2 Layer 2 Security Free Online FlashCards

What does port security limit on a switch port?

Port security limits the source MAC addresses a switch port accepts, helping restrict which devices can connect.

How should an endpoint interface be configured to limit VLAN exposure?

Configure endpoint interfaces as access ports in the intended user VLAN, rather than leaving them to negotiate trunks.

How should DHCP snooping trust be assigned?

DHCP snooping filters DHCP messages. Client-facing ports are untrusted by default; trust only the interface leading to an authorized DHCP server or trusted network path.

How does Dynamic ARP Inspection help prevent ARP spoofing?

DAI checks ARP messages on untrusted ports against valid IP-to-MAC bindings, usually learned through DHCP snooping, and drops invalid packets.

When is PortFast appropriate?

PortFast lets an end-device port enter forwarding promptly. Use it only where an endpoint, not another switch, is expected.

What should be checked before relying on DAI?

Confirm the DHCP binding table is populated and legitimate clients can obtain addresses before relying on DAI; missing or incomplete bindings can cause valid ARP traffic to be dropped.

What does sticky learning do?

Sticky learning learns source MAC addresses and adds them to the switch configuration.

What can happen when port security detects a violation?

A violation can drop unauthorized traffic, log the event, or disable the port. Disabling a port can interrupt service, so plan for legitimate devices and recovery.

How can trunk configuration reduce VLAN exposure?

Explicitly permit only required VLANs on trunks and select a native VLAN that carries no user traffic.

What should be done with unused switch interfaces?

Place unused interfaces in an unused VLAN and administratively shut them down.

What information does the DHCP snooping binding table associate?

DHCP snooping builds a binding table that associates leased IP addresses with MAC addresses, VLANs, and interfaces.

How can DAI accommodate statically addressed devices?

For statically addressed devices, configure appropriate ARP ACLs or bindings if supported; DHCP snooping may not provide their bindings.