Exam Objective 4.7: Configure Layer 2 security features.
4.7.a DHCP snooping
4.7.b Dynamic ARP inspection
4.7.c Storm control
4.7.d RA guard
4.7.e Port security
Layer 2 has historically been treated as an implicitly trusted layer, but a single compromised or misconfigured device on a switched segment can cause serious damage — a rogue DHCP server handing out bad addresses, an attacker poisoning ARP tables to intercept traffic, a broadcast storm knocking out an entire VLAN, a rogue IPv6 router advertisement hijacking client default gateways, or an unauthorized device simply plugging into an open port. This objective covers five distinct Cisco switch security features, each defending against a specific Layer 2 attack or failure scenario, and each building on concepts already covered earlier in the blueprint (DHCP from objective 1.7, ARP from objective 1.3, broadcast domains from objective 2.1, IPv6 RA/SLAAC from objective 1.4).
DHCP snooping protects against a rogue or unauthorized DHCP server being connected to the network and handing out incorrect or malicious DHCP configuration information (wrong default gateway, wrong DNS server, or an entirely bogus address range) to unsuspecting clients.
How it works: DHCP snooping classifies each switch port as either trusted or untrusted. Trusted ports (typically ports connecting to the legitimate DHCP server itself, or uplinks toward the rest of the network where the legitimate server is reachable) are allowed to send DHCP server-type messages (DHCPOFFER, DHCPACK). Untrusted ports (typically all standard access ports connecting to end hosts) are only allowed to send DHCP client-type messages (DHCPDISCOVER, DHCPREQUEST) — if a DHCP server-type message is ever received on an untrusted port, it is dropped, since a legitimate end host should never be acting as a DHCP server.
Configuration:
ip dhcp snooping
ip dhcp snooping vlan 10,20
interface GigabitEthernet0/1
description Uplink-to-legitimate-DHCP-server
ip dhcp snooping trust
Key configuration elements:
ip dhcp snooping — enables the feature globally
ip dhcp snooping vlan [list] — specifies which VLANs DHCP snooping should actively monitor (the feature does nothing on VLANs not included here)
ip dhcp snooping trust — applied on the specific interface(s) that should be allowed to source DHCP server replies (uplinks, or the port directly connecting to the legitimate DHCP server); all other ports default to untrusted once DHCP snooping is enabled on their VLAN
DHCP snooping binding table: As legitimate DHCP transactions occur on untrusted ports, the switch builds a binding table recording each client's MAC address, leased IP address, lease time, VLAN, and the interface it was learned on. This binding table becomes foundational infrastructure that Dynamic ARP Inspection (covered next) directly relies upon.
Verification: show ip dhcp snooping and show ip dhcp snooping binding
Exam Alert: DHCP snooping's trusted/untrusted port model is the core concept to know, and its binding table is the critical prerequisite that DAI depends on — these two features are almost always tested together or in sequence, since DAI cannot function properly without DHCP snooping already having built a populated binding table.
Dynamic ARP Inspection protects against ARP spoofing/poisoning attacks, where a malicious device sends forged ARP replies claiming to own an IP address that actually belongs to another device (commonly the default gateway), tricking other hosts on the segment into sending their traffic to the attacker instead — a classic man-in-the-middle technique.
How it works: DAI intercepts ARP packets on untrusted ports and validates them against the DHCP snooping binding table (or against statically configured ARP ACLs, for hosts with statically assigned IP addresses that wouldn't appear in a DHCP-derived binding table). If an ARP packet's claimed IP-to-MAC mapping doesn't match a known-valid binding, the packet is dropped rather than being allowed to update any host's ARP cache.
Dependency on DHCP snooping: Because DAI's primary validation source is the DHCP snooping binding table, DHCP snooping must generally be enabled and functioning first — DAI, without a populated binding table (or a supplemental static ARP ACL) to check against, has no reliable reference for what a legitimate ARP mapping should look like.
