题库中的一道选择题的答案有疑问？

enter51

Question 8

What is valid reasonfor a switch to deny port access to new devices when port security is enabled?

A. The denied MACaddresses have already been learned or configured on another secure interfacein the same VLAN.

B. The denied MACaddress are statically configured on the port.

C. The minimum MACthreshold has been reached.

D. The absoluteaging times for the denied MAC addresses have expired.

这道题题库给出的答案是B。但在另外的网站给出的答案是A。个人觉得后者更合理。各位意见如何。

Answer: A

Explanation

A security violationoccurs in either of these situations:

* When the maximum number of secureMAC addresses is reached on a secure port and the source MAC address of theingress traffic is different from any of the identified secure MAC addresses,port security applies the configured violation mode.

* If traffic with asecure MAC address that is configuredor learned on one secure port attempts to access another secure port in the same VLAN,applies the configured violation mode.

From the secondstatement we can figure out A is the correct answer. But for your informationwe will discuss other answers as well.

AnswerB is not correct because we can’t configured which MAC address will be denied. We can only configurewhich MAC is allowed.

We can onlyconfigure the maximum MAC threshold, not the minimum threshold -> C is notcorrect.

The aging times areonly configured for allowed MAC addresses, not for denied MAC -> D iscorrect.

For your informationabout aging time:

When the aging typeis configured with the absolute keyword, all the dynamically learned secureaddresses age out when the aging time expires

This is how toconfigure the secure MAC address aging type on the port:

Router(config-if)# switchport port-security aging typeabsolute

and configure theaging time (aging time = 120 minutes)

Router(config-if)# switchport port-security aging time120

When this command isused, all the dynamically learned secure addresses age out when the aging timeexpires

(Reference:http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/port_sec.html)

盛京一号

对，按照下面的解释我觉得是对的，选A

hjswfjx

地对地导弹地对地导弹