You save $69.98
At a design agency, the migration lead wants GigabitEthernet1/0/33 to learn an approved endpoint MAC and retain it as a secure address after a policy save. Which switch feature is designed for that?
Sticky secure MAC learning can add observed source MACs to running configuration on GigabitEthernet1/0/33 subject to configured maximum and violation rules. Administrators must review saved entries.
DAI validates ARP sender mappings, not a general port-security sticky MAC allow-list.
Root guard handles unexpected superior STP BPDUs and does not pin workstation source MACs.
A DHCP pool determines host addressing and does not directly configure port-security MAC restrictions.
Dynamic ARP Inspection is enforced in VLAN 10. A legitimate statically addressed printer never gets a DHCP lease and its ARP frames are dropped, although DHCP-based clients succeed. What is the narrowest supported remediation?
DAI commonly validates bindings from DHCP snooping; a static-IP host may need a controlled ARP ACL/static binding exception rather than blanket bypass.
Turning off DAI for all endpoints removes the spoofing safeguard instead of narrowly handling one legitimate static binding.
STP priority participates in bridge election and does not authorize an IP-to-MAC mapping in DAI.
Trusting all client-facing ports would bypass validation and permit malicious ARP claims from untrusted endpoints.
At a municipal utility, the branch support lead sees unauthorized DHCP OFFER packets originate from user-facing port GigabitEthernet1/0/24 in VLAN 40. Which switch safeguard is appropriate?
DHCP snooping tracks legitimate bindings and drops DHCP server replies from untrusted ports in VLAN 40; the authorized server path must be trusted.
Trusting the user access port allows a rogue server to send DHCP replies and defeats the intended control boundary.
OSPF route exchange is unrelated to filtering rogue Layer 2 DHCP OFFER messages.
Without snooping, a rogue DHCP server can compete with the legitimate server.
A warehouse switch access port should allow at most two distinct endpoint MACs. Staff replace one endpoint after the first device is retired. Which configuration process is safest?
Sticky security remembers observed addresses; stale learned entries can consume the maximum and reject valid replacements. Maintain the configured limit and approved MAC inventory.
A high unrestricted maximum weakens the intended endpoint limit and does not maintain authorization.
Bypassing enforcement defeats the requirement to admit only the approved number of endpoint sources.
Secure MAC entries can persist until explicitly removed; a retained old sticky entry can exhaust the maximum and reject the replacement.
At a public library, the security and networking lead requires port GigabitEthernet1/0/10 to admit one authorized workstation MAC and respond to extra MAC sources. Which feature should be configured?
Port security can limit which and how many MAC sources appear on access port GigabitEthernet1/0/10; max-count and violation mode control response to unexpected devices.
OSPF interface priority governs DR election, not Ethernet MAC admission limits.
Storm control manages excessive broadcast/multicast/unknown-unicast traffic. It does not identify and restrict a second workstation MAC on the access port.
An access port belongs to one VLAN, but can learn many source MAC addresses unless a separate port-security limit is applied.
After an unapproved MAC appears, a port secured with violation mode shutdown becomes err-disabled. The offending endpoint is removed. Which step restores service without removing the security policy?
Shutdown mode can errdisable the port. Recovery should follow investigation, and the secure MAC limit/violation configuration should remain intact.
Removing enforcement solves the symptom by discarding the access security requirement.
Port-security shutdown causes err-disable that generally requires configured recovery or manual intervention after the root cause is fixed.
DHCP timers do not automatically repair port-security errdisable state on the switch.
Dynamic ARP Inspection rejects legitimate ARP replies on a user VLAN immediately after deployment. Endpoints use static IPv4 addresses and have no DHCP snooping binding entries. Which remedy is most appropriate?
DAI commonly validates untrusted ARP against DHCP snooping bindings. Static hosts without those bindings need an approved validation mechanism rather than blind trust.
That bypasses the security control instead of providing trustworthy mappings for static hosts.
Static-IP hosts do not obtain bindings from DHCP lease exchanges; DAI needs a validated static mapping or ARP ACL for those clients.
Trusting untrusted edge ports defeats DAI’s ability to catch spoofed ARP on those access links.
At a warehouse, the migration lead must verify a remote network engineer is who they claim before granting privileged login. Which choice best addresses the stated requirement?
Authentication establishes the identity behind an access request.
Authorization decides permissions after identity, not who the claimant is.
Description text is unrelated to login proof.
Accounting records activities; it does not by itself authenticate the session.
At a warehouse, the on-call technician has authenticated a helpdesk account but must prevent it from running configuration commands. Which choice best addresses the stated requirement?
Authorization controls what an authenticated identity may do after login.
Accounting can report misuse but does not enforce permissions.
DNS caching does not set management privileges.
Authentication repetition does not define an access policy.
At a research campus, a network operations engineer needs attributable evidence of which administrator issued a sensitive command and when. Which choice best addresses the stated requirement?
Accounting records completed sessions/actions and their associated identities and timestamps.
Routing metrics do not log individual administrative actions.
Shared credentials weaken accountability.
Strong authentication does not automatically create a command audit trail.
At a biotech lab, a network operations engineer must verify a remote network engineer is who they claim before granting privileged login. During review, someone proposes: "Use a privilege policy as proof of identity without verifying a credential." Which technical explanation most directly shows why this proposal does not solve the requirement?
Authorization decides permissions after identity, not who the claimant is. The effective remedy is to use an authentication mechanism such as a validated password/MFA or certificate.
Description text is unrelated to login proof. It concerns a different proposed change, not the change being evaluated.
Accounting records activities; it does not by itself authenticate the session. That distinction is technically relevant elsewhere, but it does not identify the failure of the proposed use a privilege policy as proof of identity without verifying a credential. The actual issue is that authorization decides permissions after identity, not who the claimant is.
Authentication establishes the identity behind an access request. The statement addresses a different mechanism. Here the engineer specifically proposed use a privilege policy as proof of identity without verifying a credential; the decisive limitation is that authorization decides permissions after identity, not who the claimant is.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (760 Questions, Last Updated on Nov 4, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
