A switch is set up to allow only 2 simultaneous MAC addresses per switch port. An administrator is
reviewing a log and determines that a switch ort has been deactivated in a conference room after it
detected 3 or more MAC addresses on the same port. Which of the following reasons could have caused
this port to be disabled?
A.
A pc had a NIC replaced and reconnected to the switch
B.
An ip telephone has been plugged in
C.
A rouge access point was plugged in
D.
An arp attack was launched from a pc on this port
Couple of odd parts to this question. In the end, I would probably go with the idea that the connected PC flooded the switch with MAC addresses; thus disabling the port. Where I have a hard time is why you would allow 2 simultaneous MACs on one port. If you use an access point in bridge mode, you could allow a number of other devices into the network.
Stick with the arp attack….
I think both C and D are correct answers.