Courseiva
← 200-301
Full test
mediummultiple choiceObjective-mapped

Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?

Question 1mediummultiple choice
Full question →

Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?

Full question →

Answer choices

Why each option matters

Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.

A

Distractor review

PortFast

PortFast speeds edge-port transitions but does not validate DHCP sources.

B

Best answer

DHCP snooping

Correct. DHCP snooping is designed for this threat.

C

Distractor review

HSRP

HSRP provides gateway redundancy, not rogue DHCP protection.

D

Distractor review

LLDP

LLDP is a discovery protocol and not a DHCP security control.

Common exam trap

Common exam trap: answer the scenario, not the keyword

A frequent exam trap is selecting PortFast or HSRP as the solution to rogue DHCP servers. PortFast only speeds up port transitions and does not validate DHCP messages, so it cannot prevent rogue DHCP servers. HSRP provides gateway redundancy and failover but does not control DHCP traffic or server legitimacy. Another trap is choosing LLDP, which is a discovery protocol and unrelated to DHCP security. The correct answer is DHCP snooping because it specifically blocks unauthorized DHCP server responses on untrusted ports, directly addressing the rogue DHCP server threat.

Technical deep dive

How to think about this question

DHCP snooping is a security feature implemented on Cisco switches to protect the network from rogue DHCP servers. It works by monitoring DHCP messages exchanged between clients and servers and classifying switch ports as trusted or untrusted. Trusted ports are those connected to legitimate DHCP servers, while untrusted ports are typically edge ports connected to clients. DHCP snooping filters DHCP server responses on untrusted ports, blocking any unauthorized DHCP offers or acknowledgments that could assign incorrect IP addresses. When DHCP snooping is enabled, the switch builds a DHCP binding table that records client MAC addresses, IP addresses, lease times, and associated ports. This table helps the switch enforce IP address assignment policies and supports other security features like IP source guard and dynamic ARP inspection. The decision process involves trusting DHCP server messages only from ports explicitly configured as trusted, thereby preventing rogue DHCP servers from handing out addresses on the network. A common exam trap is confusing DHCP snooping with other features like PortFast or HSRP. PortFast accelerates spanning-tree port transitions but does not provide DHCP security. HSRP offers gateway redundancy but does not control DHCP traffic. LLDP is a discovery protocol unrelated to DHCP security. Practically, enabling DHCP snooping is essential in campus networks to maintain IP address integrity and prevent attackers from disrupting network connectivity by introducing rogue DHCP servers.

KKey Concepts to Remember

  • DHCP snooping classifies switch ports as trusted or untrusted to control which devices can send DHCP server messages on a network.
  • A rogue DHCP server is any unauthorized device that responds to DHCP client requests and can disrupt IP address assignment.
  • DHCP snooping blocks DHCP server responses on untrusted ports, preventing rogue servers from handing out IP addresses.
  • PortFast is a spanning-tree feature that speeds up port transitions but does not provide DHCP server validation or security.
  • HSRP provides gateway redundancy by allowing multiple routers to share a virtual IP but does not protect against rogue DHCP servers.
  • LLDP is a Layer 2 discovery protocol used for device identification and topology mapping, not for DHCP security.
  • Enabling DHCP snooping on a Cisco switch requires configuring trusted ports where legitimate DHCP servers connect.
  • Without DHCP snooping, switches cannot differentiate between authorized and unauthorized DHCP servers, increasing network risk.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Related practice questions

Related 200-301 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

CCNA subnetting practice questions

Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.

CCNA OSPF practice questions

Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.

CCNA VLAN practice questions

Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.

CCNA STP practice questions

Practise spanning tree, root bridge election, port roles and STP troubleshooting.

CCNA EtherChannel practice questions

Practise LACP, PAgP, port-channel behaviour and bundle requirements.

CCNA ACL practice questions

Practise standard and extended ACLs, permit/deny logic and traffic filtering.

CCNA NAT practice questions

Practise static NAT, dynamic NAT, PAT and inside/outside address translation.

CCNA DHCP practice questions

Practise DHCP scopes, relay, leases and troubleshooting.

CCNA show ip route practice questions

Practise routing-table output, longest-prefix match, AD and route selection.

CCNA show interfaces trunk practice questions

Practise trunk verification and VLAN forwarding across switches.

CCNA wireless security practice questions

Practise WLAN security, authentication and wireless architecture concepts.

CCNA IPv6 practice questions

Practise IPv6 addressing, routes, neighbour discovery and common IPv6 exam traps.

More questions from this exam

Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.

Question 1

A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?

Question 2

A router shows this output: R1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.1.1.2 1 FULL/DR 00:00:34 192.168.12.2 GigabitEthernet0/0 10.1.1.3 1 2WAY/DROTHER 00:00:39 192.168.12.3 GigabitEthernet0/0 Which statement is correct?

Question 3

What is the OSPF metric called?

Question 4

A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?

Question 5

A router interface applies this ACL inbound: 10 deny tcp any any eq 80 20 permit ip any any A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?

Question 6

A router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?

FAQ

Questions learners often ask

What does this 200-301 question test?

DHCP snooping classifies switch ports as trusted or untrusted to control which devices can send DHCP server messages on a network.

What is the correct answer to this question?

The correct answer is: DHCP snooping — DHCP snooping classifies interfaces as trusted or untrusted and can block unauthorized DHCP server replies arriving on untrusted ports.

What should I do if I get this 200-301 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.

Discussion

Loading comments…

Sign in to join the discussion.