A financial trading floor adds unmanaged conference-room switches and public-facing kiosks, with risks of rogue STP roots, accidental loops, MAC flooding, and VLAN hopping. Strict uptime and auditability are required. Which Layer 2 security mix best hardens the access edge?
Select an answer to reveal the explanation.
Short Explanation
Your edge is where friendly mistakes become outages, so each control needs the right seat. BPDU guard shuts rogue hosts while root guard pins the root upstairs. Layered together they form a tight guardrail around VLANs.
Full Explanation
The correct mix addresses all four edge risks while preserving uptime and auditability because BPDU guard err-disables host ports the moment a kiosk or unmanaged conference switch sends BPDUs, containing accidental loops without core reconvergence, while root guard on distribution ports facing access switches enforces intended root placement by blocking superior BPDUs from unexpected sources, port security with sticky MACs caps addresses per port to defeat flooding and CAM exhaustion and creates a persistent auditable MAC-to-port binding for compliance, and VACLs filter bridged traffic inside a VLAN to limit lateral movement. VLAN hopping itself is closed by disabling DTP, using static access ports and an unused native VLAN, which this mix assumes. The variant with DHCP snooping and Dynamic ARP Inspection is widely deployed against spoofing and rogue DHCP but fails because it validates bindings rather than limiting learned addresses, leaving CAM exhaustion possible and losing sticky addresses for forensics. The variant with loop guard instead of root guard is common for unidirectional failures but fails because it only guards inconsistent port states, not rogue root election, so an unmanaged switch can still hijack topology and cause outage. The variant with router ACLs is standard for north-south policy but fails because routed ACLs only inspect Layer 3 forwarded traffic, leaving Layer 2 bridged intra-VLAN hopping unfiltered where VACLs are required. For exams remember mechanism and placement: BPDU guard shuts down edge ports, root guard preserves root placement on designated ports facing downstream switches, filter disables STP, and loop guard never blocks superior roots. Verify operationally with show spanning-tree inconsistentports, show port-security address sticky, show vlan access-map with counters, and centralized err-disable and MAC syslog before sign-off.