Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator enables DHCP Snooping globally and on VLAN 20. To protect against DHCP denial-of-service (DoS) starvation attacks, the administrator configures `ip dhcp snooping limit rate 15` on all untrusted access interfaces. Shortly after, a user workstation interface transitions into the `err-disabled` state. Which operational behavior explains why this interface was placed into the `err-disabled` state?

  1. The interface received DHCP traffic exceeding the threshold of 15 packets per second configured on the untrusted port.Answer
  2. B
    The running configuration was not saved to startup configuration, causing the switch to lose learned sticky MAC addresses after a reboot.
  3. C
    The untrusted access interface experienced an 802.1Q native VLAN mismatch with the upstream switch trunk link.
  4. D
    An implicit deny clause in an applied access control list blocked incoming DHCP ACK messages from the server.

Answer

The interface received DHCP traffic exceeding the threshold of 15 packets per second configured on the untrusted port.
Configuring `ip dhcp snooping limit rate` on an untrusted interface imposes a ceiling on incoming DHCP control traffic. If a connected device sends DHCP messages faster than the configured threshold (15 packets per second in this scenario), the switch detects a rate violation and immediately transitions the port to the `err-disabled` state to protect network resources.

Step-by-Step Solution

1
Identify the Layer 2 security feature and command configured on the interface.
The switch has DHCP Snooping rate limiting configured via `ip dhcp snooping limit rate 15` on untrusted access interfaces.
This command sets a maximum allowed rate of 15 DHCP packets per second on untrusted ports.
2
Analyze the switch response when the rate limit threshold is exceeded.
If an untrusted host sends more than 15 DHCP packets per second, the switch shuts down the port and places it in the err-disabled state.
DHCP Snooping rate limiting enforces traffic ceilings to mitigate DHCP exhaustion/starvation attacks.

Key Concept

DHCP Snooping Interface Rate Limiting
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic