Examkin

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

48 soru

Tüm türler48Çoktan seçmeli26Çoklu seçim10Eşleştirme12
Soru 41Soru →

Match each Layer 2 security feature or operational scenario on the left to its corresponding switch behavior or implementation detail on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

DHCP Snooping Option 82 insertion on untrusted access ports
Dynamic ARP Inspection (DAI) evaluation with static ARP ACLs
Port Security set to 'restrict' violation mode
DHCP Snooping binding database construction

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

DHCP Snooping Option 82 insertion on untrusted access ports matches appending relay agent information (circuit ID and remote ID) to broadcast client requests before forwarding them upstream. Dynamic ARP Inspection (DAI) evaluation with static ARP ACLs matches checking IP-to-MAC mappings against configured ARP access lists prior to querying the DHCP snooping binding table. Port Security set to 'restrict' violation mode matches dropping frames from unauthorized MAC addresses, incrementing the violation counter, and generating SNMP traps/Syslog messages without disabling the port. DHCP Snooping binding database construction matches recording the host MAC address, leased IP address, lease duration, binding type, VLAN ID, and port interface upon intercepting a DHCPACK.
Each feature corresponds to its specific L2 operational behavior: DHCP Snooping Option 82 appends relay agent sub-options on untrusted ports; static ARP ACLs take precedence in DAI evaluation before querying the snooping database; restrict mode drops violating frames and generates Syslog/SNMP notifications without disabling the port; and the DHCP snooping binding database extracts host mappings from DHCPACK packets received on trusted ports.

Adım Adım Çözüm

1
Analyze DHCP Snooping Option 82 functionality on untrusted ports.
Confirm Option 82 attaches sub-options (circuit ID and remote ID) to client requests on untrusted interfaces.
Option 82 provides relay agent details to the DHCP server to aid subnet allocation and security enforcement.
2
Evaluate Dynamic ARP Inspection (DAI) processing hierarchy.
Confirm static ARP ACLs take precedence over the DHCP snooping binding table during DAI validation.
Configuring `ip arp inspection filter` allows static hosts to pass DAI validation without needing dynamic DHCP snooping entries.
3
Differentiate Port Security violation modes (protect, restrict, shutdown).
Identify 'restrict' mode as dropping unauthorized traffic, logging via Syslog/SNMP, and keeping the interface active.
'Restrict' mode generates alert notifications and tracks violation statistics without causing an error-disabled port shutdown.
4
Examine DHCP Snooping binding table creation criteria.
Verify that snooping tracks DHCPACK messages to store host MAC, IP, lease time, binding type, VLAN, and interface details.
Snooping validates server responses on trusted ports to populate the IP-to-MAC binding database required by features like DAI and IP Source Guard.

Anahtar Kavram

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)
Soru 42Soru →

Following an unexpected reboot of an enterprise access switch, users connected to interface GigabitEthernet1/0/12 report a complete loss of network connectivity. Upon investigation, the network administrator discovers that the dynamically learned MAC address added to the port security table prior to the switch reload is missing, causing the switch to reject traffic from the connected workstation. Which administrative action was omitted prior to the reboot that resulted in the loss of the sticky MAC address?

Cevabı ve açıklamayı göster

Cevap: Saving the running configuration to the startup configuration in NVRAM using the command `copy running-config startup-config`.

Cevap

Saving the running configuration to the startup configuration in NVRAM using the command `copy running-config startup-config`.
The correct answer identifies that executing `copy running-config startup-config` is required to save dynamically learned sticky MAC entries from volatile RAM into NVRAM. Enabling sticky port security causes the switch to dynamically append learned MAC addresses into the running configuration. However, because RAM contents are lost during a reboot, failing to save the running configuration causes the switch to start up without those learned MAC addresses.

Adım Adım Çözüm

1
Analyze how Port Security sticky MAC learning functions during switch operation.
When sticky learning is enabled with `switchport port-security mac-address sticky`, dynamically learned MAC addresses are converted into standard `switchport port-security mac-address sticky <MAC>` lines in the running configuration (RAM).
Sticky MAC learning dynamically converts dynamically learned addresses into running configuration statements so they behave similarly to statically configured addresses.
2
Evaluate the volatility of RAM versus non-volatile RAM (NVRAM) across switch reboots.
The running configuration stored in RAM is cleared whenever the switch reboots or loses power.
Changes in RAM must be explicitly copied to startup-config in NVRAM using `copy running-config startup-config` or `write memory` to survive a system reload.
3
Determine the root cause of the missing MAC address post-reboot.
Because the administrator failed to save the running configuration after the MAC address was learned, the running configuration reverted back to the startup configuration without the learned sticky MAC address entries.
Failing to save running-config to startup-config causes all dynamically learned sticky entries to be wiped upon switch reboot.

