300-420 Question 106
Select 3A network engineer is tasked with securing a Layer 2 switch in a corporate environment. The engineer needs to mitigate risks such as rogue DHCP servers, MAC address spoofing, and STP manipulation. Which combination of Layer 2 security techniques should the engineer implement to address these threats?
- A
Enable DHCP Snooping on relevant VLANs
- B
Implement Port Security on access ports
- C
Configure BPDU Guard on all access ports
- D
Apply VLAN Access Control Lists (VACLs) on trunk ports to filter DHCP packets
- E
Disable Spanning Tree Protocol (STP) on the entire switch
Show answer and explanation
Correct answers: A, B, C
Explanation
To secure a Layer 2 network, a combination of DHCP Snooping, Port Security, and BPDU Guard addresses the specific threats of rogue DHCP servers, MAC address spoofing, and STP manipulation. These techniques provide robust protection without compromising functionality or introducing risks.
- A. Correct.
DHCP Snooping protects the network from rogue DHCP servers by allowing DHCP responses only from authorized servers. This mitigates DHCP-related attacks.
- B. Correct.
Port Security limits the number of MAC addresses allowed on a port and can block unauthorized devices, mitigating MAC address spoofing.
- C. Correct.
BPDU Guard ensures that no unauthorized devices can send bridge protocol data units (BPDUs) on access ports, preventing STP manipulation attacks.
- D. Incorrect.
While VACLs can filter traffic, they are not typically used to address DHCP-specific threats or rogue servers. DHCP Snooping is more effective in this scenario.
- E. Incorrect.
Disabling STP on the switch would expose the network to severe risks such as broadcast storms and topology loops, making it a poor choice for securing Layer 2.