CND Network Attacks And Defense Strategies Practice Question
An enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Port Security on access switch ports with a maximum MAC address limit of one and sticky learning.
Port security on Cisco switches allows an administrator to limit the number of valid MAC addresses allowed on a port and secure it against MAC spoofing and port stealing by learning specific addresses or setting maximum limits. Additionally, Dynamic ARP Inspection (DAI) and IP Source Guard help, but port security specifically addresses MAC duplication and port stealing across switch ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Private VLANs (PVLANs) to isolate user switch ports from communicating with one another.
Why it's wrong here
PVLANs isolate ports within the same VLAN from inter-port communication, not MAC spoofing across ports.
- ✗
Configure Dynamic ARP Inspection (DAI) using the trusted DHCP snooping binding database.
Why it's wrong here
DAI prevents ARP spoofing and poisoning, not MAC address port stealing.
- ✗
Enable BPDU Guard and Root Guard on all designated edge switch ports.
Why it's wrong here
BPDU Guard and Root Guard protect Spanning Tree Protocol (STP) topology integrity.
- ✓
Enable Port Security on access switch ports with a maximum MAC address limit of one and sticky learning.
Why this is correct
Port security restricts port access to a single learned MAC address, preventing port stealing.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
About these practice questions
This CND question is part of Courseiva's 323-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.