CertAce

CCNA practice test / CCNA Layer 2 Security Practice Questions

CCNA Layer 2 Security Practice Questions

10 original questions, each with an explanation for every option.

Start the questions Or start the free trial

I work as a network engineer, and I failed my first CCNA attempt with 58% before passing on a later try. Layer 2 security is a part of the exam where the commands look simple but the questions test behavior: what a port does when a fourth MAC address shows up, why a perfectly normal DHCP server suddenly stops answering, or why one host with a static address can no longer reach its gateway.

The blueprint expects you to configure and verify three switch features. Port security limits which and how many source MAC addresses a port accepts, and its violation mode decides whether the port drops, logs or shuts down. DHCP snooping splits ports into trusted and untrusted, drops server messages on untrusted ports and builds a binding table of MAC, IP, VLAN and port. Dynamic ARP Inspection reuses that binding table to drop forged ARP packets. Each one answers a different attack, and the exam likes to offer the wrong one as a distractor.

These ten questions mix show output, configuration and troubleshooting. Read the exhibit before the answers, name the attack or symptom in your own words, and only then match it to a feature. Every explanation says why each option is right or wrong, so the wrong ones are worth reading too.

Adrian, network engineer and founder of CertAce.

How to work these questions

  1. Name the attack before you look at the features: too many or unknown MACs on a port, a rogue DHCP server, DHCP starvation, or ARP spoofing / man-in-the-middle.
  2. Map it: MAC count or MAC identity on an access port is port security; rogue DHCP servers and DHCP floods are DHCP snooping (trust plus rate limit); forged ARP replies are Dynamic ARP Inspection.
  3. Remember the dependency: DAI checks ARP against the DHCP snooping binding table, so hosts with static IPs need an ARP ACL or the port must be trusted.
  4. For trust questions, trust only ports that face the legitimate DHCP server or other switches; every port facing end users stays untrusted, which is the default.
  5. For port security, check the switchport mode (static access or trunk, never dynamic), the maximum (default 1) and the violation mode (default shutdown) before judging the symptom.
  6. If a port is err-disabled, fix the cause first, then bounce it with shutdown / no shutdown or let errdisable recovery bring it back.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

  1. Question 1 of 10Concept

    A port security violation occurs on an access port. The switch keeps the port up, drops frames from the offending MAC address, sends a syslog message and increments the security violation counter. Which violation mode is configured?

    1. protect
    2. shutdown
    3. restrict
    4. shutdown vlan
    Show the answer

    Answer: C

    All violation modes drop the offending frames. Protect is silent, restrict adds logging and the counter, and shutdown (the default) err-disables the port. If the port stays up and you see log messages, the mode is restrict.

    • A. Protect also keeps the port up and drops the frames, but it does it silently: no syslog message and no counter increment.
    • B. Shutdown, the default mode, would put the entire port into err-disabled state instead of keeping it up.
    • C. Restrict drops frames from the violating MAC, keeps forwarding for the allowed addresses, logs the event and increments the violation counter.
    • D. Shutdown vlan err-disables only the affected VLAN on the port rather than keeping it forwarding, and it is not one of the three modes the CCNA focuses on.

  2. Question 2 of 10Exhibit

    Refer to the exhibit. What is happening on GigabitEthernet0/5?

    SW1# show port-security interface GigabitEthernet0/5
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 2
Total MAC Addresses        : 2
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 2
Last Source Address:Vlan   : 00d0.1a2b.7e01:10
Security Violation Count   : 14
    1. A third MAC address is being dropped and logged while the two sticky MACs still forward.
    2. The port is err-disabled and must be bounced before any of the hosts can send traffic.
    3. All traffic is dropped because the sticky addresses were never saved to the startup config.
    4. The port is silently dropping the third MAC without any syslog messages being generated.
    Show the answer

    Answer: A

    In show port-security interface, read Port Status, Violation Mode, the maximum vs total MACs and the violation count together. Secure-up plus a rising counter means restrict; Secure-shutdown means shutdown mode fired; a counter stuck at 0 with drops points to protect.

