Examkin

Soru

Zorluk: OrtaLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer is implementing Layer 2 security controls across access switches in an enterprise network. The design requires deploying Dynamic ARP Inspection (DAI) alongside DHCP Snooping to mitigate ARP spoofing attacks. Which TWO statements correctly describe the operational interactions and interface trust requirements for these features?

  1. DAI inspects incoming ARP requests and responses on untrusted interfaces by validating the IP-to-MAC mapping against the DHCP snooping binding database.Cevap
  2. Access ports connected to end-user host workstations should be configured as untrusted for both DHCP Snooping and Dynamic ARP Inspection.Cevap
  3. C
    Enabling DHCP Snooping automatically persists dynamically learned host bindings into the startup configuration file without requiring manual administrative saves.
  4. D
    DAI bypasses ARP packet inspection on untrusted ports if an 802.1Q native VLAN ID mismatch is detected across inter-switch trunks.

Cevap

The correct statements are that DAI inspects incoming ARP packets on untrusted interfaces against the DHCP snooping binding database, and that user-facing access ports must be set as untrusted for both security features.
Dynamic ARP Inspection (DAI) relies directly on the binding table populated by DHCP Snooping to validate ARP packets received on untrusted ports. In standard Layer 2 security deployments, host-facing access ports are designated as untrusted for both DHCP Snooping (blocking rogue DHCP server offers) and DAI (blocking spoofed ARP announcements).

Adım Adım Çözüm

1
Analyze how Dynamic ARP Inspection (DAI) operates on untrusted interfaces.
DAI intercepts all ARP requests and responses on untrusted ports and verifies their IP-to-MAC bindings using the DHCP snooping binding database or static ARP ACLs.
This mechanism prevents man-in-the-middle ARP poisoning attacks on the local switch segment.
2
Evaluate port trust configurations for host-facing interfaces.
Access ports connecting client endpoints must remain untrusted for both DHCP Snooping and DAI.
Untrusted ports are subjected to rate limiting and packet validation checks to block unauthorized DHCP responses and spoofed ARP replies.
3
Evaluate misconceptions regarding database persistence and trunk VLAN mismatches.
Dynamic bindings are stored in RAM and not automatically written to startup-config. Furthermore, native VLAN mismatches affect trunking semantics but do not disable DAI filtering.
Understanding feature isolation prevents incorrect troubleshooting assumptions regarding switch state saving and multi-vlan trunking errors.

Anahtar Kavram

Dynamic ARP Inspection (DAI) and DHCP Snooping Integration and Port Trust States
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru