DHCP Snooping Trusted Port Configuration
A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?
Quick Answer
The answer is to configure the port connected to the DHCP server as trusted. This is correct because DHCP snooping, by default, treats all switch ports as untrusted, meaning they will drop any DHCP server messages like OFFER, ACK, or NAK. By designating the specific port that connects to the legitimate DHCP server as trusted, you explicitly allow only that port to forward these server responses, effectively blocking any rogue DHCP server from assigning malicious IP addresses and ensuring network integrity. On the Cisco DCCOR 350-601 exam, this concept tests your understanding of DHCP snooping’s fundamental security mechanism; a common trap is assuming that enabling DHCP snooping globally is enough, but you must remember that the trusted port configuration is the critical step that actually validates the server. A simple memory tip: trust the server port, distrust everything else.
⚠ Common exam trap
Cisco often tests the misconception that enabling DHCP snooping globally or on all VLANs is sufficient for server legitimacy, when the actual requirement is to explicitly configure the server-facing port as trusted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the port connected to the DHCP server as trusted
Configuring the port connected to the DHCP server as trusted is a best practice because DHCP snooping treats all ports as untrusted by default. Only trusted ports are allowed to forward DHCP server messages (OFFER, ACK, NAK), preventing rogue DHCP server attacks. This ensures that only the legitimate DHCP server can assign IP addresses, maintaining network integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the port connected to the DHCP server as trusted
Why this is correct
Trusted ports are allowed to forward DHCP server messages, preventing rogue servers.
- ✗
Disable DHCP snooping on the DHCP server VLAN
Why it's wrong here
Disabling snooping on the VLAN would allow rogue servers.
- ✗
Set the DHCP server IP address in the binding database
Why it's wrong here
The binding database is built dynamically from trusted port traffic.
- ✗
Enable DHCP snooping on all VLANs
Why it's wrong here
Enabling on all VLANs is not a best practice; trust configuration is key.
Visual reference
Go deeper
Related to this question
About these practice questions
This 350-601 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 350-601
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?
easy- A.The DHCP server is in VLAN 20
- B.The DHCP client is using a static IP address
- ✓ C.The DHCP server port is trusted for all VLANs
- D.The DHCP client MAC address is not verified
Why C: When a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.