Configuration:
ip arp inspection vlan 10,20
interface GigabitEthernet0/1
description Uplink-to-legitimate-DHCP-server
ip arp inspection trust
Key configuration elements:
ip arp inspection vlan [list] — enables DAI on the specified VLANs
ip arp inspection trust — applied on trusted interfaces (typically the same uplink ports trusted for DHCP snooping), exempting ARP traffic on those ports from inspection; all other ports default to untrusted and have their ARP traffic actively validated
For statically addressed hosts (no DHCP snooping binding exists): ARP ACLs can be manually configured and applied to explicitly permit specific known-valid static IP-to-MAC mappings that wouldn't otherwise appear in the DHCP-derived binding table.
Verification: show ip arp inspection and show ip arp inspection interfaces
Exam Alert: Know that DAI relies on the DHCP snooping binding table as its primary reference — an environment using only static IP addressing (no DHCP at all) requires manually configured ARP ACLs instead, since no DHCP snooping binding table would ever be populated in that scenario.
Storm control protects a switch (and the broader network) from broadcast, multicast, or unknown-unicast traffic storms — situations where excessive flooding of one of these traffic types (whether from a malfunctioning device, a Layer 2 loop, or a deliberate attack) consumes so much bandwidth that it degrades or completely disrupts normal network operation.
How it works: Storm control monitors the level of broadcast, multicast, and/or unknown-unicast traffic on a per-interface basis, measured as a percentage of total available interface bandwidth (or, on some platforms, as packets-per-second or bits-per-second), and takes a configured action once that traffic type exceeds a defined threshold.
Configuration:
interface GigabitEthernet0/1
storm-control broadcast level 70.00
storm-control multicast level 50.00
storm-control action shutdown
Key configuration elements:
storm-control [broadcast | multicast | unicast] level [percentage] — defines the traffic-level threshold for that specific traffic type on this interface
storm-control action [shutdown | trap] — defines what happens once the threshold is exceeded:
shutdown — the interface is placed into the err-disabled state, requiring manual (or auto-recovery-configured) intervention to bring it back up
trap — an SNMP trap notification is sent to alert administrators, but the interface itself continues operating and simply drops the excess traffic of that specific type once the threshold is exceeded (the default action if no action is explicitly specified is simply to drop the excess traffic without any additional shutdown or trap)
Why storm control matters even alongside spanning tree: While Rapid PVST+ (objective 2.5) is designed to prevent Layer 2 loops from forming in the first place, storm control provides an additional, independent layer of protection against excessive broadcast/multicast/unknown-unicast traffic regardless of its root cause — including scenarios where the flooding isn't necessarily due to a loop at all, such as a malfunctioning NIC or a deliberate broadcast-based attack.
Verification: show storm-control [interface] [broadcast | multicast | unicast]
Exam Alert: Know the three monitored traffic types (broadcast, multicast, unknown-unicast) and the distinction between the shutdown action (interface goes err-disabled entirely) versus the trap action (interface stays up, generates an alert, and simply drops the excess traffic above threshold).
Router Advertisement Guard (RA Guard) protects against a rogue or misconfigured IPv6 router (or an attacker) sending unauthorized Router Advertisement (RA) messages on the network, which could otherwise mislead IPv6 hosts using SLAAC (covered in objective 1.4) into adopting an incorrect default gateway, incorrect prefix, or other malicious IPv6 configuration.
Why this matters — recall from objective 1.4: Hosts using SLAAC build their IPv6 configuration based on RA messages received from a router; there is no equivalent "DHCP snooping"- style server authentication built into the base IPv6 neighbor discovery process, meaning any device on the segment could potentially send RA messages and be believed by unsuspecting hosts, exactly analogous to the rogue DHCP server problem DHCP snooping solves for IPv4.
How it works: RA Guard classifies switch ports as either a host port (not permitted to send RA messages at all) or a router port (explicitly permitted to send legitimate RA messages), and drops any RA message received on a port not authorized to send them.
Configuration:
ipv6 nd raguard policy RA-POLICY
device-role router
interface GigabitEthernet0/2
ipv6 nd raguard attach-policy RA-POLICY
Key configuration elements:
ipv6 nd raguard policy [name] — defines a named RA Guard policy
device-role [host | router] — specifies whether ports using this policy should be treated as a host (RA messages blocked) or a legitimate router (RA messages permitted)
ipv6 nd raguard attach-policy [name] — applies the defined policy to a specific interface
Exam Alert: RA Guard is the IPv6-specific, conceptual parallel to DHCP snooping's rogue-server protection — both defend against an untrusted/unauthorized device on the segment handing out network configuration information (DHCP responses for IPv4, Router Advertisements for IPv6) that clients would otherwise blindly trust.
