CCNA 200-125 Exam: Port Security Questions With Answers

  1. A network administrator needs to configure port security on a switch. Which two statements are true? (Choose two)
    • A. The network administrator can apply port security to dynamic access ports
    • B. The network administrator can configure static secure or sticky secure mac addresses in the voice vlan.
    • C. The sticky learning feature allows the addition of dynamically learned addresses to the running configuration.*
    • D. The network administrator can apply port security to EtherChannels.
    • E. When dynamic mac address learning is enabled on an interface, the switch can learn new addresses up to the maximum defined.*

    Show (Hide) Explanation/Reference
    Follow these guidelines when configuring port security:
    Port security can only be configured on static access ports, trunk ports, or 802.1Q tunnel ports. -> A is not correct.
    + A secure port cannot be a dynamic access port.
    + A secure port cannot be a destination port for Switched Port Analyzer (SPAN).
    + A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group. -> D is not correct
    You cannot configure static secure or sticky secure MAC addresses on a voice VLAN. -> B is not correct.
    + When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to at least two.
    + If any type of port security is enabled on the access VLAN, dynamic port security is automatically enabled on the voice VLAN.
    + When a voice VLAN is configured on a secure port that is also configured as a sticky secure port, all addresses seen on the voice VLAN are learned as dynamic secure addresses, and all addresses seen on the access VLAN (to which the port belongs) are learned as sticky secure addresses.
    + The switch does not support port security aging of sticky secure MAC addresses.
    + The protect and restrict options cannot be simultaneously enabled on an interface.

    (Reference: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_19_ea1/configuration/guide/3550scg/swtrafc.html#wp1038546)

    Note: Dynamic access port or Dynamic port VLAN membership must be connected to an end station. This type of port can be configured with the “switchport access vlan dynamic” command in the interface configuration mode. Please read more about Dynamic access port here: http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_19_ea1/configuration/guide/3550scg/swvlan.html#wp1103064

  2. The network administrator normally establishes a Telnet session with the switch from host A. The administrator’s attempt to establish a connect via Telnet to the switch from host B fails, but pings from host B to other two hosts are successful. What is the issue for this problem?

    • A. Host B and the switch need to be in the same subnet.
    • B. The switch needs an appropriate default gateway assigned.*
    • C. The switch interface connected to the router is down.
    • D. Host B need to be assigned an IP address in vlan 1.

    Show (Hide) Explanation/Reference
    Host A (172.19.1.1) and the management IP address of the Switch (172.19.1.250) are in the same subnet so telnet from host A to the switch can be successful even if a default gateway is not set on host A.

    But host B (172.19.32.2) and the management IP address of the Switch (172.19.1.250) are not in the same subnet so host B needs a default gateway to telnet to the switch. The default gateway on host B should be 172.19.32.254.

  3. Which option is the default switch port port-security violation mode?
    • A. shutdown*
    • B. protect
    • C. shutdown vlan
    • D. restrict

    Show (Hide) Explanation/Reference
    Shutdown is the default switch port port-security violation mode. When in this mode, the switch will automatically force the switchport into an error disabled (err-disable) state when a violation occurs. While in this state, the switchport forwards no traffic. The switchport can be brought out of this error disabled state by issuing the errdisable recovery cause CLI command or by disabling and re-enabling the switchport.
  4. By default, how many MAC addresses are permitted to be learned on a switch port with port security enabled?
    • A. 8
    • B. 2
    • C. 1*
    • D. 0

    Show (Hide) Explanation/Reference
    By default, port security limits the MAC address that can connect to a switch port to one. If the maximum number of MAC addresses is reached, when another MAC address attempting to access the port a security violation occurs.
  5. Which set of commands is recommended to prevent the use of a hub in the access layer?
    • A.
      switch(config-if)#switchport mode trunk
      switch(config-if)#switchport port-security maximum 1
    • B.
      switch(config-if)#switchport mode trunk
      switch(config-if)#switchport port-security mac-address 1
    • C.
      switch(config-if)#switchport mode access
      switch(config-if)#switchport port-security maximum 1 *
    • D.
      switch(config-if)#switchport mode access
      switch(config-if)#switchport port-security mac-address 1

    Show (Hide) Explanation/Reference
    Port security is only used on access port (which connects to hosts) so we need to set that port to “access” mode, then we need to specify the maximum number of hosts which are allowed to connect to this port -> C is correct.

    Note: If we want to allow a fixed MAC address to connect, use the “switchport port-security mac-address ” command.

  6. Select the action that results from executing these commands:
    Switch(config-if)# switchport port-security 
    Switch(config-if)# switchport port-security mac-address sticky
    • A. A dynamically learned MAC address is saved in the startup-configuration file.
    • B. A dynamically learned MAC address is saved in the running-configuration file.*
    • C. A dynamically learned MAC address is saved in the VLAN database.
    • D. Statically configured MAC addresses are saved in the startup-configuration file if frames from that address are received.
    • E. Statically configured MAC addresses are saved in the running-configuration file if frames from that address are received.

    Show (Hide) Explanation/Reference
    The full syntax of the second command is:

    switchport port-security mac-address sticky [MAC]

    If we don’t specify the MAC address (like in this question) then the switch will dynamically learn the attached MAC Address and place it into your running-configuration -> B is correct.