Anahtar Kavram

Port Security Sticky MAC Persistence across Reboots
Tahmini Süre:1m 15s
Soru 43Soru →

An enterprise network administrator is deploying Layer 2 security controls across an access switch. The administrator configures DHCP Snooping and Dynamic ARP Inspection (DAI) on VLAN 15 to safeguard clients against rogue DHCP servers and ARP spoofing attacks. Which TWO statements accurately describe the operational requirements and behaviors of Dynamic ARP Inspection (DAI) in this environment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: DAI intercepts and validates incoming ARP requests and responses on untrusted interfaces against the DHCP snooping binding database.; Uplink interfaces connected to core switches or default gateway routers must be designated as DAI trusted ports to allow legitimate ARP traffic without inspection.

Cevap

The correct operational behaviors are that Dynamic ARP Inspection (DAI) intercepts and validates ARP packets on untrusted ports against the DHCP snooping binding table, and that switch uplink/gateway interfaces must be configured as trusted ports to allow valid infrastructure ARP traffic to bypass inspection.
Dynamic ARP Inspection (DAI) protects networks against Man-in-the-Middle ARP spoofing by intercepting all ARP requests and responses on untrusted interfaces and verifying their sender IP and MAC address pairs against the DHCP snooping binding database. Additionally, ports connected to trusted network infrastructure (such as default gateways and switch uplinks) must be configured as DAI trusted interfaces so legitimate network traffic is passed without being dropped.

Adım Adım Çözüm

1
Analyze DAI untrusted port behavior
DAI intercepts incoming ARP packets on untrusted interfaces and compares the IP-and-MAC sender fields against the DHCP snooping binding database (or static ARP ACLs). Unmatched packets are dropped.
Untrusted ports are host-facing access ports where malicious ARP poisoning attacks might originate.
2
Analyze DAI trusted port role
Ports connected to authorized switches, routers, or servers bypass DAI validation checks.
Infrastructure ports carry traffic for multiple hosts or network devices that may not have dynamic DHCP bindings on the local switch, so inspecting them would result in false-positive packet drops.
3
Evaluate distractor mechanisms
DAI does not query Port Security NVRAM configurations nor does it require native VLAN alignment to inspect VLAN-specific ARP frames.
DAI relies specifically on Layer 2/3 IP-to-MAC mapping databases generated via DHCP Snooping.

Anahtar Kavram

Dynamic ARP Inspection (DAI) database binding dependencies and interface trust state roles.
Tahmini Süre:2m 0s
Soru 44Soru →

A network administrator enables Dynamic ARP Inspection (DAI) on VLAN 10 of a Cisco Catalyst switch to mitigate ARP spoofing attacks across the corporate subnet. Although DHCP clients operate without interruption, several critical servers using statically configured IP addresses immediately lose network access. Switch logs indicate that DAI is actively dropping all ARP packets generated by these static servers because their IP-to-MAC bindings do not exist in the DHCP snooping binding database. Which configuration step must be performed to restore network connectivity for the static servers while maintaining DAI protection on VLAN 10?

Cevabı ve açıklamayı göster

Cevap: Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.

Cevap

Define an ARP Access Control List (ACL) mapping the static IP and MAC addresses, and apply it to VLAN 10 using the ip arp inspection filter command.
Dynamic ARP Inspection relies by default on the DHCP snooping binding database to verify IP-to-MAC address relationships in ARP packets on untrusted ports. Because static servers never request an IP address via DHCP, their bindings are absent from the database. Defining an ARP ACL with static IP-to-MAC entries and binding it to DAI using the `ip arp inspection filter` command allows the switch to validate and permit legitimate ARP traffic from static hosts.

Adım Adım Çözüm

1
Identify the cause of packet drops under Dynamic ARP Inspection (DAI).
DAI intercepts all ARP requests and responses on untrusted ports and validates them against the DHCP snooping binding database. Statically addressed hosts do not use DHCP, so they lack entries in the database, causing DAI to drop their ARP packets.
Understanding why static hosts fail under DAI is essential for selecting the correct non-disruptive bypass mechanism.
2
Define an ARP ACL for static IP-to-MAC mappings.
Configuring an ARP ACL (`arp access-list <name>`) allows explicit static mapping of IP addresses to MAC addresses (e.g., `permit ip host <IP> mac host <MAC>`).
ARP ACLs provide a manual binding table that DAI checks when validating ARP packets.
3
Apply the ARP ACL to the affected VLAN.
Executing `ip arp inspection filter <acl-name> vlan 10 [static]` instructs DAI to consult the ARP ACL for validation on VLAN 10.
Linking the ARP ACL to DAI ensures static server ARP traffic is validated and permitted without disabling DAI security.

