H12-891_V1-0 practice question 11 of 35

When you troubleshoot a local area network with Huawei equipment deployed, you find that there are a large number of unicast frames with unknown source AC addresses in the local area network . A large number of unknown source MAC addresses single-plug frames can cause the switch the biggest danger is ?

Full set: 607 questions
Answer options
A: Memory that occupies the cache ton
B: Increases the power consumption of the power supply
C: Consumes a TCAM table entry
D: Consume the available bandwidth
E: Consume the MAC address table entry available in the system Correct answer
Correct Answer:
E. Consume the MAC address table entry available in the system
Explanation

A large number of unicast frames with unknown source MAC addresses is characteristic of a MAC flooding attack. The switch learns each new source MAC address and adds it to its MAC address table. When an attacker sends a high volume of frames with varying, spoofed source MACs, the switch's MAC address table quickly fills up. Once the table is full, the switch can no longer learn new addresses and begins to flood all subsequent frames with unknown destination MACs out of all ports, effectively behaving like a hub. This exhaustion of the MAC address table is the primary and most significant danger.

Why Incorrect

A. While the MAC table consumes memory, option E is more specific about the logical resource being exhausted, which is the direct cause of the switch's behavioral change.
B. Increased flooding and CPU processing may slightly increase power consumption, but this is a secondary effect, not the primary danger.
C. MAC tables are often implemented in TCAM, but "MAC address table entry" is the specific logical resource being attacked, making it a more precise answer.
D. Bandwidth is consumed by the resulting frame flooding, but this is a symptom of the core problem, which is the MAC table exhaustion.

References

1. Huawei. (2019). Campus Switch Security Technology White Paper. Section 2.1.1 "MAC Address Attacks". This document explains: "An attacker sends a large number of data frames with different source MAC addresses to the switch. The switch adds these MAC addresses to its MAC address table. As a result, the MAC address table is exhausted."

2. Huawei. (2022). HedEx S1720, S2700, S5700, and S6700 V200R022C00 Configuration Guide - Security. Section "MAC Address Table Security". This guide details how MAC flooding attacks exhaust MAC address table entries, leading to traffic flooding.

Scroll to Top