CCNA Network Services and Security Practice Question
Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)
⚠ Common exam trap
Cisco often tests the exact terminology of DHCP snooping trust states, and the trap here is that candidates confuse 'trusted' and 'untrusted' with other security terms like 'secure' or 'authorized' from different features (e.g., port security or 802.1X).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trusted
DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Trusted
Why this is correct
A trusted port is configured using 'ip dhcp snooping trust' and is allowed to forward all DHCP messages, including server responses. This is typically applied to ports connecting to DHCP servers or upstream relay agents.
- ✓
Untrusted
Why this is correct
Untrusted is the default trust state for all ports. These ports are only allowed to forward DHCP client messages (e.g., DISCOVER, REQUEST) and will drop any DHCP server messages (e.g., OFFER, ACK) received on them. This prevents rogue DHCP servers from offering IP addresses.
- ✗
Secure
Why it's wrong here
The term 'Secure' is not a valid trust state in DHCP snooping. DHCP snooping defines exactly two port trust states: trusted and untrusted, which govern whether DHCP server-originated messages such as OFFER and ACK are permitted on the port. While an administrator might colloquially call a hardened port 'secure,' the switch configuration does not recognize a 'secure' state—the default is always untrusted, and only the 'ip dhcp snooping trust' command changes a port to trusted. Using 'secure' as a classification would be meaningless operationally.
- ✗
Authorized
Why it's wrong here
Authorization is a concept from 802.1X port-based authentication, not from DHCP snooping. 802.1X uses an authorized state to allow or deny network access based on user or device credentials, whereas DHCP snooping simply classifies ports as trusted or untrusted to filter DHCP messages. A DHCP snooping port is never marked 'authorized'; the feature does not make identity-based decisions and has no mechanism to 'authorize' a port. The only way a port can receive DHCP server messages is by being explicitly configured as trusted.
- ✗
Relay
Why it's wrong here
A 'relay' state does not exist in DHCP snooping; DHCP relay is a separate Layer 3 function implemented with the 'ip helper-address' command on router interfaces or VLAN interfaces. Relay agents forward DHCP broadcast messages to a server on a different subnet, while DHCP snooping trust states are Layer 2 port properties that determine whether DHCP server responses can be received. Although a trusted port is often used to connect to a DHCP server or an upstream relay agent, the trust state itself is not called 'relay.' The snooping feature does inspect the giaddr field set by relay agents, but that does not make 'relay' a port trust state.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓TrustedCorrect answer▾
Why this is correct
A trusted port is configured using 'ip dhcp snooping trust' and is allowed to forward all DHCP messages, including server responses. This is typically applied to ports connecting to DHCP servers or upstream relay agents.
✗SecureWrong answer — click to see why▾
Why this is wrong here
This is a distractor term that does not exist in the DHCP snooping configuration. The correct states are trusted and untrusted.
✗AuthorizedWrong answer — click to see why▾
Why this is wrong here
This term is borrowed from other security contexts and is not applicable to DHCP snooping trust states.
✗RelayWrong answer — click to see why▾
Why this is wrong here
This confuses the DHCP relay agent feature with DHCP snooping trust states. They are different mechanisms.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.