Topic 18 Practice Test 1 covers Layer 2 Security and AAA for Cisco Certified Network Associate 200-301 CCNA and maps to objectives 5.7–5.8. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps. Every option includes focused technical reasoning explaining both the networking concept and its fit to the scenario.
Question 1
A university access switch serving student laptops has a documented requirement to block unauthorized DHCP server replies and learn legitimate DHCP bindings. Which choice matches the evidence most directly? Choose ONE.
- Port-security maximum
- DHCP snooping
- Trust only the DHCP-server/uplink interface
- Dynamic ARP Inspection (DAI)
Correct Answer: B
Correct Answer
Answer B is correct because In a university access switch serving student laptops, DHCP snooping is the closest technical fit. It filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer C is incorrect because For a university access switch serving student laptops, Trust only the DHCP-server/uplink interface solves the wrong problem. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. The scenario needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings, which points to DHCP snooping.
Answer D is incorrect because This option uses Dynamic ARP Inspection (DAI) for blocking ARP spoofing for dynamically addressed hosts when DHCP snooping bindings are available. At a university access switch serving student laptops, the required function belongs to DHCP snooping. The mechanism does not match.
Answer A is incorrect because Using Port-security maximum, the design limits how many secure source MAC addresses a switchport may accept. For a university access switch serving student laptops, the missing function is to block unauthorized DHCP server replies and learn legitimate DHCP bindings; DHCP snooping supplies it.
Question 2
A warehouse edge switch serving handheld scanners has a documented requirement to permit server-originated DHCP messages only from the known upstream direction. Which choice is the best operational match? Choose ONE.
- Trust only the DHCP-server/uplink interface
- DHCP snooping binding database
- An ARP ACL used with DAI
- Sticky secure MAC learning
Correct Answer: A
Correct Answer
Answer A is correct because The evidence at a warehouse edge switch serving handheld scanners points to Trust only the DHCP-server/uplink interface. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. That capability supports the requirement to permit server-originated DHCP messages only from the known upstream direction.
Incorrect Answers
Answer B is incorrect because This option uses DHCP snooping binding database for verifying which DHCP-learned identity is legitimately attached to a specific access port. At a warehouse edge switch serving handheld scanners, the required function belongs to Trust only the DHCP-server/uplink interface. The mechanism does not match.
Answer C is incorrect because An ARP ACL used with DAI is intended for protecting statically addressed hosts with DAI when no DHCP snooping lease exists for those endpoints. The scenario at a warehouse edge switch serving handheld scanners instead requires a mechanism to permit server-originated DHCP messages only from the known upstream direction. That is the role of Trust only the DHCP-server/uplink interface.
Answer D is incorrect because Sticky secure MAC learning is intended for learning an endpoint MAC without manually typing it while retaining the learned secure address in configuration. The scenario at a warehouse edge switch serving handheld scanners instead requires a mechanism to permit server-originated DHCP messages only from the known upstream direction. That is the role of Trust only the DHCP-server/uplink interface.
Question 3
A branch office access stack has a documented requirement to identify the learned IP-to-MAC-to-port lease association. Which choice matches the evidence most directly? Choose ONE.
- DHCP snooping binding database
- Port-security violation mode restrict
- Port-security maximum
- Dynamic ARP Inspection (DAI)
Correct Answer: A
Correct Answer
Answer A is correct because DHCP snooping binding database is appropriate for a branch office access stack. Its typical use is verifying which DHCP-learned identity is legitimately attached to a specific access port. It records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. Both clues point to this option.
Incorrect Answers
Answer D is incorrect because For a branch office access stack, Dynamic ARP Inspection (DAI) solves the wrong problem. It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. The scenario needs to identify the learned IP-to-MAC-to-port lease association, which points to DHCP snooping binding database.
Answer C is incorrect because Port-security maximum limits how many secure source MAC addresses a switchport may accept. That can be valid elsewhere, but a branch office access stack needs to identify the learned IP-to-MAC-to-port lease association. DHCP snooping binding database matches that objective.
Answer B is incorrect because For a branch office access stack, Port-security violation mode restrict solves the wrong problem. It drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. The scenario needs to identify the learned IP-to-MAC-to-port lease association, which points to DHCP snooping binding database.
Question 4
A hospital floor switch serving managed workstations has a documented requirement to reject forged ARP mappings at untrusted access interfaces. Which choice is the best operational match? Choose ONE.
