Match each Cisco Layer 2 security feature or operational state on the left to its corresponding operational behavior on the right.
- Port Security (Restrict Mode)Drops unauthorized frames, increments the security violation counter, and generates a Syslog notification while keeping the port operational.
- DHCP Snooping Untrusted InterfaceBlocks incoming DHCP server responses (such as DHCPOFFER and DHCPACK) and inspects client messages to build the binding database.
- Dynamic ARP Inspection (DAI)Intercepts and validates incoming ARP requests and responses on untrusted ports against the IP-to-MAC binding table.
- Port Security (Sticky MAC)Dynamically learns source MAC addresses and adds them to the running-config as secure MAC address entries.
Cevap
Port Security (Restrict Mode) matches with dropping unauthorized frames, incrementing the violation counter, and logging without shutting the interface down. DHCP Snooping Untrusted Interface matches with blocking incoming DHCP server responses and building the binding table from client traffic. Dynamic ARP Inspection (DAI) matches with intercepting and validating ARP packets against the binding database. Port Security (Sticky MAC) matches with dynamically adding learned MAC addresses as secure entries in the running configuration.
Each feature maps to its exact Cisco IOS operational behavior: Restrict mode logs and drops without disabling the port; DHCP Snooping untrusted ports drop server responses; DAI validates ARP frames against the DHCP binding table; and Sticky MAC converts dynamically learned addresses into running-config entries.
Adım Adım Çözüm
Anahtar Kavram
Layer 2 security mitigations (Port Security violation modes, DHCP Snooping trust roles, and Dynamic ARP Inspection validation mechanics).