Question 50
An access network requires prevention of forged source-IP traffic from endpoints with stolen static addresses. Which immediate engineering change most directly addresses this issue?
Explanation
Correct Answer
The underlying issue is that mAC-to-IP-to-port ownership is not enforced by ordinary VLAN isolation. This intervention addresses that cause directly. A useful result to confirm is: packets with valid bindings pass and forged source IPs from user ports are blocked.
Incorrect Answers
This is suited to a different condition, such as when a VSX downstream switch has an active multi-chassis LAG, but the primary and secondary peers disagree on the permitted client VLANs. The reported fault instead arises because mAC-to-IP-to-port ownership is not enforced by ordinary VLAN isolation.
This is suited to a different condition, such as when an edge port has port-security configured for one device and a desk phone with a downstream PC is unexpectedly blocked. The reported fault instead arises because mAC-to-IP-to-port ownership is not enforced by ordinary VLAN isolation.
This is suited to a different condition, such as when a service requires large Ethernet payloads, but a path across several CX switches drops only oversized frames. The reported fault instead arises because mAC-to-IP-to-port ownership is not enforced by ordinary VLAN isolation.