CCNA Network Services and Security Practice Question
Which TWO actions does DHCP snooping perform by default on a Cisco switch?
⚠ Common exam trap
Cisco often tests the distinction between DHCP snooping's default actions (filtering on untrusted ports and building the binding table) and optional features like DHCP relay or broadcast-to-unicast conversion, which are not part of DHCP snooping itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It blocks DHCP server messages received on untrusted ports.
DHCP snooping is a security feature that, by default, filters DHCP server messages (such as DHCPOFFER, DHCPACK, and DHCPNAK) received on untrusted ports. This prevents rogue DHCP servers from offering malicious IP configurations to clients. The switch also automatically builds and maintains a DHCP snooping binding table, which maps client MAC addresses to leased IP addresses, VLANs, and port information, to validate DHCP traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It blocks DHCP server messages received on untrusted ports.
Why this is correct
DHCP snooping marks each switch port as either trusted or untrusted. Ports connected to legitimate DHCP servers are configured as trusted, while all other ports are untrusted. When a DHCP server message such as DHCPOFFER, DHCPACK, or DHCPNAK arrives on an untrusted port, the switch drops it, preventing a rogue device from issuing fraudulent IP configuration to clients. This enforcement is the core security function of DHCP snooping.
- ✗
It generates a Cisco Discovery Protocol packet for each DHCP request.
Why it's wrong here
DHCP snooping is a Layer 2 security feature that inspects DHCP traffic; it has no interaction with Cisco Discovery Protocol (CDP). CDP is a separate Cisco-proprietary protocol used to advertise device identity and capabilities to directly connected neighbors over Layer 2. DHCP snooping does not generate or consume CDP packets, and it never sends a CDP frame in response to a DHCP request. This option incorrectly conflates two unrelated protocols.
- ✓
It builds a DHCP binding table.
Why this is correct
As clients complete a DHCP lease transaction, DHCP snooping inspects the DHCPACK from the server and records the client's MAC address, assigned IP address, VLAN, port, and lease time in a binding table (also called the DHCP snooping database). This table is the authoritative record that the switch uses to validate subsequent IP traffic or to interface with IP Source Guard and Dynamic ARP Inspection. The binding table is essential for preventing IP spoofing and ARP attacks on the network.
- ✗
It relays DHCP requests across VLANs.
Why it's wrong here
Forwarding DHCP requests from one VLAN to another is the function of DHCP relay, which is configured with commands like 'ip helper-address' on an interface. DHCP relay operates at Layer 3, typically on a router or multilayer switch, to forward broadcast DHCP messages to a server on a different subnet. DHCP snooping is a Layer 2 switching feature that inspects and filters DHCP messages within a VLAN; it does not route or relay packets across VLAN boundaries.
- ✗
It converts DHCP broadcasts into unicasts.
Why it's wrong here
A DHCP relay agent (again, often configured via 'ip helper-address') is responsible for converting a client's broadcast DHCPDISCOVER or DHCPREQUEST into a unicast packet directed at a specific DHCP server. This IP/UDP relay behavior allows a client to reach a server that is not on its subnet. DHCP snooping, by contrast, passively inspects DHCP frames at the access layer and never alters the Layer 2 or Layer 3 addressing of the message; it simply drops or forwards the frame based on port trust and binding rules.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It blocks DHCP server messages received on untrusted ports.Correct answer▾
Why this is correct
DHCP snooping marks each switch port as either trusted or untrusted. Ports connected to legitimate DHCP servers are configured as trusted, while all other ports are untrusted. When a DHCP server message such as DHCPOFFER, DHCPACK, or DHCPNAK arrives on an untrusted port, the switch drops it, preventing a rogue device from issuing fraudulent IP configuration to clients. This enforcement is the core security function of DHCP snooping.
✗It generates a Cisco Discovery Protocol packet for each DHCP request.Wrong answer — click to see why▾
Why this is wrong here
This statement incorrectly associates two separate features; DHCP snooping operates at Layer 2 for DHCP security, not for CDP.
✗It relays DHCP requests across VLANs.Wrong answer — click to see why▾
Why this is wrong here
This function belongs to the relay agent, not to DHCP snooping, which operates within a single VLAN to enforce security policies.
✗It converts DHCP broadcasts into unicasts.Wrong answer — click to see why▾
Why this is wrong here
This is a relay agent feature; DHCP snooping does not alter the broadcast nature of DHCP packets, it only filters them.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
DHCP server
A DHCP server is a network device or service that automatically assigns IP addresses and other network configuration parameters to devices on a network, eliminating the need for manual configuration.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.