N10-009 Network Security Practice Question
A network administrator wants to prevent rogue DHCP servers from offering IP addresses to clients on the network. Which security feature should be enabled on the switches?
⚠ Common exam trap
CompTIA often tests the distinction between DHCP snooping and Dynamic ARP Inspection (DAI), where candidates mistakenly choose DAI because they confuse ARP spoofing with rogue DHCP server attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping
DHCP snooping is the correct security feature because it acts as a firewall between untrusted hosts and trusted DHCP servers. It validates DHCP messages by filtering out responses from unauthorized DHCP servers on untrusted ports, preventing rogue servers from offering IP addresses to clients. This is achieved by building and maintaining a DHCP snooping binding database that tracks valid IP-to-MAC address mappings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DHCP snooping
Why this is correct
DHCP snooping is a security feature implemented on switches that inspects DHCP messages to prevent unauthorized DHCP servers from operating on the network. It classifies switch ports as either trusted (where legitimate DHCP servers are connected) or untrusted. On untrusted ports, DHCP snooping blocks DHCP server responses (DHCP Offer and DHCP ACK messages) and can also drop DHCP Discover messages from clients if the source MAC address doesn't match the client identifier, effectively preventing rogue servers from issuing IP addresses.
- ✗
Dynamic ARP Inspection (DAI)
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature designed to prevent ARP cache poisoning and man-in-the-middle attacks by validating ARP packets. It maintains a database of valid IP-to-MAC address bindings, typically derived from DHCP snooping, and drops ARP packets with invalid bindings. While crucial for preventing ARP-related attacks, DAI does not inspect or filter DHCP messages themselves, making it ineffective against a rogue DHCP server attempting to assign IP addresses.
When this WOULD be correct
A network administrator wants to prevent man-in-the-middle attacks where an attacker sends fake ARP replies to associate their MAC address with the IP address of a legitimate device. Enabling DAI on switches would validate ARP packets against the DHCP snooping binding table.
- ✗
Port Security
Why it's wrong here
Port Security restricts access to a switch port based on MAC addresses, but it does not inspect or filter DHCP server messages, so it cannot block a rogue DHCP server from replying to client discovery requests. It is tempting because it is a common first-line defence against unauthorised device connections; it would be correct if the goal were to prevent unknown devices from physically connecting to the network.
When this WOULD be correct
A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Enabling Port Security would be the correct answer in that scenario.
- ✗
IP Source Guard
Why it's wrong here
IP Source Guard is a port-based security feature that prevents IP address spoofing by filtering ingress traffic on untrusted ports. It dynamically creates an access control list (ACL) for each port, allowing only traffic with the source IP and MAC address pair learned from DHCP snooping to pass. While it relies on DHCP snooping bindings, IP Source Guard's primary function is to prevent clients from using unauthorized IP addresses, not to block rogue DHCP servers from issuing those addresses in the first place.
When this WOULD be correct
When the question asks for a feature that prevents IP spoofing attacks by ensuring that clients use only the IP address assigned by a trusted DHCP server, IP Source Guard is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP snoopingCorrect answer▾
Why this is correct
DHCP snooping is a security feature implemented on switches that inspects DHCP messages to prevent unauthorized DHCP servers from operating on the network. It classifies switch ports as either trusted (where legitimate DHCP servers are connected) or untrusted. On untrusted ports, DHCP snooping blocks DHCP server responses (DHCP Offer and DHCP ACK messages) and can also drop DHCP Discover messages from clients if the source MAC address doesn't match the client identifier, effectively preventing rogue servers from issuing IP addresses.
✗Dynamic ARP Inspection (DAI)Wrong answer — click to see why▾
Why this is wrong here
Dynamic ARP Inspection (DAI) is designed to validate ARP packets and prevent ARP spoofing attacks, not to block rogue DHCP servers. It does not inspect DHCP traffic or filter unauthorized DHCP offers.
★ When this WOULD be the correct answer
A network administrator wants to prevent man-in-the-middle attacks where an attacker sends fake ARP replies to associate their MAC address with the IP address of a legitimate device. Enabling DAI on switches would validate ARP packets against the DHCP snooping binding table.
Why candidates choose this
Candidates may confuse DAI with DHCP snooping because both are security features that rely on the DHCP snooping binding table and are often implemented together, leading to the mistaken belief that DAI can also prevent rogue DHCP servers.
✗Port SecurityWrong answer — click to see why▾
Why this is wrong here
Port Security limits the number of MAC addresses per port but does not inspect DHCP messages or prevent unauthorized DHCP servers from offering IP addresses.
★ When this WOULD be the correct answer
A network administrator wants to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port. Enabling Port Security would be the correct answer in that scenario.
Why candidates choose this
Candidates may confuse Port Security with DHCP snooping because both are switch security features, but Port Security focuses on MAC address control rather than DHCP message validation.
✗IP Source GuardWrong answer — click to see why▾
Why this is wrong here
IP Source Guard prevents IP spoofing by filtering traffic based on DHCP snooping bindings, but it does not directly prevent rogue DHCP servers from offering IP addresses.
★ When this WOULD be the correct answer
When the question asks for a feature that prevents IP spoofing attacks by ensuring that clients use only the IP address assigned by a trusted DHCP server, IP Source Guard is the correct answer.
Why candidates choose this
Candidates may confuse IP Source Guard with DHCP snooping because both rely on DHCP snooping bindings, leading them to think IP Source Guard also blocks rogue DHCP servers.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
MAC address
A MAC address is a unique hardware identifier assigned to a network interface card that allows devices to communicate on a local network.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.