Cisco Certified Network Associate (CCNA) 200-301 Practice Test 60
Question 590
An access port for an authorized workstation and one IP phone should learn no more than two secure source MAC addresses. Port security is enabled in the correct access/voice VLAN design. Which additional interface command sets that two-address limit?
- `switchport port-security violation restrict 2` to express a two-address limit.
- `switchport mode trunk 2` to tell the switch two MAC addresses may connect.
- `switchport port-security maximum 2` on the protected access interface.
- `ip dhcp snooping trust 2` to authorize exactly two users by MAC address.
Explanation
Correct Answer
C:Port security can restrict how many secure source MAC addresses may be learned or configured on an access switchport. On IOS platforms supporting the syntax, `switchport port-security maximum 2` sets an overall maximum of two learned secure addresses, subject to the platform's per-VLAN options. Ensure the authorized phone and workstation match the intended voice/data topology and validate actual secure MAC learning with `show port-security interface` and address displays. Also decide a violation mode appropriate to operations. A maximum of two does not identify which two addresses are authorized unless static or sticky learning and access procedures provide that control.
Incorrect Answers
A:`switchport port-security violation restrict` controls the action on frames from unauthorized addresses—typically dropping them while maintaining the port and recording violations—not the secure-MAC count. The token `2` is not the usual argument to that violation mode. Set maximum separately and configure the desired violation response.
B:`switchport mode trunk` changes a switchport's Layer 2 operational VLAN tagging mode; it does not specify a count of allowed secure MAC addresses. A workstation-and-phone design can use an access port with voice VLAN behavior. The appropriate quantity limit comes from the port-security maximum setting.
D:DHCP snooping trust is a Boolean port trust designation for forwarding authorized server-originated DHCP messages. It is not a count of users or secure MAC addresses, and trusting a host-facing port could introduce rogue DHCP risk. Keep trust rules separate from the port-security secure-MAC maximum.
Question 591
A proposed network design has this requirement: Sticky MAC learning records observed source MAC addresses in the running configuration when properly enabled. Which choice is technically appropriate for that deployment?
- Set `switchport port-security maximum 1` but never enable sticky learning and expect the secure MAC to be persisted as a running-config sticky command.
- Rely on a switch dynamic MAC-address table entry as permanently configured secure sticky state across reloads.
- Enable an IP routing static default and assume it learns endpoint MACs into port security automatically.
- Configure `switchport port-security` and `switchport port-security mac-address sticky` on the intended access port, then save the learned secure MACs if they must persist across reboot.
Explanation
Correct Answer
D:Sticky learning adds observed allowed source MACs to the running configuration as secure entries. A maximum and violation mode must be selected to prevent unapproved devices from gaining access.
Incorrect Answers
A:A maximum restricts count, whereas `mac-address sticky` controls sticky learning.
B:Dynamic MAC learning is not the same as saved sticky port-security configuration.
C:A routing entry does not configure Layer 2 sticky source-MAC security.
Question 592
A network security analyst must implement a change. A protected edge port should enter errdisabled when an unknown source MAC violates the configured shutdown action. Which technical decision most directly meets these requirements?
- Use violation mode `protect` and expect every rogue frame to errdisable the entire port.
- Use port-security violation mode `shutdown` with the approved MAC/maximum policy, so an unauthorized source violates the limit and errdisables the interface.
- Use violation mode `restrict` and assume it always transitions the port to errdisable.
- Configure no port security at all and assume the MAC table alone errdisables a third source.
Explanation
Correct Answer
B:Shutdown violation mode errdisables the affected switchport until recovery; restrict and protect instead drop unauthorized frames while typically leaving the port operational.
Incorrect Answers
A:Protect normally silently discards violating frames without shutting the interface.
C:Restrict drops/logs/counts violations while the interface remains active under normal operation.
D:Ordinary MAC learning is not a configured maximum/violation shutdown policy.
Question 593
A switch edge interface is configured for port security with one permitted MAC. The administrator wants frames from any additional source MAC to be dropped while legitimate traffic continues, with violation counters or logging available for investigation. Which violation mode is most suitable?
- `switchport port-security violation restrict`
- `switchport port-security violation protect`, which normally drops without incrementing the same violation counter.
- `switchport port-security violation shutdown`, which error-disables the interface after a violation.
