N10-009 Network Security Practice Question
A security analyst notices that a network switch is receiving DHCP discover messages from a rogue device offering IP addresses. The rogue device is causing clients to obtain invalid IP addresses and lose network connectivity. Which security feature should be implemented on the switch to prevent this type of attack?
⚠ Common exam trap
Many exam-takers confuse DHCP snooping with Dynamic ARP Inspection (DAI), but DAI only protects against ARP-based attacks, not rogue DHCP servers, while DHCP snooping directly addresses the described scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping
B is correct because DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports (connected to clients or rogue devices). When a rogue device sends DHCP discover messages offering IP addresses, DHCP snooping on untrusted ports drops those messages, preventing the rogue server from assigning invalid IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic ARP inspection (DAI)
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets in a network to prevent ARP spoofing and poisoning attacks, which can lead to man-in-the-middle scenarios. It functions by intercepting all ARP requests and responses on untrusted ports and verifying them against a DHCP snooping binding table, ensuring that only valid IP-to-MAC address bindings are allowed to pass. While DAI relies on the DHCP snooping binding table to build its trusted mappings, its primary function is to secure the ARP protocol itself, not to directly prevent or detect rogue DHCP servers from distributing IP addresses. The rogue DHCP server issue is directly addressed by DHCP snooping, which precedes DAI's reliance on its generated binding table.
When this WOULD be correct
A question describing a man-in-the-middle attack where a rogue device sends fake ARP replies to associate its MAC with the default gateway's IP, causing traffic interception. DAI would be the correct answer to validate ARP packets against a trusted database.
- ✓
DHCP snooping
Why this is correct
DHCP snooping is a crucial Layer 2 security feature implemented on network switches that actively prevents unauthorized DHCP servers from distributing IP addresses and other network configuration parameters. It operates by classifying switch ports as either trusted, where legitimate DHCP servers are connected, or untrusted, where client devices reside. The switch inspects all DHCP messages, dropping invalid DHCP server responses originating from untrusted ports, thereby effectively mitigating rogue DHCP server attacks and ensuring clients receive valid IP configurations. This mechanism also dynamically builds and maintains a DHCP snooping binding table, tracking valid IP-to-MAC address mappings for further security features.
- ✗
Port security
Why it's wrong here
Port security is a switch feature designed to control access by limiting the number of MAC addresses that can be learned on a specific switch port, or by restricting access to only a predefined set of MAC addresses. While it effectively prevents unauthorized devices from connecting by enforcing MAC address limits or specific MAC bindings, it does not inherently inspect or validate the content of DHCP messages. Therefore, a rogue DHCP server, if it presents a permitted MAC address or operates within the configured MAC limit, would not be blocked by port security alone, as its function is not to validate application-layer protocols like DHCP.
When this WOULD be correct
A question asks: 'Which feature prevents unauthorized devices from connecting to a switch port by limiting the number of MAC addresses?' Port security would be correct in that scenario.
- ✗
802.1X authentication
Why it's wrong here
802.1X authentication is a port-based network access control protocol that requires devices or users to authenticate themselves against a central authentication server before gaining access to the network. Its primary purpose is to ensure that only authorized entities can connect to the LAN, providing a strong first line of defense. However, 802.1X primarily focuses on device or user authentication at the network access layer, not on inspecting the content of application-layer protocols such as DHCP. A rogue DHCP server could potentially authenticate successfully as a legitimate device, or bypass 802.1X if it's not universally enforced, and then proceed to issue malicious IP addresses without being detected by this authentication mechanism.
When this WOULD be correct
A question describing a scenario where unauthorized devices are connecting to the network and causing security breaches, such as an attacker plugging into a wall jack to gain network access. The correct solution would be 802.1X to authenticate devices before granting access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP snoopingCorrect answer▾
Why this is correct
DHCP snooping is a crucial Layer 2 security feature implemented on network switches that actively prevents unauthorized DHCP servers from distributing IP addresses and other network configuration parameters. It operates by classifying switch ports as either trusted, where legitimate DHCP servers are connected, or untrusted, where client devices reside. The switch inspects all DHCP messages, dropping invalid DHCP server responses originating from untrusted ports, thereby effectively mitigating rogue DHCP server attacks and ensuring clients receive valid IP configurations. This mechanism also dynamically builds and maintains a DHCP snooping binding table, tracking valid IP-to-MAC address mappings for further security features.
✗Dynamic ARP inspection (DAI)Wrong answer — click to see why▾
Why this is wrong here
Dynamic ARP inspection (DAI) validates ARP packets to prevent ARP spoofing, but it does not inspect DHCP messages. The attack described involves rogue DHCP servers, which is mitigated by DHCP snooping, not DAI.
★ When this WOULD be the correct answer
A question describing a man-in-the-middle attack where a rogue device sends fake ARP replies to associate its MAC with the default gateway's IP, causing traffic interception. DAI would be the correct answer to validate ARP packets against a trusted database.
Why candidates choose this
Candidates may confuse DAI with DHCP snooping because both are security features that rely on DHCP snooping's binding table, but DAI specifically targets ARP, not DHCP server validation.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits MAC addresses on switch ports but does not inspect DHCP messages; it cannot prevent a rogue DHCP server from offering invalid IP addresses.
★ When this WOULD be the correct answer
A question asks: 'Which feature prevents unauthorized devices from connecting to a switch port by limiting the number of MAC addresses?' Port security would be correct in that scenario.
Why candidates choose this
Candidates may think port security blocks all unauthorized devices, but it only controls MAC address flooding, not DHCP-based attacks.
✗802.1X authenticationWrong answer — click to see why▾
Why this is wrong here
802.1X authentication controls network access at the port level by requiring user/device authentication, but it does not prevent rogue DHCP servers from offering IP addresses. The attack described involves unauthorized DHCP offers, which 802.1X does not filter.
★ When this WOULD be the correct answer
A question describing a scenario where unauthorized devices are connecting to the network and causing security breaches, such as an attacker plugging into a wall jack to gain network access. The correct solution would be 802.1X to authenticate devices before granting access.
Why candidates choose this
Candidates may think 802.1X can block any rogue device, including a rogue DHCP server, because it authenticates devices at the port level. However, it does not inspect DHCP messages or prevent unauthorized DHCP services from running on authenticated ports.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.