Courseiva

CCNA Layer 2 Security Questions

39 questions · Layer 2 Security · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You need to write a Layer 2 firewall filter to drop inbound frames with a specific source MAC address on an EX Series switch. Where must this filter be applied to take effect?

A.Applied to the routing-instance forwarding table.
B.Applied globally under system services l2-firewall.
C.Applied to the input of an interface or VLAN under family ethernet-switching.
D.Applied to the output of the VLAN interface under family inet.
AnswerC

Layer 2 firewall filters on EX Series switches match frame fields such as source MAC and must be applied under family ethernet-switching, either at the interface input or VLAN input, so the filter processes inbound frames before forwarding decisions.

Why this answer

Layer 2 firewall filters matching MAC addresses or Ethernet headers must be applied to the input of an interface or VLAN using the family ethernet-switching context.

Practice this question →
2
MCQhard

You are implementing MACsec on an EX Series switch to secure a point-to-point link between two data centers. The link uses a 10 Gigabit Ethernet interface. You want to ensure that only encrypted traffic is accepted and that unencrypted frames are dropped. Which configuration parameter must be set on the interface?

A.Set the MACsec security mode to 'should-secure'.
B.Set the MACsec security mode to 'must-secure'.
C.Enable MACsec with the 'no-encrypt' option.
D.Configure MACsec with a pre-shared key (PSK) and set the 'replay-protection' window to 0.
AnswerB

The 'must-secure' mode enforces that all traffic on the interface must be encrypted with MACsec. If an unencrypted frame is received, it is dropped. This ensures that only secured traffic is accepted, meeting the requirement. The other modes, such as 'should-secure' or 'clear', do not enforce encryption and would allow unencrypted frames.

Why this answer

MACsec security modes determine how encryption is enforced. The 'must-secure' mode requires all traffic to be encrypted and drops any unencrypted frames. 'should-secure' allows unencrypted traffic if MACsec is not established, and 'no-encrypt' disables encryption. Therefore, 'must-secure' is the only mode that ensures only encrypted traffic is accepted, meeting the scenario's requirement.

Exam trap

The trap here is assuming that any MACsec configuration automatically drops unencrypted frames, when only the 'must-secure' mode enforces this behavior.

Practice this question →
3
MCQhard

An administrator configures Dynamic ARP Inspection (DAI) on an access switch. To ensure legitimate ARP packets from the default gateway (which uses a statically configured IP address on a core router) are not dropped, what must be configured?

A.Enable DHCP snooping on the core router's interface.
B.Configure a static DHCP binding for the gateway IP on the access switch.
C.Apply a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC.
D.Configure the interface connected to the default gateway as a trusted interface for DAI.
AnswerD

Dynamic ARP Inspection drops ARP packets arriving on untrusted interfaces unless they match the DHCP snooping binding database. A statically addressed gateway has no binding entry, so its interface must be marked trusted to permit its ARP traffic.

Why this answer

Dynamic ARP Inspection (DAI) validates ARP packets by comparing them against the DHCP snooping binding database, and by default all interfaces are untrusted. Since the default gateway uses a statically configured IP address, no DHCP snooping binding exists for it, so its ARP packets would be dropped on an untrusted interface. Configuring the interface connected to the gateway as trusted bypasses DAI inspection for that port, allowing legitimate ARP traffic from the gateway to pass.

This is the standard Juniper configuration using 'set ethernet-switching-options secure-access-port interface ge-0/0/1.0 arp-inspection trust'.

Exam trap

JNCIS-ENT often tests the misconception that DAI can validate statically configured devices via static bindings or firewall filters, when in fact the only way to allow their ARP traffic is to configure the interface as trusted.

How to eliminate wrong answers

Option A is wrong because DHCP snooping is not configured on the core router's interface; it is a Layer 2 switch feature that builds the binding database on the access switch, and enabling it on a router interface is neither possible nor relevant to trusting the gateway's ARP. Option B is wrong because a static DHCP binding for the gateway IP would require the gateway to use DHCP, but it uses a static IP, and DAI does not use static bindings for statically configured hosts; instead, the interface must be trusted. Option C is wrong because a Layer 2 firewall filter permitting ARP broadcasts from the gateway MAC does not integrate with DAI's trust model; DAI operates independently of firewall filters, and such a filter would not prevent DAI from dropping the packets if the interface is untrusted.

Practice this question →
4
MCQmedium

You are configuring MACsec on a pair of Juniper EX4300 switches to secure data links between wiring closets. Which key agreement protocol is used by default in Junos MACsec to dynamically negotiate and manage encryption keys?

A.Internet Key Exchange version 2 (IKEv2)
B.Secure Session Protocol (SSP)
C.802.1AE Dynamic Key Distribution (AKD)
D.MACsec Key Agreement (MKA) protocol
AnswerD

Junos MACsec uses the MACsec Key Agreement protocol, defined in IEEE 802.1X-2010, to elect a key server and negotiate secure associations and encryption keys between peers. MKA is the default dynamic key-management mechanism, satisfying the EX4300 link-securing requirement.

Why this answer

Junos MACsec uses the MACsec Key Agreement (MKA) protocol, defined in IEEE 802.1X-2010, as the default key agreement protocol. MKA runs over the point-to-point link, elects a Key Server, and uses the Connectivity Association Key (CAK) to derive the Secure Association Key (SAK) that encrypts traffic.

Exam trap

JNCIS-ENT often tests the confusion between Layer 3 key-exchange protocols (IKEv2 for IPsec) and the Layer 2 MACsec key agreement protocol (MKA), causing candidates to select IKEv2 by analogy.

How to eliminate wrong answers

Option A is wrong because IKEv2 is the key-exchange protocol used by IPsec VPNs at Layer 3, not by MACsec, which operates at Layer 2. Option B is wrong because 'Secure Session Protocol' is not a real standardized key agreement protocol for MACsec. Option C is wrong because '802.1AE Dynamic Key Distribution (AKD)' is a fabricated name — 802.1AE is the MACsec frame format standard, but it does not define a key distribution protocol; that role belongs to MKA under 802.1X.

Practice this question →
5
MCQmedium

You need to configure MACsec on an EX4300 switch interface. Which cipher suite is configured by default when MACsec is enabled without specifying an explicit cipher suite?

A.AES-CBC-128
B.SHA-256-HMAC
C.GCM-AES-128
D.GCM-AES-256
AnswerC

Enabling MACsec on an EX4300 interface without naming a cipher suite applies GCM-AES-128 by default, satisfying the stem's no-explicit-suite constraint. This 128-bit Galois/Counter Mode AES suite provides both confidentiality and integrity, and remains the baseline Junos selects unless a stronger suite is specified.

