CCNA Network Services and Security Practice Question
A switch is configured with DHCP snooping and Dynamic ARP Inspection. Hosts suddenly lose connectivity after changing IP settings manually. Which explanation is strongest?
⚠ Common exam trap
Be cautious not to confuse DHCP snooping's role with DHCP server functionality or ARP cache operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.
DAI uses DHCP snooping binding to validate ARP messages; a manual IP change creates a mismatch, causing DAI to block ARP. Option B is incorrect because STP prevents loops and does not block based on MAC address changes. Option C is incorrect because OSPF authentication is a routing protocol feature irrelevant on an access port. Option D is incorrect because PPP authentication applies to serial links, not Ethernet ARP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.
Why this is correct
Dynamic ARP Inspection (DAI) intercepts ARP packets arriving on untrusted switch ports and validates them against the DHCP snooping binding table. When the administrator manually changed the IP address on the host, that new address is absent from the binding table, so DAI considers the ARP packet invalid and drops it. The switch also verifies that the sender MAC matches the bound MAC, further reinforcing the rejection.
- ✗
STP is blocking the host because its MAC address changed.
Why it's wrong here
Spanning Tree Protocol (STP) is concerned with loop prevention in a switched network, not with host IP or MAC address changes. A host changing its IP address does not alter the switch's STP state; the port remains in a forwarding state unless a topology change occurs. Even if the host's MAC changed, STP would still not block the port based on that event; it would simply update the MAC address table. Therefore, STP blocking is not the cause of the host losing ARP connectivity.
When this WOULD be correct
In a different scenario where a switch is configured with STP and a host changes its MAC address due to a hardware failure or network interface card (NIC) replacement, the question could state that STP is blocking the port due to a violation of MAC address consistency. This would make option B the correct answer.
- ✗
OSPF authentication failed on the access port.
Why it's wrong here
OSPF authentication is a Layer 3 routing protocol feature used between routers to authenticate routing updates, not to filter ARP traffic on an access port. ARP is a Layer 2 protocol, and OSPF operates at Layer 3 with its own packet types; an OSPF authentication failure would cause OSPF neighbor adjacency issues, not ARP packet drops. Since the host is performing ARP, not exchanging OSPF packets, OSPF authentication cannot be the reason for the ARP rejection.
When this WOULD be correct
If the question were about a scenario where OSPF is configured on the switch and the access port requires OSPF authentication, a failure in the authentication process could prevent OSPF routes from being exchanged, leading to connectivity issues. In this case, the question would need to focus on OSPF settings and their impact on host connectivity.
- ✗
The switch requires PPP authentication before allowing ARP traffic.
Why it's wrong here
PPP (Point-to-Point Protocol) authentication, such as PAP or CHAP, is used on serial links, DSL connections, or PPPoE, not on Ethernet access ports in a switched LAN. DAI is a Layer 2 security feature that acts on ARP packets, and it does not involve PPP or require PPP authentication. The switch enforces DAI based on DHCP snooping bindings, not on PPP session establishment, so this explanation is unrelated to the ARP failure.
When this WOULD be correct
In a different scenario where a switch is configured to require PPP authentication for all traffic on access ports, a question might ask why ARP packets are being blocked. In that case, if a host attempts to send ARP traffic without completing PPP authentication, this option would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.Correct answer▾
Why this is correct
Dynamic ARP Inspection (DAI) intercepts ARP packets arriving on untrusted switch ports and validates them against the DHCP snooping binding table. When the administrator manually changed the IP address on the host, that new address is absent from the binding table, so DAI considers the ARP packet invalid and drops it. The switch also verifies that the sender MAC matches the bound MAC, further reinforcing the rejection.
✗STP is blocking the host because its MAC address changed.Wrong answer — click to see why▾
Why this is wrong here
STP (Spanning Tree Protocol) prevents loops in redundant topologies and does not block hosts based on IP or MAC address changes. It operates at Layer 2 and is unrelated to IP address configuration.
★ When this WOULD be the correct answer
In a different scenario where a switch is configured with STP and a host changes its MAC address due to a hardware failure or network interface card (NIC) replacement, the question could state that STP is blocking the port due to a violation of MAC address consistency. This would make option B the correct answer.
Why candidates choose this
Students may confuse STP's MAC address learning with IP address changes, thinking that a new IP triggers a topology change or port blocking, but STP only reacts to topology changes, not host IP modifications.
✗OSPF authentication failed on the access port.Wrong answer — click to see why▾
Why this is wrong here
OSPF is a Layer 3 routing protocol used between routers, not on access ports connecting hosts. OSPF authentication is configured on router interfaces and does not apply to host ARP traffic on a switch.
★ When this WOULD be the correct answer
If the question were about a scenario where OSPF is configured on the switch and the access port requires OSPF authentication, a failure in the authentication process could prevent OSPF routes from being exchanged, leading to connectivity issues. In this case, the question would need to focus on OSPF settings and their impact on host connectivity.
Why candidates choose this
Test-takers might associate authentication with security features and incorrectly assume OSPF authentication could be involved, but OSPF is not used for host connectivity validation.
✗The switch requires PPP authentication before allowing ARP traffic.Wrong answer — click to see why▾
Why this is wrong here
PPP (Point-to-Point Protocol) authentication is used on serial links or PPPoE connections, not on Ethernet switch ports. It is unrelated to ARP inspection or DHCP snooping in a switched network.
★ When this WOULD be the correct answer
In a different scenario where a switch is configured to require PPP authentication for all traffic on access ports, a question might ask why ARP packets are being blocked. In that case, if a host attempts to send ARP traffic without completing PPP authentication, this option would be correct.
Why candidates choose this
The term 'authentication' may lead students to think of any security mechanism, but PPP authentication is specific to WAN links and not applicable to LAN switching security features.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
OSPF authentication
OSPF authentication is a security mechanism that verifies the identity of routers exchanging routing information within an OSPF network, preventing unauthorized or malicious routing updates.
Key term
Dynamic ARP Inspection
Dynamic ARP Inspection is a security feature that validates ARP packets on a network to prevent man-in-the-middle attacks by ensuring that only legitimate ARP messages are forwarded.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.