Question 199 of 464
DHCP Starvation Attack Identification
A security analyst notices that the DHCP server is responding to a large number of DHCP Discover messages from a single MAC address, but that client never sends a DHCP Request to complete the lease. This pattern repeats continuously. Which type of attack is most likely occurring?
Quick Answer
The clue that nails this down as DHCP starvation is the incomplete handshake: the attacker sends Discover message after Discover message but never follows through with a Request to finalize any lease. DHCP normally works through a four-step process - Discover, Offer, Request, Acknowledge - where a real client only needs to complete this once to get usable configuration. An attacker abusing this doesn't want a working lease at all; the goal is simply to make the server believe every offered address has been claimed, so by never completing the Request step for any of them, the attacker can rapidly cycle through and consume the entire address pool from just one MAC address. Once the pool is exhausted, real devices sending legitimate Discover messages get no response, since the server has nothing left to offer. This pattern is what separates starvation from other DHCP-related issues, since it's specifically an exhaustion attack against the server's available addresses rather than an attempt to intercept traffic or impersonate a server. Whenever you see a description of DHCP Discover messages piling up without ever reaching a completed Request, and legitimate clients subsequently failing to get addresses, recognize that incomplete DORA cycle as the signature of a DHCP starvation attack.
⚠ Common exam trap
Watch out — candidates often confuse DHCP starvation with a rogue DHCP server attack, but the key distinction is that starvation exhausts the legitimate server's pool via incomplete handshakes, while a rogue server offers its own IPs to intercept traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP starvation
The described behavior—a single MAC address sending continuous DHCP Discover messages without completing the lease with a DHCP Request—is the hallmark of a DHCP starvation attack. The attacker exhausts the DHCP server's IP address pool by claiming all available leases, preventing legitimate clients from obtaining IP addresses. This attack targets the DHCP protocol's four-step DORA (Discover, Offer, Request, Acknowledge) process by never completing the handshake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning involves sending forged ARP messages to associate the attacker's MAC with a legitimate IP address. This does not directly target DHCP.
When this WOULD be correct
A question describing a scenario where an attacker sends forged ARP replies to associate their MAC with the IP of a legitimate device, causing traffic to be misdirected, would make ARP poisoning the correct answer.
- ✗
DNS amplification
Why it's wrong here
DNS amplification is a type of DDoS attack that uses misconfigured DNS servers to flood a target with traffic. It is not related to DHCP.
When this WOULD be correct
A question describing a network under a DDoS attack where the attacker sends small queries to open DNS resolvers with a spoofed source IP (the victim), causing large responses to overwhelm the victim. The key clue would be high bandwidth consumption and DNS traffic.
- ✓
DHCP starvation
Why this is correct
The scenario describes a classic DHCP starvation attack. The attacker floods the DHCP server with Discover messages, causing it to exhaust its address pool. Legitimate clients then cannot obtain IP addresses.
- ✗
Rogue DHCP server
Why it's wrong here
A rogue DHCP server attack involves an unauthorized server offering IP addresses to clients, potentially intercepting traffic. Here, the legitimate server is being flooded, not spoofed.
When this WOULD be correct
A question describing clients receiving incorrect IP configurations (e.g., wrong gateway or DNS) from an unauthorized DHCP server on the network, leading to connectivity issues or man-in-the-middle attacks. The correct answer would be 'Rogue DHCP server'.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP starvationCorrect answer▾
Why this is correct
The scenario describes a classic DHCP starvation attack. The attacker floods the DHCP server with Discover messages, causing it to exhaust its address pool. Legitimate clients then cannot obtain IP addresses.
✗ARP poisoningWrong answer — click to see why▾
Why this is wrong here
ARP poisoning involves manipulating ARP tables to intercept traffic, not flooding DHCP with Discover messages from a single MAC without completing the lease.
★ When this WOULD be the correct answer
A question describing a scenario where an attacker sends forged ARP replies to associate their MAC with the IP of a legitimate device, causing traffic to be misdirected, would make ARP poisoning the correct answer.
Why candidates choose this
Candidates may confuse DHCP starvation with ARP-based attacks because both involve MAC addresses and network exhaustion, but ARP poisoning targets layer 2 address resolution, not DHCP lease exhaustion.
✗DNS amplificationWrong answer — click to see why▾
Why this is wrong here
DNS amplification attacks exploit open DNS resolvers to flood a target with amplified traffic, not DHCP servers or MAC addresses. The question describes DHCP-specific behavior (Discover messages without Request), which is unrelated to DNS.
★ When this WOULD be the correct answer
A question describing a network under a DDoS attack where the attacker sends small queries to open DNS resolvers with a spoofed source IP (the victim), causing large responses to overwhelm the victim. The key clue would be high bandwidth consumption and DNS traffic.
Why candidates choose this
Candidates may confuse 'amplification' with the repeated Discover messages, thinking the DHCP server is being used to amplify traffic, but DHCP starvation is about exhausting IP addresses, not traffic amplification.
✗Rogue DHCP serverWrong answer — click to see why▾
Why this is wrong here
A rogue DHCP server attack involves an unauthorized server offering IP addresses, not a single MAC address repeatedly sending Discover messages without completing the lease. The described pattern of continuous Discover messages from one MAC is characteristic of DHCP starvation, not rogue server.
★ When this WOULD be the correct answer
A question describing clients receiving incorrect IP configurations (e.g., wrong gateway or DNS) from an unauthorized DHCP server on the network, leading to connectivity issues or man-in-the-middle attacks. The correct answer would be 'Rogue DHCP server'.
Why candidates choose this
Candidates may confuse DHCP starvation (exhausting IP pool) with a rogue DHCP server (offering malicious leases), as both involve DHCP abuse. The continuous Discover messages might be misattributed to a rogue server trying to respond, rather than a client flooding to deplete addresses.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing DHCP server logs and notices that a single MAC address is sending an extremely high number of DHCP discover packets. The DHCP server is responding, but the client never sends a DHCP request. Which type of attack is most likely occurring?
hard- ✓ A.A) DHCP starvation
- B.B) ARP poisoning
- C.C) MAC flooding
- D.D) DNS spoofing
Why A: A DHCP starvation attack works by flooding the DHCP server with DHCPDISCOVER packets from spoofed MAC addresses, exhausting the server's IP address pool. In this scenario, a single MAC address sending excessive DHCPDISCOVER packets without completing the DORA handshake (no DHCPREQUEST) is a classic indicator of a starvation attack, as the attacker aims to consume all available leases and cause a denial of service for legitimate clients.
Last reviewed: Jun 11, 2026
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.