Examkin

Soru

Zorluk: ZorLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

Match each Layer 2 security feature or operational scenario on the left to its corresponding switch behavior or implementation detail on the right.

  • DHCP Snooping Option 82 insertion on untrusted access portsAppends relay agent information (circuit ID and remote ID) to broadcast client requests before forwarding them upstream.
  • Dynamic ARP Inspection (DAI) evaluation with static ARP ACLsChecks IP-to-MAC mappings against configured ARP access lists prior to querying the DHCP snooping binding table.
  • Port Security set to 'restrict' violation modeDrops frames from unauthorized MAC addresses, increments the violation counter, and generates SNMP traps/Syslog messages without disabling the port.
  • DHCP Snooping binding database constructionRecords the host MAC address, leased IP address, lease duration, binding type, VLAN ID, and port interface upon intercepting a DHCPACK.

Cevap

DHCP Snooping Option 82 insertion on untrusted access ports matches appending relay agent information (circuit ID and remote ID) to broadcast client requests before forwarding them upstream. Dynamic ARP Inspection (DAI) evaluation with static ARP ACLs matches checking IP-to-MAC mappings against configured ARP access lists prior to querying the DHCP snooping binding table. Port Security set to 'restrict' violation mode matches dropping frames from unauthorized MAC addresses, incrementing the violation counter, and generating SNMP traps/Syslog messages without disabling the port. DHCP Snooping binding database construction matches recording the host MAC address, leased IP address, lease duration, binding type, VLAN ID, and port interface upon intercepting a DHCPACK.
Each feature corresponds to its specific L2 operational behavior: DHCP Snooping Option 82 appends relay agent sub-options on untrusted ports; static ARP ACLs take precedence in DAI evaluation before querying the snooping database; restrict mode drops violating frames and generates Syslog/SNMP notifications without disabling the port; and the DHCP snooping binding database extracts host mappings from DHCPACK packets received on trusted ports.

Adım Adım Çözüm

1
Analyze DHCP Snooping Option 82 functionality on untrusted ports.
Confirm Option 82 attaches sub-options (circuit ID and remote ID) to client requests on untrusted interfaces.
Option 82 provides relay agent details to the DHCP server to aid subnet allocation and security enforcement.
2
Evaluate Dynamic ARP Inspection (DAI) processing hierarchy.
Confirm static ARP ACLs take precedence over the DHCP snooping binding table during DAI validation.
Configuring `ip arp inspection filter` allows static hosts to pass DAI validation without needing dynamic DHCP snooping entries.
3
Differentiate Port Security violation modes (protect, restrict, shutdown).
Identify 'restrict' mode as dropping unauthorized traffic, logging via Syslog/SNMP, and keeping the interface active.
'Restrict' mode generates alert notifications and tracks violation statistics without causing an error-disabled port shutdown.
4
Examine DHCP Snooping binding table creation criteria.
Verify that snooping tracks DHCPACK messages to store host MAC, IP, lease time, binding type, VLAN, and interface details.
Snooping validates server responses on trusted ports to populate the IP-to-MAC binding database required by features like DAI and IP Source Guard.

Anahtar Kavram

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru