You save $69.98
At a research campus, a network operations engineer wants GigabitEthernet1/0/15 to learn an approved endpoint MAC and retain it as a secure address after a policy save. Which switch feature is designed for that?
Sticky secure MAC learning can add observed source MACs to running configuration on GigabitEthernet1/0/15 subject to configured maximum and violation rules. Administrators must review saved entries.
Root guard handles unexpected superior STP BPDUs and does not pin workstation source MACs.
A DHCP pool determines host addressing and does not directly configure port-security MAC restrictions.
DAI validates ARP sender mappings, not a general port-security sticky MAC allow-list.
At a university, the migration lead enables DAI in VLAN 30 but legitimate client ARP is unexpectedly blocked after a DHCP relay migration. Which dependency should be validated?
DAI depends on a trusted source for valid bindings or explicit ARP ACLs. DHCP snooping trust and binding entries for VLAN 30 must match actual clients and legitimate DHCP paths.
Interface or VLAN descriptions do not enforce DAI or provide binding records.
Blind trust removes inspection from attacker-accessible ports and permits spoofed ARP messages.
Leaving both DHCP and ARP unvalidated exposes clients to rogue server and ARP impersonation attacks.
DHCP snooping is enabled for VLAN 50 on a campus switch. Clients on untrusted access ports receive no addresses after the legitimate DHCP server is moved behind a new uplink Gi1/0/48. Server OFFER packets are seen at Gi1/0/48, and this is the only authorized DHCP-server path. What precise configuration should be checked?
DHCP snooping discards server-originated replies arriving on untrusted interfaces. Trust must be assigned only to the legitimate server-facing path; access ports remain untrusted so rogue servers cannot inject DHCP replies.
Trusting users allows a rogue DHCP server to deliver unauthorized OFFERs and defeats snooping protection.
Disabling snooping may restore address allocation but removes protection against unauthorized DHCP servers.
An OSPF routing process does not classify DHCP OFFER frames as authorized on the switchport.
An access port uses port security with a maximum of one learned MAC and violation mode restrict. A second device sends traffic. Which result should be expected?
Restrict mode denies unauthorized source MAC traffic without errdisabling the entire port. It supports monitoring attempts while preserving the approved host connection.
Errdisable/shutdown behavior is characteristic of port-security shutdown mode, not restrict mode.
A configured port-security MAC maximum is enforced rather than automatically increased.
Protect and restrict drop violating frames while keeping the port active; shutdown is the violation mode that err-disables the port.
At an insurance company, a network operations engineer requires port GigabitEthernet1/0/25 to admit one authorized workstation MAC and respond to extra MAC sources. Which feature should be configured?
Port security can limit which and how many MAC sources appear on access port GigabitEthernet1/0/25; max-count and violation mode control response to unexpected devices.
A static forwarding-table mapping directs frames destined to a MAC; it does not itself prevent other source MACs from appearing on the port.
OSPF interface priority governs DR election, not Ethernet MAC admission limits.
Trusting DHCP snooping allows DHCP server messages on a port; it does not prevent unrelated Ethernet MAC sources, and is generally unsuitable for an ordinary client port.
At a retail branch, the on-call technician wants GigabitEthernet1/0/22 to learn an approved endpoint MAC and retain it as a secure address after a policy save. Which switch feature is designed for that?
Sticky secure MAC learning can add observed source MACs to running configuration on GigabitEthernet1/0/22 subject to configured maximum and violation rules. Administrators must review saved entries.
A DHCP pool determines host addressing and does not directly configure port-security MAC restrictions.
Root guard handles unexpected superior STP BPDUs and does not pin workstation source MACs.
DAI validates ARP sender mappings, not a general port-security sticky MAC allow-list.
A campus enables DHCP snooping to block a rogue DHCP server connected to a user access port. Where should DHCP snooping trust normally be enabled?
Trusted interfaces are permitted to carry DHCP server responses. Untrusted user ports are inspected to prevent unauthorized offers and ACKs.
Trusting all access ports permits rogue server responses and defeats the protective purpose.
DHCP snooping trust is an interface-level switch feature on forwarding ports, not a substitute SVI setting.
Client DISCOVER requests are expected on untrusted ports; trust is for authorized server-side traffic.
At an enterprise data center, the on-call technician sees unauthorized DHCP OFFER packets originate from user-facing port GigabitEthernet1/0/43 in VLAN 80. Which switch safeguard is appropriate?
DHCP snooping tracks legitimate bindings and drops DHCP server replies from untrusted ports in VLAN 80; the authorized server path must be trusted.
Without snooping, a rogue DHCP server can compete with the legitimate server.
OSPF route exchange is unrelated to filtering rogue Layer 2 DHCP OFFER messages.
Trusting the user access port allows a rogue server to send DHCP replies and defeats the intended control boundary.
At a telecom operations room, the migration lead observes forged ARP replies on user VLAN 100; DHCP snooping binding data is available. Which defense validates sender IP/MAC claims?
Dynamic ARP Inspection checks ARP claims against valid snooping bindings or ARP ACLs and can reject forged mappings on untrusted access ports in VLAN 100.
Lease duration alone does not validate the MAC/IP claimed in an ARP packet.
Trusting all edge ports bypasses ARP validation for potential attacker traffic.
Routing defaults do not verify Layer 2 ARP mappings received on access ports.
At a research campus, the on-call technician requires port GigabitEthernet1/0/16 to admit one authorized workstation MAC and respond to extra MAC sources. Which feature should be configured?
Port security can limit which and how many MAC sources appear on access port GigabitEthernet1/0/16; max-count and violation mode control response to unexpected devices.
DAI validates ARP traffic against bindings and inspection rules. It does not enforce a one-MAC source cap for all frames.
OSPF interface priority governs DR election, not Ethernet MAC admission limits.
PortFast changes initial STP edge forwarding behavior, not how many source MAC addresses may use the port.
At a design agency, the migration lead wants GigabitEthernet1/0/33 to learn an approved endpoint MAC and retain it as a secure address after a policy save. Which switch feature is designed for that?
Sticky secure MAC learning can add observed source MACs to running configuration on GigabitEthernet1/0/33 subject to configured maximum and violation rules. Administrators must review saved entries.
DAI validates ARP sender mappings, not a general port-security sticky MAC allow-list.
Root guard handles unexpected superior STP BPDUs and does not pin workstation source MACs.
A DHCP pool determines host addressing and does not directly configure port-security MAC restrictions.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (760 Questions, Last Updated on Nov 4, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