    • A. The port is Secure-up with 2 of 2 MACs learned as sticky, the mode is restrict and the counter is 14, so frames from an extra address are dropped and counted while the two allowed hosts keep working.
    • B. An err-disabled port would show Port Status Secure-shutdown; restrict mode never shuts the port down.
    • C. Sticky MACs are in the running config and work immediately; saving to startup only matters after a reload, and the port is clearly forwarding.
    • D. Silent dropping without logs describes protect mode, and protect does not increment the violation counter, which here is 14.

  3. Question 3 of 10Scenario

    Access port Gi0/12 has `switchport port-security` with no other port security commands. A user connects an IP phone to it and plugs a PC into the phone. Shortly after, the port goes err-disabled. What is the right fix?

    1. Configure errdisable recovery cause psecure-violation and leave the port settings as they are.
    2. Set switchport port-security maximum 2 (or more) on Gi0/12, then enter shutdown and no shutdown.
    3. Add switchport port-security mac-address sticky so both MACs are learned and saved automatically.
    4. Change the violation mode to protect, which re-enables the port and lets both devices forward.
    Show the answer

    Answer: B

    Port security defaults are maximum 1 and violation shutdown, so a phone with a PC behind it trips it. Fix the cause (raise the maximum; Cisco often suggests 2 or 3 for phone ports), then recover the port with shutdown / no shutdown or errdisable recovery.

    • A. Automatic recovery brings the port back after 300 seconds, but with the default maximum of 1 the second MAC triggers the violation again and the port keeps flapping into err-disabled.
    • B. The default maximum is 1 and the phone plus the PC are two source MACs. Raising the maximum removes the cause, and shutdown / no shutdown recovers the err-disabled port.
    • C. Sticky only changes how addresses are learned and stored; the maximum stays 1, so the second MAC is still a violation.
    • D. Changing the mode does not recover a port that is already err-disabled, and with a maximum of 1 protect would silently drop one of the two devices.

  4. Question 4 of 10Config

    Interface Gi0/7 is still at the factory switchport settings. When you type `switchport port-security` on it, IOS answers "Command rejected: GigabitEthernet0/7 is a dynamic port." Which sequence enables port security correctly?

    1. switchport nonegotiate, then switchport port-security
    2. switchport port-security maximum 1, then switchport port-security
    3. switchport mode dynamic desirable, then switchport port-security
    4. switchport mode access, then switchport port-security
    Show the answer

    Answer: D

    Port security is refused on dynamic auto and dynamic desirable ports, and many switches default to dynamic auto. Configure switchport mode access (or trunk) first, then switchport port-security.

    • A. Nonegotiate stops DTP frames but is only accepted on a port statically set to access or trunk, and it does not change the port from dynamic mode.
    • B. The maximum command does not change the switchport mode, so the port stays dynamic and port security is still rejected.
    • C. Dynamic desirable is still a dynamic mode; port security needs the mode set statically.
    • D. Port security works only on ports statically configured as access or trunk, so you set access mode first and then enable the feature.

  5. Question 5 of 10Scenario

    Users in VLAN 10 start receiving addresses in 192.168.0.0/24 instead of the company range 10.10.10.0/24. You find a home router plugged into access port Fa0/14. Which feature, configured how, stops this from happening again on every access port?

    1. DHCP snooping for VLAN 10, with only the uplink toward the real server set as trusted
    2. Port security on all access ports with a maximum of 1 MAC and violation mode restrict
    3. Dynamic ARP Inspection for VLAN 10, with only the uplink toward the gateway trusted
    4. An ip helper-address on the VLAN 10 SVI pointing at the company DHCP server address
    Show the answer

    Answer: A

    Rogue DHCP server equals DHCP snooping. Enable it globally and per VLAN, trust only ports toward legitimate servers or upstream switches, and leave every user port untrusted so server messages arriving there are dropped.

    • A. DHCP snooping drops DHCP server messages (OFFER, ACK) arriving on untrusted ports, so a rogue server on an access port can no longer answer clients.
    • B. The home router uses one MAC address on that port, so port security with a maximum of 1 would not stop its DHCP offers.
    • C. DAI validates ARP packets, not DHCP messages; it would not stop the rogue server from handing out leases.
    • D. A helper address relays client broadcasts to the real server but does nothing to block a local rogue server that answers first.

  6. Question 6 of 10Exhibit

    Refer to the exhibit. R1 is the DHCP server for VLAN 10. After this configuration was applied to SW3, PCs in VLAN 10 no longer get addresses. What is the cause?

