The correct action is to set Ethernet 1/1 as a trusted port. This is because DHCP snooping operates on the principle of trusted and untrusted ports: by default, all switch ports are untrusted, meaning they will drop any DHCP server messages like OFFER or ACK. By designating the port connected to the legitimate DHCP server as trusted, you allow only those valid server responses to be forwarded, while any unauthorized DHCP server messages arriving on untrusted ports—such as Ethernet 1/2—are automatically discarded. On the Cisco DCCOR 350-601 exam, this concept tests your understanding of DHCP snooping’s core security mechanism, often appearing in scenario-based questions where you must identify which port to trust. A common trap is assuming you must block the rogue server’s port directly, but the correct approach is to trust the legitimate server’s port. Remember the memory tip: “Trust the source, block the rest.”
350-601 Security Practice Question
This 350-601 practice question tests your understanding of security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set Ethernet 1/1 as a trusted port
Option D is correct because DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded. All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enable the DHCP snooping information option
Why it's wrong here
The information option (Option 82) is for relay agent information, not for blocking unauthorized servers.
✗
Set Ethernet 1/2 as a trusted port
Why it's wrong here
Setting the unauthorized port as trusted would allow it to act as a DHCP server, which is undesirable.
✗
Disable DHCP snooping globally
Why it's wrong here
Disabling DHCP snooping would remove all protection, not just stop the unauthorized server.
✓
Set Ethernet 1/1 as a trusted port
Why this is correct
The DHCP server port must be trusted to permit DHCP server messages such as OFFER and ACK.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the common misconception that you must set the port connected to the unauthorized server as untrusted (which is the default) rather than explicitly setting the legitimate server's port as trusted, leading candidates to incorrectly select option B or C.
Detailed technical explanation
How to think about this question
DHCP snooping builds a DHCP snooping binding database by monitoring DHCP messages on untrusted ports. When a DHCP server is on a trusted port, its OFFER and ACK messages are forwarded, and the switch populates the binding table with client MAC, IP, lease time, and port information. This database is also used by Dynamic ARP Inspection (DAI) and IP Source Guard to prevent spoofing attacks. In a real-world scenario, if an attacker connects a rogue DHCP server to an untrusted port, the switch silently drops its OFFER messages, preventing IP address conflicts and man-in-the-middle attacks.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 350-601 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security — This question tests Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Set Ethernet 1/1 as a trusted port — Option D is correct because DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded. All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.
What should I do if I get this 350-601 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is configuring DHCP snooping on a Cisco Nexus 9000 switch to prevent rogue DHCP server attacks. The switch connects to the legitimate DHCP server on Ethernet 1/1. Clients are connected to ports Ethernet 1/2 through 1/24. The engineer enables DHCP snooping globally and on VLAN 10, but clients are unable to obtain IP addresses from the DHCP server. Other connectivity between clients and the server works (e.g., static IPs). What is the most likely cause and solution?
easy
A.Disable DHCP snooping as it is not needed in this topology.
B.Configure a static DHCP binding for each client on the switch.
✓ C.Ethernet 1/1 is untrusted by default. Configure it as trusted with 'ip dhcp snooping trust' and verify DHCP snooping is enabled on VLAN 10.
D.Add 'ip dhcp snooping information option' on Ethernet 1/1 to allow DHCP option 82.
Why C: By default, all interfaces on a Cisco Nexus 9000 switch are untrusted for DHCP snooping. The legitimate DHCP server is connected to Ethernet 1/1, which must be explicitly configured as trusted using the 'ip dhcp snooping trust' interface command. Without this, the switch discards DHCP server messages (OFFER, ACK) received on that port, preventing clients from obtaining IP addresses even though DHCP snooping is enabled globally and on VLAN 10.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.