CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable DHCP snooping globally and for the needed VLANs

  Why this is correct

  DHCP snooping is the foundational security feature that validates DHCP messages and constructs the binding table. Enabling it globally activates the feature, but you must also enable it on specific VLANs to apply filtering to access layer ports. Without this step, the switch will not inspect DHCP traffic, leaving client ports vulnerable to rogue DHCP replies. This configuration is mandatory for any DHCP snooping protection to take effect in the VLAN.

• ✓

  Trust the uplink toward the legitimate DHCP server path

  Why this is correct

  In DHCP snooping, interfaces are untrusted by default, meaning they cannot receive DHCP server responses. The uplink toward the legitimate DHCP server is typically a trusted interface because it must be allowed to pass valid DHCPOFFER and DHCPACK messages downstream. Trusting this uplink explicitly ensures that authentic DHCP server traffic reaches clients while rogue servers on untrusted access ports are blocked. This trust boundary is essential for the proper operation of DHCP snooping.

• ✗

  Enable PortFast on all trunks to block rogue servers

  Why it's wrong here

  PortFast is a spanning-tree optimization that transitions a port directly to the forwarding state to accelerate device boot time; it is designed for end hosts, not trunk links. Enabling PortFast on trunks is not a security measure and does not intercept or filter DHCP messages. Rogue DHCP servers are mitigated by DHCP snooping, which classifies ports as trusted or untrusted and drops illegitimate DHCP server replies. PortFast has no interaction with DHCP snooping, so it cannot block rogue servers and misapplying it to trunks is outside its intended use.

  When this WOULD be correct

  In a question about preventing spanning tree topology changes or reducing convergence time on access ports connected to end devices, enabling PortFast would be correct. For example: 'Which feature allows an access port to transition immediately to forwarding state?'

• ✗

  Disable ARP on access ports

  Why it's wrong here

  ARP (Address Resolution Protocol) is essential for mapping IP addresses to MAC addresses on Ethernet, and disabling it on access ports would break all IP connectivity. Switch ports do not have a feature to 'disable ARP', and doing so would not prevent rogue DHCP servers. DHCP snooping works at the DHCP message level, not by suppressing ARP. In fact, Dynamic ARP Inspection (DAI) can use the DHCP snooping binding table to validate ARP packets, but disabling ARP entirely is neither possible nor intended.

  When this WOULD be correct

  In a question about preventing ARP spoofing or man-in-the-middle attacks, enabling Dynamic ARP Inspection (DAI) or disabling ARP on untrusted ports might be correct. For example: 'Which feature helps prevent ARP cache poisoning on access ports?'

• ✗

  Set every access port as trusted

  Why it's wrong here

  If every access port is marked as trusted, DHCP snooping will not filter any DHCP server messages arriving on those ports. Trusted interfaces are exempt from DHCP snooping checks, meaning a rogue DHCP server plugged into any access port would be able to send malicious offers without being dropped. The entire purpose of DHCP snooping is to block untrusted DHCP server traffic, and setting all ports as trusted completely defeats that protection. Trust should be assigned only to ports that connect to known, legitimate DHCP servers or authoritative uplinks.

  When this WOULD be correct

  In a scenario where all access ports are connected only to known, authorized devices (e.g., a fully managed environment with no possibility of rogue devices), and the question asks for a configuration to minimize DHCP snooping overhead, marking all ports as trusted could be acceptable.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”