Anahtar Kavram

Dynamic ARP Inspection (DAI) Static Host Validation via ARP ACLs
Soru 45Soru →

A network engineer is troubleshooting host connectivity issues on a Cisco Catalyst switch after enabling Dynamic ARP Inspection (DAI) on VLAN 50. Most clients receive their network settings dynamically via DHCP, but a legacy server connected to interface GigabitEthernet1/0/10 uses a static IP address. Because the server's IP-to-MAC mapping is absent from the DHCP snooping binding database, the switch drops all ARP packets originating from GigabitEthernet1/0/10. Which configuration sequence allows ARP traffic from this static server while maintaining active DAI inspection for all other hosts on VLAN 50?

Cevabı ve açıklamayı göster

Cevap: Define an ARP access control list matching the server's IP and MAC addresses, then apply it globally to VLAN 50 using the ip arp inspection filter command with the static keyword.

Cevap

The correct action is to define an ARP access control list specifying the static host's IP and MAC address mapping, and bind it to VLAN 50 using the command `ip arp inspection filter <acl-name> vlan 50 static`.
Dynamic ARP Inspection relies on the DHCP snooping binding database to validate ARP packets on untrusted interfaces. When network endpoints use static IP addressing, their entries do not exist in the DHCP binding database. To resolve this, administrators must configure an ARP ACL (`arp access-list`) containing the static host's MAC and IP address, and apply it to the VLAN via `ip arp inspection filter <acl_name> vlan <vlan-id> [static]`. The optional `static` keyword ensures that for IPs specified in the ACL, DAI only permits packets matching the configured MAC address and drops all others.

Adım Adım Çözüm

1
Identify why Dynamic ARP Inspection (DAI) is dropping packets on interface GigabitEthernet1/0/10.
DAI inspects incoming ARP packets on untrusted ports against the DHCP snooping binding database. Statically configured hosts do not perform DHCP transactions, so their IP-to-MAC mappings are missing from the binding table.
Without a valid binding table entry, DAI flags incoming ARP requests/replies as invalid and drops them.
2
Determine the Cisco IOS mechanism to manually define static IP-to-MAC bindings for DAI.
Configuring an ARP Access Control List (ARP ACL) using `arp access-list <name>` allows explicit mapping of IP addresses to MAC addresses.
ARP ACLs supply static verification entries to DAI for hosts that do not utilize DHCP.
3
Apply the ARP ACL to the VLAN using the correct DAI command option.
Executing `ip arp inspection filter <acl-name> vlan 50 static` forces the switch to check the ARP ACL first.
Including the `static` keyword specifies an implicit deny for IP addresses defined in the ACL if their MAC addresses do not match, ensuring static hosts are authenticated without relying on DHCP snooping.

Anahtar Kavram

Dynamic ARP Inspection (DAI) ARP ACL Integration
Soru 46Soru →

A network administrator is implementing Layer 2 security controls across corporate access switches. Which TWO operational characteristics correctly describe how DHCP Snooping, Dynamic ARP Inspection (DAI), and Port Security function on untrusted interfaces? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: DHCP Snooping drops incoming DHCP server messages, such as DHCPOFFER and DHCPACK, when received on untrusted ports.; Dynamic ARP Inspection intercept and validate ARP packets on untrusted ports by comparing source IP and MAC addresses against the DHCP snooping binding database.

Cevap

The correct operational behaviors are that DHCP Snooping drops DHCP server messages on untrusted ports and Dynamic ARP Inspection uses the DHCP snooping binding database to validate ARP packets on untrusted ports.
DHCP Snooping designates user-facing access ports as untrusted by default, causing any DHCP server responses (DHCPOFFER, DHCPACK) to be discarded to prevent rogue server deployment. Furthermore, Dynamic ARP Inspection (DAI) checks incoming ARP packets on untrusted ports against the IP-to-MAC bindings in the DHCP snooping table to stop ARP spoofing attacks.

