N10-009 Network Security Practice Question
A network administrator is concerned about DHCP security. To prevent rogue DHCP servers from offering incorrect IP addresses, the administrator enables DHCP snooping on the switches. Additionally, the administrator wants to prevent DHCP starvation attacks that exhaust the DHCP pool. Which feature should be enabled on the switch to specifically mitigate DHCP starvation?
⚠ Common exam trap
The N10-009 exam often tests the distinction between DHCP snooping features: candidates confuse DHCP snooping's role in preventing rogue servers (by filtering DHCP server messages) with the need for a separate rate-limiting mechanism to prevent starvation attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rate limiting on DHCP packets
Rate limiting on DHCP packets (option D) is the correct feature to mitigate DHCP starvation attacks. DHCP starvation works by flooding the network with fake DHCP discover messages, each using a different MAC address, to exhaust the DHCP server's address pool. By limiting the rate at which DHCP packets are accepted from a given interface, the switch can drop excessive requests before they reach the DHCP server, preventing pool exhaustion without blocking legitimate traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic ARP Inspection (DAI)
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature designed to prevent ARP spoofing and man-in-the-middle attacks by validating ARP packets against the DHCP snooping binding table. It inspects incoming ARP requests and replies on untrusted ports, dropping invalid packets that do not match a valid IP-to-MAC address binding. While crucial for maintaining the integrity of the ARP cache and preventing address resolution poisoning, DAI focuses exclusively on ARP traffic and does not provide any mechanism to control or limit the rate of DHCP messages or prevent rogue DHCP servers from operating.
When this WOULD be correct
A question asks: 'A network administrator wants to prevent a man-in-the-middle attack where an attacker sends fake ARP replies to associate their MAC address with the default gateway's IP. Which feature should be enabled?' In that scenario, DAI is the correct answer.
- ✗
IP Source Guard (IPSG)
Why it's wrong here
IP Source Guard (IPSG) is a security feature that prevents IP spoofing by filtering ingress traffic on a port based on a dynamically built DHCP snooping binding table or statically configured entries. It ensures that only traffic with a source IP address and MAC address pair that matches a valid DHCP lease or static entry is allowed to pass. While IPSG effectively prevents clients from using unauthorized IP addresses, it operates after a DHCP lease has been established and does not actively prevent a rogue DHCP server from issuing leases or a client from flooding the network with DHCP requests.
When this WOULD be correct
IP Source Guard would be correct in a question asking: 'Which feature prevents a host from using a statically assigned IP address that conflicts with a DHCP lease?' or 'Which feature blocks traffic from unauthorized IP addresses on a switch port?'
- ✗
Port Security
Why it's wrong here
Port Security is a Layer 2 control feature that restricts the number of MAC addresses allowed to communicate through a specific switch port. It can be configured to allow only a single MAC address or a predefined set, and it can take action (e.g., shutdown, restrict) if an unauthorized MAC address attempts to connect. While effective against unauthorized devices connecting to a port, it does not directly prevent a legitimate client or a rogue device with a permitted MAC address from sending an excessive volume of DHCP requests or acting as an unauthorized DHCP server.
When this WOULD be correct
Port Security would be correct in a question asking how to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port, such as in a scenario to stop MAC flooding attacks.
- ✓
Rate limiting on DHCP packets
Why this is correct
DHCP rate limiting, often configured as part of DHCP snooping on network switches, restricts the maximum number of DHCP messages (e.g., Discover, Request, Offer) that can be processed from a specific port within a given time frame. This mechanism is crucial for preventing denial-of-service attacks, such as DHCP starvation, where an attacker floods the network with requests to exhaust the legitimate DHCP server's address pool. By limiting the rate, it also effectively mitigates the impact of rogue DHCP servers attempting to respond to numerous client requests, as their excessive traffic would be dropped.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓Rate limiting on DHCP packetsCorrect answer▾
Why this is correct
DHCP rate limiting, often configured as part of DHCP snooping on network switches, restricts the maximum number of DHCP messages (e.g., Discover, Request, Offer) that can be processed from a specific port within a given time frame. This mechanism is crucial for preventing denial-of-service attacks, such as DHCP starvation, where an attacker floods the network with requests to exhaust the legitimate DHCP server's address pool. By limiting the rate, it also effectively mitigates the impact of rogue DHCP servers attempting to respond to numerous client requests, as their excessive traffic would be dropped.
✗Dynamic ARP Inspection (DAI)Wrong answer — click to see why▾
Why this is wrong here
Dynamic ARP Inspection (DAI) validates ARP packets to prevent ARP spoofing attacks, not DHCP starvation. DHCP starvation is mitigated by rate limiting DHCP packets to prevent an attacker from exhausting the DHCP pool.
★ When this WOULD be the correct answer
A question asks: 'A network administrator wants to prevent a man-in-the-middle attack where an attacker sends fake ARP replies to associate their MAC address with the default gateway's IP. Which feature should be enabled?' In that scenario, DAI is the correct answer.
Why candidates choose this
Candidates may confuse DHCP snooping with DAI because both are often enabled together as part of DHCP security, leading them to think DAI also addresses DHCP starvation.
✗IP Source Guard (IPSG)Wrong answer — click to see why▾
Why this is wrong here
IP Source Guard (IPSG) prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not limit the rate of DHCP packets, which is required to mitigate DHCP starvation attacks.
★ When this WOULD be the correct answer
IP Source Guard would be correct in a question asking: 'Which feature prevents a host from using a statically assigned IP address that conflicts with a DHCP lease?' or 'Which feature blocks traffic from unauthorized IP addresses on a switch port?'
Why candidates choose this
Candidates often confuse IPSG with DHCP rate limiting because both are related to DHCP snooping, and they may think IPSG's filtering capability can also prevent excessive DHCP requests.
✗Port SecurityWrong answer — click to see why▾
Why this is wrong here
Port Security limits the number of MAC addresses per port but does not control the rate of DHCP packets, so it cannot prevent DHCP starvation attacks that exhaust the DHCP pool by flooding DHCP requests.
★ When this WOULD be the correct answer
Port Security would be correct in a question asking how to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port, such as in a scenario to stop MAC flooding attacks.
Why candidates choose this
Candidates may confuse DHCP starvation with MAC flooding or think that limiting MAC addresses per port can also limit DHCP requests, not realizing that DHCP starvation is a rate-based attack requiring rate limiting.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.