300-420 Question 105
Select 3A network engineer is tasked with securing a Layer 2 network in a campus environment. The engineer notices that unauthorized devices are connecting to access layer switches, and there have been instances of broadcast storms caused by Layer 2 loops. Which combination of Layer 2 security techniques should the engineer implement to mitigate these issues?
- A
Enable BPDU Guard on all access ports to protect against misconfigured switches or rogue devices.
- B
Configure Port Security to limit the number of MAC addresses allowed on each access port.
- C
Implement VLAN Access Control Lists (VACLs) to restrict traffic between VLANs at Layer 2.
- D
Activate Root Guard on all ports to ensure the current root bridge remains unchanged.
- E
Disable Spanning Tree Protocol (STP) on all access layer switches to prevent loops.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure a Layer 2 network and address the identified issues, the engineer should implement BPDU Guard to protect against rogue devices sending BPDUs, Port Security to limit unauthorized device connections, and Root Guard to maintain the integrity of the STP topology. Disabling STP is not a valid solution, and VACLs are not directly related to resolving the specific problems described in the scenario.
- A. Correct.
Enabling BPDU Guard on access ports ensures that if any unauthorized device sends Bridge Protocol Data Units (BPDUs), the port will be placed into an error-disabled state, preventing potential topology changes or loops.
- B. Correct.
Port Security can restrict the number of MAC addresses allowed on a port, which helps prevent unauthorized devices from connecting to the network.
- C. Incorrect.
VLAN Access Control Lists (VACLs) are used to filter traffic at the VLAN level but are not relevant to mitigating the specific issues of unauthorized device connections or broadcast storms.
- D. Correct.
Root Guard prevents unauthorized devices from becoming the root bridge by blocking superior BPDUs received on specific ports. This helps protect the stability of the STP topology.
- E. Incorrect.
Disabling STP is not recommended, as it would remove the loop prevention mechanisms entirely, potentially leading to broadcast storms.