A university opens library study halls where students plug personal switches into wall jacks. The network team reports rogue STP elections, MAC flooding alarms, and a need to block lateral worm traffic between infected laptops in the same VLAN without changing the IP gateway. Which Layer 2 security design best addresses rogue STP and intra-VLAN threats?
Select an answer to reveal the explanation.
Short Explanation
Dorm-room switches and curious laptops demand bouncers at every door. BPDU guard shuts rogue uplinks, port security caps MAC chaos, and VACLs filter traffic inside the same VLAN. You've covered elections, flooding, and lateral spread.
Full Explanation
BPDU guard err-disables PortFast access ports upon receiving BPDUs, which directly stops rogue switches from joining STP, port security limits MAC counts to mitigate flooding and MAC spoofing, and VACLs filter traffic within a VLAN regardless of routing, satisfying the intra-VLAN containment requirement that router ACLs cannot meet. Root guard on access ports with snooping fails by concept because root guard is for enforcing root placement on designated uplinks, not for disabling rogue access devices, and edge isolation was not requested. Loop guard with dynamic ARP inspection fails by concept because loop guard protects against unidirectional failures on point-to-point links, not rogue BPDUs on access ports, and inter-VLAN ACLs do not filter same-VLAN traffic. UDLD with source guard fails by concept because UDLD detects fiber unidirectional links rather than access STP attacks, and router subinterface ACLs only affect routed traffic. Exam caveat: distinguish BPDU guard for access versus root guard for core placement. Practical check: test with BPDU injection and verify VACL hits for intra-VLAN denies.