200-301 Question 166
Select 4A network administrator is configuring port security on a switch to mitigate unauthorized access. The administrator wants to limit the number of devices that can connect to a specific port and ensure that only a predetermined MAC address is allowed. Which configuration steps should the administrator take?
- A
Set the port mode to access.
- B
Enable port security on the interface.
- C
Set the maximum number of MAC addresses allowed on the port to 1.
- D
Manually specify the allowed MAC address using the 'switchport port-security mac-address' command.
- E
Enable dynamic MAC address learning on the port.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To meet the administrator's goal of limiting the number of devices and allowing only a predetermined MAC address, the port must be set to access mode, port security must be enabled, the maximum number of MAC addresses must be limited to 1, and the allowed MAC address must be manually specified. Dynamic MAC address learning is not appropriate for this scenario as it does not align with the requirement of specifying a static MAC address.
- A. Correct.
Setting the port mode to access is a prerequisite for enabling port security, as port security is only applicable to access ports, not trunk ports.
- B. Correct.
Enabling port security on the interface is a necessary step to activate the feature and start enforcing security policies.
- C. Correct.
Setting the maximum number of MAC addresses to 1 ensures that only a single device is allowed to connect to the port at any given time, meeting the administrator's requirement.
- D. Correct.
Manually specifying the allowed MAC address ensures that only the specified device can connect to the port, adding an additional layer of security.
- E. Incorrect.
Dynamic MAC address learning contradicts the requirement to manually specify a predetermined MAC address and can potentially allow unauthorized devices to connect.