Topic 18 Practice Test 2 covers Layer 2 Security and AAA for Cisco Certified Network Associate 200-301 CCNA and maps to objectives 5.7–5.8. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps. Every option includes focused technical reasoning explaining both the networking concept and its fit to the scenario.
Question 1
A design review for a contact-center expansion switch focuses on this use case: stopping a rogue DHCP server on an access segment while recording client IP/MAC/VLAN/port bindings. Which technology or concept should be selected? Choose ONE.
- Trust only the DHCP-server/uplink interface
- Dynamic ARP Inspection (DAI)
- Port-security maximum
- DHCP snooping
Correct Answer: D
Correct Answer
Answer D is correct because Choose DHCP snooping for a contact-center expansion switch. The scenario needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings, and DHCP snooping supplies that function. It validates DHCP behavior rather than ARP replies or generic MAC-count limits. That distinction is decisive.
Incorrect Answers
Answer A is incorrect because This option uses Trust only the DHCP-server/uplink interface for designating the known server-facing or upstream interface as trusted in a DHCP-snooping design. At a contact-center expansion switch, the required function belongs to DHCP snooping. The mechanism does not match.
Answer B is incorrect because Dynamic ARP Inspection (DAI) validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. That can be valid elsewhere, but a contact-center expansion switch needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings. DHCP snooping matches that objective.
Answer C is incorrect because Port-security maximum is intended for constraining an edge port to the expected number of attached endpoint MAC addresses. The scenario at a contact-center expansion switch instead requires a mechanism to block unauthorized DHCP server replies and learn legitimate DHCP bindings. That is the role of DHCP snooping.
Question 2
A design review for an airport back-office access switch focuses on this use case: designating the known server-facing or upstream interface as trusted in a DHCP-snooping design. Which mechanism should the engineer use? Choose ONE.
- An ARP ACL used with DAI
- Sticky secure MAC learning
- Trust only the DHCP-server/uplink interface
- DHCP snooping binding database
Correct Answer: C
Correct Answer
Answer C is correct because Trust only the DHCP-server/uplink interface is appropriate for an airport back-office access switch. Its typical use is designating the known server-facing or upstream interface as trusted in a DHCP-snooping design. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. Both clues point to this option.
Incorrect Answers
Answer D is incorrect because DHCP snooping binding database records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. That can be valid elsewhere, but an airport back-office access switch needs to permit server-originated DHCP messages only from the known upstream direction. Trust only the DHCP-server/uplink interface matches that objective.
Answer A is incorrect because An ARP ACL used with DAI supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. At an airport back-office access switch, it does not provide the requirement to permit server-originated DHCP messages only from the known upstream direction. Trust only the DHCP-server/uplink interface does.
Answer B is incorrect because Sticky secure MAC learning dynamically learns secure MAC addresses and places them into the running configuration. At an airport back-office access switch, it does not provide the requirement to permit server-originated DHCP messages only from the known upstream direction. Trust only the DHCP-server/uplink interface does.
Question 3
A design review for a small manufacturing site focuses on this use case: verifying which DHCP-learned identity is legitimately attached to a specific access port. Which technology or concept should be selected? Choose ONE.
- Port-security maximum
- Dynamic ARP Inspection (DAI)
- DHCP snooping binding database
- Port-security violation mode restrict
Correct Answer: C
Correct Answer
Answer C is correct because For a small manufacturing site, the requirement is to identify the learned IP-to-MAC-to-port lease association. DHCP snooping binding database provides that function. It matches the evidence. It is state learned from DHCP and is later consumed by controls such as DAI.
Incorrect Answers
Answer B is incorrect because This option uses Dynamic ARP Inspection (DAI) for blocking ARP spoofing for dynamically addressed hosts when DHCP snooping bindings are available. At a small manufacturing site, the required function belongs to DHCP snooping binding database. The mechanism does not match.
Answer A is incorrect because Using Port-security maximum, the design limits how many secure source MAC addresses a switchport may accept. For a small manufacturing site, the missing function is to identify the learned IP-to-MAC-to-port lease association; DHCP snooping binding database supplies it.
Answer D is incorrect because This option uses Port-security violation mode restrict for keeping an access port operational for authorized devices while logging and counting an unexpected source MAC. At a small manufacturing site, the required function belongs to DHCP snooping binding database. The mechanism does not match.
Question 4
A design review for a regional sales branch focuses on this use case: blocking ARP spoofing for dynamically addressed hosts when DHCP snooping bindings are available. Which mechanism should the engineer use? Choose ONE.