- Sticky secure MAC learning
- Port-security violation mode protect
- Dynamic ARP Inspection (DAI)
- An ARP ACL used with DAI
Correct Answer: C
Correct Answer
Answer C is correct because The evidence at a hospital floor switch serving managed workstations points to Dynamic ARP Inspection (DAI). It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. That capability supports the requirement to reject forged ARP mappings at untrusted access interfaces.
Incorrect Answers
Answer D is incorrect because Using An ARP ACL used with DAI, the design supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. For a hospital floor switch serving managed workstations, the missing function is to reject forged ARP mappings at untrusted access interfaces; Dynamic ARP Inspection (DAI) supplies it.
Answer A is incorrect because Using Sticky secure MAC learning, the design dynamically learns secure MAC addresses and places them into the running configuration. For a hospital floor switch serving managed workstations, the missing function is to reject forged ARP mappings at untrusted access interfaces; Dynamic ARP Inspection (DAI) supplies it.
Answer B is incorrect because For a hospital floor switch serving managed workstations, Port-security violation mode protect solves the wrong problem. It silently drops traffic from unknown source MAC addresses after the secure limit is reached without violation notifications. The scenario needs to reject forged ARP mappings at untrusted access interfaces, which points to Dynamic ARP Inspection (DAI).
Question 5
A retail store access switch has a documented requirement to validate ARP for a statically addressed endpoint that has no DHCP lease. Which choice matches the evidence most directly? Choose ONE.
- Port-security violation mode shutdown
- An ARP ACL used with DAI
- Port-security maximum
- Port-security violation mode restrict
Correct Answer: B
Correct Answer
Answer B is correct because An ARP ACL used with DAI fits a retail store access switch: it supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. That behavior matches the requirement to validate ARP for a statically addressed endpoint that has no DHCP lease. Other choices perform different roles.
Incorrect Answers
Answer C is incorrect because This option uses Port-security maximum for constraining an edge port to the expected number of attached endpoint MAC addresses. At a retail store access switch, the required function belongs to An ARP ACL used with DAI. The mechanism does not match.
Answer D is incorrect because Port-security violation mode restrict drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. At a retail store access switch, it does not provide the requirement to validate ARP for a statically addressed endpoint that has no DHCP lease. An ARP ACL used with DAI does.
Answer A is incorrect because For a retail store access switch, Port-security violation mode shutdown solves the wrong problem. It places the interface into an error-disabled state after a port-security violation and records the event. The scenario needs to validate ARP for a statically addressed endpoint that has no DHCP lease, which points to An ARP ACL used with DAI.
Question 6
A factory line access switch has a documented requirement to limit the number of allowed secure source MAC addresses. Which choice is the best operational match? Choose ONE.
- Authentication
- Port-security violation mode protect
- Sticky secure MAC learning
- Port-security maximum
Correct Answer: D
Correct Answer
Answer D is correct because Port-security maximum is appropriate for a factory line access switch. Its typical use is constraining an edge port to the expected number of attached endpoint MAC addresses. It limits how many secure source MAC addresses a switchport may accept. Both clues point to this option.
Incorrect Answers
Answer C is incorrect because Sticky secure MAC learning dynamically learns secure MAC addresses and places them into the running configuration. That can be valid elsewhere, but a factory line access switch needs to limit the number of allowed secure source MAC addresses. Port-security maximum matches that objective.
Answer B is incorrect because Port-security violation mode protect silently drops traffic from unknown source MAC addresses after the secure limit is reached without violation notifications. At a factory line access switch, it does not provide the requirement to limit the number of allowed secure source MAC addresses. Port-security maximum does.
Answer A is incorrect because Using Authentication, the design verifies the claimed identity of a user or device before access is granted. For a factory line access switch, the missing function is to limit the number of allowed secure source MAC addresses; Port-security maximum supplies it.
Question 7
A call-center floor switch has a documented requirement to learn secure MAC addresses automatically and retain them in running configuration. Which choice matches the evidence most directly? Choose ONE.
- Port-security violation mode restrict
- Port-security violation mode shutdown
- Authorization
- Sticky secure MAC learning
Correct Answer: D
Correct Answer
Answer D is correct because For a call-center floor switch, the requirement is to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning provides that function. It matches the evidence. Ordinary dynamic secure MAC learning is not added to the running configuration.