Why this answer

When MACsec is enabled in Junos without specifying a cipher suite, GCM-AES-128 is used by default.

Practice this question →
6
Multi-Selectmedium

Which THREE features are considered part of the secure access port feature suite in Junos OS? (Choose three)

Select 3 answers
A.MACsec Key Agreement (MKA)
B.Dynamic ARP Inspection (DAI)
C.DHCP Snooping
D.IP Source Guard
E.Spanning Tree Root Protection
AnswersB, C, D

Dynamic ARP Inspection validates ARP packets against trusted DHCP snooping bindings, discarding spoofed replies. It belongs to the secure access port suite because it protects the access edge from ARP poisoning, satisfying the stem's requirement for features bundled under that Junos OS security framework.

Why this answer

The secure access port feature suite in Junos OS is designed to protect the access layer from Layer 2 attacks, and it comprises Dynamic ARP Inspection (DAI), DHCP Snooping, and IP Source Guard. Option B (Dynamic ARP Inspection) is correct because DAI validates ARP packets against the DHCP snooping binding table to prevent ARP spoofing and MITM attacks on access ports. Option C (DHCP Snooping) is correct because it builds and maintains the trusted binding table of IP-to-MAC mappings and blocks rogue DHCP servers, serving as the foundation for DAI and IP Source Guard.

Option D (IP Source Guard) is correct because it uses the DHCP snooping database to filter traffic and prevent IP/MAC spoofing on untrusted access ports. Option A (MACsec Key Agreement) is not part of this suite; MKA is a Layer 2 encryption key management protocol for MACsec, a separate security feature. Option E (Spanning Tree Root Protection) is a Layer 2 loop-prevention STP enhancement, not a secure access port feature.

Practice this question →
7
Multi-Selecthard

Which THREE components are required for Dynamic ARP Inspection (DAI) to function properly on an EX Series switch? (Choose three)

Select 3 answers
A.MACsec pre-shared keys configured on all access ports
B.Dynamic ARP Inspection enabled on the specific VLAN
C.Configured static ARP inspection bindings for every client
D.Trusted ports configured on uplinks toward DHCP servers or core routers
E.DHCP snooping enabled on the respective VLAN
AnswersB, D, E

Dynamic ARP Inspection must be enabled on the specific VLAN to be active; it validates ARP packets against the DHCP snooping binding database for that VLAN. Without VLAN-level enablement, DAI does not inspect traffic, so this component is required.

Why this answer

Dynamic ARP Inspection on EX Series switches requires three things to work: DAI must be enabled on the specific VLAN (option B), because the inspection policy is applied per-VLAN and ARP packets are validated only on VLANs where DAI is explicitly turned on. Trusted ports must be configured on uplinks toward DHCP servers or core routers (option D), since DAI drops ARP packets on untrusted ports that fail validation, while trusted ports bypass inspection so legitimate infrastructure ARP traffic is not blocked. DHCP snooping must be enabled on the respective VLAN (option E), because DAI relies on the DHCP snooping binding database to validate ARP packet IP-to-MAC mappings; without it, DAI has no trusted binding source and will drop valid ARP traffic.

Option A is incorrect because MACsec is a Layer 2 encryption protocol unrelated to DAI operation. Option C is incorrect because static ARP inspection bindings are not required for every client; DAI uses dynamic DHCP snooping bindings, and static bindings are only optional for hosts with static IPs.

Practice this question →
8
MCQmedium

You are configuring port security on an EX Series switch. The security policy states that when a MAC limit is exceeded on an access port, the port should be shut down and remain down until manually re-enabled by an administrator. Which configuration action accomplishes this requirement?

A.Configure the interface with 'mac-limit limit 1 action none'.
B.Configure the interface with 'mac-limit limit 1 action log'.
C.Configure the interface with 'mac-limit limit 1 action drop'.
D.Configure the interface with 'mac-limit limit 1 action shutdown'.
AnswerD

The 'action shutdown' option causes the interface to be disabled when the MAC limit is exceeded. The port remains shut down until an administrator manually clears the error or re-enables the interface, exactly matching the security policy requirement.

Why this answer

The 'action shutdown' parameter in the MAC limit configuration causes the interface to be disabled when the configured limit is exceeded. The port remains in a shut down state until an administrator manually intervenes, which aligns with the requirement to keep the port down until manually re-enabled.

Exam trap

The trap here is confusing the 'drop' action with 'shutdown', as 'drop' only discards violating traffic without disabling the port.

Practice this question →
9
MCQmedium

You are troubleshooting port security on an EX Series switch. An interface has been configured with 'action-on-violation shutdown', and a violation occurs. What is the default operational state of the interface after the violation, and how is it restored?

A.The interface automatically recovers after a default hold-down timer of 300 seconds.
B.The interface is disabled and must be manually re-enabled using a clear command or by disabling/re-enabling the interface.
C.The interface drops violating packets but remains operationally up until manually disabled.
D.The interface transitions to a blocked state and flushes its MAC table every 60 seconds until cleared.
AnswerB

A violation triggers the configured shutdown, placing the interface in a disabled state that persists until an administrator intervenes. Restoration requires clearing the port security error via the clear ethernet-switching port-error command, or administratively disabling then re-enabling the interface. This satisfies the stem's requirement for the default operational state and recovery method.

Why this answer

When port security is configured with 'action-on-violation shutdown' on an EX switch, a violation causes the interface to be disabled (err-disabled). It does not automatically recover; the administrator must manually clear the violation using 'clear ethernet-switching port-error' or by disabling and re-enabling the interface. This is the documented default behavior for shutdown action.

Exam trap

The trap is assuming automatic recovery after a hold-down timer — Junos port security shutdown requires manual intervention, unlike some other vendors' err-disable recovery features.

How to eliminate wrong answers

Option A is wrong because there is no default 300-second hold-down timer for port security violations on EX switches — recovery is manual, not automatic. Option C is wrong because 'action-on-violation shutdown' disables the interface entirely, not just drops violating packets while staying up. Option D is wrong because the interface does not transition to a blocked state with periodic MAC table flushes — it is simply disabled until manually cleared.

Practice this question →
10
MCQeasy

Which statement accurately describes port security MAC-limit behavior?