- `switchport port-security maximum 1`, which sets the limit but not the requested violation response.
Explanation
Correct Answer
A:Port-security restrict mode drops offending traffic from unauthorized source MAC addresses while the secured port can remain operational for legitimate configured or learned addresses. On the relevant Cisco platforms it also increments violation counters, making monitoring and investigation easier than protect mode when a logged signal is required. Configure the secure MAC maximum and authorized MAC learning separately, then test with a controlled second source and inspect `show port-security interface` for the selected mode, counter and ongoing link state. Restrict protects the port without the interface-wide errdisable behavior of shutdown; actual logging may depend on platform and monitoring settings.
Incorrect Answers
B:Protect mode can silently discard traffic from unauthorized MAC addresses while leaving legitimate communication working, but on common IOS semantics it does not increment the same violation counter as restrict. Because the requirement includes accountable violation evidence, restrict is the stronger fit. The forwarding impact alone is not enough to choose protect.
C:Shutdown is the default violation mode on many platforms and can put a port into error-disabled state when an unauthorized source appears. That also stops legitimate hosts until recovery, contradicting the requirement to preserve authorized traffic. Restrict drops offending frames while allowing the port to continue forwarding permitted sources.
D:`switchport port-security maximum 1` limits how many secure source addresses the port accepts, but it does not select whether a violation is logged, silently dropped or triggers errdisable. A maximum setting may already be correct in the scenario; the question asks for response mode. Configure `violation restrict` separately.
Question 594
A Catalyst switch has DHCP snooping enabled for VLAN 40. The actual DHCP server arrives through Gi1/0/47, but only Gi1/0/48 is marked trusted. Client DHCPDISCOVER broadcasts reach the server; the server's DHCPOFFER frames enter Gi1/0/47 and are dropped by the switch. What is the specific configuration fault?
- DAI is dropping the server response because an ARP sender address has no DHCP binding.
- The server-facing switchport receiving DHCP Offer packets is not configured as DHCP-snooping trusted.
- The switch has reached a Port Security maximum on the client access port.
- The router is missing a static default route for traffic outside VLAN 40.
Explanation
Correct Answer
B:DHCP snooping treats server-originated messages arriving on untrusted interfaces as potentially rogue and drops them. Although the deployment intended Gi1/0/48 to carry server traffic, the actual server is connected through Gi1/0/47, which remains untrusted. That exactly explains Discover reaching the server while its Offers fail on return. Validate physical adjacency and `show ip dhcp snooping` interface trust information, then trust only the verified server-facing port and leave client access ports untrusted. The test isolates port trust placement, not a missing DHCP pool or downstream ARP inspection.
Incorrect Answers
A:Dynamic ARP Inspection validates ARP messages against trusted data such as DHCP snooping bindings, but DHCPOFFER is a DHCP control message rather than an ARP reply. The loss happens as a DHCP Offer enters the server-facing switchport, before any endpoint ARP mapping needs inspection. A DHCP-snooping trust decision is therefore the relevant Layer 2 control. DAI might be tested later when validating legitimate host ARP, but it does not explain these Offer drops. Check snooping trust state on the actual ingress uplink.
C:Port Security can restrict which source MAC addresses are learned on a switchport, potentially causing a protect, restrict, or shutdown violation. In this incident there is no stated MAC-limit violation or errdisabled access port. The explicit drop is a DHCP Offer received on an untrusted server-facing port, matching DHCP snooping policy. Investigating Port Security would distract from a documented DHCP-snooping trust mismatch. Inspect snooping drop counters and trust state for the uplink carrying the server responses before changing access-port MAC restrictions.
D:A default route is needed for forwarding to destinations outside the local routing table, but the failure is at a VLAN switch receiving a DHCP Offer from an adjacent server. DHCP snooping drops the server message on an untrusted port regardless of whether a router has a valid Internet default route. Because the client Discover is seen by the server and the Offer is dropped at ingress, the required correction is specific to switch trust configuration. Routing changes will not make a forbidden server message acceptable to snooping.
Question 595
On VLAN 40, an attacker connected to an untrusted access port sends a gratuitous ARP claiming the default gateway IP 192.168.40.1 is at the attacker's MAC 00aa.bbcc.ddee. The DHCP snooping binding for that source port does not authorize the claimed IP/MAC pair, and DAI logs an invalid ARP drop. What explains the blocked traffic?
