CCNA Network Services and Security Practice Question
What problem does DHCP snooping help prevent?
⚠ Common exam trap
A frequent exam trap is selecting options related to Layer 3 routing issues or encryption weaknesses, such as route loops or weak SSH ciphers, when asked about DHCP snooping. Candidates may mistakenly think DHCP snooping prevents routing problems or secures SSH sessions. However, DHCP snooping specifically targets unauthorized DHCP server messages at Layer 2 and does not affect routing protocols or encryption. Misunderstanding this scope leads to incorrect answers. Remember, DHCP snooping’s primary function is to block rogue DHCP servers on untrusted ports, not to solve routing or encryption problems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unauthorized DHCP server responses from user-facing ports
DHCP snooping marks interfaces as trusted or untrusted and blocks rogue DHCP server messages arriving on untrusted ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unauthorized DHCP server responses from user-facing ports
Why this is correct
DHCP snooping is a security feature on switches that filters DHCP messages. It builds a binding table of trusted DHCP server ports and untrusted user-facing ports. It drops DHCP server responses (DHCPOFFER, DHCPACK, DHCPNAK) received on untrusted ports, preventing a rogue DHCP server from assigning malicious IP configurations. This mitigates man-in-the-middle and denial-of-service attacks.
- ✗
Layer 3 route loops
Why it's wrong here
Route loops are a routing protocol issue caused by inconsistent routing information or layer 3 topology; DHCP snooping has no mechanism to affect routing tables or loop prevention. It only validates DHCP messages and does not participate in IP forwarding decisions. Routing loops are handled by protocols like Spanning Tree for L2 or TTL/hop counts for L3.
When this WOULD be correct
In a question focused on Layer 3 network stability, such as 'What mechanisms can prevent routing loops in a Layer 3 network?' option B would be correct, as it directly addresses the issue of routing loops that can occur in IP networks.
- ✗
Trunk encapsulation mismatch
Why it's wrong here
Trunk ports require matching VLAN tagging protocols (802.1Q or ISL) on both ends; a mismatch causes VLAN miscommunication and port status issues. DHCP snooping is a per-VLAN security feature that does not influence trunk negotiation or encapsulation types. Troubleshooting trunk mismatches involves checking switchport trunk encapsulation and allowed VLANs, not DHCP snooping.
When this WOULD be correct
In a question asking about issues related to VLAN trunking and encapsulation, such as 'What can cause VLAN traffic to be improperly forwarded between switches?', option C would be correct as it directly addresses the problem of mismatched trunk encapsulation.
- ✗
Weak SSH ciphers
Why it's wrong here
SSH is an application-layer protocol for secure remote management; its cipher strength is negotiated between client and server and is unrelated to Layer 2 DHCP traffic. DHCP snooping operates at Layer 2 and only inspects DHCP packets, not SSH encryption parameters. Weak ciphers are addressed by configuring SSH version and crypto algorithms, not by DHCP snooping.
When this WOULD be correct
If the question were about securing SSH connections, specifically asking what measures can be taken to prevent weak encryption algorithms from being used, then 'Weak SSH ciphers' could be a correct answer. This would involve scenarios discussing SSH configuration and security best practices.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Unauthorized DHCP server responses from user-facing portsCorrect answer▾
Why this is correct
DHCP snooping is a security feature on switches that filters DHCP messages. It builds a binding table of trusted DHCP server ports and untrusted user-facing ports. It drops DHCP server responses (DHCPOFFER, DHCPACK, DHCPNAK) received on untrusted ports, preventing a rogue DHCP server from assigning malicious IP configurations. This mitigates man-in-the-middle and denial-of-service attacks.
✗Layer 3 route loopsWrong answer — click to see why▾
Why this is wrong here
DHCP snooping specifically targets the prevention of unauthorized DHCP server responses, not issues related to Layer 3 routing. Layer 3 route loops are typically addressed through routing protocols and configurations, making this option irrelevant to DHCP snooping.
★ When this WOULD be the correct answer
In a question focused on Layer 3 network stability, such as 'What mechanisms can prevent routing loops in a Layer 3 network?' option B would be correct, as it directly addresses the issue of routing loops that can occur in IP networks.
Why candidates choose this
Candidates may confuse DHCP snooping with broader network stability concepts, leading them to mistakenly associate it with preventing routing issues, especially if they have encountered similar terms in their studies.
✗Trunk encapsulation mismatchWrong answer — click to see why▾
Why this is wrong here
Trunk encapsulation mismatch refers to a situation where the encapsulation types (like 802.1Q or ISL) on trunk links do not match, leading to VLAN traffic issues. DHCP snooping does not address this issue as it focuses on preventing unauthorized DHCP server responses.
★ When this WOULD be the correct answer
In a question asking about issues related to VLAN trunking and encapsulation, such as 'What can cause VLAN traffic to be improperly forwarded between switches?', option C would be correct as it directly addresses the problem of mismatched trunk encapsulation.
Why candidates choose this
Candidates may confuse DHCP snooping with general network security measures and assume it could also prevent other types of network misconfigurations, such as trunk mismatches, due to a lack of understanding of specific DHCP functions.
✗Weak SSH ciphersWrong answer — click to see why▾
Why this is wrong here
Weak SSH ciphers are related to encryption strength and secure communication, not to DHCP snooping, which specifically addresses unauthorized DHCP server responses. Thus, this option does not pertain to the DHCP protocol or its security features.
★ When this WOULD be the correct answer
If the question were about securing SSH connections, specifically asking what measures can be taken to prevent weak encryption algorithms from being used, then 'Weak SSH ciphers' could be a correct answer. This would involve scenarios discussing SSH configuration and security best practices.
Why candidates choose this
Candidates may choose this option due to a general understanding of network security and the importance of strong encryption, leading them to mistakenly associate it with DHCP security measures.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Routing Protocol Comparison
| Protocol | Metric | Max Hops | Algorithm | Type |
|---|---|---|---|---|
| RIP v2 | Hop count | 15 | Bellman-Ford | Distance vector |
| OSPF | Cost (bandwidth) | Unlimited | Dijkstra (SPF) | Link state |
| EIGRP | Composite metric | Unlimited | DUAL | Hybrid |
| IS-IS | Cost | Unlimited | Dijkstra | Link state |
| BGP | Policy / attributes | Unlimited | Path vector | Path vector |
RIP's 15-hop limit makes it unsuitable for large networks. OSPF and EIGRP dominate modern enterprise deployments.
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
DHCP server
A DHCP server is a network device or service that automatically assigns IP addresses and other network configuration parameters to devices on a network, eliminating the need for manual configuration.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.