Port security restricts which specific device(s) — identified by MAC address — are allowed to communicate through a given switchport, protecting against unauthorized devices being connected to an access port, MAC flooding attacks (where an attacker floods a switch's MAC address table with bogus entries to force it into flooding all traffic like a hub), and simple physical security violations (someone unplugging an authorized device and plugging in their own).
Configuration:
interface GigabitEthernet0/3
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation restrict
Key configuration elements:
switchport port-security — enables port security on the interface (only valid on a port already in access mode, or on a voice/access combination port; port security is not compatible with dynamic trunking negotiation)
switchport port-security maximum [number] — sets how many total MAC addresses are allowed to be learned/permitted on this port simultaneously (default is 1 if not otherwise specified)
switchport port-security mac-address [address] — manually/statically specifies a permitted MAC address
switchport port-security mac-address sticky — dynamically learns whatever MAC address(es) first connect to the port, then automatically adds them to the running configuration as if they'd been manually/statically entered, combining the convenience of dynamic learning with the persistence of static configuration
Port security violation modes — what happens when an unauthorized MAC address is detected:
protect — silently drops traffic from the unauthorized/violating MAC address, without generating any log message or otherwise disabling the port; legitimate traffic from already-permitted MAC addresses continues normally
restrict — drops traffic from the violating MAC address (same as protect), but additionally generates a log message/SNMP trap and increments a violation counter
shutdown — the default violation mode; immediately places the entire port into the err-disabled state upon detecting a violation, requiring manual (or auto-recovery) intervention to restore the port to service, even for legitimate traffic that would otherwise be allowed
Recovering an err-disabled port security violation: Since shutdown is the default and most severe violation action, recovering a port placed into err-disable requires either manually issuing shutdown followed by no shutdown on the interface, or configuring automatic err-disable recovery globally (errdisable recovery cause psecure-violation, combined with a configured recovery interval).
Verification: show port-security and show port-security interface [interface]
Exam Alert: Know the three violation modes in order of increasing severity: protect (silent drop, no logging), restrict (drop plus logging/counter), shutdown (default, entire port err-disabled). This is one of the most frequently and specifically tested details in this entire objective — expect a scenario describing symptoms (a port went completely down versus a port that's still passing legitimate traffic but silently dropping something) and being asked which violation mode is in effect.
These features are not mutually exclusive and are frequently deployed together as layered defense on the same access-layer switch:
Port security restricts which specific devices can connect to a given port at all
DHCP snooping ensures only trusted, legitimate DHCP server responses are accepted anywhere on the segment, and builds the binding table
Dynamic ARP Inspection leverages that same binding table to validate ARP traffic and prevent ARP spoofing
Storm control provides an independent safety net against excessive broadcast/multicast/unknown-unicast flooding, regardless of its specific cause
RA Guard provides the IPv6-specific equivalent protection against rogue Router Advertisements, parallel to what DHCP snooping provides for IPv4
Typical deployment pattern: All five features are commonly enabled together on standard user-facing access ports, while uplink/trunk ports toward the rest of the network are configured as trusted (for DHCP snooping and DAI specifically) or as router ports (for RA Guard), reflecting that legitimate DHCP servers, ARP traffic for many hosts, and legitimate routers are all expected to be reached through those specific uplink connections.
Enable DHCP snooping globally and per-VLAN first, since Dynamic ARP Inspection depends on its binding table; designate the correct uplink/server-facing ports as trusted.
Enable Dynamic ARP Inspection on the same VLANs, again designating the same uplink ports as trusted; configure static ARP ACLs for any statically-addressed hosts not covered by a DHCP snooping binding.
Configure storm control thresholds and the appropriate action (shutdown or trap) on access ports, independent of the loop-prevention already provided by spanning tree.
Configure RA Guard policies distinguishing host ports from legitimate router ports, if IPv6 is in use on the network.
Configure port security on individual access ports, setting an appropriate maximum MAC count, using sticky learning where convenient, and selecting a violation mode appropriate to the desired balance between security strictness and operational disruption (protect/restrict for lower-impact enforcement, shutdown for maximum strictness).