- Dynamic ARP Inspection (DAI)
- An ARP ACL used with DAI
- Sticky secure MAC learning
- Port-security violation mode protect
Correct Answer: A
Correct Answer
Answer A is correct because Dynamic ARP Inspection (DAI) is appropriate for a regional sales branch. Its typical use is blocking ARP spoofing for dynamically addressed hosts when DHCP snooping bindings are available. It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. Both clues point to this option.
Incorrect Answers
Answer B is incorrect because An ARP ACL used with DAI is intended for protecting statically addressed hosts with DAI when no DHCP snooping lease exists for those endpoints. The scenario at a regional sales branch instead requires a mechanism to reject forged ARP mappings at untrusted access interfaces. That is the role of Dynamic ARP Inspection (DAI).
Answer C is incorrect because Sticky secure MAC learning is intended for learning an endpoint MAC without manually typing it while retaining the learned secure address in configuration. The scenario at a regional sales branch instead requires a mechanism to reject forged ARP mappings at untrusted access interfaces. That is the role of Dynamic ARP Inspection (DAI).
Answer D is incorrect because This option uses Port-security violation mode protect for discarding violating frames while leaving the port up when logging or traps are not required. At a regional sales branch, the required function belongs to Dynamic ARP Inspection (DAI). The mechanism does not match.
Question 5
A design review for a medical imaging support LAN focuses on this use case: protecting statically addressed hosts with DAI when no DHCP snooping lease exists for those endpoints. Which technology or concept should be selected? Choose ONE.
- Port-security maximum
- Port-security violation mode restrict
- Port-security violation mode shutdown
- An ARP ACL used with DAI
Correct Answer: D
Correct Answer
Answer D is correct because In a medical imaging support LAN, An ARP ACL used with DAI is the closest technical fit. It supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer A is incorrect because Port-security maximum limits how many secure source MAC addresses a switchport may accept. That can be valid elsewhere, but a medical imaging support LAN needs to validate ARP for a statically addressed endpoint that has no DHCP lease. An ARP ACL used with DAI matches that objective.
Answer B is incorrect because For a medical imaging support LAN, Port-security violation mode restrict solves the wrong problem. It drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. The scenario needs to validate ARP for a statically addressed endpoint that has no DHCP lease, which points to An ARP ACL used with DAI.
Answer C is incorrect because This option uses Port-security violation mode shutdown for taking the entire access port out of service after an unauthorized MAC violates the security policy. At a medical imaging support LAN, the required function belongs to An ARP ACL used with DAI. The mechanism does not match.
Question 6
A design review for a secured records room network focuses on this use case: constraining an edge port to the expected number of attached endpoint MAC addresses. Which mechanism should the engineer use? Choose ONE.
- Sticky secure MAC learning
- Port-security maximum
- Authentication
- Port-security violation mode protect
Correct Answer: B
Correct Answer
Answer B is correct because For a secured records room network, the requirement is to limit the number of allowed secure source MAC addresses. Port-security maximum provides that function. It matches the evidence. It controls MAC-count admission rather than DHCP or ARP protocol validity.
Incorrect Answers
Answer A is incorrect because Using Sticky secure MAC learning, the design dynamically learns secure MAC addresses and places them into the running configuration. For a secured records room network, the missing function is to limit the number of allowed secure source MAC addresses; Port-security maximum supplies it.
Answer D is incorrect because For a secured records room network, Port-security violation mode protect solves the wrong problem. It silently drops traffic from unknown source MAC addresses after the secure limit is reached without violation notifications. The scenario needs to limit the number of allowed secure source MAC addresses, which points to Port-security maximum.
Answer C is incorrect because Authentication is intended for answering the question of who the requester is by checking credentials or another identity factor. The scenario at a secured records room network instead requires a mechanism to limit the number of allowed secure source MAC addresses. That is the role of Port-security maximum.
Question 7
A design review for a university residence access layer focuses on this use case: learning an endpoint MAC without manually typing it while retaining the learned secure address in configuration. Which technology or concept should be selected? Choose ONE.
- Authorization
- Sticky secure MAC learning
- Port-security violation mode restrict
- Port-security violation mode shutdown
Correct Answer: B
Correct Answer
Answer B is correct because Sticky secure MAC learning fits a university residence access layer: it dynamically learns secure MAC addresses and places them into the running configuration. That behavior matches the requirement to learn secure MAC addresses automatically and retain them in running configuration. Other choices perform different roles.
Incorrect Answers
Answer C is incorrect because Port-security violation mode restrict drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. At a university residence access layer, it does not provide the requirement to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning does.
Answer D is incorrect because For a university residence access layer, Port-security violation mode shutdown solves the wrong problem. It places the interface into an error-disabled state after a port-security violation and records the event. The scenario needs to learn secure MAC addresses automatically and retain them in running configuration, which points to Sticky secure MAC learning.
Answer A is incorrect because Authorization determines which resources, commands, or services an authenticated identity is permitted to use. That can be valid elsewhere, but a university residence access layer needs to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning matches that objective.
Question 8
A design review for a restaurant chain branch focuses on this use case: keeping an access port operational for authorized devices while logging and counting an unexpected source MAC. Which mechanism should the engineer use? Choose ONE.
- Port-security violation mode restrict
- Port-security violation mode protect
- Authentication
- Accounting
Correct Answer: A
Correct Answer
Answer A is correct because Choose Port-security violation mode restrict for a restaurant chain branch. The scenario needs to drop violating MAC traffic while keeping the port up and producing operational evidence, and Port-security violation mode restrict supplies that function. Protect also drops offending traffic but does not provide the same violation notification behavior. That distinction is decisive.
Incorrect Answers
Answer B is incorrect because Port-security violation mode protect silently drops traffic from unknown source MAC addresses after the secure limit is reached without violation notifications. At a restaurant chain branch, it does not provide the requirement to drop violating MAC traffic while keeping the port up and producing operational evidence. Port-security violation mode restrict does.
Answer C is incorrect because Using Authentication, the design verifies the claimed identity of a user or device before access is granted. For a restaurant chain branch, the missing function is to drop violating MAC traffic while keeping the port up and producing operational evidence; Port-security violation mode restrict supplies it.
Answer D is incorrect because Using Accounting, the design records session activity, resource use, command activity, or start/stop events for audit and reporting. For a restaurant chain branch, the missing function is to drop violating MAC traffic while keeping the port up and producing operational evidence; Port-security violation mode restrict supplies it.
Question 9
Engineers reviewing a branch user VLAN being hardened against address-assignment and ARP attacks need two complementary capabilities: one that filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases, plus another that validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. Select the TWO options that provide those capabilities. Choose TWO.
- Trust only the DHCP-server/uplink interface
- Dynamic ARP Inspection (DAI)
- DHCP snooping
- Port-security violation mode restrict
- Port-security maximum
Correct Answers: B, C
Correct Answers
Answer C is correct because Choose DHCP snooping for a branch user VLAN being hardened against address-assignment and ARP attacks. The scenario needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings, and DHCP snooping supplies that function. It validates DHCP behavior rather than ARP replies or generic MAC-count limits. That distinction is decisive.
Answer B is correct because Choose Dynamic ARP Inspection (DAI) for a branch user VLAN being hardened against address-assignment and ARP attacks. The scenario needs to reject forged ARP mappings at untrusted access interfaces, and Dynamic ARP Inspection (DAI) supplies that function. It protects ARP integrity rather than deciding which DHCP server may answer. That distinction is decisive.
Incorrect Answers
Answer A is incorrect because Trust only the DHCP-server/uplink interface does not satisfy the paired requirement at a branch user VLAN being hardened against address-assignment and ARP attacks. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. The needed choices are DHCP snooping and Dynamic ARP Inspection (DAI).
Answer E is incorrect because Port-security maximum limits how many secure source MAC addresses a switchport may accept. The pair required at a branch user VLAN being hardened against address-assignment and ARP attacks is DHCP snooping plus Dynamic ARP Inspection (DAI). This option serves another role.
Answer D is incorrect because Port-security violation mode restrict is used for keeping an access port operational for authorized devices while logging and counting an unexpected source MAC. In a branch user VLAN being hardened against address-assignment and ARP attacks, the required functions come from DHCP snooping and Dynamic ARP Inspection (DAI). It is not one of them.
Question 10
A design review for a corporate training center focuses on this use case: taking the entire access port out of service after an unauthorized MAC violates the security policy. Which mechanism should the engineer use? Choose ONE.
- Accounting
- Trust only the DHCP-server/uplink interface
- Port-security violation mode shutdown
- Authentication
Correct Answer: C
Correct Answer
Answer C is correct because Choose Port-security violation mode shutdown for a corporate training center. The scenario needs to error-disable the port when a secure-MAC violation occurs, and Port-security violation mode shutdown supplies that function. Restrict and protect keep the port operational for permitted sources. That distinction is decisive.
Incorrect Answers
Answer D is incorrect because Authentication verifies the claimed identity of a user or device before access is granted. That can be valid elsewhere, but a corporate training center needs to error-disable the port when a secure-MAC violation occurs. Port-security violation mode shutdown matches that objective.
Answer A is incorrect because Accounting records session activity, resource use, command activity, or start/stop events for audit and reporting. That can be valid elsewhere, but a corporate training center needs to error-disable the port when a secure-MAC violation occurs. Port-security violation mode shutdown matches that objective.
Answer B is incorrect because For a corporate training center, Trust only the DHCP-server/uplink interface solves the wrong problem. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. The scenario needs to error-disable the port when a secure-MAC violation occurs, which points to Port-security violation mode shutdown.
Question 11
A design review for an insurance branch switch focuses on this use case: answering the question of who the requester is by checking credentials or another identity factor. Which technology or concept should be selected? Choose ONE.
- DHCP snooping binding database
- Authentication
- Authorization
- DHCP snooping
Correct Answer: B
Correct Answer
Answer B is correct because For an insurance branch switch, the requirement is to verify who the requester is. Authentication provides that function. It matches the evidence. Authorization happens after identity is established and determines allowed actions.
Incorrect Answers
Answer C is incorrect because For an insurance branch switch, Authorization solves the wrong problem. It determines which resources, commands, or services an authenticated identity is permitted to use. The scenario needs to verify who the requester is, which points to Authentication.
Answer D is incorrect because Using DHCP snooping, the design filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. For an insurance branch switch, the missing function is to verify who the requester is; Authentication supplies it.
Answer A is incorrect because This option uses DHCP snooping binding database for verifying which DHCP-learned identity is legitimately attached to a specific access port. At an insurance branch switch, the required function belongs to Authentication. The mechanism does not match.
Question 12
A design review for a design studio access switch focuses on this use case: enforcing what a known administrator or endpoint may do after successful authentication. Which mechanism should the engineer use? Choose ONE.
- Dynamic ARP Inspection (DAI)
- Trust only the DHCP-server/uplink interface
- Accounting
- Authorization
Correct Answer: D
Correct Answer
Answer D is correct because The evidence at a design studio access switch points to Authorization. It determines which resources, commands, or services an authenticated identity is permitted to use. That capability supports the requirement to decide what an already authenticated requester is allowed to do.
Incorrect Answers
Answer C is incorrect because This option uses Accounting for creating an auditable record of what an authenticated and authorized user did during a session. At a design studio access switch, the required function belongs to Authorization. The mechanism does not match.
Answer B is incorrect because Trust only the DHCP-server/uplink interface allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. At a design studio access switch, it does not provide the requirement to decide what an already authenticated requester is allowed to do. Authorization does.
Answer A is incorrect because For a design studio access switch, Dynamic ARP Inspection (DAI) solves the wrong problem. It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. The scenario needs to decide what an already authenticated requester is allowed to do, which points to Authorization.
Question 13
A design review for a warehouse receiving LAN focuses on this use case: creating an auditable record of what an authenticated and authorized user did during a session. Which technology or concept should be selected? Choose ONE.
- DHCP snooping
- DHCP snooping binding database
- An ARP ACL used with DAI
- Accounting
Correct Answer: D
Correct Answer
Answer D is correct because Accounting is appropriate for a warehouse receiving LAN. Its typical use is creating an auditable record of what an authenticated and authorized user did during a session. It records session activity, resource use, command activity, or start/stop events for audit and reporting. Both clues point to this option.
Incorrect Answers
Answer A is incorrect because DHCP snooping filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. That can be valid elsewhere, but a warehouse receiving LAN needs to record what occurred during the session for audit. Accounting matches that objective.
Answer B is incorrect because For a warehouse receiving LAN, DHCP snooping binding database solves the wrong problem. It records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. The scenario needs to record what occurred during the session for audit, which points to Accounting.
Answer C is incorrect because Using An ARP ACL used with DAI, the design supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. For a warehouse receiving LAN, the missing function is to record what occurred during the session for audit; Accounting supplies it.
Question 14
The case involving a research annex access switch turns on a specific distinction: it protects ARP integrity rather than deciding which DHCP server may answer. Which option best addresses this requirement? Choose ONE.
- Sticky secure MAC learning
- Port-security violation mode protect
- Dynamic ARP Inspection (DAI)
- An ARP ACL used with DAI
Correct Answer: C
Correct Answer
Answer C is correct because Dynamic ARP Inspection (DAI) is appropriate for a research annex access switch. Its typical use is blocking ARP spoofing for dynamically addressed hosts when DHCP snooping bindings are available. It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. Both clues point to this option.
