Quick Answer
The answer is that DHCP snooping prevents rogue DHCP servers from disrupting network operations by blocking unauthorized DHCP server responses from user-facing ports. This is achieved by designating switch interfaces as either trusted or untrusted; only ports connected to known, legitimate DHCP servers are marked as trusted, while all other ports are untrusted by default. When a DHCP offer or acknowledgment message arrives on an untrusted port, DHCP snooping silently drops it, ensuring that only the authorized server can assign IP addresses. On the CCNA 200-301 v2 exam, this topic tests your understanding of Layer 2 security features, often appearing in scenario-based questions where you must identify which switchport should be trusted. A common trap is forgetting that the uplink port to the DHCP server must be explicitly configured as trusted, or assuming that all ports are trusted by default. Remember the mnemonic: “Trust the trunk, block the rest”—only the port facing the legitimate DHCP server should ever be trusted.
This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: dHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
What problem does DHCP snooping help prevent?
Unauthorized DHCP server responses from user-facing ports
Correct. This is the main value of DHCP snooping.
Layer 3 route loops
Why wrong: Route loops are not solved by DHCP snooping.
Trunk encapsulation mismatch
Why wrong: Trunk negotiation issues are unrelated.
Weak SSH ciphers
Why wrong: SSH ciphers are not part of DHCP snooping.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Unauthorized DHCP server responses from user-facing ports
DHCP snooping marks interfaces as trusted or untrusted and blocks rogue DHCP server messages arriving on untrusted ports.
Key principle: DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Unauthorized DHCP server responses from user-facing ports
Why this is correct
Correct. This is the main value of DHCP snooping.
Related concept
DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.
Layer 3 route loops
Why it's wrong here
Route loops are not solved by DHCP snooping.
When this WOULD be correct
In a question focused on Layer 3 network stability, such as 'What mechanisms can prevent routing loops in a Layer 3 network?' option B would be correct, as it directly addresses the issue of routing loops that can occur in IP networks.
Trunk encapsulation mismatch
Why it's wrong here
Trunk negotiation issues are unrelated.
Weak SSH ciphers
Why it's wrong here
SSH ciphers are not part of DHCP snooping.
When this WOULD be correct
If the question were about securing SSH connections, specifically asking what measures can be taken to prevent weak encryption algorithms from being used, then 'Weak SSH ciphers' could be a correct answer. This would involve scenarios discussing SSH configuration and security best practices.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct. This is the main value of DHCP snooping.
Why this is wrong here
DHCP snooping specifically targets the prevention of unauthorized DHCP server responses, not issues related to Layer 3 routing. Layer 3 route loops are typically addressed through routing protocols and configurations, making this option irrelevant to DHCP snooping.
★ When this WOULD be the correct answer
In a question focused on Layer 3 network stability, such as 'What mechanisms can prevent routing loops in a Layer 3 network?' option B would be correct, as it directly addresses the issue of routing loops that can occur in IP networks.
Why candidates choose this
Candidates may confuse DHCP snooping with broader network stability concepts, leading them to mistakenly associate it with preventing routing issues, especially if they have encountered similar terms in their studies.
Why this is wrong here
Trunk encapsulation mismatch refers to a situation where the encapsulation types (like 802.1Q or ISL) on trunk links do not match, leading to VLAN traffic issues. DHCP snooping does not address this issue as it focuses on preventing unauthorized DHCP server responses.
★ When this WOULD be the correct answer
In a question asking about issues related to VLAN trunking and encapsulation, such as 'What can cause VLAN traffic to be improperly forwarded between switches?', option C would be correct as it directly addresses the problem of mismatched trunk encapsulation.
Why candidates choose this
Candidates may confuse DHCP snooping with general network security measures and assume it could also prevent other types of network misconfigurations, such as trunk mismatches, due to a lack of understanding of specific DHCP functions.
Why this is wrong here
Weak SSH ciphers are related to encryption strength and secure communication, not to DHCP snooping, which specifically addresses unauthorized DHCP server responses. Thus, this option does not pertain to the DHCP protocol or its security features.
★ When this WOULD be the correct answer
If the question were about securing SSH connections, specifically asking what measures can be taken to prevent weak encryption algorithms from being used, then 'Weak SSH ciphers' could be a correct answer. This would involve scenarios discussing SSH configuration and security best practices.
Why candidates choose this
Candidates may choose this option due to a general understanding of network security and the importance of strong encryption, leading them to mistakenly associate it with DHCP security measures.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A frequent exam trap is selecting options related to Layer 3 routing issues or encryption weaknesses, such as route loops or weak SSH ciphers, when asked about DHCP snooping. Candidates may mistakenly think DHCP snooping prevents routing problems or secures SSH sessions. However, DHCP snooping specifically targets unauthorized DHCP server messages at Layer 2 and does not affect routing protocols or encryption. Misunderstanding this scope leads to incorrect answers. Remember, DHCP snooping’s primary function is to block rogue DHCP servers on untrusted ports, not to solve routing or encryption problems.
Detailed technical explanation
DHCP snooping is a security feature implemented on Cisco switches to protect the network from rogue DHCP servers that can assign incorrect IP addresses to clients. It works by classifying switch ports as trusted or untrusted. Trusted ports are typically connected to legitimate DHCP servers or uplinks, allowing DHCP server messages to pass through. Untrusted ports are user-facing ports where DHCP server messages are blocked, preventing unauthorized DHCP offers from reaching clients. This mechanism ensures that only authorized DHCP servers can respond to client requests, maintaining IP address integrity and network stability. When DHCP snooping is enabled, the switch builds a DHCP binding table that records the IP address, MAC address, lease time, VLAN, and interface information for each DHCP lease granted through trusted ports. This table is used to validate DHCP messages and enforce security policies. If a DHCP server message arrives on an untrusted port, the switch drops it, effectively preventing rogue DHCP servers from disrupting the network. This process helps mitigate attacks such as DHCP spoofing and DHCP starvation, which can cause denial of service or man-in-the-middle attacks. A common exam trap is confusing DHCP snooping with features that address Layer 3 routing or encryption, such as route loops or SSH cipher weaknesses. DHCP snooping strictly operates at Layer 2 to validate DHCP messages and does not influence routing protocols or encryption methods. Understanding this distinction is crucial for correctly answering questions about DHCP snooping. In practical networks, DHCP snooping is often combined with Dynamic ARP Inspection and IP Source Guard to provide comprehensive Layer 2 security against IP address spoofing and DHCP-related attacks.
Key takeaway
DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.
Real-world example
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Review dHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports..
The correct answer is: Unauthorized DHCP server responses from user-facing ports — DHCP snooping marks interfaces as trusted or untrusted and blocks rogue DHCP server messages arriving on untrusted ports.
Review dHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports., then practise related 200-301 questions on the same topic to reinforce the concept.
DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?
mediumWhy B: DHCP snooping classifies interfaces as trusted or untrusted and can block unauthorized DHCP server replies arriving on untrusted ports.
Last reviewed: Apr 12, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.