A.It statically assigns all learned MAC addresses to the switch configuration file automatically.
B.It defines the maximum bandwidth a single MAC address can consume on a port.
C.It prevents MAC address spoofing by validating IP bindings against DHCP tables.
D.It restricts the maximum number of MAC addresses that can be learned on a secure interface.
AnswerD

The MAC-limit parameter caps how many source MAC addresses a secure interface may learn, dropping or logging frames beyond the configured threshold. This directly satisfies the stem's requirement by binding learned entries to a defined maximum, preventing MAC flooding attacks on access ports.

Why this answer

Port security MAC-limit restricts the maximum number of MAC addresses learned on a secure interface.

Practice this question →
11
MCQhard

An administrator enables Dynamic ARP Inspection (DAI) on a VLAN that uses DHCP snooping for IP binding verification. A static client on the same VLAN cannot communicate with the default gateway. What is the most likely cause of this issue?

A.The static client is using an IP address outside the DHCP pool range.
B.The client's MAC address violates the port security maximum limit.
C.DAI requires all interfaces to be trusted on the VLAN.
D.The static client's IP-to-MAC binding is missing from the DHCP snooping database, causing DAI drops.
AnswerD

Static clients lack DHCP-assigned bindings, so the DHCP snooping database holds no IP-to-MAC entry for them. DAI validates ARP packets against that database and drops any ARP lacking a matching binding, blocking the static client's gateway resolution. A static ARP access-list entry is required to permit it.

Why this answer

Static clients do not participate in DHCP exchanges, so they are missing from the DHCP snooping binding database, causing DAI to drop their ARP packets unless static ARP entries are added.

Practice this question →
12
MCQmedium

You have enabled DHCP snooping on an EX Series switch. What must be configured on the interface connecting to the legitimate corporate DHCP server to prevent rogue DHCP server replies?

A.Configure the interface as a trusted interface for DHCP snooping.
B.Configure the interface as a trunk port.
C.Apply an ingress firewall filter blocking UDP port 67.
D.Enable IP Source Guard on the uplink interface.
AnswerA

DHCP snooping drops server replies arriving on untrusted ports, so the port facing the legitimate corporate server must be marked trusted to permit its offers through. This satisfies the stem's requirement to allow only that server's replies.

Why this answer

DHCP snooping classifies switch ports as trusted or untrusted. Only trusted ports are permitted to forward DHCP server messages (OFFER, ACK); untrusted ports drop them. Therefore the uplink toward the legitimate DHCP server must be marked trusted so its replies are allowed, while user-facing ports remain untrusted and block rogue servers.

Exam trap

JNCIS-ENT often tests the misconception that enabling DHCP snooping alone is sufficient; candidates forget that the legitimate server-facing port must be explicitly marked trusted or all DHCP replies will be dropped.

How to eliminate wrong answers

Option B is wrong because making the port a trunk does not affect DHCP snooping trust state — trust is a separate configuration. Option C is wrong because an ingress filter blocking UDP 67 would also block legitimate client DHCP requests (clients send to UDP 67), breaking DHCP entirely. Option D is wrong because IP Source Guard validates source IP/MAC bindings from the snooping table; it does not designate a port as trusted for DHCP server replies.

Practice this question →
13
MCQeasy

Which command is used to clear the Dynamic ARP Inspection violation counters on an EX Series switch?

A.reset interface security-violations
B.clear bridge security-counters
C.clear ethernet-switching security-violation
D.clear arp-inspection statistics
AnswerC

`clear ethernet-switching security-violation` resets the DAI violation counters, satisfying the requirement to clear them without disturbing the DHCP snooping database. Unlike `clear arp` or interface-level commands, it targets the ethernet-switching security subsystem where DAI violations are recorded, so counters return to zero while inspection remains active.

Why this answer

Violation counters and security states are cleared using 'clear ethernet-switching security-violation'.

Practice this question →
14
Multi-Selecthard

When configuring Layer 2 firewall filters on an EX Series switch, which THREE statements are correct regarding filter structure and application? (Choose three)

Select 3 answers
A.They are configured under the 'family ethernet-switching' match criteria context.
B.They are applied to logical Layer 3 routing interfaces (irb or vlan interfaces) using family inet.
C.They can match on source and destination MAC addresses as well as EtherType fields.
D.They can be applied to physical switch ports or entire VLANs.
E.They execute routing lookups prior to evaluating packet match conditions.
AnswersA, C, D

Layer 2 filters on EX Series switches require the family ethernet-switching match condition, which tells Junos to inspect Ethernet header fields rather than IP or IPv6 headers. Without this family context, MAC-based terms cannot be parsed, so the filter must be defined under this hierarchy.

Why this answer

Option A is correct because Layer 2 firewall filters on EX Series switches are configured within the 'family ethernet-switching' context, which provides the match conditions for Layer 2 fields such as MAC addresses and EtherType. Option C is correct because these filters can match on source and destination MAC addresses and EtherType values, which are fundamental Layer 2 header fields. Option D is correct because Layer 2 filters can be applied to physical switch ports (interfaces) or to VLANs, allowing filtering at the ingress port or across a VLAN.

Option B is incorrect because applying filters to logical Layer 3 interfaces (irb or vlan interfaces) using 'family inet' is for Layer 3 filters, not Layer 2. Option E is incorrect because firewall filters evaluate match conditions before any routing lookup occurs; routing lookups happen after a packet is permitted and forwarded.

Practice this question →
15
Multi-Selecthard

An administrator configures a Layer 2 firewall filter to drop broadcast packets while permitting unicast traffic on an access VLAN. Which THREE configuration elements are required to implement this filter properly? (Choose three)

Select 3 answers
A.Enable active router-advertisement snooping to support the filter.
B.Apply the filter under the 'family inet' routing protocol hierarchy.
C.Configure the filter action as 'discard' for the broadcast term.
D.Define the filter under 'family ethernet-switching'.
E.Use a match condition for destination MAC address broadcast 'ff:ff:ff:ff:ff:ff'.
AnswersC, D, E

The broadcast term needs a terminating action, and 'discard' silently drops matching frames without generating ICMP messages. This satisfies the requirement to drop broadcast packets while the implicit default permits unicast traffic on the access VLAN.

Why this answer

Option C is correct because a Layer 2 firewall filter term that should silently drop broadcast traffic must use the 'discard' action, which drops the matching frames without sending any ICMP or TCP reset response. Option D is correct because Layer 2 firewall filters on switches are defined and applied under the 'family ethernet-switching' hierarchy, not under 'family inet', which is for Layer 3 IPv4 filters. Option E is correct because broadcast Ethernet frames are identified by the destination MAC address ff:ff:ff:ff:ff:ff, so a match condition on that address is required to select broadcast packets while leaving unicast frames unmatched and permitted.

