CCNA Network Services and Security Practice Question
Which four of the following are true statements regarding the operation of DHCP snooping on a Cisco switch? (Choose all that apply. There are four correct answers.)
⚠ Common exam trap
Cisco often tests the misconception that DHCP snooping can be configured to allow authorized servers on any port, but the feature strictly enforces that only trusted ports can source DHCP server messages, regardless of the server's IP or MAC address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping distinguishes trusted and untrusted ports.
The four correct statements are true because DHCP snooping is a security feature that operates by classifying switch ports as trusted or untrusted. By default, all ports are untrusted, meaning they cannot send DHCP server messages (OFFER, ACK, NAK) unless explicitly configured as trusted. Rate-limiting DHCP messages on untrusted ports mitigates DHCP starvation attacks, and the binding database (MAC-to-IP mapping) is built from DHCP ACK messages to prevent IP spoofing. The incorrect statement "DHCP snooping requires an external DHCP server to be configured on the switch" is false because DHCP snooping itself does not require the switch to act as a DHCP server; it simply relies on DHCP messages from a legitimate server reachable through a trusted port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DHCP snooping distinguishes trusted and untrusted ports.
Why this is correct
DHCP snooping's core operation is the separation of switch ports into trusted and untrusted categories. Trusted ports are permitted to accept DHCP server messages such as DHCPOFFER and DHCPACK, while untrusted ports are blocked from receiving these message types. This port-level distinction is the fundamental mechanism that filters malicious DHCP traffic and is the basis for all other DHCP snooping functions.
- ✓
By default, all ports are considered untrusted for DHCP snooping.
Why this is correct
By default, when DHCP snooping is globally enabled and applied to VLANs, every switch port is automatically classified as untrusted. To give a port trusted status, an administrator must explicitly issue the 'ip dhcp snooping trust' command on that interface. This default-to-untrusted posture ensures that no port is assumed safe until it is intentionally designated as a legitimate server-facing or uplink port.
- ✓
DHCP snooping can rate-limit DHCP messages to prevent denial-of-service attacks.
Why this is correct
DHCP snooping provides a rate-limiting function on untrusted ports using the 'ip dhcp snooping limit rate' command, which caps the number of DHCP packets accepted per second from a given port. This throttling prevents DHCP starvation and DoS attacks where a rogue client floods the network with fake DHCP requests, exhausting server IP pools or overwhelming switch CPU resources.
- ✓
DHCP snooping builds and maintains a DHCP snooping binding database (also called a binding table).
Why this is correct
DHCP snooping constructs and maintains a binding database, often called the binding table, which records DHCP-assigned IP addresses alongside client MAC addresses, VLANs, ports, and lease expiration times. The table is populated from valid DHCPACK messages and is used to filter subsequent DHCP traffic, and it also feeds features like IP Source Guard and Dynamic ARP Inspection to mitigate spoofing attacks.
- ✗
DHCP snooping prevents rogue DHCP servers by allowing only authorized servers on any port.
Why it's wrong here
This statement is incorrect because DHCP snooping does not allow authorized servers on 'any port'; rather, it restricts server messages to only those ports explicitly configured as trusted. Untrusted ports are forbidden from receiving DHCP server-offered messages, so legitimate servers must reside behind trusted ports, typically uplinks or dedicated server connections. Allowing a server on any port would defeat the feature's security purpose.
- ✗
DHCP snooping requires an external DHCP server to be configured on the switch.
Why it's wrong here
This statement is false because DHCP snooping is a purely passive security feature that inspects existing DHCP traffic; it does not require the switch to act as a DHCP server or to have any external DHCP server configured on the switch itself. The switch simply learns bindings by watching DHCP exchanges between clients and servers. An external DHCP server may exist on the trusted side of the network, but its configuration is not a requirement for DHCP snooping to operate.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
DHCP server
A DHCP server is a network device or service that automatically assigns IP addresses and other network configuration parameters to devices on a network, eliminating the need for manual configuration.
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.