CCNA Network Services and Security Practice Question
Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?
⚠ Common exam trap
Avoid confusing PortFast (which skips STP convergence) with DHCP-specific features like DHCP Snooping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping
DHCP snooping classifies interfaces as trusted or untrusted and can block unauthorized DHCP server replies arriving on untrusted ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PortFast
Why it's wrong here
PortFast is a Spanning Tree Protocol (STP) enhancement applied to access ports that immediately transitions the port from blocking to forwarding, bypassing the listening and learning states to reduce the time a host must wait before sending traffic. It is a convergence optimization for edge devices and has no understanding of DHCP protocol semantics, so it cannot differentiate a valid DHCP server response from a malicious one. In fact, connecting a rogue DHCP server to a PortFast-enabled port would still allow it to transmit DHCPOFFER messages unless a separate feature such as DHCP snooping explicitly drops them.
When this WOULD be correct
In a different exam scenario, a question might ask about features that optimize switch port behavior for end devices in a network where rapid connectivity is crucial. In that case, a question could ask about improving the speed of port activation for devices like VoIP phones, making PortFast the correct answer.
- ✓
DHCP snooping
Why this is correct
DHCP snooping is a Layer 2 security feature on switches that filters DHCP traffic by designating trusted ports (typically uplinks to known DHCP servers) and untrusted ports (end-user access ports). It builds a DHCP snooping binding table of legitimate leases and drops DHCPOFFER or DHCPACK messages arriving on untrusted ports, which directly blocks a rogue DHCP server from successfully handing out IP addresses. This is the standard mitigation for rogue DHCP server attacks.
- ✗
HSRP
Why it's wrong here
Hot Standby Router Protocol (HSRP) is a Cisco First Hop Redundancy Protocol that provides default gateway redundancy by letting multiple routers share a virtual IP address, transparently failing over if the active router becomes unavailable. It operates at Layer 3 and manages router state for gateway availability, but it does not inspect, filter, or track DHCP messages or maintain lease bindings. Since its sole function is gateway resilience, a rogue DHCP server connected directly to the LAN remains completely undetected and unblocked by HSRP.
When this WOULD be correct
If the exam question asked about ensuring high availability and redundancy for gateway devices in a network, HSRP would be the correct answer, as it allows multiple routers to work together to present a single virtual IP address to clients.
- ✗
LLDP
Why it's wrong here
Link Layer Discovery Protocol (LLDP) is an open-standard IEEE 802.1AB protocol used to advertise a device's identity, capabilities, and management addresses to directly attached neighbors, aiding in network topology discovery and inventory management. LLDP frames are sent periodically as multicast packets and are processed by the link-layer stack; the protocol neither inspects UDP port 67/68 nor enforces any DHCP security policy. Consequently, LLDP gives no visibility into DHCP transactions and cannot prevent a rogue DHCP server from responding to client requests.
When this WOULD be correct
If the exam question asked about protocols that enhance network management and device discovery, LLDP would be the correct answer. For example, a question could focus on how to identify and manage devices on a switch network, where LLDP plays a crucial role.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP snoopingCorrect answer▾
Why this is correct
DHCP snooping is a Layer 2 security feature on switches that filters DHCP traffic by designating trusted ports (typically uplinks to known DHCP servers) and untrusted ports (end-user access ports). It builds a DHCP snooping binding table of legitimate leases and drops DHCPOFFER or DHCPACK messages arriving on untrusted ports, which directly blocks a rogue DHCP server from successfully handing out IP addresses. This is the standard mitigation for rogue DHCP server attacks.
✗PortFastWrong answer — click to see why▾
Why this is wrong here
PortFast is a Spanning Tree Protocol feature that immediately transitions an access port to the forwarding state, bypassing the listening and learning states. It does not inspect or validate DHCP messages, so it cannot prevent a rogue DHCP server from handing out addresses.
★ When this WOULD be the correct answer
In a different exam scenario, a question might ask about features that optimize switch port behavior for end devices in a network where rapid connectivity is crucial. In that case, a question could ask about improving the speed of port activation for devices like VoIP phones, making PortFast the correct answer.
Why candidates choose this
Students might think PortFast provides security because it is often used on edge ports where end devices connect, and they may confuse its rapid transition with a security feature that blocks unauthorized servers.
✗HSRPWrong answer — click to see why▾
Why this is wrong here
HSRP (Hot Standby Router Protocol) provides first-hop redundancy by allowing multiple routers to share a virtual IP address, ensuring gateway availability. It does not inspect DHCP traffic or provide any mechanism to block unauthorized DHCP servers.
★ When this WOULD be the correct answer
If the exam question asked about ensuring high availability and redundancy for gateway devices in a network, HSRP would be the correct answer, as it allows multiple routers to work together to present a single virtual IP address to clients.
Why candidates choose this
Because HSRP involves IP address management and redundancy, some students might mistakenly believe it can also manage or secure DHCP address assignment, especially since both operate at Layer 3.
✗LLDPWrong answer — click to see why▾
Why this is wrong here
LLDP (Link Layer Discovery Protocol) is a vendor-neutral protocol used for discovering neighboring devices and their capabilities by exchanging information such as device type, management addresses, and VLAN IDs. It has no role in DHCP security or filtering DHCP messages.
★ When this WOULD be the correct answer
If the exam question asked about protocols that enhance network management and device discovery, LLDP would be the correct answer. For example, a question could focus on how to identify and manage devices on a switch network, where LLDP plays a crucial role.
Why candidates choose this
LLDP is a Layer 2 protocol that operates on switches, and students might confuse it with DHCP snooping because both are associated with network discovery and management, but they serve entirely different purposes.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.