Question 285 of 1,389
CCNA Network Services and Security Practice Question
Which three of the following are characteristics of DHCP snooping? (Choose three.)
⚠ Common exam trap
Cisco often tests the distinction between trusted and untrusted ports, leading candidates to incorrectly assume that DHCP snooping filters messages on trusted ports or allows server messages from untrusted ports under certain conditions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It builds and maintains a DHCP snooping binding database.
DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database to track valid IP-to-MAC address assignments. It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, and it validates DHCP client MAC addresses against the source MAC in the Ethernet frame to prevent MAC spoofing. These three functions directly correspond to the correct answer options.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It filters untrusted DHCP messages on trusted ports.
Why it's wrong here
DHCP snooping classifies switch ports as trusted or untrusted; trusted ports are explicitly configured and are the only ports allowed to receive DHCP server messages. Filtering untrusted messages on trusted ports is backwards: DHCP snooping filters DHCP server messages on untrusted ports, not on trusted ones. Trusted ports bypass filtering to allow legitimate server responses, while untrusted ports have all DHCP server messages dropped. Therefore, this option inverts the security boundary and is incorrect.
- ✓
It builds and maintains a DHCP snooping binding database.
Why this is correct
The DHCP snooping binding database is a core function: it records each client's MAC address, IP address, lease time, VLAN, and port after successful DHCP negotiation. Entries are populated from DHCP ACK messages observed on untrusted ports, and the database is used for security features like IP source guard and dynamic ARP inspection. This database is essential for tracking trusted clients and enforcing IP integrity on untrusted ports, so this is a correct characteristic.
- ✓
It prevents DHCP starvation attacks by rate-limiting DHCP messages.
Why this is correct
DHCP starvation attacks flood a DHCP server with fake requests to exhaust its address pool. DHCP snooping mitigates this by rate-limiting the number of DHCP packets (DISCOVER, REQUEST, etc.) accepted on untrusted ports, discarding excess packets. The default limit is typically 15 packets per second on a per-port basis, and this throttling prevents an attacker from consuming all available leases. This attack-prevention capability is a well-known characteristic of DHCP snooping, making this option correct.
- ✗
It allows DHCP server messages from untrusted ports if the source MAC matches.
Why it's wrong here
DHCP snooping treats untrusted ports as ports that should never receive DHCP server messages, regardless of the source MAC address. If a DHCP OFFER or ACK appears on an untrusted port, the switch drops it because untrusted ports are presumed to be connected to clients, not servers. Matching the source MAC to the client would not make the message permissible; in fact, DHCP snooping validates client messages for the opposite direction (client-to-server) using source MAC verification. Thus, allowing server messages on untrusted ports based on MAC match is not a feature and is wrong.
- ✓
It can validate DHCP client MAC addresses against the source MAC in the Ethernet frame.
Why this is correct
A critical DHCP snooping validation is checking that the client hardware address (chaddr) in the DHCP packet equals the Ethernet source MAC address. This prevents a client from spoofing a different MAC in the DHCP payload to poison the binding database or bypass MAC-based security. If the MACs do not match on an untrusted port, the DHCP message is dropped. This is one of the many Layer 2 integrity checks DHCP snooping performs, so this statement is correct.
- ✗
It automatically enables IP source guard when configured globally.
Why it's wrong here
IP source guard is a separate switch security feature that uses the DHCP snooping binding database to filter IP traffic on a per-port basis. Although DHCP snooping must be enabled globally for IP source guard to function, enabling DHCP snooping alone does not automatically activate IP source guard. An administrator must explicitly configure it (e.g., "ip verify source") on target interfaces or globally. Therefore, DHCP snooping does not automatically enable IP source guard; this option misrepresents the relationship and is incorrect.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.