N10-009 Network Security Practice Question
An attacker is launching a DHCP starvation attack by sending a large number of DHCP discover messages with spoofed MAC addresses. This exhausts the DHCP pool and causes legitimate clients to fail to obtain IP addresses. Which security feature should be implemented on the switch to mitigate this attack?
⚠ Common exam trap
CompTIA often tests DHCP snooping as the answer for DHCP starvation attacks, but candidates confuse it with DAI because both rely on the DHCP snooping binding table, forgetting that DAI only validates ARP packets, not DHCP messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping
DHCP snooping is the correct mitigation because it filters untrusted DHCP messages on access ports. By default, it only allows DHCP server responses (OFFER, ACK, etc.) on trusted ports (typically uplinks to the legitimate DHCP server) and drops them on untrusted ports, preventing a rogue or spoofed server from replying. Additionally, DHCP snooping builds a DHCP snooping binding table that tracks valid MAC-to-IP address mappings, which can be used to rate-limit DHCP discover messages and detect starvation attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security
Why it's wrong here
Port security is a switch feature designed to limit the number of MAC addresses that can be learned on a specific port, or to restrict access to only specific MAC addresses. While it can prevent unauthorized devices from connecting by shutting down or restricting a port if the MAC limit is exceeded, it does not inspect or filter DHCP messages themselves. Therefore, it cannot prevent a legitimate or spoofed device from sending a flood of DHCP DISCOVER requests using different MAC addresses, which is the core mechanism of a DHCP starvation attack.
When this WOULD be correct
Port security would be correct in a scenario where an attacker connects a rogue switch or device to flood the network with many MAC addresses to overflow the MAC address table (CAM table overflow attack).
- ✓
DHCP snooping
Why this is correct
DHCP snooping is a critical security feature implemented on network switches that inspects DHCP traffic to prevent rogue DHCP servers and DHCP starvation attacks. It classifies switch ports as trusted (for legitimate DHCP servers) or untrusted, dropping DHCP server messages received on untrusted ports. Crucially, it can enforce rate limiting on untrusted ports to prevent an attacker from flooding the network with excessive DHCP DISCOVER requests, thereby mitigating DHCP starvation by limiting the number of requests. It also builds and maintains a DHCP snooping binding table, mapping MAC addresses to IP addresses, which can be used by other security features.
- ✗
Dynamic ARP Inspection (DAI)
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets on a network to prevent ARP spoofing and man-in-the-middle attacks. It achieves this by intercepting all ARP requests and responses, comparing them against the DHCP snooping binding table to ensure IP-to-MAC address mappings are legitimate. While crucial for maintaining the integrity of ARP, DAI specifically targets ARP traffic and does not inspect, filter, or rate-limit DHCP messages. Consequently, it is ineffective against DHCP starvation attacks, which exploit the DHCP protocol itself rather than ARP.
When this WOULD be correct
DAI would be correct in a scenario where an attacker is sending forged ARP replies to associate their MAC address with the IP address of a legitimate device (e.g., default gateway) to intercept traffic.
- ✗
802.1X
Why it's wrong here
IEEE 802.1X is a port-based network access control protocol that authenticates devices attempting to connect to a network before granting them access. It typically uses an authentication server (like RADIUS) to verify user or device credentials, ensuring only authorized entities can join the network. While 802.1X can prevent unauthorized devices from gaining network access, it operates at a layer above DHCP message inspection and does not inherently monitor or rate-limit DHCP requests from authenticated clients. An authenticated but malicious client could still launch a DHCP starvation attack by exhausting the DHCP server's IP address pool.
When this WOULD be correct
802.1X would be the correct answer for a question asking which feature prevents unauthorized devices from connecting to the network by requiring authentication before granting access, such as in a scenario where the goal is to block rogue devices from using the network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP snoopingCorrect answer▾
Why this is correct
DHCP snooping is a critical security feature implemented on network switches that inspects DHCP traffic to prevent rogue DHCP servers and DHCP starvation attacks. It classifies switch ports as trusted (for legitimate DHCP servers) or untrusted, dropping DHCP server messages received on untrusted ports. Crucially, it can enforce rate limiting on untrusted ports to prevent an attacker from flooding the network with excessive DHCP DISCOVER requests, thereby mitigating DHCP starvation by limiting the number of requests. It also builds and maintains a DHCP snooping binding table, mapping MAC addresses to IP addresses, which can be used by other security features.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits the number of MAC addresses per port but does not inspect DHCP messages or prevent DHCP pool exhaustion from spoofed MAC addresses.
★ When this WOULD be the correct answer
Port security would be correct in a scenario where an attacker connects a rogue switch or device to flood the network with many MAC addresses to overflow the MAC address table (CAM table overflow attack).
Why candidates choose this
Candidates may confuse port security's MAC address limiting with DHCP snooping's ability to rate-limit DHCP messages, thinking both prevent spoofing without understanding the specific attack vector.
✗Dynamic ARP Inspection (DAI)Wrong answer — click to see why▾
Why this is wrong here
Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing and man-in-the-middle attacks, but it does not prevent DHCP starvation attacks, which target DHCP address exhaustion.
★ When this WOULD be the correct answer
DAI would be correct in a scenario where an attacker is sending forged ARP replies to associate their MAC address with the IP address of a legitimate device (e.g., default gateway) to intercept traffic.
Why candidates choose this
Candidates may confuse DAI with DHCP snooping because both are security features that inspect network traffic and are often implemented together on switches.
✗802.1XWrong answer — click to see why▾
Why this is wrong here
802.1X is an authentication protocol that controls network access at the port level, but it does not prevent DHCP starvation attacks because it does not monitor or rate-limit DHCP messages.
★ When this WOULD be the correct answer
802.1X would be the correct answer for a question asking which feature prevents unauthorized devices from connecting to the network by requiring authentication before granting access, such as in a scenario where the goal is to block rogue devices from using the network.
Why candidates choose this
Candidates may think 802.1X can mitigate DHCP starvation by blocking spoofed MAC addresses, but it only authenticates users, not DHCP message flooding.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Access Control (NAC)
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.