Option A is incorrect because router-advertisement snooping is an IPv6/ND feature unrelated to matching and dropping Layer 2 broadcast frames. Option B is incorrect because applying the filter under 'family inet' would make it an IPv4 Layer 3 filter, which cannot match Ethernet MAC addresses or operate on an access VLAN's Layer 2 traffic.

Exam trap

The trap is confusing Layer 2 and Layer 3 filter hierarchies — candidates may choose 'family inet' because they are used to IP filters, but Ethernet broadcast filtering requires 'family ethernet-switching'.

Practice this question →
16
MCQmedium

You are deploying a new access switch in a campus network. The security policy requires that all ARP packets received on untrusted access ports be validated against the DHCP snooping database, and that any ARP packet with an invalid IP-to-MAC binding be dropped and logged. You configure DHCP snooping on VLAN 100 and enable the appropriate feature on the untrusted ports. Which Junos OS feature must you enable to meet the policy requirement?

A.IP Source Guard
B.Dynamic ARP Inspection (DAI)
C.MAC limiting
D.Storm control
AnswerB

Dynamic ARP Inspection (DAI) intercepts ARP packets on untrusted access ports and validates the sender's IP-to-MAC binding against the DHCP snooping database. If the binding is invalid, DAI drops the ARP packet and generates a log entry, satisfying the security policy requirement.

Why this answer

Dynamic ARP Inspection is the Junos OS feature designed to validate ARP packets on untrusted access ports by comparing the sender's IP and MAC addresses against the DHCP snooping binding database. When a mismatch occurs, the packet is dropped and logged, directly enforcing the security policy described.

Exam trap

The trap here is assuming that IP Source Guard also validates ARP packets, when it actually only inspects IP packet source addresses.

Practice this question →
17
Multi-Selectmedium

Which THREE statements describe the behavior and requirements of DHCP snooping? (Choose three)

Select 3 answers
A.It requires IP Source Guard to be enabled before the binding table can be populated.
B.It inspects DHCP messages to record client MAC addresses, IP addresses, VLANs, and interface bindings.
C.Ports facing DHCP servers must be explicitly configured as trusted.
D.Untrusted ports drop DHCP server response messages (Offer and ACK).
E.It operates exclusively by analyzing static ARP entries configured by administrators.
AnswersB, C, D

DHCP snooping builds a binding table by inspecting DHCP traffic, mapping each client's MAC address, leased IP address, VLAN and ingress interface. This recorded binding is what later enables dynamic ARP inspection and IP source guard to filter spoofed traffic on untrusted access ports.

Why this answer

Option B is correct because DHCP snooping builds and maintains a binding table by snooping DHCP DISCOVER/REQUEST and OFFER/ACK exchanges, recording the client MAC address, leased IP address, VLAN, and the ingress switch port (interface) for each binding. Option C is correct because switch ports that connect toward legitimate DHCP servers (or uplinks toward them) must be manually configured as trusted; otherwise their server messages would be filtered. Option D is correct because on untrusted ports DHCP snooping drops server-to-client messages such as DHCPOFFER and DHCPACK (and NAK), preventing rogue DHCP servers from handing out addresses to clients.

Option A is not correct because IP Source Guard depends on the DHCP snooping binding table, not the reverse — snooping populates the table independently, and IP Source Guard is not a prerequisite. Option E is not correct because DHCP snooping works by inspecting live DHCP packet flows, not by analyzing static ARP entries.

Practice this question →
18
MCQeasy

Which traffic rate-limiting mechanism is primarily used by storm control to protect switch CPU and interfaces from broadcast and multicast storms?

A.Traffic policing by dropping packets exceeding the configured bandwidth threshold
B.Input queue buffering and tail-drop avoidance
C.Rate limiting via TCP window size adjustments
D.Traffic shaping with weighted random early detection (WRED)
AnswerA

Storm control enforces its bandwidth threshold through traffic policing: packets exceeding the configured rate are dropped rather than queued or shaped. This directly satisfies the stem's requirement to protect switch CPU and interfaces from broadcast and multicast storms, since policing caps the flooded traffic before it overwhelms control-plane resources.

Why this answer

Storm control utilizes traffic policing to measure traffic rates and drop excess packets.

Practice this question →
19
MCQeasy

An administrator wants to prevent a malicious user from flooding an EX Series switch with a high volume of broadcast traffic from an untrusted end-user device. Which feature should be configured?

A.MACsec
B.Dynamic ARP Inspection
C.Port security
D.Storm control
AnswerD

Storm control meters broadcast, multicast and unknown unicast traffic per interface, dropping frames once a configured bandwidth threshold is exceeded. This directly satisfies the stem's constraint of preventing an untrusted end-user device from flooding the switch with excessive broadcast traffic.

Why this answer

Storm control is designed to prevent traffic types such as broadcast, multicast, and unknown unicast from overwhelming the switch and network resources.

Practice this question →
20
MCQhard

You are troubleshooting a Dynamic ARP Inspection (DAI) deployment on an EX4300 switch. Clients on VLAN 20 are experiencing intermittent loss of connectivity. You run 'show arp inspection statistics' and notice dropped packets due to 'invalid-ip'. What is the most likely cause of these drops?

A.The uplink port connecting to the default gateway is missing the 'set protocols arp-inspection trust' statement.
B.Clients are using statically assigned IP addresses that do not exist in the DHCP snooping binding database.
C.MAC limiting has tripped on the access port, causing ARP packets to be discarded.
D.The ARP inspection rate-limit has been exceeded on the access ports.
AnswerB

Static IP clients bypass DHCP snooping, so no binding entry exists for their addresses. Dynamic ARP Inspection validates every ARP packet against that database, and the 'invalid-ip' counter increments when the sender IP is absent from it. The intermittent loss reflects only those statically addressed hosts on VLAN 20, not DHCP clients.

Why this answer

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding database. An 'invalid-ip' drop means the source IP in the ARP packet does not match any entry in the binding table for that MAC/VLAN/interface. This occurs when clients use statically assigned IP addresses that were never learned via DHCP snooping, so no binding exists and DAI drops the ARP as untrusted.

Exam trap

JNCIS-ENT often tests the specific DAI drop reason counters; candidates confuse 'invalid-ip' (binding mismatch) with 'untrusted-port' (missing trust) or 'rate-limit' (too many ARPs), leading to wrong root-cause selection.

