The correct answer is to trust the uplink toward the legitimate DHCP server path. This works because DHCP snooping operates by dividing switch ports into trusted and untrusted categories; only trusted ports are allowed to forward DHCP server messages like DHCPOFFER and DHCPACK, while untrusted ports silently drop them. On the CCNA 200-301 v2 exam, this concept tests your understanding of how to secure access-layer ports against rogue DHCP servers without breaking legitimate DHCP operations. A common trap is confusing PortFast with DHCP snooping—PortFast only accelerates spanning-tree convergence and does nothing to filter DHCP traffic. Another trap is assuming that disabling ARP or marking all ports as trusted would help, but those either break connectivity or invite rogue servers. Remember the memory tip: trust the trunk, block the access—only the port facing the real DHCP server or relay should be trusted, while every user-facing port stays untrusted.
CCNA Network Services and Security Practice Question
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: dHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which two actions help protect access-layer switch ports from rogue DHCP servers?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DHCP snooping globally and for the needed VLANs
DHCP snooping marks trusted and untrusted interfaces and filters server-type DHCP messages on untrusted ports. Uplink ports toward the real DHCP server or relay are typically trusted, while user-facing ports stay untrusted. Option C is incorrect because PortFast does not filter DHCP messages; it only speeds up spanning tree convergence. Option D is incorrect because disabling ARP breaks normal communication and does not block DHCP. Option E is incorrect because marking all access ports as trusted would permit rogue DHCP servers on those ports.
Key principle: DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Enable DHCP snooping globally and for the needed VLANs
Why this is correct
That turns on the feature and applies it to selected VLANs.
Related concept
DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.
✓
Trust the uplink toward the legitimate DHCP server path
Why this is correct
The real DHCP responses must be allowed on trusted interfaces.
Related concept
DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.
✗
Enable PortFast on all trunks to block rogue servers
Why it's wrong here
PortFast is not the control for rogue DHCP service.
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable DHCP snooping globally and for the needed VLANsCorrect answer▾
Why this is correct
That turns on the feature and applies it to selected VLANs.
✗Enable PortFast on all trunks to block rogue serversWrong answer — click to see why▾
Why this is wrong here
PortFast is used to speed up the transition of a port to forwarding state in spanning tree, typically for end-user devices. It does not filter DHCP messages or prevent rogue DHCP servers; DHCP snooping is the correct mechanism.
Why candidates choose this
Students may confuse PortFast with security features because it is often enabled on access ports, but it has no role in DHCP protection.
✗Disable ARP on access portsWrong answer — click to see why▾
Why this is wrong here
ARP is essential for IP communication and disabling it would break network connectivity. DHCP snooping does not involve ARP; it operates at the DHCP protocol level to validate messages.
Why candidates choose this
Some might think ARP spoofing is related to DHCP attacks, but disabling ARP is not a viable solution and is unrelated to rogue DHCP server prevention.
✗Set every access port as trustedWrong answer — click to see why▾
Why this is wrong here
Setting every access port as trusted would allow any device connected to those ports to act as a DHCP server, defeating the purpose of DHCP snooping. Only ports connected to legitimate DHCP servers should be trusted.
Why candidates choose this
A student might think trusting all ports simplifies configuration, but it completely undermines security by allowing rogue DHCP servers on any access port.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
DHCP snooping is a Layer 2 security feature implemented on Cisco switches to protect the network from rogue DHCP servers that can assign incorrect IP addresses to clients. It works by classifying switch ports as trusted or untrusted. Trusted ports are uplinks toward legitimate DHCP servers or DHCP relay agents, while untrusted ports are typically user-facing access ports. DHCP messages from untrusted ports that claim to be from a DHCP server are blocked, preventing unauthorized DHCP servers from distributing IP addresses.
When DHCP snooping is enabled globally and on specific VLANs, the switch inspects DHCP traffic only on those VLANs, filtering DHCP server messages on untrusted ports. This selective application ensures that only authorized DHCP servers can respond to client requests. The trusted uplink ports allow legitimate DHCP server responses to pass through, maintaining proper IP address assignment. This setup also enables the switch to build a DHCP snooping binding table, which maps MAC addresses, IP addresses, VLANs, and lease times, helping prevent IP spoofing and other attacks.
A common exam trap is to mistakenly trust all access ports or enable unrelated features like PortFast to block rogue DHCP servers. Trusting all access ports disables DHCP snooping’s filtering, allowing rogue DHCP servers to operate freely. PortFast only affects Spanning Tree Protocol port states and does not filter DHCP messages. Disabling ARP is unrelated and would disrupt normal network communication. Understanding the correct use of DHCP snooping and trusted ports is critical for securing access-layer switch ports against rogue DHCP servers in Cisco networks.
KKey Concepts to Remember
DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.
Enabling DHCP snooping globally and on specific VLANs activates the filtering mechanism only where needed, protecting those VLANs from unauthorized DHCP servers.
Trusted ports are typically uplinks toward legitimate DHCP servers or DHCP relay agents, allowing DHCP server messages to pass through without restriction.
Untrusted ports are user-facing access-layer switch ports where DHCP server messages are blocked to prevent rogue DHCP server attacks.
DHCP snooping builds and maintains a binding table that tracks legitimate DHCP clients and their assigned IP addresses to prevent IP address spoofing.
Incorrectly trusting all access ports defeats DHCP snooping’s purpose by allowing rogue DHCP servers to operate on user-facing ports.
PortFast does not affect DHCP snooping or DHCP server filtering; it is designed to speed up port transition to forwarding state and is unrelated to DHCP security.
Disabling ARP on access ports is not a valid method to prevent rogue DHCP servers because ARP is essential for normal IP communication and unrelated to DHCP snooping.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this 200-301 question in full detail.
Review dHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — This question tests Network Services and Security — DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted..
What is the correct answer to this question?
The correct answer is: Enable DHCP snooping globally and for the needed VLANs — DHCP snooping marks trusted and untrusted interfaces and filters server-type DHCP messages on untrusted ports. Uplink ports toward the real DHCP server or relay are typically trusted, while user-facing ports stay untrusted. Option C is incorrect because PortFast does not filter DHCP messages; it only speeds up spanning tree convergence. Option D is incorrect because disabling ARP breaks normal communication and does not block DHCP. Option E is incorrect because marking all access ports as trusted would permit rogue DHCP servers on those ports.
What should I do if I get this 200-301 question wrong?
Review dHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted., then practise related 200-301 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
DHCP snooping is a security feature that filters DHCP messages and prevents rogue DHCP servers by classifying switch ports as trusted or untrusted.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.