mediumMultiple SelectObjective-mapped
350-401 Practice Question: Which two statements about IP Source Guard are…
Which two statements about IP Source Guard are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IP Source Guard uses the DHCP snooping binding database to validate source IP addresses.
IP Source Guard (IPSG) filters IP traffic on a per-port basis using the DHCP snooping binding database. Option A is correct because IPSG uses the binding database to validate source IP addresses. Option D is correct because IPSG can be configured with a static IP source binding for hosts with static IP addresses. Option B is incorrect because IPSG does not filter MAC addresses; that is the role of port security. Option C is incorrect because IPSG is applied on Layer 2 switch ports, not on Layer 3 interfaces. Option E is incorrect because IPSG does not require 802.1X; it can work with DHCP snooping alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IP Source Guard uses the DHCP snooping binding database to validate source IP addresses.
Why this is correct
Correct because IPSG relies on the DHCP snooping binding database to determine which source IP addresses are allowed on a given port.
- ✗
IP Source Guard filters traffic based on the source MAC address.
Why it's wrong here
Incorrect because IPSG filters based on source IP address, not MAC address. MAC filtering is done by port security.
- ✗
IP Source Guard is applied on Layer 3 interfaces of a switch.
Why it's wrong here
Incorrect because IPSG is configured on Layer 2 access ports, not on Layer 3 routed interfaces.
- ✓
IP Source Guard can be configured with a static IP source binding for hosts with static IP addresses.
Why this is correct
Correct because administrators can manually configure 'ip source binding' entries for devices that do not use DHCP.
- ✗
IP Source Guard requires 802.1X authentication to function.
Why it's wrong here
Incorrect because IPSG can operate with DHCP snooping alone and does not require 802.1X.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
ACLs and Infrastructure Security Features
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
Key term
Cisco ISE
Cisco Identity Services Engine is a security policy management platform that controls who can access a network and what they can do once connected.
About these practice questions
One of 1,175 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.