How to eliminate wrong answers

Option A is wrong because a missing trust on the uplink would cause drops on the uplink port, but the symptom 'invalid-ip' specifically indicates an IP-to-MAC binding mismatch, not a trust issue; trust issues typically show as 'untrusted-port' drops. Option C is wrong because MAC limiting is a separate port security feature that limits the number of MAC addresses; it would not produce DAI 'invalid-ip' counters. Option D is wrong because exceeding the ARP inspection rate-limit produces 'rate-limit' or 'rate-exceeded' drops, not 'invalid-ip' drops.

Practice this question →
21
MCQeasy

When implementing Layer 2 firewall filters on an EX Series switch, which packet characteristic can be matched in a filter term?

A.Source MAC address
B.Destination IP address
C.ICMP type code
D.TCP port number
AnswerA

Layer 2 firewall filters on EX Series switches match fields within the Ethernet header, and the source MAC address is one such matchable characteristic. This satisfies the stem's Layer 2 constraint, since matching occurs on frame header data rather than Layer 3 or Layer 4 information.

Why this answer

Layer 2 firewall filters in Junos can match fields such as source MAC address, destination MAC address, VLAN ID, and EtherType.

Practice this question →
22
MCQeasy

An administrator wants to protect against MAC flooding attacks on an EX Series switch access port. The port should learn a maximum of 5 MAC addresses and drop frames with unknown source MAC addresses after that limit is reached. Which feature should be configured?

A.Storm control
B.DHCP snooping
C.Port security
D.MACsec
AnswerC

Port security allows you to specify the maximum number of MAC addresses that can be learned on an interface. Once the limit is reached, frames with new source MAC addresses are dropped, preventing MAC flooding attacks. This directly matches the requirement to learn a maximum of 5 MAC addresses and drop subsequent unknown MACs. It is the correct feature for this scenario.

Why this answer

Port security is the Junos OS feature that restricts the number of MAC addresses that can be learned on an interface. By setting a maximum, the switch drops frames with source MAC addresses beyond the limit, mitigating MAC flooding attacks. Storm control, MACsec, and DHCP snooping serve different purposes and do not provide this specific MAC limiting capability.

Port security is configured under the interface with 'mac-limit'.

Exam trap

The trap here is assuming storm control limits MAC addresses, when it actually limits traffic rates and does not restrict MAC learning.

Practice this question →
23
MCQeasy

Which Junos command displays the active DHCP snooping binding database entries on an EX Series switch?

A.show ethernet-switching dhcp-snooping binding
B.show dhcp-snooping binding
C.show system dhcp-snooping database
D.show bridge dhcp bindings
AnswerA

The operational command show ethernet-switching dhcp-snooping binding lists the snooping database, showing each learned MAC, IP, lease, VLAN and interface. It directly satisfies the stem's request for active binding entries on the EX Series switch.

Why this answer

The operational command to view DHCP snooping bindings is 'show ethernet-switching dhcp-snooping binding'.

Practice this question →
24
MCQhard

An administrator configures a Layer 2 firewall filter to drop all ARP packets with a specific invalid sender hardware address. The filter is applied to a VLAN interface. What special consideration must be taken when applying Layer 2 filters to VLANs in Junos?

A.Layer 2 filters applied to VLANs require family inet to inspect ARP payloads.
B.Layer 2 filters on VLANs evaluate traffic across all member ports belonging to that VLAN instance.
C.Layer 2 filters cannot be applied to VLANs; they must be applied to physical interfaces only.
D.VLAN-based Layer 2 filters only process egress traffic leaving the VLAN trunk ports.
AnswerB

Layer 2 filters applied to a VLAN interface operate on the VLAN's logical instance, inspecting frames from every member port rather than a single physical interface. This satisfies the stem's constraint: the ARP filter must catch the invalid sender hardware address regardless of which access port the offending host connects through.

Why this answer

In Junos, when a Layer 2 firewall filter is applied to a VLAN, it evaluates traffic across all member ports of that VLAN instance, not just a single physical interface. This is because the VLAN is a logical Layer 2 broadcast domain, and the filter operates at the VLAN level, inspecting frames as they traverse the VLAN's forwarding path. This behavior is critical when filtering protocols like ARP, which are broadcast within the VLAN.

Exam trap

The trap is assuming Layer 2 filters must be applied per physical interface, but Junos allows VLAN-level application, which affects all member ports — a key scaling and design consideration.

How to eliminate wrong answers

Option A is wrong because Layer 2 filters inspect Ethernet frames (including ARP payloads) without requiring 'family inet' — that would be a Layer 3 filter requirement. Option C is wrong because Junos does support Layer 2 filters on VLANs (via 'filter' under 'vlan' or 'ethernet-switching' hierarchy); they are not limited to physical interfaces. Option D is wrong because VLAN-based Layer 2 filters can process both ingress and egress traffic depending on where they are applied; they are not restricted to egress on trunk ports.

Practice this question →
25
MCQeasy

You are asked to implement a Layer 2 security feature that prevents a user from connecting a small unmanaged switch to an access port and generating traffic from multiple MAC addresses. The solution should limit the number of MAC addresses learned on the port to one. Which Junos OS feature should you configure?

A.DHCP snooping
B.Dynamic ARP Inspection
C.MAC limiting
D.Storm control
AnswerC

MAC limiting allows you to restrict the number of source MAC addresses that can be learned on an interface. Setting the limit to one ensures that only a single MAC address is permitted, effectively blocking additional devices connected through an unmanaged switch.

Why this answer

MAC limiting is the Junos OS feature that restricts the number of source MAC addresses that can be learned on an interface. By setting the limit to one, the switch will only allow one MAC address, preventing a user from connecting a switch and using multiple devices on that port.

Exam trap

The trap here is thinking that storm control or DHCP snooping can restrict the number of MAC addresses, when they address different security concerns.

Practice this question →
26
MCQhard

An administrator implements port security on a switch stack. A user moves their IP phone (which has an integrated PC attached to it) to a port configured with a MAC limit of one. Only the IP phone works, and the PC is blocked. What feature should be configured to allow multiple authenticated MAC addresses behind a single port securely?

A.Enable DHCP snooping with static ARP inspection override.
B.Increase the mac-limit to 2 and enable dynamic MAC learning persistence.
C.Configure IEEE 802.1X with multiple supplicants or MAC Authentication Bypass (MAB).
D.Configure storm control with a multi-device profile.
AnswerC

IEEE 802.1X with multiple supplicants authenticates several devices independently on one port, while MAB authenticates devices lacking a supplicant via their MAC address. This lets the phone and attached PC both pass port security's single-MAC limit securely.

