Soru

Zorluk: OrtaLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding operational behavior on the right.

  • Port Security (Restrict Mode)Drops unauthorized frames, increments the security violation counter, and generates a Syslog notification while keeping the port operational.
  • DHCP Snooping Untrusted InterfaceBlocks incoming DHCP server responses (such as DHCPOFFER and DHCPACK) and inspects client messages to build the binding database.
  • Dynamic ARP Inspection (DAI)Intercepts and validates incoming ARP requests and responses on untrusted ports against the IP-to-MAC binding table.
  • Port Security (Sticky MAC)Dynamically learns source MAC addresses and adds them to the running-config as secure MAC address entries.

Cevap

Port Security (Restrict Mode) matches with dropping unauthorized frames, incrementing the violation counter, and logging without shutting the interface down. DHCP Snooping Untrusted Interface matches with blocking incoming DHCP server responses and building the binding table from client traffic. Dynamic ARP Inspection (DAI) matches with intercepting and validating ARP packets against the binding database. Port Security (Sticky MAC) matches with dynamically adding learned MAC addresses as secure entries in the running configuration.
Each feature maps to its exact Cisco IOS operational behavior: Restrict mode logs and drops without disabling the port; DHCP Snooping untrusted ports drop server responses; DAI validates ARP frames against the DHCP binding table; and Sticky MAC converts dynamically learned addresses into running-config entries.

Adım Adım Çözüm

1
Analyze Port Security violation modes
Identify that 'restrict' drops traffic, logs a message, and increments counters without disabling the port (unlike 'shutdown' mode which err-disables the interface).
Differentiating between protect, restrict, and shutdown modes is essential for Layer 2 access control.
2
Analyze DHCP Snooping interface roles
Recognize that untrusted ports drop DHCP server response packets (DHCPOFFER, DHCPACK) to prevent rogue DHCP server attacks.
DHCP Snooping enforces trust boundaries between user access ports (untrusted) and legitimate DHCP server ports (trusted).
3
Analyze Dynamic ARP Inspection mechanics
Confirm DAI checks incoming ARP packets on untrusted interfaces against the DHCP Snooping IP-to-MAC binding database.
DAI depends on the integrity of the DHCP Snooping binding table to mitigate man-in-the-middle ARP spoofing.
4
Analyze Sticky MAC address persistence
Verify that sticky MAC learning places dynamically discovered MAC addresses directly into the active running configuration.
Sticky MAC addresses persist in memory until saved to startup-config via copy running-config startup-config.

Anahtar Kavram

Layer 2 security mitigations (Port Security violation modes, DHCP Snooping trust roles, and Dynamic ARP Inspection validation mechanics).
Bu soruyu puanla