Adım Adım Çözüm

1
Analyze the operational rules of DHCP Snooping on untrusted interfaces.
Untrusted interfaces are designated for end-user devices. Server responses such as DHCPOFFER, DHCPACK, and DHCPLEASEQUERY are dropped to block unauthorized DHCP servers.
Ensures rogue DHCP servers cannot distribute incorrect IP addresses or gateway information.
2
Analyze how Dynamic ARP Inspection (DAI) operates on untrusted interfaces.
DAI intercepts incoming ARP requests and replies on untrusted interfaces and validates their source MAC and IP against the DHCP snooping database.
Prevents ARP poisoning and man-in-the-middle attacks.
3
Evaluate sticky MAC address storage behavior in Port Security.
Sticky MACs are placed into the running configuration in volatile memory and will be lost upon reboot if not saved.
Port security does not automatically update NVRAM.

Anahtar Kavram

Layer 2 Security Integration (DHCP Snooping, DAI, Port Security)
Tahmini Süre:1m 30s
Soru 47Soru →

A network technician enables DHCP Snooping globally and on VLAN 10 using the commands `ip dhcp snooping` and `ip dhcp snooping vlan 10`. However, clients connected to access ports on VLAN 10 are failing to acquire IP addresses from the central DHCP server reachable via trunk interface GigabitEthernet0/1. Which condition accounts for the DHCP packet drops on the switch?

Cevabı ve açıklamayı göster

Cevap: Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.

Cevap

Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.
When DHCP Snooping is globally activated on a Cisco switch, every interface is set to an untrusted state by default. Untrusted interfaces only allow DHCP client broadcast requests to enter the switch, while dropping any incoming DHCP server response messages (DHCPOFFER, DHCPACK). Because GigabitEthernet0/1 connects to the central DHCP server, it must be explicitly configured with `ip dhcp snooping trust` to permit server responses to reach clients on VLAN 10.

Adım Adım Çözüm

1
Analyze default DHCP Snooping port trust states upon enabling the feature.
By default, all switch interfaces are categorized as untrusted.
DHCP Snooping enforces security by filtering unauthorized DHCP server traffic on untrusted ports.
2
Evaluate packet handling rules on untrusted ports.
Untrusted ports permit client requests (DHCPDISCOVER, DHCPREQUEST) but drop server replies (DHCPOFFER, DHCPACK, DHCPNAK).
Prevents rogue DHCP servers from offering unauthorized IP configurations to clients.
3
Determine the required resolution to restore DHCP functionality.
Configure `ip dhcp snooping trust` on interface GigabitEthernet0/1.
Designating the server-facing uplink as trusted allows legitimate server offer and acknowledgment packets to pass.

Anahtar Kavram

DHCP Snooping Trusted vs Untrusted Port Operational Behavior
Soru 48Soru →

A network administrator configures port security on access interface GigabitEthernet0/1 of a Cisco Catalyst switch by executing `switchport port-security` and `switchport port-security mac-address sticky`. Hosts connect successfully and their MAC addresses are dynamically learned by the switch. However, after an unscheduled switch reboot, the administrator discovers that the dynamically learned MAC addresses were removed and hosts must re-trigger learning. Which operational step was omitted prior to the switch restart?

Cevabı ve açıklamayı göster

Cevap: Saving the running configuration to the startup configuration in NVRAM using the `copy running-config startup-config` command.

Cevap

The network administrator omitted saving the running configuration to the startup configuration using the `copy running-config startup-config` command.
When `switchport port-security mac-address sticky` is configured, the switch dynamically adds learned MAC addresses into the active `running-config` file. Because `running-config` resides in volatile RAM memory, any dynamically learned MAC addresses are lost upon a reboot unless the administrator explicitly copies the running configuration to the startup configuration using `copy running-config startup-config` (or `write memory`).

Adım Adım Çözüm

1
Analyze how sticky MAC addresses operate in Cisco Port Security.
When sticky MAC learning is enabled (`switchport port-security mac-address sticky`), the switch dynamically learns MAC addresses and writes them directly into the running configuration (`running-config`) as static-like entries.
Sticky MAC learning converts dynamically learned addresses into running configuration entries.
2
Evaluate the behavior of running-config during a switch reload.
RAM memory housing `running-config` is volatile. Unless `running-config` is saved to `startup-config` in NVRAM, all unsaved dynamic sticky MAC entries are erased when the switch reboots.
Volatile memory contents do not survive system reboots.
3
Identify the missing command required for persistence.
Executing `copy running-config startup-config` (or `write memory`) copies the learned sticky MAC entries into non-volatile memory so they load automatically upon boot.
Saving the configuration persists sticky MAC addresses across reboots.

Anahtar Kavram

Port Security Sticky MAC Persistence across Switch Reboots
ÖncekiSayfa 3 / 3
Layer 2 Security Features (Port Security, DHCP Snooping, DAI) Alıştırma Soruları — Cisco CCNA — Sayfa 3 | Examkin