Incorrect Answers
Answer A is incorrect because Port-security violation mode restrict is intended for keeping an access port operational for authorized devices while logging and counting an unexpected source MAC. The scenario at a call-center floor switch instead requires a mechanism to learn secure MAC addresses automatically and retain them in running configuration. That is the role of Sticky secure MAC learning.
Answer B is incorrect because Port-security violation mode shutdown places the interface into an error-disabled state after a port-security violation and records the event. At a call-center floor switch, it does not provide the requirement to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning does.
Answer C is incorrect because This option uses Authorization for enforcing what a known administrator or endpoint may do after successful authentication. At a call-center floor switch, the required function belongs to Sticky secure MAC learning. The mechanism does not match.
Question 8
A finance office edge switch has a documented requirement to drop violating MAC traffic while keeping the port up and producing operational evidence. Which choice is the best operational match? Choose ONE.
- Authentication
- Accounting
- Port-security violation mode restrict
- Port-security violation mode protect
Correct Answer: C
Correct Answer
Answer C is correct because In a finance office edge switch, Port-security violation mode restrict is the closest technical fit. It drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer D is incorrect because Port-security violation mode protect is intended for discarding violating frames while leaving the port up when logging or traps are not required. The scenario at a finance office edge switch instead requires a mechanism to drop violating MAC traffic while keeping the port up and producing operational evidence. That is the role of Port-security violation mode restrict.
Answer A is incorrect because Authentication verifies the claimed identity of a user or device before access is granted. That can be valid elsewhere, but a finance office edge switch needs to drop violating MAC traffic while keeping the port up and producing operational evidence. Port-security violation mode restrict matches that objective.
Answer B is incorrect because Accounting records session activity, resource use, command activity, or start/stop events for audit and reporting. That can be valid elsewhere, but a finance office edge switch needs to drop violating MAC traffic while keeping the port up and producing operational evidence. Port-security violation mode restrict matches that objective.
Question 9
A campus access layer exposed to rogue DHCP and ARP spoofing has two independent requirements. First, it must block unauthorized DHCP server replies and learn legitimate DHCP bindings. Second, it must reject forged ARP mappings at untrusted access interfaces. Which TWO choices satisfy those requirements? Choose TWO.
- DHCP snooping
- Port-security violation mode restrict
- Port-security maximum
- Trust only the DHCP-server/uplink interface
- Dynamic ARP Inspection (DAI)
Correct Answers: A, E
Correct Answers
Answer A is correct because In a campus access layer exposed to rogue DHCP and ARP spoofing, DHCP snooping is the closest technical fit. It filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. The observed requirement depends on that specific behavior.
Answer E is correct because In a campus access layer exposed to rogue DHCP and ARP spoofing, Dynamic ARP Inspection (DAI) is the closest technical fit. It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer D is incorrect because Using Trust only the DHCP-server/uplink interface, the design allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. A campus access layer exposed to rogue DHCP and ARP spoofing instead needs both DHCP snooping and Dynamic ARP Inspection (DAI). This addresses a different mechanism.
Answer C is incorrect because Port-security maximum does not satisfy the paired requirement at a campus access layer exposed to rogue DHCP and ARP spoofing. It limits how many secure source MAC addresses a switchport may accept. The needed choices are DHCP snooping and Dynamic ARP Inspection (DAI).
Answer B is incorrect because Port-security violation mode restrict drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. The pair required at a campus access layer exposed to rogue DHCP and ARP spoofing is DHCP snooping plus Dynamic ARP Inspection (DAI). This option serves another role.
Question 10
A distribution closet feeding several access switches has a documented requirement to error-disable the port when a secure-MAC violation occurs. Which choice is the best operational match? Choose ONE.
- Port-security violation mode shutdown
- Authentication
- Accounting
- Trust only the DHCP-server/uplink interface
Correct Answer: A
Correct Answer
Answer A is correct because In a distribution closet feeding several access switches, Port-security violation mode shutdown is the closest technical fit. It places the interface into an error-disabled state after a port-security violation and records the event. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer B is incorrect because This option uses Authentication for answering the question of who the requester is by checking credentials or another identity factor. At a distribution closet feeding several access switches, the required function belongs to Port-security violation mode shutdown. The mechanism does not match.
Answer C is incorrect because This option uses Accounting for creating an auditable record of what an authenticated and authorized user did during a session. At a distribution closet feeding several access switches, the required function belongs to Port-security violation mode shutdown. The mechanism does not match.
Answer D is incorrect because Trust only the DHCP-server/uplink interface allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. At a distribution closet feeding several access switches, it does not provide the requirement to error-disable the port when a secure-MAC violation occurs. Port-security violation mode shutdown does.
Question 11
A campus help-desk switch has a documented requirement to verify who the requester is. Which choice matches the evidence most directly? Choose ONE.
- Authorization
- DHCP snooping
- DHCP snooping binding database
- Authentication
Correct Answer: D
Correct Answer
Answer D is correct because Authentication is appropriate for a campus help-desk switch. Its typical use is answering the question of who the requester is by checking credentials or another identity factor. It verifies the claimed identity of a user or device before access is granted. Both clues point to this option.
Incorrect Answers
Answer A is incorrect because Authorization determines which resources, commands, or services an authenticated identity is permitted to use. At a campus help-desk switch, it does not provide the requirement to verify who the requester is. Authentication does.
Answer B is incorrect because DHCP snooping filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. That can be valid elsewhere, but a campus help-desk switch needs to verify who the requester is. Authentication matches that objective.
Answer C is incorrect because For a campus help-desk switch, DHCP snooping binding database solves the wrong problem. It records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. The scenario needs to verify who the requester is, which points to Authentication.
Question 12
A research lab switch has a documented requirement to decide what an already authenticated requester is allowed to do. Which choice is the best operational match? Choose ONE.
- Accounting
- Authorization
- Dynamic ARP Inspection (DAI)
- Trust only the DHCP-server/uplink interface
Correct Answer: B
Correct Answer
Answer B is correct because Choose Authorization for a research lab switch. The scenario needs to decide what an already authenticated requester is allowed to do, and Authorization supplies that function. Authentication proves identity but does not define the permitted privilege set. That distinction is decisive.
Incorrect Answers
Answer A is incorrect because For a research lab switch, Accounting solves the wrong problem. It records session activity, resource use, command activity, or start/stop events for audit and reporting. The scenario needs to decide what an already authenticated requester is allowed to do, which points to Authorization.
Answer D is incorrect because Trust only the DHCP-server/uplink interface is intended for designating the known server-facing or upstream interface as trusted in a DHCP-snooping design. The scenario at a research lab switch instead requires a mechanism to decide what an already authenticated requester is allowed to do. That is the role of Authorization.
Answer C is incorrect because Dynamic ARP Inspection (DAI) validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. At a research lab switch, it does not provide the requirement to decide what an already authenticated requester is allowed to do. Authorization does.
Question 13
A training-room access switch has a documented requirement to record what occurred during the session for audit. Which choice matches the evidence most directly? Choose ONE.
- An ARP ACL used with DAI
- Accounting
- DHCP snooping
- DHCP snooping binding database
Correct Answer: B
Correct Answer
Answer B is correct because The evidence at a training-room access switch points to Accounting. It records session activity, resource use, command activity, or start/stop events for audit and reporting. That capability supports the requirement to record what occurred during the session for audit.
Incorrect Answers
Answer C is incorrect because This option uses DHCP snooping for stopping a rogue DHCP server on an access segment while recording client IP/MAC/VLAN/port bindings. At a training-room access switch, the required function belongs to Accounting. The mechanism does not match.
Answer D is incorrect because DHCP snooping binding database records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. At a training-room access switch, it does not provide the requirement to record what occurred during the session for audit. Accounting does.
Answer A is incorrect because An ARP ACL used with DAI supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. That can be valid elsewhere, but a training-room access switch needs to record what occurred during the session for audit. Accounting matches that objective.
Question 14
During troubleshooting of a clinic branch switch, the missing capability is one that validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. Which mechanism should the engineer use? Choose ONE.
- Dynamic ARP Inspection (DAI)
- An ARP ACL used with DAI
- Sticky secure MAC learning
- Port-security violation mode protect
Correct Answer: A
Correct Answer
Answer A is correct because The evidence at a clinic branch switch points to Dynamic ARP Inspection (DAI). It validates ARP packets on untrusted interfaces against trusted bindings and drops invalid ARP information. That capability supports the requirement to reject forged ARP mappings at untrusted access interfaces.