Why this answer

IEEE 802.1X with multiple supplicants (or MAC Authentication Bypass for non-802.1X devices) allows multiple authenticated MAC addresses to share a single switch port, which is exactly the scenario of an IP phone with a PC daisy-chained behind it. The phone authenticates via 802.1X (or MAB), and the PC authenticates separately, each getting its own authorization. This is the secure, standards-based way to support multiple devices on one port without simply raising the MAC limit.

Exam trap

The trap is reaching for a simple MAC-limit increase or a Layer 2 security feature (DHCP snooping, storm control) when the question is really about authentication — the secure answer is always 802.1X/MAB, not loosening port security.

How to eliminate wrong answers

Option A is wrong because DHCP snooping and Dynamic ARP Inspection are Layer 2 security features that prevent rogue DHCP servers and ARP spoofing — they do not authenticate or authorize multiple MAC addresses on a port. Option B is wrong because simply raising mac-limit to 2 with dynamic learning persistence is insecure — it allows any two MACs to be learned without authentication, defeating the purpose of port security and leaving the port open to MAC flooding. Option D is wrong because storm control limits broadcast/multicast/unknown-unicast rates to prevent loops and DoS; it has no role in authenticating multiple devices on a port.

Practice this question →
27
Multi-Selecteasy

Which TWO statements are true regarding IP Source Guard? (Choose two)

Select 2 answers
A.It is configured under the routing-instances protocol hierarchy.
B.It automatically encrypts all user data packets using AES-256.
C.It functions by monitoring and rate-limiting broadcast ARP traffic storms.
D.It prevents IP spoofing attacks by filtering traffic based on binding databases.
E.It relies on the DHCP snooping database to validate client source IP addresses.
AnswersD, E

IP Source Guard inspects source addresses against the DHCP snooping binding table, dropping packets whose IP/MAC pair is absent. This filtering directly blocks spoofed source addresses, satisfying the stem's requirement to prevent IP spoofing attacks on untrusted access ports.

Why this answer

Option D is correct because IP Source Guard (IPSG) is an anti-spoofing feature that filters ingress traffic by comparing each packet's source IP (and often MAC) against a trusted binding table, dropping any packet whose source address does not match an entry, thereby preventing IP spoofing attacks. Option E is correct because on Juniper devices IPSG builds its binding table from the DHCP snooping database (populated by snooped DHCP ACK/lease bindings), so client source IP addresses are validated against dynamically learned DHCP bindings; static bindings can also be added, but the primary mechanism relies on DHCP snooping. Option A is incorrect because IPSG is configured at the interface/access-port level (e.g., 'ip-source-guard' under the interface or VLAN/forwarding-options hierarchy), not under the routing-instances protocol hierarchy.

Option B is incorrect because IPSG performs filtering and validation, not encryption; AES-256 encryption is unrelated to this feature. Option C is incorrect because IPSG does not monitor or rate-limit broadcast ARP storms; ARP storm control and related protections are separate features (e.g., ARP policing/storm control), not IP Source Guard.

Practice this question →
28
MCQhard

An engineer deploys MACsec across an untrusted Metro Ethernet Layer 2 transport circuit. After enabling MACsec, packets larger than 1500 bytes fail to pass through the link. What is the most likely cause of this issue?

A.The MKA key exchange failed due to MTU handshake validation timeouts.
B.Dynamic ARP Inspection is dropping fragmented Ethernet frames.
C.The MACsec ICV and header overhead exceed the standard 1500-byte MTU, requiring an increased MTU along the path.
D.The cipher suite GCM-AES-256 compresses frames beyond the minimum frame size limit.
AnswerC

MACsec encapsulates each frame with a SecTAG header and an ICV trailer, adding up to 32 bytes of overhead. On a 1500-byte MTU path, frames at full size exceed the transport's capacity and are dropped. Raising the MTU on all intervening interfaces accommodates this encapsulation overhead, satisfying the untrusted Metro Ethernet circuit's size constraint.

Why this answer

MACsec encapsulation adds overhead (ICV and security headers) to the Ethernet frame, increasing its size. If the transport provider network or physical interface MTU is not increased to accommodate this overhead, frames are dropped.

Practice this question →
29
Multi-Selecthard

Which THREE parameters must match between two peer devices to successfully establish a MACsec secure session using pre-shared keys (PSK)? (Choose three)

Select 3 answers
A.Connectivity Association Key (CAK)
B.Connectivity Key Name (CKN)
C.Maximum Transmission Unit (MTU) size set to exactly 1500 bytes
D.Cipher suite configuration
E.IP address subnet allocation on the physical transit ports
AnswersA, B, D

Both peers must be configured with the identical Connectivity Association Key, the secret used to derive MACsec session keys. A mismatch causes the secure association to fail, so the CAK is a mandatory matching parameter for PSK-based MACsec.

Why this answer

To establish a MACsec secure session using pre-shared keys, both peers must share the same Connectivity Association Key (CAK), which is the secret used to derive the session keys — so option A is correct. They must also agree on the Connectivity Key Name (CKN), the identifier that tells each peer which CAK to use when multiple keys exist, making option B correct. The cipher suite configuration must match as well, because both peers must negotiate the same encryption and integrity algorithms (for example GCM-AES-128 or GCM-AES-256) to interoperate — so option D is correct.

Option C is wrong because MACsec does not require an MTU of exactly 1500 bytes; MTU is a general interface parameter and can vary as long as the link supports the encapsulated frame size. Option E is wrong because MACsec operates at Layer 2 and does not depend on IP subnet allocation on the physical transit ports.

Practice this question →
30
MCQeasy

Which statement is true regarding the behavior of storm control when the traffic rate exceeds the configured threshold?

A.Excess traffic exceeding the threshold is dropped by the switch hardware.
B.Traffic is rate-shaped and buffered in the output queue until congestion clears.
C.The interface is immediately shut down and placed in an error-disabled state.
D.The switch sends SNMP traps and forwards the traffic with a low-priority CoS marking.
AnswerA

Storm control enforces the configured threshold directly in switch hardware, so frames exceeding the limit are discarded at line rate rather than punted to the control plane. This satisfies the stem's requirement for true behaviour on threshold breach: excess traffic is dropped, not merely logged or rate-limited in software.

Why this answer

When storm control thresholds are exceeded, Junos drops the excess traffic matching the storm control criteria until the rate drops below the threshold.

