables upstream DHCP servers to apply localized IP allocation policies based on switch port location.
4
Analyze DAI ARP ACL Inspection Filter
Identify that ARP ACLs provide static mapping validation override prior to falling back to the dynamic DHCP snooping binding database lookup.
Required to prevent DAI from dropping valid ARP packets generated by static IP assigned hosts that lack DHCP lease entries.

Anahtar Kavram

Operational mechanics of Layer 2 security features including Port Security violation handling, DHCP Snooping Option 82 insertion, DAI payload validation, and ARP ACL filtering.
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru