350-601 Security Practice Question

Which feature on a Nexus switch uses DHCP snooping binding information to filter IP traffic on a per-port basis?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

IP Source Guard

IP Source Guard uses DHCP snooping bindings to filter IP traffic, allowing only traffic from valid IP-MAC pairs.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Port Security
Why it's wrong here
Port security limits MAC addresses, not IP filtering.
✓
IP Source Guard
Why this is correct
IP Source Guard filters IP traffic based on DHCP snooping bindings.
✗
Dynamic ARP Inspection
Why it's wrong here
DAI validates ARP, not IP traffic.
✗
CoPP
Why it's wrong here
CoPP protects the control plane, not per-port IP filtering.

Visual reference

Quick reference

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper