5.7 Configure and Verify Layer 2 Security Features (DHCP Snooping, Dynamic ARP Inspection, and Port Security) 200-301 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A switch has DHCP snooping enabled on VLAN 10, and DAI is enabled on the same VLAN. A new IP phone is connected to an access port and successfully receives an IP address via DHCP. However, the phone's ARP requests are being dropped by DAI. What is the most likely reason?

   • AThe DHCP snooping binding table does not contain the phone's IP-to-MAC mapping.
   • BThe port is configured as trusted for DAI.
   • CDAI is not enabled on VLAN 10.
   • DPort security is blocking the phone's MAC address.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A network administrator wants to see the number of security violations that have occurred on a specific switch port. Which command provides this information?

   • Ashow port-security interface gigabitethernet0/1
   • Bshow interfaces gigabitethernet0/1
   • Cshow mac address-table interface gigabitethernet0/1
   • Dshow port-security
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of sticky MAC learning in port security?

   • ATo automatically shut down the port when a new MAC address is seen.
   • BTo prevent any MAC address from being learned on the port.
   • CTo dynamically learn MAC addresses and save them in the running configuration so they are retained across reboots.
   • DTo allow an unlimited number of MAC addresses on the port.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A network administrator is configuring DHCP snooping on a switch that connects to an upstream router providing DHCP services. The switch has several access ports for end users. After enabling DHCP snooping globally and on VLAN 10, the administrator must ensure that legitimate DHCP offers from the router are accepted while rogue DHCP servers on access ports are blocked. Which configuration step is required?

   • AConfigure all access ports as trusted.
   • BConfigure the port connected to the router as trusted.
   • CSet the maximum rate for DHCP packets on the uplink.
   • DEnable DAI on VLAN 10 to filter DHCP messages.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A switch has DHCP snooping enabled on VLAN 10. The administrator notices that the DHCP snooping binding table is not being populated. The switch is connected to a DHCP server on port Gi0/1, and clients are on ports Gi0/2-24. The administrator verifies that DHCP snooping is enabled globally and on VLAN 10. What is the most likely cause?

   • AThe client ports are trusted.
   • BThe switch does not have an IP address on VLAN 10.
   • CThe port Gi0/1 is untrusted.
   • DThe DHCP server is not sending DHCPACK messages.
   Reveal Solution Discussion Select an answer first