350-401 Question 251
Single answerAn enterprise network administrator is tasked with securing the infrastructure by limiting the risk of unauthorized devices connecting to the network. They decide to configure port security on a Cisco switch. Which configuration step is required to ensure that only a single specific device can connect to a specific port, and any violation will disable the port?
- A
Configure the port as an access port and set the maximum number of MAC addresses allowed to 1.
- B
Enable Dynamic ARP Inspection (DAI) on the switch port.
- C
Configure the port as a trunk port with VLAN pruning enabled.
- D
Set the port security violation mode to 'protect'.
Show answer and explanation
Correct answer: A
Explanation
To secure a switch port and ensure only one specific device can connect, the port must be configured as an access port with port security enabled, limiting the maximum number of MAC addresses to 1. This configuration ensures that any unauthorized device attempting to connect will trigger a port security violation. Choosing the correct violation mode (e.g., 'shutdown') would disable the port if a violation occurs, adding an additional layer of protection.
- A. Correct.
Configuring the port as an access port and setting the maximum number of MAC addresses to 1 ensures that only one device (based on its MAC address) can connect to the port. This is a fundamental step in port security.
- B. Incorrect.
Dynamic ARP Inspection (DAI) is a security feature designed to prevent ARP spoofing attacks, but it is unrelated to limiting device connections to a port.
- C. Incorrect.
Configuring a port as a trunk with VLAN pruning enabled is unrelated to port security and does not restrict the number of devices connecting to the port.
- D. Incorrect.
Setting the port security violation mode to 'protect' allows the port to drop traffic from unauthorized devices but does not disable the port upon a violation.