Refer to the exhibit. An engineer must strictly enforce the port security configuration database in the Fibre Channel fabric. A new device has been connected to the Fibre Channel storage interface…

Question

Exhibits

Options

• ACommit the active database with the port-security database copy vsan 1 command
• BDisable auto learn in VSAN 1 with the no port-security auto-learn vsan 1 command
• CDisable CFS distribution with the no port-security distribute vsan 1 command
• DCommit the changes with the port-security commit copy vsan 1 command

• A
  7% (2)
• B
  77% (23)
• C
  13% (4)
• D
  3% (1)

Explanation

Auto-learn is the root cause of the problem. When auto-learn is enabled on a VSAN, the switch automatically adds any newly connecting device's WWN to the active port security database - effectively defeating strict enforcement by letting rogue devices log in and get whitelisted on the fly. Disabling it with no port-security auto-learn vsan 1 freezes the active database so only pre-configured devices are permitted to log in.

Why the distractors are wrong:

• A - port-security database copy copies the active database elsewhere but doesn't stop auto-learn from continuing to populate that active database with rogue entries.
• C - Disabling CFS distribution prevents the config from propagating across switches but does nothing to stop auto-learn from permitting new logins on the local switch.
• D - port-security commit is not a valid Cisco NX-OS command in this context; the correct commit syntax differs, and committing wouldn't address the auto-learn behavior regardless.

Memory tip: Think of auto-learn as a "guest list that writes itself" - port security is meaningless if the door automatically adds every stranger who knocks. You must disable auto-learn to lock the list before you enforce it.

No community discussion yet for this question.