Match each Cisco Layer 2 security feature or operational state on the left to its corresponding system action or behavior on the right.
- Port Security Protect ModeDrops unauthorized traffic quietly without incrementing the violation counter or generating log messages.
- Port Security Restrict ModeDrops unauthorized traffic, increments the security violation counter, and generates a syslog message.
- Dynamic ARP Inspection (DAI)Validates ARP requests and responses against the IP-to-MAC binding database before forwarding.
- DHCP Snooping Untrusted PortDiscards incoming DHCP server packets (such as DHCPOFFER and DHCPACK) received from end-user access interfaces.
Cevap
Port Security Protect Mode matches dropping traffic silently without counter increments or log messages. Port Security Restrict Mode matches dropping traffic while incrementing the violation counter and logging. Dynamic ARP Inspection matches validating ARP packets against the DHCP binding database. DHCP Snooping Untrusted Port matches discarding incoming DHCP server packets like DHCPOFFER and DHCPACK.
Each feature is correctly matched to its specific control-plane or data-plane enforcement mechanism: Protect mode drops frames without logging; Restrict mode drops frames with logging and counter increments; Dynamic ARP Inspection verifies ARP packets using the DHCP snooping binding database; untrusted DHCP snooping ports drop inbound server messages (DHCPOFFER/DHCPACK).
Adım Adım Çözüm
Anahtar Kavram
Layer 2 Security Mechanisms (Port Security Violation Modes, DAI Operation, DHCP Snooping Trust States)