Quick Answer

The four correct statements are true because DHCP snooping operation on a Cisco switch is fundamentally a security mechanism that enforces trust boundaries. It works by classifying each switch port as either trusted or untrusted, with all ports defaulting to untrusted, meaning they cannot originate DHCP server messages like OFFER, ACK, or NAK. The switch builds and maintains a DHCP snooping binding database—a MAC-to-IP mapping table—by inspecting only DHCP ACK messages received on trusted ports, which prevents IP spoofing attacks. Rate-limiting DHCP traffic on untrusted ports further mitigates DHCP starvation attacks. On the CCNA 200-301 v2 exam, this topic tests your understanding of how DHCP snooping operates as a Layer 2 security feature, often appearing in multiple-choice questions that ask you to identify correct statements about its behavior. A common trap is assuming the switch itself must be a DHCP server, but DHCP snooping only relies on a legitimate server reachable through a trusted port. Memory tip: think “Trust the ACK, rate-limit the rest” to recall that only ACK messages build the binding table and untrusted ports are rate-limited.