mediumMultiple ChoiceObjective-mapped
350-701 Practice Question: Refer to the exhibit
Exhibit
Refer to the exhibit. interface GigabitEthernet0/0 ip address 192.168.1.1 255.255.255.0 ip verify source ! interface GigabitEthernet0/1 ip address 192.168.2.1 255.255.255.0 ip verify source ! ip dhcp snooping vlan 1-100 ip dhcp snooping information option ip dhcp snooping ! ip source binding 00:11:22:33:44:55 vlan 10 192.168.1.10 interface GigabitEthernet0/0 !
Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that IP Source Guard works independently of DHCP Snooping, when in fact it relies entirely on the DHCP snooping binding database, and a missing trust configuration on the DHCP server-facing port is a common root cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DHCP snooping database is not updated because interface Gi0/1 is not trusted
The host cannot ping its default gateway because DHCP Snooping marks interface Gi0/1 as untrusted by default. Since the DHCP server is connected to Gi0/1, the switch drops DHCP replies from that interface, preventing the DHCP snooping binding database from being updated with the host's IP address. Without a valid binding, IP Source Guard on Gi0/0 drops all IP traffic from the host, including pings to the gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The DHCP snooping database is not updated because interface Gi0/1 is not trusted
Why this is correct
Gi0/1 is not configured as trust, so DHCP replies from the server are dropped, and the host may not have a valid lease. However, the static binding exists, but dynamic bindings fail.
- ✗
The static IP source binding is configured on the wrong VLAN
Why it's wrong here
The binding is for VLAN 10, and the host is on VLAN 10 (implied by IP 192.168.1.10/24).
- ✗
ARP inspection is not enabled, so the switch drops ARP replies
Why it's wrong here
DAI is not configured, but without it, ARP works normally.
- ✗
The 'ip verify source' command is missing the 'port-security' keyword
Why it's wrong here
Without 'port-security', IP Source Guard only checks IP, not MAC, but the host's IP matches.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-701 question from scratch — 978 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-701 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-701 exam.