Incorrect Answers
Answer B is incorrect because Using An ARP ACL used with DAI, the design supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. For a clinic branch switch, the missing function is to reject forged ARP mappings at untrusted access interfaces; Dynamic ARP Inspection (DAI) supplies it.
Answer C is incorrect because Using Sticky secure MAC learning, the design dynamically learns secure MAC addresses and places them into the running configuration. For a clinic branch switch, the missing function is to reject forged ARP mappings at untrusted access interfaces; Dynamic ARP Inspection (DAI) supplies it.
Answer D is incorrect because For a clinic branch switch, Port-security violation mode protect solves the wrong problem. It silently drops traffic from unknown source MAC addresses after the secure limit is reached without violation notifications. The scenario needs to reject forged ARP mappings at untrusted access interfaces, which points to Dynamic ARP Inspection (DAI).
Question 15
During troubleshooting of a hotel staff-network switch, the missing capability is one that filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. Which technology or concept should be selected? Choose ONE.
- DHCP snooping
- Port-security maximum
- Dynamic ARP Inspection (DAI)
- Trust only the DHCP-server/uplink interface
Correct Answer: A
Correct Answer
Answer A is correct because In a hotel staff-network switch, DHCP snooping is the closest technical fit. It filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer D is incorrect because For a hotel staff-network switch, Trust only the DHCP-server/uplink interface solves the wrong problem. It allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. The scenario needs to block unauthorized DHCP server replies and learn legitimate DHCP bindings, which points to DHCP snooping.
Answer C is incorrect because This option uses Dynamic ARP Inspection (DAI) for blocking ARP spoofing for dynamically addressed hosts when DHCP snooping bindings are available. At a hotel staff-network switch, the required function belongs to DHCP snooping. The mechanism does not match.
Answer B is incorrect because Using Port-security maximum, the design limits how many secure source MAC addresses a switchport may accept. For a hotel staff-network switch, the missing function is to block unauthorized DHCP server replies and learn legitimate DHCP bindings; DHCP snooping supplies it.
Question 16
During troubleshooting of a municipal office access switch, the missing capability is one that drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. Which mechanism should the engineer use? Choose ONE.
- Authentication
- Accounting
- Port-security violation mode restrict
- Port-security violation mode protect
Correct Answer: C
Correct Answer
Answer C is correct because In a municipal office access switch, Port-security violation mode restrict is the closest technical fit. It drops frames from violating source MAC addresses while incrementing the violation counter and generating notifications. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer D is incorrect because Port-security violation mode protect is intended for discarding violating frames while leaving the port up when logging or traps are not required. The scenario at a municipal office access switch instead requires a mechanism to drop violating MAC traffic while keeping the port up and producing operational evidence. That is the role of Port-security violation mode restrict.
Answer A is incorrect because Authentication verifies the claimed identity of a user or device before access is granted. That can be valid elsewhere, but a municipal office access switch needs to drop violating MAC traffic while keeping the port up and producing operational evidence. Port-security violation mode restrict matches that objective.
Answer B is incorrect because Accounting records session activity, resource use, command activity, or start/stop events for audit and reporting. That can be valid elsewhere, but a municipal office access switch needs to drop violating MAC traffic while keeping the port up and producing operational evidence. Port-security violation mode restrict matches that objective.
Question 17
During troubleshooting of an engineering office switch, the missing capability is one that dynamically learns secure MAC addresses and places them into the running configuration. Which technology or concept should be selected? Choose ONE.
- Authorization
- Sticky secure MAC learning
- Port-security violation mode restrict
- Port-security violation mode shutdown
Correct Answer: B
Correct Answer
Answer B is correct because For an engineering office switch, the requirement is to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning provides that function. It matches the evidence. Ordinary dynamic secure MAC learning is not added to the running configuration.
Incorrect Answers
Answer C is incorrect because Port-security violation mode restrict is intended for keeping an access port operational for authorized devices while logging and counting an unexpected source MAC. The scenario at an engineering office switch instead requires a mechanism to learn secure MAC addresses automatically and retain them in running configuration. That is the role of Sticky secure MAC learning.
Answer D is incorrect because Port-security violation mode shutdown places the interface into an error-disabled state after a port-security violation and records the event. At an engineering office switch, it does not provide the requirement to learn secure MAC addresses automatically and retain them in running configuration. Sticky secure MAC learning does.
