CCNA Network Services and Security Practice Question
After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the dependency of DAI on DHCP snooping, and the trap here is that candidates assume DAI validates based on the actual IP/MAC correctness rather than requiring a binding table entry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.
Dynamic ARP Inspection (DAI) relies on the DHCP snooping binding table to validate ARP packets. When a host uses a static IP address, it does not have an entry in that table, so DAI treats its ARP packets as invalid and drops them. This prevents the static host from resolving the default gateway's MAC address, breaking connectivity even though the IP and MAC are correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.
Why it's wrong here
The DHCP snooping binding table is populated exclusively from DHCPACK messages observed on trusted ports, so only hosts that complete a DHCP lease are recorded as bindings. Static hosts have manually configured IP addresses and never transmit DHCP requests, meaning they never generate the DHCPACK traffic that would create an entry and they also never consume an entry. Even if the switch's binding table were completely full, it would have no bearing on static hosts because they are simply absent from the table; DAI drops their ARP packets due to the missing lookup entry, not because the table has run out of capacity.
- ✗
IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.
Why it's wrong here
IP Source Guard relies on the DHCP snooping binding table to filter IP traffic, but the symptom is ARP resolution failure after DAI was enabled. While IP Source Guard could block traffic if enabled, it is not mentioned and DAI alone explains the observed drop of ARP packets.
- ✓
DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.
Why this is correct
When DAI is enabled, it checks every ARP packet on untrusted ports against the DHCP snooping binding table. Since the static hosts have no DHCP lease, no binding exists, and DAI drops their ARP packets, preventing them from learning the gateway MAC address and causing loss of connectivity.
- ✗
The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.
Why it's wrong here
By default, DAI does not shut down interfaces; it simply drops invalid ARP packets. While ARP rate-limiting can cause a port to be err-disabled, that is not the default behavior, and the scenario does not mention interface status changes, only connectivity loss.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.Correct answer▾
Why this is correct
When DAI is enabled, it checks every ARP packet on untrusted ports against the DHCP snooping binding table. Since the static hosts have no DHCP lease, no binding exists, and DAI drops their ARP packets, preventing them from learning the gateway MAC address and causing loss of connectivity.
✗The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.Wrong answer — click to see why▾
Why this is wrong here
Candidates may think that a large number of untrusted hosts could overwhelm the binding table, but static hosts do not interact with DHCP and would not fill the table or be rejected.
✗IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.Wrong answer — click to see why▾
Why this is wrong here
Candidates often confuse DAI and IP Source Guard since both use DHCP snooping; however, DAI specifically validates ARP packets, which matches the symptom of connectivity loss due to ARP resolution failure.
✗The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.Wrong answer — click to see why▾
Why this is wrong here
Some candidates might associate ARP security features with port shutdown, but standard DAI operation does not disable ports, and the symptom does not indicate interface down events.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
Key term
Media Access Control
Media Access Control (MAC) is a sublayer of the Data Link Layer in networking that controls how devices on the same network share access to the physical medium and uniquely identifies each device with a hardware address.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.