If a port unexpectedly stops passing traffic, check show port-security interface and the switch's error-disable log/show logging output to determine which specific feature (port security, storm control, or another err-disable-capable feature) actually triggered the shutdown.
If DAI is dropping legitimate ARP traffic unexpectedly, confirm the DHCP snooping binding table actually contains an entry for that host, or that an appropriate static ARP ACL has been configured for statically-addressed devices.
Q1. Which Layer 2 security feature builds a binding table that Dynamic ARP Inspection directly relies on for validating ARP traffic?
A. Storm control
B. RA Guard
C. DHCP snooping
D. Port security
Answer: C. DHCP snooping builds a binding table recording each client's MAC address, leased IP address, VLAN, and interface as legitimate DHCP transactions occur on untrusted ports. Dynamic ARP Inspection uses this same binding table as its primary reference for validating whether an ARP packet's claimed IP-to-MAC mapping is legitimate.
Q2. A port security violation is configured with the "restrict" violation mode. What happens when an unauthorized MAC address attempts to communicate through that port?
A. The entire port is immediately placed into the err-disabled state
B. Traffic from the unauthorized MAC address is silently dropped with no logging at all
C. Traffic from the unauthorized MAC address is dropped, and a log message/SNMP trap is generated along with an incremented violation counter
D. The unauthorized MAC address is automatically added to the permitted address list
Answer: C. The restrict violation mode drops traffic from the violating MAC address, similar to protect mode, but additionally generates a log message or SNMP trap notification and increments a violation counter — distinguishing it from protect (which drops silently with no logging) and from shutdown (which places the entire port into err-disable rather than simply dropping the offending traffic).
Q3. Which IPv6-specific Layer 2 security feature protects against a rogue device sending unauthorized Router Advertisement messages that could mislead SLAAC-configured hosts?
A. DHCP snooping
B. Dynamic ARP Inspection
C. RA Guard
D. Storm control
Answer: C. RA Guard specifically protects against rogue or unauthorized Router Advertisement messages, which SLAAC-configured IPv6 hosts would otherwise trust implicitly, potentially leading to an incorrect default gateway, prefix, or other malicious configuration. This is the IPv6 conceptual parallel to DHCP snooping's protection against rogue DHCP servers in IPv4.
Q4. An interface is configured with storm-control broadcast level 60.00 and storm-control action trap. Broadcast traffic on that interface exceeds the 60 percent threshold. What happens?
A. The interface is placed into the err-disabled state
B. The interface remains up, excess broadcast traffic above the threshold is dropped, and an SNMP trap notification is generated
C. All traffic on the interface is immediately blocked
D. The switch automatically reduces the interface's speed
Answer: B. The trap action generates an SNMP trap notification to alert administrators when the configured threshold is exceeded, but the interface itself remains operational — it simply drops the excess broadcast traffic above the threshold rather than being taken down entirely, which is the behavior specifically associated with the shutdown action instead.
Q5. Which command enables port security to automatically learn a connecting device's MAC address and add it to the running configuration as if it had been manually configured?
A. switchport port-security maximum 1
B. switchport port-security mac-address sticky
C. switchport port-security violation protect
D. ip dhcp snooping trust
Answer: B. The sticky keyword combines dynamic MAC address learning with static persistence — the switch learns whichever MAC address(es) first connect to the port and automatically adds them into the running configuration exactly as if an administrator had manually typed a static switchport port-security mac-address entry.
Q6. On a switch with both DHCP snooping and Dynamic ARP Inspection enabled, which type of port should be explicitly configured as trusted for both features?
A. Every single access port connecting to end-user devices
B. The uplink port(s) connecting toward the legitimate DHCP server and the rest of the trusted network
C. Only ports with port security enabled
D. No ports should ever be marked as trusted
Answer: B. Uplink ports connecting toward the legitimate DHCP server (and generally toward the rest of the trusted upstream network) should be marked as trusted for both DHCP snooping and DAI, since legitimate DHCP server responses and ARP traffic for potentially many hosts are expected to arrive through those specific connections. Standard end-user access ports should remain untrusted by default, since a legitimate end host has no business acting as a DHCP server or generating certain ARP patterns.