200-301 Question 168
Select 2A network engineer is tasked with configuring a switch to provide secure network access for devices connected to its interfaces. The engineer needs to ensure that unauthorized devices cannot connect to the network through the switch. Which of the following configuration options should the engineer implement to achieve this?
- A
Enable port security on the switch interfaces
- B
Configure VLANs to isolate traffic between different departments
- C
Set a maximum number of MAC addresses allowed per interface
- D
Enable dynamic ARP inspection (DAI) on the switch
- E
Assign a static IP address to every connected device and disable DHCP
Show answer and explanation
Correct answers: A, C
Explanation
To secure network access, port security should be enabled on switch interfaces, and the maximum number of MAC addresses per interface should be set. These measures ensure only authorized devices can connect to the switch interfaces. While VLANs, DAI, and static IPs have their own security benefits, they do not directly address the problem of unauthorized devices connecting to the network through switch ports.
- A. Correct.
Enabling port security on switch interfaces is a key step to prevent unauthorized devices from connecting to the network. It helps control which devices can connect by limiting MAC addresses per port.
- B. Incorrect.
Configuring VLANs is useful for traffic segmentation and security between departments but does not directly prevent unauthorized devices from connecting to the network.
- C. Correct.
Setting a maximum number of MAC addresses allowed per interface is a port security feature that limits how many devices can connect on a single interface, preventing unauthorized connections.
- D. Incorrect.
Dynamic ARP Inspection (DAI) is used to prevent ARP spoofing attacks but does not directly secure switch interfaces from unauthorized device connections.
- E. Incorrect.
Assigning static IP addresses and disabling DHCP is not a scalable or practical method for securing network access and does not directly prevent unauthorized devices from connecting to the switch.