Courseiva
← 200-301
Full test
mediummultiple choiceObjective-mapped

What problem does DHCP snooping help prevent?

Question 1mediummultiple choice
Full question →

What problem does DHCP snooping help prevent?

Full question →

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

A

Best answer

Unauthorized DHCP server responses from user-facing ports

Correct. This is the main value of DHCP snooping.

B

Distractor review

Layer 3 route loops

Route loops are not solved by DHCP snooping.

C

Distractor review

Trunk encapsulation mismatch

Trunk negotiation issues are unrelated.

D

Distractor review

Weak SSH ciphers

SSH ciphers are not part of DHCP snooping.

Common exam trap

Common exam trap: answer the scenario, not the keyword

A frequent exam trap is selecting options related to Layer 3 routing issues or encryption weaknesses, such as route loops or weak SSH ciphers, when asked about DHCP snooping. Candidates may mistakenly think DHCP snooping prevents routing problems or secures SSH sessions. However, DHCP snooping specifically targets unauthorized DHCP server messages at Layer 2 and does not affect routing protocols or encryption. Misunderstanding this scope leads to incorrect answers. Remember, DHCP snooping’s primary function is to block rogue DHCP servers on untrusted ports, not to solve routing or encryption problems.

Technical deep dive

How to think about this question

DHCP snooping is a security feature implemented on Cisco switches to protect the network from rogue DHCP servers that can assign incorrect IP addresses to clients. It works by classifying switch ports as trusted or untrusted. Trusted ports are typically connected to legitimate DHCP servers or uplinks, allowing DHCP server messages to pass through. Untrusted ports are user-facing ports where DHCP server messages are blocked, preventing unauthorized DHCP offers from reaching clients. This mechanism ensures that only authorized DHCP servers can respond to client requests, maintaining IP address integrity and network stability. When DHCP snooping is enabled, the switch builds a DHCP binding table that records the IP address, MAC address, lease time, VLAN, and interface information for each DHCP lease granted through trusted ports. This table is used to validate DHCP messages and enforce security policies. If a DHCP server message arrives on an untrusted port, the switch drops it, effectively preventing rogue DHCP servers from disrupting the network. This process helps mitigate attacks such as DHCP spoofing and DHCP starvation, which can cause denial of service or man-in-the-middle attacks. A common exam trap is confusing DHCP snooping with features that address Layer 3 routing or encryption, such as route loops or SSH cipher weaknesses. DHCP snooping strictly operates at Layer 2 to validate DHCP messages and does not influence routing protocols or encryption methods. Understanding this distinction is crucial for correctly answering questions about DHCP snooping. In practical networks, DHCP snooping is often combined with Dynamic ARP Inspection and IP Source Guard to provide comprehensive Layer 2 security against IP address spoofing and DHCP-related attacks.

KKey Concepts to Remember

  • DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.
  • A trusted port in DHCP snooping is typically an uplink or server-facing interface allowed to send DHCP server messages.
  • An untrusted port is usually a user-facing port where DHCP server messages are blocked to prevent rogue DHCP servers.
  • DHCP snooping builds a binding table that tracks valid IP-to-MAC address mappings learned from DHCP transactions on trusted ports.
  • DHCP snooping helps maintain network security by preventing IP address spoofing and DHCP starvation attacks.
  • DHCP snooping operates at Layer 2 and integrates with other security features like Dynamic ARP Inspection and IP Source Guard.
  • DHCP snooping does not address Layer 3 routing issues such as route loops or routing protocol mismatches.
  • DHCP snooping is unrelated to SSH security or trunk encapsulation negotiation, focusing solely on DHCP message validation.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Related practice questions

Related 200-301 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

CCNA subnetting practice questions

Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.

CCNA OSPF practice questions

Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.

CCNA VLAN practice questions

Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.

CCNA STP practice questions

Practise spanning tree, root bridge election, port roles and STP troubleshooting.

CCNA EtherChannel practice questions

Practise LACP, PAgP, port-channel behaviour and bundle requirements.

CCNA ACL practice questions

Practise standard and extended ACLs, permit/deny logic and traffic filtering.

CCNA NAT practice questions

Practise static NAT, dynamic NAT, PAT and inside/outside address translation.

CCNA DHCP practice questions

Practise DHCP scopes, relay, leases and troubleshooting.

CCNA show ip route practice questions

Practise routing-table output, longest-prefix match, AD and route selection.

CCNA show interfaces trunk practice questions

Practise trunk verification and VLAN forwarding across switches.

CCNA wireless security practice questions

Practise WLAN security, authentication and wireless architecture concepts.

CCNA IPv6 practice questions

Practise IPv6 addressing, routes, neighbour discovery and common IPv6 exam traps.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

Question 1

A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?

Question 2

A router shows this output: R1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:34 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 2WAY/DROTHER 00:00:39 192.168.12.3 GigabitEthernet0/0 Which statement is correct?

Question 3

What is the OSPF metric called?

Question 4

A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?

Question 5

A router interface applies this ACL inbound: 10 deny tcp any any eq 80 20 permit ip any any A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?

Question 6

A router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?

FAQ

Questions learners often ask

What does this 200-301 question test?

DHCP snooping prevents unauthorized DHCP server responses by marking switch ports as trusted or untrusted, blocking rogue DHCP offers on untrusted ports.

What is the correct answer to this question?

The correct answer is: Unauthorized DHCP server responses from user-facing ports — DHCP snooping marks interfaces as trusted or untrusted and blocks rogue DHCP server messages arriving on untrusted ports.

What should I do if I get this 200-301 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.

Discussion

Loading comments…

Sign in to join the discussion.