- The switch is dropping legitimate DHCP Offers because the server uplink is untrusted.
- A Port Security violation automatically moved the attacker port into VLAN 999.
- Dynamic ARP Inspection rejected the spoofed ARP sender mapping on an untrusted port because it did not match a permitted binding.
- An IEEE 802.1X policy assigned the client an incorrect authorization VLAN after authentication.
Explanation
Correct Answer
C:DAI inspects ARP packets entering untrusted ports and verifies sender information against permitted IP-to-MAC bindings, commonly populated from DHCP snooping. The attacker advertises the legitimate gateway IP from a different MAC and an unauthorized access port. Because the binding data does not authorize that mapping, DAI discards the gratuitous ARP and records an invalid packet. This is the intended protective outcome against ARP spoofing, not necessarily an outage. Verify the DAI drop counters and the binding entry without trusting the attacker's access port.
Incorrect Answers
A:DHCP snooping checks server-side DHCP control traffic on trusted and untrusted interfaces, but the frame described here is a gratuitous ARP claiming another device's IP address. A DHCP Offer drop would appear during address assignment, not in an ARP-inspection invalid-packet counter. DAI can use DHCP snooping bindings as its validation database; that relationship does not make every DAI drop a DHCP snooping server-trust event. The stated unauthorized ARP sender mapping directly identifies the inspection action and the reason for blocking the spoof.
B:Port Security can restrict the MAC addresses seen on a switchport, and some violations can place a port into an errdisabled state, depending on platform and configured violation action. But the event explicitly records an ARP inspection drop for an IP/MAC mapping inconsistent with a known binding. No port shutdown, MAC maximum, or VLAN reassignment is described. Investigate Port Security only if the switch also shows a separate source-MAC violation; do not infer it from DAI's ARP consistency check.
D:IEEE 802.1X determines network admission or access policy based on authentication and authorization, which may include VLAN assignment. That is independent of whether a specific ARP frame's sender IP/MAC pair matches a DHCP snooping binding. The scenario does not describe a RADIUS authentication failure or an unauthorized VLAN; it provides direct evidence of an inconsistent gateway ARP claim and a DAI invalid drop. A VLAN authorization audit would not explain the logged ARP validation failure unless additional evidence were present.
Question 596
An access switch port has `switchport port-security maximum 2`. It learns a third previously unauthorized source MAC, logs a port-security violation and increments the violation counter. Which condition caused the alert?
- An OSPF area mismatch caused a route to disappear.
- The third distinct source MAC exceeded the configured maximum of two permitted MAC addresses.
- A dynamic ARP inspection binding was missing for an IPv4 gateway.
- A DHCP relay delivered a wrong DNS address to a host.
Explanation
Correct Answer
B:Port security tracks learned secure source MACs. Once the allowed maximum is reached, frames from an additional unauthorized MAC trigger the configured violation behavior.
Incorrect Answers
A:OSPF area mismatches affect Layer 3 routing adjacencies, not the switchport source-MAC limit.
C:DAI binding checks ARP validity and is a different Layer 2 security feature from secure-MAC limits.
D:DHCP options are delivered to clients and do not cause this port-security maximum counter to increment.
Question 597
A switch access port uses port security with one sticky-learned MAC address. An authorized laptop receives a replacement NIC, so its source MAC changes, and the new NIC's frames are rejected. The port still remembers the previous sticky address. What maintenance action restores access without disabling security?
- Disable port security globally on every switch in the VLAN to allow unknown devices.
- Update the authorized sticky MAC binding to the replacement NIC's address after identity verification, and ensure the secure address count is consistent.
- Increase the STP bridge priority so the replacement laptop becomes the new root.
- Configure the old NIC's MAC as the IPv4 default gateway for the workstation.
Explanation
Correct Answer
B:Sticky MAC learning records secure source addresses on the interface, allowing the switch to enforce which devices may send frames. Replacing a network adapter changes the laptop's source MAC, so the new identity can exceed the allowed secure-address set or trigger the configured violation mode while the prior address remains. Verify the authorized hardware change, remove or update the obsolete secure/sticky MAC as appropriate for the platform, and relearn or configure the new address. Confirm `show port-security address` and `show port-security interface`, then save the intended configuration if sticky state must survive reload. Do not automatically whitelist any observed MAC without operational authorization.
