hardMultiple SelectObjective-mapped
350-401 Practice Question: Which two statements about DHCP snooping are…
Which two statements about DHCP snooping are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping treats all ports as untrusted by default, except those explicitly configured as trusted.
This question tests detailed knowledge of DHCP snooping operation and configuration, including trusted/untrusted ports and option 82.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DHCP snooping treats all ports as untrusted by default, except those explicitly configured as trusted.
Why this is correct
Correct because DHCP snooping defaults all ports to untrusted to prevent rogue DHCP server attacks; only trusted ports (usually uplink to legitimate DHCP server) are configured.
- ✗
The ip dhcp snooping trust command is applied on ports connected to DHCP clients.
Why it's wrong here
Incorrect because the trust command is applied on ports connected to DHCP servers, not clients. Client ports remain untrusted.
- ✓
DHCP snooping builds a binding database that maps client MAC addresses, IP addresses, VLAN, and port information.
Why this is correct
Correct because the DHCP snooping binding table records client MAC, IP, VLAN, and port to prevent spoofing and ensure security.
- ✗
DHCP snooping can be configured globally without enabling it on specific VLANs.
Why it's wrong here
Incorrect because DHCP snooping must be enabled on specific VLANs using the ip dhcp snooping vlan command; global enable alone does not activate it.
- ✗
DHCP snooping drops all DHCP packets that contain option 82 information from untrusted ports.
Why it's wrong here
Incorrect because DHCP snooping drops DHCP packets from untrusted ports that do not contain option 82, or if the option 82 is present but inconsistent; the statement is too absolute and not fully accurate.
Visual reference
Go deeper
Related to this question
Learn chapter
EIGRP: Basics and Advanced Configuration
Key term
L2 Security Features
L2 Security Features are network security mechanisms that operate at Layer 2 of the OSI model to protect local network traffic from threats like MAC spoofing, ARP attacks, and unauthorized access.
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.