CCNA Network Services and Security Practice Question
Which three of the following are characteristics of DHCP snooping on a Cisco switch? (Choose three.)
⚠ Common exam trap
Cisco often tests that DHCP snooping's rate-limiting feature specifically targets DHCP starvation attacks, not rogue server attacks, and that the binding database is used for both IP source guard and dynamic ARP inspection integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It differentiates trusted and untrusted ports to filter DHCP messages.
DHCP snooping is a security feature that filters untrusted DHCP messages by differentiating trusted and untrusted ports. It builds and maintains a DHCP snooping binding database to track valid IP-to-MAC address assignments. Additionally, it prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, typically using the 'ip dhcp snooping limit rate' command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It differentiates trusted and untrusted ports to filter DHCP messages.
Why this is correct
DHCP snooping categorizes switch ports as trusted or untrusted. Trusted ports (typically uplinks to DHCP servers) are allowed to receive all DHCP messages, while untrusted ports (facing clients) only permit DHCP requests and are filtered for unauthorized DHCP server responses like offers and acks. This differentiation is the core mechanism that enforces DHCP snooping's security policy.
- ✓
It builds and maintains a DHCP snooping binding database.
Why this is correct
The binding database is populated from successful DHCP leases, mapping client MAC addresses to IP addresses, VLANs, and associated ports. This database is used to validate subsequent DHCP and IP traffic, preventing clients from spoofing IP or MAC addresses. It can also be used by other security features like dynamic ARP inspection.
- ✓
It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports.
Why this is correct
DHCP starvation attacks flood the DHCP server with bogus DHCP requests, exhausting its address pool. DHCP snooping mitigates this by rate-limiting DHCP packets received on untrusted ports, capping the frequency of requests any single host can generate. This throttling prevents a malicious client from monopolizing the server's available addresses.
- ✗
It encrypts DHCP traffic between the client and the server.
Why it's wrong here
DHCP snooping is a Layer 2 security feature that operates at the switch level and does not provide any encryption. DHCP traffic itself is transmitted in clear text, and snooping only inspects and filters messages based on trust and rate limits, not confidentiality. Encryption would require separate protocols like IPsec or DHCPv6 with secure mechanisms.
- ✗
It replaces the DHCP server's IP address with a static route.
Why it's wrong here
DHCP snooping does not alter IP routing or modify the DHCP server's IP address in any way. It does not interact with static routes or the routing table. Its functions are limited to Layer 2 DHCP message filtering and building a binding table; any IP address replacement would be unrelated and incorrect.
- ✗
It requires all DHCP servers to be connected to untrusted ports.
Why it's wrong here
Actually, DHCP servers must be connected to trusted ports for their responses to be accepted. Untrusted ports, typically for clients, cause DHCP server broadcast messages to be discarded if they originate from those ports. Requiring servers on untrusted ports would break DHCP functionality because their offer and ack messages would be dropped.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.