Incorrect Answers
A:Disabling port security on all switches would eliminate the access restriction far beyond the one authorized endpoint change and create an unnecessary exposure. The problem is local to a specific stored MAC binding and secure-address limit. Modify only that port's authorized address while maintaining enforcement.
C:STP bridge priority determines which switch is preferred as a spanning-tree root, not which laptop NIC may transmit on a secure access port. A replacement source MAC is an endpoint identity issue under port security. Adjusting root election cannot update sticky secure MAC entries.
D:The IPv4 default gateway is a Layer 3 router or virtual-gateway IP address, not an endpoint's old Ethernet MAC identity. Assigning the obsolete MAC as a gateway value is not a valid host IP configuration. Correct the secure source MAC authorization on the switchport instead.
Question 598
The switch logs a security violation and the interface transitions errdisabled after a third unauthorized MAC arrives. The team should investigate which specific technical cause?
- The port is merely in protect mode silently dropping one frame while remaining up.
- Port-security maximum was exceeded and shutdown-mode violation put the switchport into errdisabled state when the unauthorized third MAC appeared.
- The switch has formed an OSPF neighbor adjacency to the rogue MAC, which causes errdisable by routing policy.
- A switchport security maximum of 2 automatically expands to 3 when a new source arrives.
Explanation
Correct Answer
B:In shutdown mode, a port-security violation raises a counter/log and administratively disables traffic forwarding until the cause is removed and the interface recovered.
Incorrect Answers
A:The stated errdisabled transition indicates shutdown behavior, not protect-only dropping.
C:OSPF neighbors are a Layer 3 control protocol; the direct event is MAC limit violation.
D:The configured limit is enforced; a third unauthorized MAC triggers violation under shutdown mode.
Question 599
A network security analyst must explain an outage. Unauthorized frames are dropped but no violation logs or counter increments appear, and staff expected restrict behavior. Which diagnosis follows from these observations?
- The port is in `restrict` mode, which must never increment violation counts or report events.
- The port is in `shutdown` mode, which always keeps it forwarding with no message after an unauthorized MAC.
- The port uses violation mode `protect`, which silently drops unknown/over-limit source MACs without the restrict-mode logging and violation counter updates.
- The observed silence proves port security is disabled and every unauthorized source is freely forwarded.
Explanation
Correct Answer
C:Cisco port security protect drops violating frames but typically does not increment the violation counter or send the same notification as restrict. Restrict drops and reports/counts violations while leaving the interface up.
Incorrect Answers
A:Restrict is the mode associated with counters/logging for violations.
B:Shutdown violation normally errdisables the interface and records an event.
D:Frames are being dropped; protect mode explains that without counters.
Question 600
DHCP snooping is enabled on VLAN 30. A rogue laptop sends DHCPOFFER on an untrusted access port, and legitimate DHCP server replies arrive on the uplink. After trusting only the genuine server-facing uplink, which evidence best validates the policy?
- The uplink is still untrusted and all DHCP server replies are discarded, regardless of their source.
- Port-security secure-MAC counts rise, with no check of DHCP message direction or snooping bindings.
- Dynamic ARP Inspection is disabled, which alone ensures DHCP offers cannot reach clients.
- `show ip dhcp snooping` identifies the legitimate uplink as trusted and client ports as untrusted; snooping bindings populate for leases, while rogue offers are dropped.
Explanation
Correct Answer
D:DHCP snooping distinguishes trusted server-facing ports from untrusted client ports. Verify trust state, appropriate discard counters for rogue replies and binding entries after successful legitimate leases; both acceptance and enforcement matter.
Incorrect Answers
A:Leaving the server-facing uplink untrusted would reproduce the broken legitimate lease exchange; DHCP snooping must permit server-originated messages only from trusted links.
B:Port security limits learned source MAC addresses, not the trust of DHCP server messages or lease metadata. Counts do not prove that rogue DHCPOFFERs were rejected.
C:Dynamic ARP Inspection validates ARP traffic using bindings and related checks. It is not the mechanism that allows valid DHCPOFFERs from trusted ports and blocks them on untrusted ones.