    SW3# show running-config | section dhcp|interface
ip dhcp snooping vlan 10
ip dhcp snooping
interface GigabitEthernet0/1
 description Uplink to R1 (DHCP server)
 switchport mode trunk
interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access
 ip dhcp snooping limit rate 15
interface FastEthernet0/2
 switchport access vlan 10
 switchport mode access
 ip dhcp snooping limit rate 15
    1. Snooping is enabled globally but has not been enabled for VLAN 10 on SW3.
    2. A rate limit of 15 packets per second is too low for normal DHCP traffic.
    3. Gi0/1 is untrusted, so the OFFER and ACK messages from R1 are discarded.
    4. Dynamic ARP Inspection must be enabled before snooping starts forwarding.
    Show the answer

    Answer: C

    After enabling DHCP snooping, add ip dhcp snooping trust on every port toward the legitimate DHCP server or relay. Forgetting it is the classic cause of all clients losing their addresses.

    • A. The line ip dhcp snooping vlan 10 is present, so snooping is active on VLAN 10.
    • B. A client exchange is a handful of packets; 15 pps on an access port is a normal value and would not block it.
    • C. All ports are untrusted by default, and Gi0/1 has no ip dhcp snooping trust, so server messages arriving from R1 are dropped and clients never get an OFFER.
    • D. DHCP snooping works on its own; it is DAI that depends on snooping, not the other way round.

  7. Question 7 of 10Scenario

    DAI is enabled for VLAN 20. A network printer with a static IP on Gi0/9 cannot reach its gateway, and the switch logs: `%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/9, vlan 20.([00d0.1a2b.3c4d/10.20.0.50/0000.0000.0000/10.20.0.1/...])`. How do you fix it while keeping ARP inspection on Gi0/9?

    1. Configure ip arp inspection trust on Gi0/9 so ARPs from the printer bypass inspection.
    2. Create an ARP ACL for 10.20.0.50 / 00d0.1a2b.3c4d and apply it with ip arp inspection filter.
    3. Configure ip dhcp snooping trust on Gi0/9 so the printer is treated as a known host.
    4. Add switchport port-security mac-address sticky on Gi0/9 to register the printer's MAC.
    Show the answer

    Answer: B

    DAI validates ARP sender MAC/IP against the DHCP snooping binding table. Static-IP hosts are missing from it, so permit them with an ARP ACL (arp access-list, then ip arp inspection filter) or, if inspection is not required there, trust the port.

    • A. Trusting the port would make the printer work, but it turns off ARP inspection on Gi0/9, which the requirement forbids.
    • B. The printer never used DHCP, so it has no entry in the snooping binding table. An ARP ACL permitting that IP/MAC pair, applied with ip arp inspection filter <name> vlan 20, lets DAI validate it.
    • C. DHCP snooping trust only affects DHCP messages; it does not add a binding, and DAI still drops the printer's ARPs.
    • D. Port security controls source MACs on the port and has no effect on how DAI validates ARP packets.

  8. Question 8 of 10Concept

    Which two statements about Dynamic ARP Inspection are true? (Choose two.)

    1. It compares ARP packets with the DHCP snooping binding table.
    2. All access ports are trusted for DAI until configured otherwise.
    3. It drops invalid ARP packets received on untrusted interfaces.
    4. It blocks rogue DHCP servers connected to user access ports.
    5. It requires port security to be enabled on the inspected ports.
    Show the answer

    Answer: A and C

    DAI mitigates ARP spoofing by checking ARP on untrusted ports against the DHCP snooping binding table. All ports start untrusted; trust only links toward other switches or routers.

    • A. DAI uses the IP-to-MAC bindings that DHCP snooping builds (plus any ARP ACLs) to decide whether an ARP packet is legitimate.
    • B. The default is the opposite: every interface is untrusted for DAI, and you trust only uplinks and ports toward other switches.
    • C. On untrusted ports DAI intercepts ARP packets and drops those whose sender MAC/IP does not match a valid binding, which stops ARP spoofing.
    • D. Blocking rogue DHCP servers is the job of DHCP snooping; DAI only looks at ARP.
    • E. DAI and port security are independent features; DAI depends on DHCP snooping, not on port security.

