Question 240 of 464
DHCP Starvation Attack
A security analyst is reviewing logs and finds that a single MAC address is rapidly requesting IP addresses from a DHCP server, each time with a different client ID. The DHCP server is exhausting its address pool. Which type of attack is occurring?
Quick Answer
This scenario is a textbook DHCP starvation attack, and the key detail is the mismatch between a single MAC address and multiple different client IDs - a legitimate host only needs one lease and identifies itself consistently, but an attacker automating this attack spoofs a new client identifier with every request so the DHCP server treats each one as a distinct client needing its own address. Because the server has no way to tell these apart from genuine requests, it keeps allocating addresses until the entire pool is exhausted, at which point legitimate devices on the network can no longer obtain an IP address and lose connectivity. This is different from an attack that targets a specific host or spoofs an existing IP, since starvation is purely about exhausting a finite shared resource rather than intercepting or redirecting traffic. Defending against it typically involves limiting how many MAC addresses or leases a single port can request, which is a natural pairing with switch-level DHCP protections. When you see a scenario describing rapid, repeated DHCP requests using varying client identifiers from one source and an exhausted address pool as the outcome, that combination of symptoms is the signature of a DHCP starvation attack rather than any other DHCP-related exploit.
⚠ Common exam trap
A common mix-up: candidates confuse DHCP starvation with MAC flooding, as both involve 'flooding' and MAC addresses, but MAC flooding targets switch CAM tables, not DHCP servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP starvation attack
A DHCP starvation attack occurs when an attacker sends numerous DHCP discover messages, each with a unique client ID (chaddr), to exhaust the DHCP server's address pool. This prevents legitimate clients from obtaining IP addresses, as the server believes all leases are assigned. The rapid requests with different client IDs from a single MAC address are a hallmark of this attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DHCP starvation attack
Why this is correct
This is exactly the description of a DHCP starvation attack, where the attacker floods the DHCP server with requests to deplete the address pool.
- ✗
MAC flooding attack
Why it's wrong here
MAC flooding attacks target the switch's MAC address table, not DHCP servers.
When this WOULD be correct
A question describing a switch that stops forwarding traffic correctly after receiving a flood of frames with unique source MAC addresses, causing the CAM table to overflow, would make MAC flooding the correct answer.
- ✗
ARP spoofing
Why it's wrong here
ARP spoofing involves sending fake ARP replies to associate an attacker's MAC with an IP address, not DHCP exhaustion.
When this WOULD be correct
A question describing an attacker sending fake ARP messages to intercept traffic between two hosts on the same subnet, causing man-in-the-middle attacks or denial of service, would make ARP spoofing the correct answer.
- ✗
DNS poisoning
Why it's wrong here
DNS poisoning corrupts DNS cache to redirect traffic, unrelated to DHCP exhaustion.
When this WOULD be correct
A question describing an attacker modifying DNS records to redirect users to a malicious site, or a scenario where users are being sent to incorrect IP addresses due to compromised DNS data.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP starvation attackCorrect answer▾
Why this is correct
This is exactly the description of a DHCP starvation attack, where the attacker floods the DHCP server with requests to deplete the address pool.
✗MAC flooding attackWrong answer — click to see why▾
Why this is wrong here
MAC flooding attacks target switch MAC address tables by sending many frames with different source MAC addresses, not by exhausting DHCP IP address pools via rapid DHCP requests.
★ When this WOULD be the correct answer
A question describing a switch that stops forwarding traffic correctly after receiving a flood of frames with unique source MAC addresses, causing the CAM table to overflow, would make MAC flooding the correct answer.
Why candidates choose this
Candidates confuse 'MAC address' in the log with MAC flooding, and both attacks involve exhaustion of a network resource, leading to a superficial association.
✗ARP spoofingWrong answer — click to see why▾
Why this is wrong here
ARP spoofing involves sending forged ARP replies to associate an attacker's MAC address with a legitimate IP address, not exhausting DHCP address pools by rapidly requesting IPs with different client IDs.
★ When this WOULD be the correct answer
A question describing an attacker sending fake ARP messages to intercept traffic between two hosts on the same subnet, causing man-in-the-middle attacks or denial of service, would make ARP spoofing the correct answer.
Why candidates choose this
Candidates may confuse DHCP starvation with ARP spoofing because both involve MAC addresses and network layer attacks, but the specific mechanism of exhausting DHCP leases is unique to starvation attacks.
✗DNS poisoningWrong answer — click to see why▾
Why this is wrong here
DNS poisoning involves corrupting DNS resolver caches to redirect traffic, not exhausting DHCP address pools via rapid requests with varying client IDs.
★ When this WOULD be the correct answer
A question describing an attacker modifying DNS records to redirect users to a malicious site, or a scenario where users are being sent to incorrect IP addresses due to compromised DNS data.
Why candidates choose this
Candidates may confuse network-layer attacks, thinking that any attack involving IP address manipulation could be DNS-related, or they may not clearly distinguish between DHCP and DNS functions.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator is concerned about DHCP security. To prevent rogue DHCP servers from offering incorrect IP addresses, the administrator enables DHCP snooping on the switches. Additionally, the administrator wants to prevent DHCP starvation attacks that exhaust the DHCP pool. Which feature should be enabled on the switch to specifically mitigate DHCP starvation?
hard- A.Dynamic ARP Inspection (DAI)
- B.IP Source Guard (IPSG)
- C.Port Security
- ✓ D.Rate limiting on DHCP packets
Why D: Rate limiting on DHCP packets (option D) is the correct feature to mitigate DHCP starvation attacks. DHCP starvation works by flooding the network with fake DHCP discover messages, each using a different MAC address, to exhaust the DHCP server's address pool. By limiting the rate at which DHCP packets are accepted from a given interface, the switch can drop excessive requests before they reach the DHCP server, preventing pool exhaustion without blocking legitimate traffic.
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.