Cisco CCNA (200-301)Security FundamentalsHard
A network administrator wants a switch to automatically learn MAC addresses on each access port via port security and retain them across a reload without manual re-entry. Which configuration accomplishes this?
- Aswitchport port-security violation protect
- Bswitchport port-security mac-address sticky, combined with saving the running-config
- Cswitchport port-security mac-address dynamic
- Dswitchport port-security maximum 1
Show answer & explanationAnswer & explanation
Correct answer: B. switchport port-security mac-address sticky, combined with saving the running-config
'switchport port-security mac-address sticky' causes dynamically learned MAC addresses to be converted into 'sticky secure' addresses added to the running-config; saving the config with 'copy running-config startup-config' ensures they persist across a reload.
Why the other options are wrong
- A. Violation mode controls the response to violations, not how addresses are learned or saved.
- C. There is no 'dynamic' keyword for mac-address in port security; dynamic learning happens by default without sticky.
- D. Setting the maximum only limits the count of addresses, it does not enable persistent learning.
Port Security Sticky MAC
The 'sticky' keyword causes dynamically learned MAC addresses to be added to the running configuration as secure addresses, which persist if the config is saved.
- Without sticky, dynamically learned addresses are lost on reload
- Sticky addresses appear in running-config once learned
- Must save config (copy run start) for persistence across reboots
Memory trick: Sticky Notes Stay Stuck After Saving