  9. Question 9 of 10Exhibit

    Refer to the exhibit. Why did FastEthernet0/12 go into err-disabled state?

    SW2# show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
40
DHCP snooping is operational on following VLANs:
40
Insertion of option 82 is enabled
Interface                  Trusted    Allow option    Rate limit (pps)
-----------------------    -------    ------------    ----------------
GigabitEthernet0/1         yes        yes             unlimited
FastEthernet0/12           no         no              10

%PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Fa0/12, putting Fa0/12 in err-disable state
    1. Fa0/12 is untrusted, so the switch err-disables it when a DHCP OFFER arrives on it.
    2. Port security on Fa0/12 detected more source MAC addresses than its maximum allows.
    3. Dynamic ARP Inspection dropped too many invalid ARP packets received on Fa0/12.
    4. More than 10 DHCP packets per second arrived on Fa0/12, exceeding its rate limit.
    Show the answer

    Answer: D

    ip dhcp snooping limit rate on untrusted ports protects against DHCP starvation floods; exceeding it err-disables the port with cause dhcp-rate-limit. Read the err-disable cause in the log to tell which feature fired.

    • A. An OFFER on an untrusted port is simply dropped; the port is not err-disabled for that.
    • B. A port security violation would log a psecure-violation cause, not dhcp-rate-limit.
    • C. A DAI rate problem would show an arp-inspection cause; the log names dhcp-rate-limit.
    • D. Fa0/12 has a limit of 10 pps and the log shows the dhcp-rate-limit cause, so a DHCP flood such as a starvation attack exceeded it and the switch err-disabled the port.

  10. Question 10 of 10Config

    On a switch, VLAN 30 clients must get addresses only from the DHCP server reached through uplink Gi0/24. Which configuration meets the requirement?

    1. ip dhcp snooping vlan 30 / interface Gi0/24 / ip dhcp snooping trust
    2. ip dhcp snooping / ip dhcp snooping vlan 30 / interface Gi0/24 / ip arp inspection trust
    3. ip dhcp snooping / ip dhcp snooping vlan 30 / interface range Fa0/1 - 23 / ip dhcp snooping trust
    4. ip dhcp snooping / ip dhcp snooping vlan 30 / interface Gi0/24 / ip dhcp snooping trust
    Show the answer

    Answer: D

    DHCP snooping needs three pieces: the global ip dhcp snooping, ip dhcp snooping vlan <list>, and ip dhcp snooping trust on the port toward the real server. User ports stay untrusted by default.

    • A. Without the global ip dhcp snooping command the feature stays disabled, even though the VLAN and trust lines are configured.
    • B. This trusts Gi0/24 for DAI, not for DHCP snooping, so the server's OFFER and ACK messages on Gi0/24 are still dropped.
    • C. Trusting the user ports is backwards: it allows a rogue server there, and the real server's uplink stays untrusted.
    • D. Snooping is enabled globally and for VLAN 30, and only the uplink toward the legitimate server is trusted, so server messages from any other port are dropped.

Want more like these? The full CertAce bank has timed exams, a review pool for the questions you miss and readiness per exam domain.

Start free trial

3 days and 100 questions, no card needed.

Common mistakes

Questions people ask

What is the difference between the protect, restrict and shutdown violation modes?

All three drop frames from MAC addresses that exceed the allowed set. Protect only drops them silently. Restrict drops them, sends a syslog/SNMP message and increments the violation counter. Shutdown, the default, puts the whole port into err-disabled state, logs it and increments the counter.

How do I bring back a port that port security put into err-disabled?

Remove the cause, then enter shutdown followed by no shutdown on the interface. Alternatively, configure `errdisable recovery cause psecure-violation`; the switch then re-enables the port automatically after the recovery interval, 300 seconds by default.

Do I need DHCP snooping to use Dynamic ARP Inspection?

For DHCP clients, yes: DAI validates the sender MAC and IP of ARP packets against the DHCP snooping binding table. Hosts with static addresses are not in that table, so you permit them with an ARP ACL applied by `ip arp inspection filter`, or you trust the port they use.

More CCNA topics

Questions written by CertAce. CertAce is not affiliated with or endorsed by Cisco Systems. CCNA and Cisco are trademarks of Cisco Systems, Inc.