11.1_Impelement Port Security

Question 1

___are considered to be the weakest link in a company’s security infrastructure.

Answer 1

Layer 2 devices

Question 2

A simple method that many administrators use to help secure the network from unauthorized access is to _____

Answer 2

disable all unused ports on a switch

Question 3

to disable a port

Answer 3

shutdown

Question 4

to enable a port

Answer 4

no shutdown

Question 5

to configure a range or ports

Answer 5

interface range TYPE MODULE/FIRST-NUMBER–LAST NUMBER

Question 6

The simplest and most effective method to prevent MAC address table overflow attacks is to enable ___.

Answer 6

port security

When a port configured with port security receives a frame, the source MAC address of the frame is compared to the list of secure source MAC addresses that were manually configured or dynamically learned on the port.

Question 7

Port security limits the number of ___allowed on a port.

Answer 7

valid MAC addresses

Question 8

To set the maximum number of MAC addresses allowed on a port, use the command __

Answer 8

switchport port-security maximum VALUE

Question 9

The default port security value is___

Answer 9

1

Question 10

TRUE OR FALSE
The maximum number of secure MAC addresses that can be configured is fixed.

Answer 10

FALSE
It depends the switch and the IOS.

Question 11

3 WAYS FOR MAC LEARNING
1. ____

The administrator manually configures a static MAC address(es) by using the following command for each secure MAC address on the port:____

Answer 11

Manually Configured
switchport port-security mac-address MAC-ADDRESS

Question 12

3 WAYS FOR MAC LEARNING
2. ____

When the ___ command is entered, the current source MAC for the device connected to the port is automatically secured but is not added to the startup configuration. If the switch is rebooted, the port will have to re-learn the device’s MAC address.

Answer 12

Dynamically Learned
switchport port-security

Question 13

3 WAYS FOR MAC LEARNING
3. ____
The administrator can enable the switch to dynamically learn the MAC address and “stick” them to the running configuration by using the following command:____

Answer 13

Dynamically Learned – Sticky
switchport port-security mac-address sticky

Question 14

The output of the ___command lists the two learned MAC addresses.

Answer 14

show port-security address

Question 15

____can be used to set the aging time for static and dynamic secure addresses on a port.

Answer 15

Port security aging

Question 16

Two types of aging are supported per port:
____: The secure addresses on the port are deleted after the specified aging time.

Answer 16

Absolute

Question 17

Two types of aging are supported per port:
__: The secure addresses on the port are deleted only if they are inactive for the specified aging time.

Answer 17

Inactivity

Question 18

Use ___to remove secure MAC addresses on a secure port without manually deleting the existing secure MAC addresses

Answer 18

aging

Question 19

Use the ____ command to enable or disable static aging for the secure port, or to set the aging time or type.

Answer 19

switchport port-security aging

Question 20

PARAMETERS FOR switchport port-security aging { static | time time | type {absolute | inactivity}}

Enable aging for statically configured secure addresses on this port.

Answer 20

static

Question 21

PARAMETERS FOR switchport port-security aging { static | time time | type {absolute | inactivity}}

Specify the aging time for this port. The range is 0 to 1440 minutes. If the time is 0, aging is disabled for this port.

Answer 21

time TIME

Question 22

PARAMETERS FOR switchport port-security aging { static | time time | type {absolute | inactivity}}

Set the absolute aging time. All the secure addresses on this port age out exactly after the time (in minutes) specified and are removed from the secure address list

Answer 22

type absolute

Question 23

PARAMETERS FOR switchport port-security aging { static | time time | type {absolute | inactivity}}

Set the inactivity aging type. The secure addresses on this port age out only if there is no data traffic from the secure source address for the specified time period.

Answer 23

type inactivity

Question 24

If the MAC address of a device attached to the port differs from the list of secure addresses, then a port violation occurs. By default, the port enters the ____ state.

Answer 24

error-disabled

Question 25

To set the port security violation mode, use the following command:

Answer 25

switchport port-security violation { protect | restrict | shutdown}

Question 26

Security Violation Mode Descriptions
switchport port-security violation { protect | restrict | shutdown}

The port transitions to the error-disabled state immediately, turns off the port LED, and sends a syslog message. It increments the violation counter. When a secure port is in the error-disabled state, an administrator must re-enable it by entering the ***and no ** commands.

Answer 26

shutdown

Question 27

Security Violation Mode Descriptions
switchport port-security violation { protect | restrict | shutdown}

The port drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the maximum value. This mode causes the Security Violation counter to increment and generates a syslog message.

Answer 27

restrict

Question 28

Security Violation Mode Descriptions
switchport port-security violation { protect | restrict | shutdown}

This is the least secure of the security violation modes. The port drops packets with unknown MAC source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the maximum value. No syslog message is sent.

Answer 28

protect

Question 29

Security Violation Mode Comparison
Violation Mode| Discards Offending Traffic| Sends Syslog Message| Increase Violation Counter| Shuts Down Port

YES-NO-NO-NO

Answer 29

Protect

Question 30

Security Violation Mode Comparison
Violation Mode| Discards Offending Traffic| Sends Syslog Message| Increase Violation Counter| Shuts Down Port
YES-YES-YES-NO

Answer 30

restrict

Question 31

Security Violation Mode Comparison
Violation Mode| Discards Offending Traffic| Sends Syslog Message| Increase Violation Counter| Shuts Down Port

YES-YES-YES-YES

Answer 31

shutdown

Question 32

To verify that MAC addresses are “sticking” to the configuration, use the ___ command as shown in the example for FastEthernet 0/19

Answer 32

show run INTERFACE