Switch Port Security Quiz for Network Engineers

1. Which attack does Dynamic ARP Inspection (DAI) help prevent?

ARP spoofing and man-in-the-middle attacks

Port scanning attacks

Denial of service floods

Password brute-force attacks

2. What happens when a port security violation occurs in 'shutdown' mode?

The port transitions to error-disabled state and stops forwarding

Only the offending MAC address is blocked

The entire switch is reset

A notification email is sent to administrators

3. Which feature allows a switch port to automatically detect and block unauthorized network devices?

Port security with MAC address filtering

STP protection mechanisms

VLAN segmentation

Trunk port configuration

4. What is the purpose of configuring a native VLAN on a trunk port?

Untagged frames are assigned to this VLAN for management traffic

All traffic on the trunk is encrypted

Port security is automatically enabled

The switch automatically creates additional VLANs

5. Which security feature on a switch helps prevent VLAN hopping attacks?

Disabling DTP and manually configuring trunk ports

Enabling port security on all ports

Configuring DHCP snooping

Enabling spanning tree protocol

6. What does loop guard protect against on a switch?

Unidirectional link failures creating bridging loops

Excessive MAC address learning

Unauthorized port access

VLAN configuration errors

7. Which command configures the maximum number of MAC addresses on a port to 5?

Switchport port-security maximum 5

Port-security limit 5

Mac-address limit 5

Security maximum-addresses 5

8. What is the primary difference between 'protect' and 'restrict' violation modes?

Protect silently drops frames; restrict logs violations

Protect disables the port; restrict keeps it active

Protect allows one violation; restrict allows multiple

Protect is for trunk ports; restrict is for access ports

9. Which feature prevents a non-root bridge from becoming the root bridge?

Root guard

BPDU guard

Loop guard

Port security

10. What does the 'restrict' violation mode do when a security violation occurs?

Discards traffic from unauthorized MAC addresses and logs the violation

Blocks all traffic on the switch

Sends an alert but allows traffic

Temporarily disables the port for 1 minute

11. What is the primary purpose of port security on a network switch?

Limit the number of MAC addresses that can access a port

Increase bandwidth on the switch

Reduce power consumption

Encrypt all traffic passing through the port

12. What is the purpose of enabling portfast on access ports?

Allows ports to skip listening and learning states and go directly to forwarding

Increases the speed of data transmission

Disables port security automatically

Enables VLAN trunking

13. Which feature prevents unauthorized switches from being added to the network?

Port security with MAC address filtering

Root guard

Loop guard

Spanning tree portfast

14. What does DHCP snooping prevent on a switch?

Rogue DHCP servers from assigning IP addresses

All DHCP traffic from entering the network

Legitimate clients from obtaining IP addresses

VLAN tagging on access ports

15. Port Addressable Memory (PAM) is associated with which security feature?

MAC address table management

VLAN hopping prevention

DDoS mitigation

Encryption protocols

16. What is BPDU guard used to protect against?

Spanning Tree Protocol manipulation attacks

MAC address spoofing

DHCP starvation

ARP poisoning

17. Which violation mode sends a syslog message but continues to allow traffic?

Protect

Restrict

Shutdown

Disable

18. In port security, what is the default maximum number of MAC addresses allowed per port?

1

5

10

Unlimited

19. What does MAC address sticky learning do on a switch port?

Dynamically learns and stores MAC addresses in the running configuration

Permanently blocks all MAC addresses

Encrypts MAC address tables

Increases port bandwidth capacity

20. Which port security violation mode disables the port immediately when a violation occurs?