Module 11- Switch Security Configuration

Refer to the exhibit. The Fa0/2 interface on switch S1 has been configured with the switchport port-security mac-address 0023.189d.6456 command and a workstation has been connected. What could be the reason that the Fa0/2 interface is shutdown?

• The connection between S1 and PC1 is via a crossover cable.

• The Fa0/24 interface of S1 is configured with the same MAC address as the Fa0/2 interface.

• S1 has been configured with a switchport port-security aging command.

• The MAC address of PC1 that connects to the Fa0/2 interface is not the configured MAC address.

Answer explanation

The security violation counter for Fa0/2 has been incremented (evidenced by the 1 in the SecurityViolation column). The most secure addresses allowed on port Fa0/2 is 1 and that address was manually entered. Therefore, PC1 must have a different MAC address than the one configured for port Fa0/2. Connections between end devices and the switch, as well as connections between a router and a switch, are made with a straight-through cable.

Refer to the exhibit. Port Fa0/2 has already been configured appropriately. The IP phone and PC work properly. Which switch configuration would be most appropriate for port Fa0/2 if the network administrator has the following goals?

No one is allowed to disconnect the IP phone or the PC and connect some other wired device.

If a different device is connected, port Fa0/2 is shut down. The switch should automatically detect the MAC address of the IP phone and the PC and add those addresses to the running configuration.

• SWA(config-if)# switchport-security

  SWA(config-if)# switch port security mac-address sticky

• SWA(config-if)# switchport port-security mac-address sticky

  SWA(config-if)# switchport port-security maximum 2

• SWA(config-if)# switchport port-security

  SWA(config-if)# switchport port-security maximum 2

  SWA(config-if)# switchport port-security mac-address sticky

• SWA(config-if)# switchport port-security

  SWA(config-if)# switchport port-security maximum 2

  SWA(config-if)# switchport port-security mac-address sticky

  SWA(config-if)# switchport port-security violation restrict

Answer explanation

The default mode for a port security violation is to shut down the port so the switchport port-security violation command is not necessary. The switchport port-security command must be entered with no additional options to enable port security for the port. Then, additional port security options can be added.

Refer to the exhibit. Port security has been configured on the Fa 0/12 interface of switch S1. What action will occur when PC1 is attached to switch S1 with the applied configuration?

• Frames from PC1 will be dropped, and there will be no log of the violation.

• Frames from PC1 will cause the interface to shut down immediately, and a log entry will be made.

• Frames from PC1 will be forwarded to its destination, and a log entry will be created.

• Frames from PC1 will be forwarded to its destination, but a log entry will not be created.

• Frames from PC1 will be forwarded since the switchport port-security violation command is missing.

Answer explanation

Manual configuration of the single allowed MAC address has been entered for port fa0/12. PC1 has a different MAC address and when attached will cause the port to shut down (the default action), a log message to be automatically created, and the violation counter to increment. The default action of shutdown is recommended because the restrict option might fail if an attack is underway.

A network administrator is configuring port security on a Cisco switch. The company security policy specifies that when a violation occurs, packets with unknown source addresses should be dropped and no notification should be sent. Which violation mode should be configured on the interfaces?

• off

• restrict

• protect

• shutdown

Answer explanation

On a Cisco switch, an interface can be configured for one of three violation modes, specifying the action to be taken if a violation occurs:

Protect - Packets with unknown source addresses are dropped until a sufficient number of secure MAC addresses are removed, or the number of maximum allowable addresses is increased. There is no notification that a security violation has occurred.

Restrict - Packets with unknown source addresses are dropped until a sufficient number of secure MAC addresses are removed, or the number of maximum allowable addresses is increased. In this mode, there is a notification that a security violation has occurred.

Shutdown - The interface immediately becomes error-disabled and the port LED is turned off.

What security benefit is gained from enabling BPDU guard on PortFast enabled interfaces?

• preventing rogue switches from being added to the network

• protecting against Layer 2 loops

• enforcing the placement of root bridges

• preventing buffer overflow attacks

Answer explanation

BPDU guard immediately error-disables a port that receives a BPDU. This prevents rogue switches from being added to the network. BPDU guard should only be applied to all end-user ports.

Which type of VLAN-hopping attack may be prevented by designating an unused VLAN as the native VLAN?

• DTP spoofing

• DHCP spoofing

• VLAN double-tagging

• DHCP starvation

Answer explanation

Spoofing DTP messages forces a switch into trunking mode as part of a VLAN-hopping attack, but VLAN double tagging works even if trunk ports are disabled. Changing the native VLAN from the default to an unused VLAN reduces the possibility of this type of attack. DHCP spoofing and DHCP starvation exploit vulnerabilities in the DHCP message exchange.​

Refer to the exhibit. PC1 and PC2 should be able to obtain IP address assignments from the DHCP server. How many ports among switches should be assigned as trusted ports as part of the DHCP snooping configuration?

• 1

• 3

• 5

• 7

Answer explanation

The DHCP snooping configuration includes building the DHCP Snooping Binding Database and assigning necessary trusted ports on switches. A trusted port points to the legitimate DHCP servers. In this network design, because the DHCP server is attached to AS3, seven switch ports should be assigned as trusted ports, one on AS3 toward the DHCP server, one on DS1 toward AS3, one on DS2 toward AS3, and two connections on both AS1 and AS2 (toward DS1 and DS2), for a total of seven.

An IT security specialist enables port security on a switch port of a Cisco switch. What is the default violation mode in use until the switch port is configured to use a different violation mode?

• restrict

• disabled

• protect

• shutdown

Answer explanation

If no violation mode is specified when port security is enabled on a switch port, then the security violation mode defaults to shutdown.

A network administrator enters the following commands on the switch

SW1.SW1(config)# interface range fa0/5 – 10

SW1(config-if)# ip dhcp snooping limit rate 6

What is the effect after these commands are entered?

• FastEthernet ports 5 through 10 can receive up to 6 DHCP discovery messages per second.

• FastEthernet ports 5 through 10 can receive up to 6 DHCP messages per second of any type.

• If any of the FastEthernet ports 5 through 10 receive more than 6 DHCP messages per second, the port will be shut down.

• If any of the FastEthernet ports 5 through 10 receive more than 6 DHCP messages per second, the port will continue to operate and an error message will be sent to the network administrator.

Answer explanation

When DHCP snooping is being configured, the number of DHCP discovery messages that untrusted ports can receive per second should be rate-limited by using the ip dhcp snooping limit rate interface configuration command. When a port receives more messages than the rate allows, the extra messages will be dropped.

A network administrator is configuring DAI on a switch with the command ip arp inspection validate src-mac . What is the purpose of this configuration command?

• It checks the source MAC address in the Ethernet header against the MAC address table.

• It checks the source MAC address in the Ethernet header against the user-configured ARP ACLs.

• It checks the source MAC address in the Ethernet header against the target MAC address in the ARP body.

• It checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body.

Answer explanation

DAI can be configured to check for both destination or source MAC and IP addresses:

Destination MAC - Checks the destination MAC address in the Ethernet header against the target MAC address in the ARP body.

Source MAC - Checks the source MAC address in the Ethernet header against the sender MAC address in the ARP body.

IP address - Checks the ARP body for invalid and unexpected IP addresses including addresses 0.0.0.0, 255.255.255.255, and all IP multicast addresses.