Cisco 200-301 Exam Dumps, Practice Test Questions

A one-address limit is violated by the second unauthorized MAC, so the observed Secure-shutdown status cannot mean unrestricted forwarding.

The port-security counter reports a MAC-security limit event rather than proving a native VLAN tagging mismatch.

Spanning-tree role/state is a different control plane; the displayed port-security status and count directly identify MAC-security enforcement.

Ordinary clients should be untrusted so unauthorized server-type offers/ACKs arriving there can be dropped.

Without snooping, rogue DHCP responses from a client port are no longer filtered by trust.

Trust should apply to the authorized server path, not arbitrary hosts that might impersonate DHCP service.

Spanning-tree output shows Layer 2 topology and forwarding state but not DHCP snooping address bindings.

EtherChannel summary reports link aggregation membership and status rather than DHCP leases.

OSPF RIB output lists dynamic routes, not the DHCP client binding table.

A trusted DAI port bypasses validation for all received ARP packets and weakens protection on a user-controlled access interface.

Disabling DAI for the VLAN removes ARP spoofing checks instead of accommodating a statically addressed host securely.

An IPv4 TCP ACL operates at IP/transport matching; ARP is a different EtherType and needs a compatible DAI binding source or ARP ACL.

Trusting the attacker-controlled edge port broadens its DHCP authority and is not the requested flood limit.

Routing paths do not bound the rate of Layer 2 DHCP broadcast requests arriving on the untrusted edge.

DAI protects ARP integrity; it is not the DHCPDISCOVER rate limiter specified.

Physical CRC/error counters do not give port-security learned count, secure-port state or violation total.

MAC learning alone does not show port-security enforcement state and violation counters.

The snooping binding table maps DHCP/IP/MAC/port, not the secure-port violation counter the question asks for.

Ordinary dynamic entries expire and are not automatically retained after restart unless sticky learned entries are saved.

A maximum limits count but does not by itself persist the dynamically learned address as a saved sticky entry.

Restrict is a violation action; it does not automatically make the learned MAC persist across reboots.

Shutdown places a violating port into an error-disabled state, disconnecting even its legitimate authorized endpoint until recovery.

Protect also drops unauthorized source MAC traffic but generally does not increment or report the same violation notifications requested here.

With no port security, the access switch ordinarily learns source MACs without applying the configured maximum and violation action.

Restrict prevents traffic from unauthorized MAC addresses and counts or logs violations, but does not shut the entire port as requested.

Protect typically drops unauthorized MAC traffic without bringing down the full interface, unlike the requested shutdown policy.

Raising the limit allows the previously unauthorized second address and defeats the requirement for immediate port shutdown.

The interface view can show state and counts but does not directly list all secure MAC/VLAN/port entries the auditor requests.

ARP neighbor cache does not indicate which MACs are actually secured by port-security on each switchport.

VLAN membership shows interfaces and VLANs, not the port-security secure MAC address inventory.

DHCP snooping is not itself a mandatory prohibition on all statically configured hosts; DAI binding policy and packet-rate handling are separate checks.

An ARP ACL governs whether ARP claims match its configured policy. DAI rate limiting is a separate limit and trusted ports are not limited by the default untrusted rate.

PortFast accelerates STP edge forwarding behavior and does not implement DAI ARP packet-rate enforcement.