300-420 Question 104
Select 4You are designing a Layer 2 network for a large enterprise. To enhance the security posture of the network, you must prevent unauthorized devices from connecting, mitigate potential issues from malicious STP manipulation, and ensure ACLs are enforced at the VLAN level. Which of the following techniques should you implement to address these requirements?
- A
Port security to restrict access to specific MAC addresses
- B
BPDU Guard to disable ports with unauthorized STP activity
- C
VACLs to enforce ACLs at the VLAN level
- D
Root Guard to prevent unauthorized devices from becoming the STP root
- E
DHCP snooping to prevent rogue DHCP servers
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To enhance Layer 2 security, a combination of techniques such as port security, BPDU Guard, and Root Guard can mitigate unauthorized device connections and malicious STP manipulation. VACLs further enhance security by applying traffic filtering at the VLAN level. While DHCP snooping is a valuable security feature, it is not directly relevant to the requirements in this scenario.
- A. Correct.
Port security restricts access to a port by allowing only specific MAC addresses. This prevents unauthorized devices from connecting and is a critical Layer 2 security technique.
- B. Correct.
BPDU Guard disables a port if it receives a BPDU on a port where STP participation is not expected. This mitigates risks from malicious STP manipulation.
- C. Correct.
VACLs (VLAN Access Control Lists) enforce access control at the VLAN level, ensuring that only authorized traffic is permitted within or between VLANs.
- D. Correct.
Root Guard prevents unauthorized devices from becoming the STP root, which helps maintain the intended STP topology and prevents potential network disruptions.
- E. Incorrect.
DHCP snooping is not directly relevant to this scenario as it focuses on preventing rogue DHCP servers rather than Layer 2 security techniques related to STP or VLANs.