Practice this question →
31
MCQmedium

You configure port security on a switch interface and set the violation action to 'restrict'. What happens when a port security violation occurs under this setting?

A.Packets from violating MAC addresses are dropped, and a syslog message/counter is generated while valid traffic continues.
B.The interface immediately shuts down and generates an SNMP trap.
C.The violating MAC address is automatically added to a static ARP inspection deny list.
D.The switch drops all traffic on the interface until the violation timer expires.
AnswerA

With restrict, frames sourced from violating MAC addresses are discarded, while traffic from permitted addresses continues forwarding. The switch also increments a violation counter and emits a syslog message, giving visibility without shutting the interface down as shutdown mode would.

Why this answer

The 'restrict' action causes the switch to drop packets from unauthorized source MAC addresses and increment violation counters, but the port remains up and forwarding for valid MACs.

Practice this question →
32
MCQeasy

Which Junos configuration hierarchy is used to configure secure access port features such as DHCP snooping and Dynamic ARP Inspection?

A.set ethernet-switching-options secure-access-port
B.set protocols l2-security
C.set system security layer2
D.set switch-options port-security
AnswerA

DHCP snooping and Dynamic ARP Inspection are Layer 2 security features configured under the `secure-access-port` stanza within the `ethernet-switching-options` hierarchy on EX Series switches. This satisfies the stem's requirement for the Junos hierarchy dedicated to secure access port features, binding trusted interfaces and VLANs to those protections.

Why this answer

In Junos, secure access port features like DHCP snooping, Dynamic ARP Inspection (DAI), and IP source guard are configured under the [edit ethernet-switching-options secure-access-port] hierarchy. This is the correct location for these Layer 2 security features on EX Series switches. The command 'set ethernet-switching-options secure-access-port' enables the configuration stanza where you can then specify VLANs, interfaces, and other parameters for DHCP snooping and DAI.

Exam trap

JNCIS-ENT often tests the exact hierarchy for Layer 2 security features, and candidates may confuse 'secure-access-port' with 'port-security' or assume it's under 'protocols' or 'system'.

How to eliminate wrong answers

Option B is wrong because 'protocols l2-security' is not a valid Junos hierarchy; L2 security features are not configured under protocols. Option C is wrong because 'system security layer2' does not exist; system security is for management access, not Layer 2 features. Option D is wrong because 'switch-options port-security' is not the correct hierarchy; port security (MAC limiting) is configured under 'ethernet-switching-options secure-access-port' as well, but the specific hierarchy for DHCP snooping and DAI is 'secure-access-port', not 'port-security'.

Practice this question →
33
MCQhard

An administrator configures IP Source Guard on an access switch port. When a client connects, its traffic is dropped even though it acquired an IP via DHCP. Reviewing logs shows no DHCP snooping binding. What is the root cause?

A.IP Source Guard requires static ARP inspection to be enabled simultaneously.
B.The client's MAC address is in the port security violation log.
C.DHCP snooping was not enabled on the corresponding VLAN, preventing binding table creation.
D.IP Source Guard only supports static IP bindings, not DHCP-derived bindings.
AnswerC

IP Source Guard relies on the DHCP snooping binding table to validate source IP and MAC pairs. Without DHCP snooping enabled on the client's VLAN, no binding is created, so all traffic is dropped despite successful DHCP lease acquisition.

Why this answer

IP Source Guard (IPSG) relies on the DHCP snooping binding table to validate source IP and MAC addresses on untrusted ports. If DHCP snooping is not enabled on the VLAN, the binding table is not populated, so IPSG has no entries to permit and drops all traffic. The root cause is that DHCP snooping was not enabled on the corresponding VLAN.

Exam trap

The trap is assuming IPSG works independently of DHCP snooping; candidates must remember that IPSG depends on the DHCP snooping binding table for dynamic entries.

How to eliminate wrong answers

Option A is wrong because IPSG does not require static ARP inspection; it can work with DHCP snooping bindings or static bindings. Option B is wrong because port security violations would log MAC addresses, but the issue is that no binding exists, not a violation. Option D is wrong because IPSG supports both static and DHCP-derived bindings; the problem is that DHCP snooping is not enabled to create the bindings.

Practice this question →
34
Multi-Selecteasy

Which TWO traffic conditions will trigger storm control drops on a configured switch interface? (Choose two)

Select 2 answers
A.Multicast traffic rate exceeding the configured threshold
B.Unicast traffic destined for known active MAC addresses exceeding average utilization
C.CPU control plane queue utilization exceeding 90%
D.Broadcast traffic rate exceeding the configured threshold
E.BPDU control frames exceeding Spanning Tree hello timers
AnswersA, D

Storm control meters ingress traffic per type against configured thresholds. Multicast frames are one monitored category, so a multicast rate exceeding its configured threshold triggers the interface to drop excess multicast packets until the rate falls back below the limit.

Why this answer

Storm control on a switch interface monitors Layer 2 traffic rates and drops frames when a configured threshold is exceeded, and it applies to broadcast, multicast, and unknown unicast traffic. Option A is correct because multicast traffic exceeding the configured threshold is one of the traffic types storm control polices, so it triggers drops. Option D is correct because broadcast traffic exceeding the configured threshold is the classic storm control trigger, suppressing broadcast storms on the interface.

Option B is wrong because unicast destined for known active MAC addresses is normal, expected forwarding traffic and is not counted by storm control (only unknown unicast is). Option C is wrong because CPU control plane queue utilization is a control-plane policing concern, not an interface storm control action. Option E is wrong because BPDUs are control frames handled by Spanning Tree, not storm-control-monitored data traffic.

Practice this question →
35
MCQhard

An administrator configures MACsec on a point-to-point link between two EX switches. Encrypted frames are received by the remote switch, but decryption fails, and packets are dropped. What is the most likely reason for this decryption failure?

A.The cipher suite defaults to GCM-AES-128 on one end and AES-CBC-128 on the other.
B.The MTU on the physical interface is set too small to accommodate MACsec ICV overhead.
C.A mismatch in pre-shared keys (CAK/CKN) or security association parameters between the peers.
D.DHCP snooping is blocking the MACsec control frames on the transit link.
AnswerC

MACsec decryption requires both peers to share identical connectivity association key material and matching security association parameters. A mismatch in CAK/CKN or SA settings causes received encrypted frames to fail integrity and decryption checks, so they are discarded.

Why this answer

Decryption failure in MACsec typically stems from a mismatch in connectivity association keys (CAK) or connectivity key names (CKN) configured on the peers.

