N10-009 Network Security Practice Question
A network administrator wants to prevent unauthorized DHCP servers from offering IP addresses to clients on a switch. Which security feature should be enabled?
⚠ Common exam trap
Many exam-takers confuse DHCP snooping with Dynamic ARP Inspection, but DAI only validates ARP traffic, not DHCP offers, while BPDU guard is an STP mechanism unrelated to DHCP security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping
DHCP snooping is the correct answer because it is a security feature specifically designed to filter untrusted DHCP messages on a switch. By configuring trusted and untrusted ports, DHCP snooping drops DHCP server responses (OFFER, ACK) received on untrusted ports, effectively preventing rogue DHCP servers from assigning IP addresses to clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BPDU guard
Why it's wrong here
BPDU guard is a Cisco proprietary feature designed to protect the integrity of a Spanning Tree Protocol (STP) topology. It disables a port if it receives a Bridge Protocol Data Unit (BPDU), which are messages exchanged by switches to determine the STP topology. This prevents unauthorized switches from being introduced into the network and manipulating the STP, thereby maintaining network stability. However, it has no mechanism to inspect or control DHCP traffic or block rogue DHCP servers.
When this WOULD be correct
A network administrator wants to prevent a rogue switch from being connected to an access port and participating in the spanning tree protocol. Enabling BPDU guard on the port would disable it upon receiving a BPDU, thus protecting the STP topology.
- ✓
DHCP snooping
Why this is correct
DHCP snooping is a crucial security feature implemented on network switches that inspects DHCP messages to prevent unauthorized DHCP servers from distributing IP addresses. It classifies switch ports as either trusted (connected to legitimate DHCP servers) or untrusted (all other ports). The switch then actively blocks DHCP offer messages originating from untrusted ports, ensuring clients only receive IP configurations from authorized sources. This mechanism effectively mitigates man-in-the-middle attacks and ensures network integrity by preventing rogue servers from interfering with IP address assignment.
- ✗
Dynamic ARP inspection
Why it's wrong here
Dynamic ARP Inspection (DAI) is a security feature that validates ARP packets on a network to prevent ARP spoofing and poisoning attacks. It achieves this by intercepting all ARP requests and responses and verifying them against a trusted DHCP snooping binding table, which maps IP addresses to MAC addresses. While DAI relies on DHCP snooping to build its trusted database, its primary function is to prevent incorrect MAC-to-IP address bindings, not to directly block or detect unauthorized DHCP servers.
When this WOULD be correct
Dynamic ARP inspection would be correct in a scenario where the question asks for a security feature to prevent ARP spoofing or man-in-the-middle attacks on a switch, such as when a malicious host sends fake ARP replies to intercept traffic.
- ✗
Port security
Why it's wrong here
Port security is a switch feature designed to restrict access to a specific port based on MAC addresses. It limits the number of MAC addresses that can be learned on a port, and can even statically assign specific MAC addresses to a port, preventing unauthorized devices from connecting or performing MAC flooding. While effective at controlling which devices can physically connect to a port, it does not inspect or validate DHCP traffic itself, making it ineffective against a rogue DHCP server attempting to offer IP addresses.
When this WOULD be correct
A network administrator wants to restrict the number of devices that can connect to a specific switch port based on MAC addresses. Enabling port security would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP snoopingCorrect answer▾
Why this is correct
DHCP snooping is a crucial security feature implemented on network switches that inspects DHCP messages to prevent unauthorized DHCP servers from distributing IP addresses. It classifies switch ports as either trusted (connected to legitimate DHCP servers) or untrusted (all other ports). The switch then actively blocks DHCP offer messages originating from untrusted ports, ensuring clients only receive IP configurations from authorized sources. This mechanism effectively mitigates man-in-the-middle attacks and ensures network integrity by preventing rogue servers from interfering with IP address assignment.
✗BPDU guardWrong answer — click to see why▾
Why this is wrong here
BPDU guard is used to prevent loops by disabling ports that receive Bridge Protocol Data Units (BPDUs) from unauthorized switches, not to block unauthorized DHCP servers.
★ When this WOULD be the correct answer
A network administrator wants to prevent a rogue switch from being connected to an access port and participating in the spanning tree protocol. Enabling BPDU guard on the port would disable it upon receiving a BPDU, thus protecting the STP topology.
Why candidates choose this
Candidates may confuse BPDU guard with DHCP snooping because both are security features that protect against unauthorized network devices, but they operate at different layers and for different protocols.
✗Dynamic ARP inspectionWrong answer — click to see why▾
Why this is wrong here
Dynamic ARP inspection (DAI) validates ARP packets to prevent ARP spoofing, but it does not prevent unauthorized DHCP servers from assigning IP addresses. DHCP snooping is the feature that filters DHCP messages and blocks rogue DHCP servers.
★ When this WOULD be the correct answer
Dynamic ARP inspection would be correct in a scenario where the question asks for a security feature to prevent ARP spoofing or man-in-the-middle attacks on a switch, such as when a malicious host sends fake ARP replies to intercept traffic.
Why candidates choose this
Candidates may confuse DAI with DHCP snooping because both are often used together in DHCP-based security, and both involve inspecting network traffic at Layer 2. The similarity in purpose (securing IP assignments) leads to this mix-up.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits the number of MAC addresses per port but does not prevent unauthorized DHCP servers from assigning IP addresses.
★ When this WOULD be the correct answer
A network administrator wants to restrict the number of devices that can connect to a specific switch port based on MAC addresses. Enabling port security would be the correct answer.
Why candidates choose this
Candidates may confuse port security with DHCP snooping because both are switch security features, but port security focuses on MAC address control rather than DHCP message validation.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Network Device Hardening
Key term
DHCP server
A DHCP server is a network device or service that automatically assigns IP addresses and other network configuration parameters to devices on a network, eliminating the need for manual configuration.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.