350-401 Question 250
Single answerAn enterprise network administrator is tasked with securing the network infrastructure. The administrator needs to configure a feature on Cisco devices to prevent unauthorized devices from accessing the network by dynamically learning and limiting the number of MAC addresses allowed on a switch port. Which infrastructure security feature should the administrator implement?
- A
Port Security
- B
Dynamic ARP Inspection (DAI)
- C
IP Source Guard
- D
Access Control Lists (ACLs)
Show answer and explanation
Correct answer: A
Explanation
Port Security is a critical feature for securing the network by limiting the number of MAC addresses that can be learned on a switch port. This feature helps prevent unauthorized devices from accessing the network and mitigates Layer 2 attacks such as MAC flooding. The other options, while useful for network security, address different aspects and do not provide the functionality described in the scenario.
- A. Correct.
Port Security is the correct feature for dynamically learning and limiting the number of MAC addresses allowed on a switch port, providing protection against unauthorized devices.
- B. Incorrect.
Dynamic ARP Inspection (DAI) is used to prevent ARP spoofing attacks by validating ARP packets but does not limit the number of MAC addresses on a port.
- C. Incorrect.
IP Source Guard is used to prevent IP address spoofing by filtering traffic based on IP and MAC bindings but does not limit MAC addresses on a switch port.
- D. Incorrect.
Access Control Lists (ACLs) are used to filter traffic based on criteria like IP addresses, protocols, and ports but do not dynamically learn or limit MAC addresses.