CCNP Switch Chapter 16 Exam Questions with Correct Answers |New Update 100% Verified
By Experts
What is the port security feature based on? MAC addresses
What command do you use to enable port security? switchport port-security
What command do you use to configure the maximum number of MAC addresses that will be
allowed access (24 for example)? switchport port-security maximum 24
What's the default number of MAC addresses that are allowed access on each switch port?
What is the range number of addresses? the default is 1, but it can go up to 1024
How does port security learn MAC addresses by default? Do you have to program them or are
they dynamically picked-up? they are picked up dynamically (sticky MAC addresses)
Do learned sticky MAC addresses ever expire? They can be aged out of the table if those
hosts are silent for a period of time. By default, no aging occurs.
What command would you use to statically define a MAC address on an interface
(0006.5b02.acd9 for example)? switchport port-security mac-address 0006.5b02.acd9
What are the names of the three different ways port-security can be violated? 1. Shutdown
mode
2. Restrict mode
3. Protect mode
What does the port-security Shutdown mode mean? The port immediately is put into the
Errdisable state, which effectively shuts it down. It must be reenabled manually or through
errdisable recovery to be used again.
, What does the port-security Restrict mode mean? The port is allowed to stay up, but all
packets from violating MAC addresses are dropped. The switch keeps a running count of the
number of violating packets and can send an SNMP trap and a syslog message as an alert of the
violation.
What does the port-security Protect mode mean? The port is allowed to stay up, as in the
restrict mode. Although packets from violating addresses are dropped, no record of the
violation is kept.
What command do you use to pick the port-security violation mode for a port? switchport
port-security violation {shutdown | restrict | protect}
If you want to clear the learned MAC addresses in port-security from a port, what command do
you use? clear port-security dynamic [address mac-addr | interface type mod/num]
What command do you use if you want to see all of the ports that have been shutdown by port-
security Shutdown mode? show interfaces status err-disabled
What command do you use if you just want to see a summary of what is going on with port-
security? show port-security
What is port-based authentication and what does it do? Catalyst switches can support port-
based authentication, a combination of AAA authentication and port security. This feature is
based on the IEEE 802.1x standard. When it is enabled, a switch port will not pass any traffic
until a user has authenticated with the switch. If the authentication is successful, the user can
use the port normally.
What do you need in place to put port-based authentication in place? Both the switch and
the end user's PC must support the 802.1x standard, using the Extensible Authentication
Protocol over LANs (EAPOL). RADIUS can also be used.
By Experts
What is the port security feature based on? MAC addresses
What command do you use to enable port security? switchport port-security
What command do you use to configure the maximum number of MAC addresses that will be
allowed access (24 for example)? switchport port-security maximum 24
What's the default number of MAC addresses that are allowed access on each switch port?
What is the range number of addresses? the default is 1, but it can go up to 1024
How does port security learn MAC addresses by default? Do you have to program them or are
they dynamically picked-up? they are picked up dynamically (sticky MAC addresses)
Do learned sticky MAC addresses ever expire? They can be aged out of the table if those
hosts are silent for a period of time. By default, no aging occurs.
What command would you use to statically define a MAC address on an interface
(0006.5b02.acd9 for example)? switchport port-security mac-address 0006.5b02.acd9
What are the names of the three different ways port-security can be violated? 1. Shutdown
mode
2. Restrict mode
3. Protect mode
What does the port-security Shutdown mode mean? The port immediately is put into the
Errdisable state, which effectively shuts it down. It must be reenabled manually or through
errdisable recovery to be used again.
, What does the port-security Restrict mode mean? The port is allowed to stay up, but all
packets from violating MAC addresses are dropped. The switch keeps a running count of the
number of violating packets and can send an SNMP trap and a syslog message as an alert of the
violation.
What does the port-security Protect mode mean? The port is allowed to stay up, as in the
restrict mode. Although packets from violating addresses are dropped, no record of the
violation is kept.
What command do you use to pick the port-security violation mode for a port? switchport
port-security violation {shutdown | restrict | protect}
If you want to clear the learned MAC addresses in port-security from a port, what command do
you use? clear port-security dynamic [address mac-addr | interface type mod/num]
What command do you use if you want to see all of the ports that have been shutdown by port-
security Shutdown mode? show interfaces status err-disabled
What command do you use if you just want to see a summary of what is going on with port-
security? show port-security
What is port-based authentication and what does it do? Catalyst switches can support port-
based authentication, a combination of AAA authentication and port security. This feature is
based on the IEEE 802.1x standard. When it is enabled, a switch port will not pass any traffic
until a user has authenticated with the switch. If the authentication is successful, the user can
use the port normally.
What do you need in place to put port-based authentication in place? Both the switch and
the end user's PC must support the 802.1x standard, using the Extensible Authentication
Protocol over LANs (EAPOL). RADIUS can also be used.