Practice this question →
36
Multi-Selecteasy

Which TWO features rely on the DHCP snooping binding database to function properly? (Choose two)

Select 2 answers
A.IP Source Guard
B.Storm Control rate-limiting
C.Dynamic ARP Inspection (DAI)
D.Port Security MAC-Limit
E.MACsec Key Agreement (MKA)
AnswersA, C

IP Source Guard validates each ingress packet's source address against the DHCP snooping binding database, dropping frames whose IP-MAC pair is absent. Without that binding table, the feature cannot verify legitimate clients, so it depends on snooping.

Why this answer

IP Source Guard (A) is correct because it uses the DHCP snooping binding database to build its IP-to-MAC-to-port-to-VLAN binding table, then filters traffic on untrusted ports by dropping any packet whose source IP/MAC does not match an entry in that database (or a statically configured binding). Dynamic ARP Inspection (C) is also correct because DAI validates ARP packets on untrusted ports by comparing the sender IP and sender MAC against the DHCP snooping binding database, dropping ARP packets that do not match a valid binding (with static ARP ACLs as an optional supplement). Storm Control (B) is not correct because it is a hardware-based traffic rate limiter that monitors broadcast, multicast, or unknown unicast frames per port and does not consult any DHCP snooping bindings.

Port Security MAC-Limit (D) is not correct because it restricts the number of source MAC addresses learned on a port using the MAC address table, independent of DHCP snooping bindings. MACsec Key Agreement (E) is not correct because MKA is part of IEEE 802.1X-2010 MACsec and negotiates session keys between link peers using EAPOL-MKA frames, with no dependency on the DHCP snooping binding database.

Practice this question →
37
Multi-Selecthard

An administrator wants to deploy MACsec between two EX Series switches using MKA with pre-shared keys. Which THREE configuration steps must be performed on both switches? (Choose three)

Select 3 answers
A.Enable MACsec on the physical interface.
B.Configure the interface as a trusted port for Dynamic ARP Inspection.
C.Configure matching Connectivity Association Key (CAK) and Connectivity Key Name (CKN).
D.Enable DHCP snooping on the transit VLAN.
E.Configure security association parameters or cipher suites if deviating from defaults.
AnswersA, C, E

MACsec encryption operates at the physical port level, so the feature must be enabled on the interface carrying the point-to-point link before MKA can negotiate. This satisfies the stem's requirement that the step be performed on both EX Series switches.

Why this answer

Option A is correct because MACsec is enabled per physical interface on EX Series switches (for example, with the 'set security macsec interfaces ge-0/0/0' or 'security macsec' interface configuration), and this must be done on both ends of the point-to-point link before MKA can negotiate. Option C is correct because MKA with pre-shared keys requires both peers to be configured with the same Connectivity Association Key (CAK) and Connectivity Key Name (CKN); these values identify and authenticate the connectivity association so the switches can derive the Secure Association Key (SAK). Option E is correct because, although EX Series switches use default cipher suite and security association parameters, any deviation from those defaults—such as selecting a different cipher suite or key lifetime—must be explicitly configured identically on both switches for MKA to establish the MACsec session.

Option B is not required because Dynamic ARP Inspection trusted-port configuration is unrelated to MACsec/MKA and applies to DHCP snooping/DAI deployments. Option D is not required because DHCP snooping on the transit VLAN is a separate Layer 2 security feature and has no role in establishing MACsec with MKA pre-shared keys.

Practice this question →
38
Multi-Selecthard

Which THREE features are part of the secure access port feature set on Juniper EX Series switches? (Choose three)

Select 3 answers
A.DHCP snooping
B.MAC address limiting and persistent learning
C.OSPFv3 authentication
D.MACsec point-to-point encryption
E.Dynamic ARP Inspection
AnswersA, B, E

DHCP snooping is a secure access port feature: it inspects DHCP messages on untrusted ports, blocking rogue servers and binding IP-to-MAC-to-port entries used by IP source guard and dynamic ARP inspection, satisfying the port-level security requirement in the stem.

Why this answer

DHCP snooping (A) is a core secure access port feature on EX Series switches: it classifies ports as trusted or untrusted, builds the DHCP snooping database from trusted-port server replies, and drops DHCP offers/ACKs arriving on untrusted access ports to block rogue DHCP servers. MAC address limiting and persistent learning (B) are also part of the secure access port feature set, allowing an administrator to cap the number of MAC addresses learned per interface and to store learned MAC entries in the Ethernet switching table so they survive a reboot, mitigating MAC flooding and spoofing. Dynamic ARP Inspection (E) completes the set: it validates ARP packets against the DHCP snooping database and discards invalid ARP requests/replies on untrusted access ports, preventing ARP spoofing and man-in-the-middle attacks.

OSPFv3 authentication (C) is a routing protocol security mechanism for IPv6 OSPF adjacencies, not a Layer 2 secure access port feature, and MACsec point-to-point encryption (D) is a separate link-layer encryption standard (802.1AE) supported on specific platforms/ports rather than being grouped in the EX secure access port feature set.

Practice this question →
39
MCQeasy

Which feature is required to be enabled on an access switch to populate the DHCP snooping database binding table with legitimate client IP-to-MAC address mappings?

A.Dynamic ARP Inspection
B.IP Source Guard
C.DHCP Snooping
D.Port Security MAC-Limit
AnswerC

DHCP snooping builds the binding table by intercepting DHCP messages on untrusted access ports, recording client IP-to-MAC-to-port-to-VLAN mappings. Enabling it on the access switch is the prerequisite for populating legitimate bindings, satisfying the stem's requirement.

Why this answer

DHCP snooping must be enabled on the access switch to build the DHCP snooping binding database, which maps client IP addresses to MAC addresses, VLANs, and interfaces. This database is populated by snooping DHCP ACK messages as clients obtain leases. Without DHCP snooping enabled, the binding table remains empty, and features like Dynamic ARP Inspection and IP Source Guard cannot function.

Exam trap

JNCIS-ENT often tests the dependency chain — candidates may pick DAI or IP Source Guard, but those consume the binding table; DHCP snooping is what populates it.

How to eliminate wrong answers

Option A is wrong because Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table but does not populate it — DAI validates ARP packets against the table, so it depends on DHCP snooping being enabled first. Option B is wrong because IP Source Guard also relies on the DHCP snooping binding table to filter traffic; it does not create the table itself. Option D is wrong because Port Security MAC-Limit restricts the number of MAC addresses per port but does not build an IP-to-MAC binding table for DHCP clients.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Layer 2 Security questions.

Start 20-question session