Campus switches terminate city APs. Which port-hardening pair best protects those AP attachment points?
Select an answer to reveal the explanation.
Short Explanation
AP switchports deserve sticky MACs and BPDU guard so random bridges cannot play switch. Flooding every VLAN or silencing logs softens the port. Unlimited MAC moves invite swaps.
Full Explanation
Campus switches that terminate city APs should harden those attachment points with MAC sticky learning on AP ports and BPDU guard. Sticky MAC learning helps detect when the trusted AP MAC is replaced by another device, while BPDU guard protects against someone introducing a switch or bridge that participates in spanning tree on the AP drop. Together they express least-privilege physical attachment hygiene for municipal WLAN edge ports. Disabling all logging on AP switchports to reduce noise removes evidence needed when a swap or loop event occurs. Trunking every possible VLAN including unused lab nets to each AP drop expands blast radius if the port is abused. Allowing unlimited MAC moves and enabling spanning-tree forwarding from any phone invites soft-AP and rogue-bridge attacks on the wired edge. Exam caveat: sticky MAC and port-security violation actions must be rehearsed—shutdown versus restrict modes change both security outcome and overnight outage risk for genuine AP replacements. Operational check: on a lab AP port, record the AP MAC with sticky learning, connect a different MAC, confirm the configured violation action fires, and verify BPDU guard err-disables the port when test BPDUs are injected.