  7. Refer to the exhibit. The following commands are executed on interface fa0/1 of 2950Switch.
    2950Switch(config-if)#switchport port-security
    2950Switch(config-if)#switchport port-security mac-address sticky
    2950Switch(config-if)#switchport port-security maximum 1

    The Ethernet frame that is shown arrives on interface fa0/1. What two functions will occur when this frame is received by 2950Switch? (Choose two)

    • A. The MAC address table will now have an additional entry of fa0/1 FFFF.FFFF.FFFF.
    • B. Only host A will be allowed to transmit frames on fa0/1.*
    • C. This frame will be discarded when it is received by 2950Switch.
    • D. All frames arriving on 2950Switch with a destination of 0000.00aa.aaaa will be forwarded out fa0/1.*
    • E. Hosts B and C may forward frames out fa0/1 but frames arriving from other switches will not be forwarded out fa0/1.
    • F. Only frames from source 0000.00bb.bbbb, the first learned MAC address of 2950Switch, will be forwarded out fa0/1.

    Show (Hide) Explanation/Reference
    The first command 2950Switch(config-if)#switchport port-security is to enable the port-security in a switch port.

    In the second command 2950Switch(config-if)#switchport port-security mac-address sticky, we need to know the full syntax of this command is switchport port-security mac-address sticky [MAC]. The STICKY keyword is used to make the MAC address appear in the running configuration and you can save it for later use. If you do not specify any MAC addresses after the STICKY keyword, the switch will dynamically learn the attached MAC Address and place it into your running-configuration. In this case, the switch will dynamically learn the MAC address 0000.00aa.aaaa of host A and add this MAC address to the running configuration.

    In the last command 2950Switch(config-if)#switchport port-security maximum 1 you limited the number of secure MAC addresses to one and dynamically assigned it (because no MAC address is mentioned, the switch will get the MAC address of the attached MAC address to interface fa0/1), the workstation attached to that port is assured the full bandwidth of the port.Therefore only host A will be allowed to transmit frames on fa0/1 -> B is correct.

    After you have set the maximum number of secure MAC addresses for interface fa0/1, the secure addresses are included in the “Secure MAC Address” table (this table is similar to the Mac Address Table but you can only view it with the show port-security address command). So in this question, although you don’t see the MAC address of host A listed in the MAC Address Table but frames with a destination of 0000.00aa.aaaa will be forwarded out of fa0/1 interface -> D is correct.

  8. Which two commands correctly verify whether port security has been configured on port FastEthernet 0/12 on a switch? (Choose two)
    • A. SW1# show switchport port-security interface FastEthernet 0/12
    • B. SW1# show switchport port-secure interface FastEthernet 0/12
    • C. SW1# show port-security interface FastEthernet 0/12*
    • D. SW1# show running-config*

    Show (Hide) Explanation/Reference
    We can verify whether port security has been configured by using the “show running-config” or “show port-security interface ” for more detail. An example of the output of “show port-security interface ” command is shown below:

  9. Refer to the exhibit. A junior network administrator was given the task of configuring port security on SwitchA to allow only PC_A to access the switched network through port fa0/1. If any other device is detected, the port is to drop frames from this device. The administrator configured the interface and tested it with successful pings from PC_A to RouterA, and then observes the output from these two show commands.

    Which two of these changes are necessary for SwitchA to meet the requirements? (Choose two)

    • A. Port security needs to be globally enabled.
    • B. Port security needs to be enabled on the interface.*
    • C. Port security needs to be configured to shut down the interface in the event of a violation.
    • D. Port security needs to be configured to allow only one learned MAC address.*
    • E. Port security interface counters need to be cleared before using the show command.
    • F. The port security configuration needs to be saved to NVRAM before it can become active.

    Show (Hide) Explanation/Reference
    As we see in the output, the “Port Security” is in “Disabled” state (line 2 in the output). To enable Port security feature, we must enable it on that interface first with the command:

    SwitchA(config-if)#switchport port-security

    -> B is correct.

    Also from the output, we learn that the switch is allowing 2 devices to connect to it (switchport port-security maximum 2) but the question requires allowing only PC_A to access the network so we need to reduce the maximum number to 1 -> D is correct.

  10. Which condition does the err-disabled status indicate on an Ethernet interface?
    • A. There is a duplex mismatch.
    • B. The device at the other end of the connection is powered off.
    • C. The serial interface is disabled.
    • D. The interface is configured with the shutdown command.
    • E. Port security has disabled the interface.*
    • F. The interface is fully functioning.

    Show (Hide) Explanation/Reference
    There are various reasons for the interface to go into errdisable. The reason can be:

    + Duplex mismatch
    + Port channel misconfiguration
    + BPDU guard violation
    + UniDirectional Link Detection (UDLD) condition
    + Late-collision detection
    + Link-flap detection
    + Security violation
    + Port Aggregation Protocol (PAgP) flap
    + Layer 2 Tunneling Protocol (L2TP) guard
    + DHCP snooping rate-limit
    + Incorrect GBIC / Small Form-Factor Pluggable (SFP) module or cable
    + Address Resolution Protocol (ARP) inspection
    + Inline power

    Reference: http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html

    Therefore in fact there are two correct answers in this question, which are “There is a duplex mismatch” and “Port security has disabled the interface” but maybe you should choose the port security answer as it is the most popular reason.


Related Articles

Leave a Reply

avatar