N10-009 Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  DHCP Snooping

  Why this is correct

  DHCP Snooping is a crucial Layer 2 security feature implemented on network switches to prevent unauthorized DHCP servers from distributing IP addresses and configurations. It operates by classifying switch ports as either trusted (where legitimate DHCP servers are connected) or untrusted. The switch then filters DHCP server messages, specifically DHCPOFFER and DHCPACK, on untrusted ports, dropping any that originate from there, thereby ensuring clients only receive valid IP configurations from authorized sources.

• ✗

  Dynamic ARP Inspection

  Why it's wrong here

  Dynamic ARP Inspection (DAI) is a security feature designed to prevent ARP spoofing and man-in-the-middle attacks by validating ARP packets on a network. It intercepts ARP requests and replies, verifying the sender's IP-to-MAC address bindings against a trusted database, often populated by DHCP snooping. While essential for maintaining the integrity of the Address Resolution Protocol, DAI does not directly address or mitigate the issue of rogue DHCP servers distributing incorrect IP addresses.

  When this WOULD be correct

  A network administrator notices intermittent connectivity and ARP cache poisoning attacks on the LAN. Which security feature should be implemented on switches to validate ARP packets and prevent man-in-the-middle attacks?

• ✗

  IP Source Guard

  Why it's wrong here

  IP Source Guard is a port security feature that mitigates IP address spoofing by restricting IP traffic on untrusted Layer 2 ports. It dynamically creates an access control list (ACL) based on the DHCP snooping binding table, allowing only traffic with a source IP and MAC address that matches a valid DHCP lease. Although it relies on DHCP snooping for its binding information, IP Source Guard's primary function is to prevent clients from using unauthorized IP addresses, not to block rogue DHCP server advertisements.

  When this WOULD be correct

  A network administrator wants to prevent devices from spoofing IP addresses on the network. IP Source Guard would be the correct answer when the question asks for a security feature that filters IP traffic on a per-port basis using the DHCP snooping binding table to block unauthorized IP source addresses.

• ✗

  Port Security

  Why it's wrong here

  Port Security is a Layer 2 switch feature designed to restrict network access based on MAC addresses. It limits the number of MAC addresses that can be learned on a specific switch port, and can be configured to allow only specific MAC addresses to connect. While effective in preventing unauthorized devices from connecting to a port, it does not inspect or filter DHCP messages and therefore cannot prevent a rogue DHCP server from operating and distributing IP addresses on the network.

  When this WOULD be correct

  Port Security would be correct in a scenario where the question asks how to prevent unauthorized devices from connecting to the network by limiting the number of MAC addresses allowed on a switch port, such as in a high-security environment to prevent rogue laptops or switches from plugging in.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question