ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Port security lets an administrator specify how many and which source MAC addresses are accepted on a switch interface. When the configured limit is exceeded or an unexpected MAC address appears, the switch can automatically shut the port, effectively blocking the unauthorized device. Because each access port hosts a single known scanner, setting the maximum to one learned or statically assigned MAC address meets the policy with almost no day-to-day maintenance. Dynamic ARP Inspection validates ARP traffic but does not stop a device from sending other Layer 2 frames. An outbound IPv4 ACL would have to be maintained for every possible scanner IP and can be bypassed by spoofing a permitted address. BPDU Guard protects against rogue switches sending STP BPDUs; it does not restrict end-station access. Therefore, enabling port security with a single allowed MAC address per port is the most effective and low-maintenance solution.