Incorrect Answers
Answer D is incorrect because An ARP ACL used with DAI is intended for protecting statically addressed hosts with DAI when no DHCP snooping lease exists for those endpoints. The scenario at a research annex access switch instead requires a mechanism to reject forged ARP mappings at untrusted access interfaces. That is the role of Dynamic ARP Inspection (DAI).
Answer A is incorrect because Sticky secure MAC learning is intended for learning an endpoint MAC without manually typing it while retaining the learned secure address in configuration. The scenario at a research annex access switch instead requires a mechanism to reject forged ARP mappings at untrusted access interfaces. That is the role of Dynamic ARP Inspection (DAI).
Answer B is incorrect because This option uses Port-security violation mode protect for discarding violating frames while leaving the port up when logging or traps are not required. At a research annex access switch, the required function belongs to Dynamic ARP Inspection (DAI). The mechanism does not match.
Question 15
The case involving a laboratory instrument network turns on a specific distinction: it validates DHCP behavior rather than ARP replies or generic MAC-count limits. Which option provides the required function? Choose ONE.
- Dynamic ARP Inspection (DAI)
- Trust only the DHCP-server/uplink interface
- DHCP snooping
- Port-security maximum
Correct Answer: C
Correct Answer
Answer C is correct because Choose DHCP snooping for a laboratory instrument network. The scenario needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings, and DHCP snooping supplies that function. It validates DHCP behavior rather than ARP replies or generic MAC-count limits. That distinction is decisive.
Incorrect Answers
Answer B is incorrect because This option uses Trust only the DHCP-server/uplink interface for designating the known server-facing or upstream interface as trusted in a DHCP-snooping design. At a laboratory instrument network, the required function belongs to DHCP snooping. The mechanism does not match.
Answer A is incorrect because Dynamic ARP Inspection (DAI) validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. That can be valid elsewhere, but a laboratory instrument network needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings. DHCP snooping matches that objective.
Answer D is incorrect because Port-security maximum is intended for constraining an edge port to the expected number of attached endpoint MAC addresses. The scenario at a laboratory instrument network instead requires a mechanism to block unauthorized DHCP server replies and learn legitimate DHCP bindings. That is the role of DHCP snooping.
Question 16
The case involving a government branch office turns on a specific distinction: protect also drops offending traffic but does not provide the same violation notification behavior. Which option best addresses this requirement? Choose ONE.
- Port-security violation mode restrict
- Port-security violation mode protect
- Authentication
- Accounting
Correct Answer: A
Correct Answer
Answer A is correct because Choose Port-security violation mode restrict for a government branch office. The scenario needs to drop violating MAC traffic while keeping the port up and producing operational evidence, and Port-security violation mode restrict supplies that function. Protect also drops offending traffic but does not provide the same violation notification behavior. That distinction is decisive.
Incorrect Answers
Answer B is incorrect because Port-security violation mode protect silently drops traffic from unknown source MAC addresses after the secure limit is reached without violation notifications. At a government branch office, it does not provide the requirement to drop violating MAC traffic while keeping the port up and producing operational evidence. Port-security violation mode restrict does.
Answer C is incorrect because Using Authentication, the design verifies the claimed identity of a user or device before access is granted. For a government branch office, the missing function is to drop violating MAC traffic while keeping the port up and producing operational evidence; Port-security violation mode restrict supplies it.
Answer D is incorrect because Using Accounting, the design records session activity, resource use, command activity, or start/stop events for audit and reporting. For a government branch office, the missing function is to drop violating MAC traffic while keeping the port up and producing operational evidence; Port-security violation mode restrict supplies it.
Question 17
The case involving a media production access switch turns on a specific distinction: ordinary dynamic secure MAC learning is not added to the running configuration. Which option provides the required function? Choose ONE.
- Port-security violation mode restrict
- Port-security violation mode shutdown
- Authorization
- Sticky secure MAC learning
Correct Answer: D
Correct Answer
Answer D is correct because Sticky secure MAC learning fits a media production access switch: it dynamically learns secure MAC addresses and places them into the running configuration. That behavior matches the requirement to learn secure MAC addresses automatically and retain them in running configuration. Other choices perform different roles.
Incorrect Answers
Answer A is incorrect because Port-security violation mode restrict drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. At a media production access switch, it does not provide the requirement to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning does.
