How to Block Rogue DHCP Servers with DHCP Snooping
A network administrator is experiencing issues where unauthorized devices are offering IP addresses to clients, causing connectivity problems. Which security feature should be enabled on switches to prevent this?
Quick Answer
DHCP Snooping is correct because the problem described - unauthorized devices successfully handing out IP addresses - is precisely the failure mode this feature exists to close off at Layer 2. Without it, a switch has no concept of which devices are allowed to act as DHCP servers, so any connected device sending DHCPOFFER and DHCPACK messages will be treated the same as the legitimate server. Enabling DHCP Snooping changes that by classifying each port as trusted or untrusted: trusted ports, typically the uplinks toward known DHCP infrastructure, are allowed to relay server-side messages, while untrusted ports, usually the access ports where end-user devices connect, have those same messages silently dropped. This means a rogue device plugged into a normal access port is blocked before its offers ever reach clients, without needing to identify or physically locate the unauthorized device first. It's worth noting this control operates purely on port trust, not on inspecting the content of the DHCP messages themselves, which is what makes it lightweight and effective at the switch level. Any exam scenario describing unauthorized IP address assignment or unexpected DHCP servers on the network is pointing toward DHCP Snooping as the switch-level control that filters DHCP server traffic by port trust.
⚠ Common exam trap
Test-takers frequently confuse the roles of DHCP Snooping, DAI, and IP Source Guard, often selecting DAI because they associate ARP with address assignment, but only DHCP Snooping directly filters unauthorized DHCP server messages.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP Snooping
C is correct because DHCP Snooping is a security feature that filters untrusted DHCP messages on a per-port basis, preventing unauthorized DHCP servers from offering IP addresses to clients. By configuring trusted ports (typically uplinks to legitimate DHCP servers) and untrusted ports (access ports), the switch drops DHCPOFFER and DHCPACK messages received on untrusted ports, directly stopping rogue DHCP server attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Dynamic ARP Inspection (DAI)
Why it's wrong here
DAI protects against ARP spoofing, not rogue DHCP servers.
When this WOULD be correct
DAI would be correct in a scenario where the network is experiencing ARP spoofing attacks, where an attacker sends forged ARP replies to associate their MAC address with the IP address of a legitimate device, causing traffic interception.
- ✗
IP Source Guard
Why it's wrong here
IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but does not directly block rogue DHCP servers.
When this WOULD be correct
A network administrator notices clients are receiving IP addresses from unknown sources and suspects IP spoofing attacks. Enabling IP Source Guard on access ports would block traffic from unauthorized IP addresses.
- ✓
DHCP Snooping
Why this is correct
DHCP Snooping allows only DHCP messages from trusted DHCP servers, blocking unauthorized DHCP offers.
- ✗
Port Security
Why it's wrong here
Port Security limits the number of MAC addresses on a port but does not filter DHCP messages.
When this WOULD be correct
A question asking which feature prevents MAC flooding attacks or restricts device access based on MAC addresses on a switch port would make Port Security the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP SnoopingCorrect answer▾
Why this is correct
DHCP Snooping allows only DHCP messages from trusted DHCP servers, blocking unauthorized DHCP offers.
✗Dynamic ARP Inspection (DAI)Wrong answer — click to see why▾
Why this is wrong here
Dynamic ARP Inspection (DAI) validates ARP packets to prevent man-in-the-middle attacks, but it does not prevent unauthorized DHCP servers from offering IP addresses. The issue described is rogue DHCP servers, which DHCP Snooping addresses.
★ When this WOULD be the correct answer
DAI would be correct in a scenario where the network is experiencing ARP spoofing attacks, where an attacker sends forged ARP replies to associate their MAC address with the IP address of a legitimate device, causing traffic interception.
Why candidates choose this
Candidates may confuse DAI with DHCP Snooping because both are security features that rely on DHCP Snooping's binding database, and both protect against different types of attacks on the same layer.
✗IP Source GuardWrong answer — click to see why▾
Why this is wrong here
IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not prevent unauthorized DHCP servers from offering IP addresses.
★ When this WOULD be the correct answer
A network administrator notices clients are receiving IP addresses from unknown sources and suspects IP spoofing attacks. Enabling IP Source Guard on access ports would block traffic from unauthorized IP addresses.
Why candidates choose this
Candidates may confuse IP Source Guard with DHCP Snooping because both rely on DHCP snooping bindings, but they address different threats: IP Source Guard filters IP traffic, while DHCP Snooping filters DHCP messages.
✗Port SecurityWrong answer — click to see why▾
Why this is wrong here
Port Security limits the number of MAC addresses per port but does not prevent unauthorized DHCP servers from offering IP addresses.
★ When this WOULD be the correct answer
A question asking which feature prevents MAC flooding attacks or restricts device access based on MAC addresses on a switch port would make Port Security the correct answer.
Why candidates choose this
Candidates may confuse port-level security with DHCP protection, thinking that restricting MAC addresses also blocks rogue DHCP servers.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
DHCP server
A DHCP server is a network device or service that automatically assigns IP addresses and other network configuration parameters to devices on a network, eliminating the need for manual configuration.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on N10-009
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator wants to prevent rogue DHCP servers from offering IP addresses to clients on the network. Which security feature should be enabled on the switches?
easy- ✓ A.DHCP snooping
- B.Dynamic ARP Inspection (DAI)
- C.Port Security
- D.IP Source Guard
Why A: DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. It validates DHCP messages by filtering out responses from unauthorized DHCP servers on untrusted ports, preventing rogue servers from offering IP addresses to clients. This is achieved by building and maintaining a DHCP snooping binding database that tracks valid IP-to-MAC address mappings.
Variation 2. A network administrator wants to prevent unauthorized DHCP servers from offering IP addresses to clients on a switch. Which security feature should be enabled?
easy- A.BPDU guard
- ✓ B.DHCP snooping
- C.Dynamic ARP inspection
- D.Port security
Why B: DHCP snooping is the correct answer because it is a security feature specifically designed to filter untrusted DHCP messages on a switch. By configuring trusted and untrusted ports, DHCP snooping drops DHCP server responses (OFFER, ACK) received on untrusted ports, effectively preventing rogue DHCP servers from assigning IP addresses to clients.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.