Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch where DHCP Snooping is also active. All access interfaces on VLAN 20 are left in the default untrusted state. A critical host connected to interface GigabitEthernet1/0/12 is configured with a static IP address ($192.168.20.50/24$) and MAC address ($0050.56a1.23bc$). Consequently, DAI drops all ARP requests sent by this host because no entry exists for it in the DHCP snooping binding database. The engineer must allow this host to communicate while keeping GigabitEthernet1/0/12 untrusted and maintaining DAI protection on VLAN 20. Which command sequence must be configured on the switch to resolve this issue?

A network administrator is implementing Layer 2 security controls on Cisco Catalyst access switches. Match each Layer 2 security feature mechanism on the left to its corresponding operational behavior on the right.

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding operational behavior on the right.

A network engineer is implementing Layer 2 security controls across access switches in an enterprise network. The design requires deploying Dynamic ARP Inspection (DAI) alongside DHCP Snooping to mitigate ARP spoofing attacks. Which TWO statements correctly describe the operational interactions and interface trust requirements for these features?

A network administrator enables DHCP Snooping globally and on VLAN 20. To protect against DHCP denial-of-service (DoS) starvation attacks, the administrator configures `ip dhcp snooping limit rate 15` on all untrusted access interfaces. Shortly after, a user workstation interface transitions into the `err-disabled` state. Which operational behavior explains why this interface was placed into the `err-disabled` state?

Match each Cisco Layer 2 security feature or operational state on the left to its corresponding system action or behavior on the right.

A network administrator configures port security on access interface GigabitEthernet0/10 of a Cisco Catalyst switch using the command `switchport port-security mac-address sticky`. Over the next week, several workstations connect to the port, and their MAC addresses are dynamically added to the running configuration. Following an unscheduled power outage and switch reboot, the administrator discovers that the connected workstations are unable to gain access and port security sticky entries are missing from the configuration. What was the root cause of this issue?

A network administrator is implementing Layer 2 security controls on an access switch, configuring Port Security with sticky MAC address learning alongside DHCP Snooping on edge switch ports. Which two statements correctly describe the operational behavior of these features? (Select two.)

A network administrator is implementing Layer 2 security on VLAN 30 of a Cisco Catalyst switch. The VLAN contains both dynamic DHCP clients and devices with statically configured IP addresses. DHCP Snooping is active on VLAN 30.

To allow traffic from the static IP devices that do not exist in the DHCP snooping binding database, the administrator creates an ARP Access Control List (ACL) named `STATIC_DEVICES` matching the static MAC and IP pairs, and executes the following command:

`Switch(config)# ip arp inspection filter STATIC_DEVICES vlan 30`

Immediately after applying this command, static IP hosts communicate successfully, but all dynamic DHCP clients on VLAN 30 lose connectivity because their ARP packets are dropped by Dynamic ARP Inspection (DAI).

Which configuration modification must be made to permit ARP traffic from both static IP devices and dynamic DHCP clients?

A network administrator enables port security on a switch access port using the command switchport port-security mac-address sticky. Devices connect to the port, and their MAC addresses are dynamically added to the switch configuration. However, after a planned reload of the switch, the port loses all learned MAC addresses and fails to forward traffic for previously connected hosts. What is the primary cause of this issue?

An administrator configures port security on a Cisco Catalyst switch access interface using the command switchport port-security mac-address sticky. End devices connect to the port, and their MAC addresses are dynamically converted to sticky MAC addresses. Following a scheduled reload of the switch, the connected devices lose network connectivity. What is the root cause of this issue?

Match each Cisco Layer 2 security feature or interface trust state on the left with its correct operational behavior or dependency on the right.

An administrator attempts to secure VLAN 20 on a Cisco Catalyst switch by executing the commands `ip dhcp snooping vlan 20` and `ip arp inspection vlan 20`. Access interface GigabitEthernet0/2 is in VLAN 20 and remains in its default untrusted state for both security features. Clients connected to GigabitEthernet0/2 are configured with static IP addresses, but all outgoing ARP packets from these clients are intercepted and dropped by the switch, preventing any network communication. Which root cause explains why Dynamic ARP Inspection (DAI) is dropping this ARP traffic?

An administrator enables port security on a Cisco switch interface using default settings without specifying a violation mode. What default action will the switch take if an unauthorized device connects to this interface?

Match each port security violation mode on the left with its corresponding switch behavior when an unauthorized MAC address is detected on an interface.

A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch. DHCP Snooping is enabled on VLAN 20, but several legacy printers on untrusted access ports use static IPv4 addresses and are not recorded in the DHCP snooping binding database. Consequently, DAI drops legitimate ARP packets originating from these printers. Which two configuration actions must the administrator perform to allow ARP traffic from the static hosts while maintaining DAI inspection on those untrusted ports? (Select two.)

A network engineer is hardening an enterprise access layer switch using Cisco Layer 2 security features. Match each specific Layer 2 security feature configuration component on the left with its exact operational behavior or validation requirement on the right.

In enterprise Cisco switch implementations, Layer 2 security controls govern frame processing, metadata insertion, and hardware lookup behaviors. Match each Layer 2 security operation or feature context to its exact functional mechanism.

A network administrator executes the commands `ip dhcp snooping` and `ip arp inspection vlan 10` on a Cisco Catalyst switch to mitigate Layer 2 ARP spoofing attacks. However, users on VLAN 10 immediately lose all network connectivity because Dynamic ARP Inspection (DAI) drops all incoming ARP requests from client ports. Executing `show ip dhcp snooping binding` displays an empty binding table. Which command was omitted from the switch configuration?

A network administrator configures an access port on a Cisco Catalyst switch using the commands `switchport port-security` and `switchport port-security mac-address sticky`. A host connects to the port, and its MAC address is dynamically learned and written to the running configuration. Shortly after, the switch experiences an unexpected reboot due to a brief power failure, before `copy running-config startup-config` or `write memory` was executed. What happens to the learned sticky MAC address on this interface after the switch completes its boot sequence?