Answer B is incorrect because For a media production access switch, Port-security violation mode shutdown solves the wrong problem. It places the interface into an error-disabled state after a port-security violation and records the event. The scenario needs to learn secure MAC addresses automatically and retain them in running configuration, which points to Sticky secure MAC learning.
Answer C is incorrect because Authorization determines which resources, commands, or services an authenticated identity is permitted to use. That can be valid elsewhere, but a media production access switch needs to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning matches that objective.
Question 18
Engineers reviewing a network-access policy that must verify a user before assigning allowed privileges need two complementary capabilities: one that verifies the claimed identity of a user or device before access is granted, plus another that determines which resources, commands, or services an authenticated identity is permitted to use. Select the TWO options that provide those capabilities. Choose TWO.
- Authorization
- Authentication
- An ARP ACL used with DAI
- DHCP snooping binding database
- DHCP snooping
Correct Answers: A, B
Correct Answers
Answer B is correct because Choose Authentication for a network-access policy that must verify a user before assigning allowed privileges. The scenario needs to verify who the requester is, and Authentication supplies that function. Authorization happens after identity is established and determines allowed actions. That distinction is decisive.
Answer A is correct because Authorization is appropriate for a network-access policy that must verify a user before assigning allowed privileges. Its typical use is enforcing what a known administrator or endpoint may do after successful authentication. It determines which resources, commands, or services an authenticated identity is permitted to use. Both clues point to this option.
Incorrect Answers
Answer E is incorrect because DHCP snooping filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. The pair required at a network-access policy that must verify a user before assigning allowed privileges is Authentication plus Authorization. This option serves another role.
Answer D is incorrect because DHCP snooping binding database is used for verifying which DHCP-learned identity is legitimately attached to a specific access port. In a network-access policy that must verify a user before assigning allowed privileges, the required functions come from Authentication and Authorization. It is not one of them.
Answer C is incorrect because Using An ARP ACL used with DAI, the design supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. A network-access policy that must verify a user before assigning allowed privileges instead needs both Authentication and Authorization. This addresses a different mechanism.
Question 19
The case involving an industrial control support LAN turns on a specific distinction: accounting observes and records activity rather than proving identity or granting permission. Which option provides the required function? Choose ONE.
- An ARP ACL used with DAI
- Accounting
- DHCP snooping
- DHCP snooping binding database
Correct Answer: B
Correct Answer
Answer B is correct because Accounting is appropriate for an industrial control support LAN. Its typical use is creating an auditable record of what an authenticated and authorized user did during a session. It records session activity, resource use, command activity, or start/stop events for audit and reporting. Both clues point to this option.
Incorrect Answers
Answer C is incorrect because DHCP snooping filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. That can be valid elsewhere, but an industrial control support LAN needs to record what occurred during the session for audit. Accounting matches that objective.
Answer D is incorrect because For an industrial control support LAN, DHCP snooping binding database solves the wrong problem. It records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. The scenario needs to record what occurred during the session for audit, which points to Accounting.
Answer A is incorrect because Using An ARP ACL used with DAI, the design supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. For an industrial control support LAN, the missing function is to record what occurred during the session for audit; Accounting supplies it.
Question 20
The case involving a satellite office switch turns on a specific distinction: restrict and protect keep the port operational for permitted sources. Which option best addresses this requirement? Choose ONE.
- Port-security violation mode shutdown
- Authentication
- Accounting
- Trust only the DHCP-server/uplink interface
Correct Answer: A
Correct Answer
Answer A is correct because Choose Port-security violation mode shutdown for a satellite office switch. The scenario needs to error-disable the port when a secure-MAC violation occurs, and Port-security violation mode shutdown supplies that function. Restrict and protect keep the port operational for permitted sources. That distinction is decisive.
Incorrect Answers
Answer B is incorrect because Authentication verifies the claimed identity of a user or device before access is granted. That can be valid elsewhere, but a satellite office switch needs to error-disable the port when a secure-MAC violation occurs. Port-security violation mode shutdown matches that objective.
Answer C is incorrect because Accounting records session activity, resource use, command activity, or start/stop events for audit and reporting. That can be valid elsewhere, but a satellite office switch needs to error-disable the port when a secure-MAC violation occurs. Port-security violation mode shutdown matches that objective.
Answer D is incorrect because For a satellite office switch, Trust only the DHCP-server/uplink interface solves the wrong problem. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. The scenario needs to error-disable the port when a secure-MAC violation occurs, which points to Port-security violation mode shutdown.