Answer A is incorrect because This option uses Authorization for enforcing what a known administrator or endpoint may do after successful authentication. At an engineering office switch, the required function belongs to Sticky secure MAC learning. The mechanism does not match.
Question 18
An administrator login policy that separates identity checks from permitted commands has two independent requirements. First, it must verify who the requester is. Second, it must decide what an already authenticated requester is allowed to do. Which TWO choices satisfy those requirements? Choose TWO.
- An ARP ACL used with DAI
- DHCP snooping binding database
- DHCP snooping
- Authorization
- Authentication
Correct Answers: D, E
Correct Answers
Answer E is correct because In an administrator login policy that separates identity checks from permitted commands, Authentication is the closest technical fit. It verifies the claimed identity of a user or device before access is granted. The observed requirement depends on that specific behavior.
Answer D is correct because The evidence at an administrator login policy that separates identity checks from permitted commands points to Authorization. It determines which resources, commands, or services an authenticated identity is permitted to use. That capability supports the requirement to decide what an already authenticated requester is allowed to do.
Incorrect Answers
Answer C is incorrect because DHCP snooping does not satisfy the paired requirement at an administrator login policy that separates identity checks from permitted commands. It filters untrusted DHCP server messages and builds a binding database for legitimate DHCP leases. The needed choices are Authentication and Authorization.
Answer B is incorrect because DHCP snooping binding database records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. The pair required at an administrator login policy that separates identity checks from permitted commands is Authentication plus Authorization. This option serves another role.
Answer A is incorrect because An ARP ACL used with DAI is used for protecting statically addressed hosts with DAI when no DHCP snooping lease exists for those endpoints. In an administrator login policy that separates identity checks from permitted commands, the required functions come from Authentication and Authorization. It is not one of them.
Question 19
During troubleshooting of a remote-office access switch, the missing capability is one that records session activity, resource use, command activity, or start/stop events for audit and reporting. Which technology or concept should be selected? Choose ONE.
- DHCP snooping
- DHCP snooping binding database
- An ARP ACL used with DAI
- Accounting
Correct Answer: D
Correct Answer
Answer D is correct because The evidence at a remote-office access switch points to Accounting. It records session activity, resource use, command activity, or start/stop events for audit and reporting. That capability supports the requirement to record what occurred during the session for audit.
Incorrect Answers
Answer A is incorrect because This option uses DHCP snooping for stopping a rogue DHCP server on an access segment while recording client IP/MAC/VLAN/port bindings. At a remote-office access switch, the required function belongs to Accounting. The mechanism does not match.
Answer B is incorrect because DHCP snooping binding database records learned client MAC, IP, VLAN, interface, and lease information from valid DHCP exchanges. At a remote-office access switch, it does not provide the requirement to record what occurred during the session for audit. Accounting does.
Answer C is incorrect because An ARP ACL used with DAI supplies approved IP-to-MAC mappings for ARP validation where hosts use static addressing. That can be valid elsewhere, but a remote-office access switch needs to record what occurred during the session for audit. Accounting matches that objective.
Question 20
During troubleshooting of a library public-access switch, the missing capability is one that places the interface into an error-disabled state after a port-security violation and records the event. Which mechanism should the engineer use? Choose ONE.
- Accounting
- Trust only the DHCP-server/uplink interface
- Port-security violation mode shutdown
- Authentication
Correct Answer: C
Correct Answer
Answer C is correct because In a library public-access switch, Port-security violation mode shutdown is the closest technical fit. It places the interface into an error-disabled state after a port-security violation and records the event. The observed requirement depends on that specific behavior.
Incorrect Answers
Answer D is incorrect because This option uses Authentication for answering the question of who the requester is by checking credentials or another identity factor. At a library public-access switch, the required function belongs to Port-security violation mode shutdown. The mechanism does not match.
Answer A is incorrect because This option uses Accounting for creating an auditable record of what an authenticated and authorized user did during a session. At a library public-access switch, the required function belongs to Port-security violation mode shutdown. The mechanism does not match.
Answer B is incorrect because Trust only the DHCP-server/uplink interface allows DHCP server messages on the path toward the legitimate server while client-facing ports remain untrusted. At a library public-access switch, it does not provide the requirement to error-disable the port when a secure-MAC violation occurs. Port-security violation mode shutdown does.
