Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network technician enables DHCP Snooping globally and on VLAN 10 using the commands `ip dhcp snooping` and `ip dhcp snooping vlan 10`. However, clients connected to access ports on VLAN 10 are failing to acquire IP addresses from the central DHCP server reachable via trunk interface GigabitEthernet0/1. Which condition accounts for the DHCP packet drops on the switch?

  1. Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.Answer
  2. B
    The switch drops DHCP requests because sticky port security was not saved to the running-config before enabling DHCP Snooping.
  3. C
    DHCP Snooping drops all client messages because a native VLAN mismatch exists on the GigabitEthernet0/1 trunk interface.
  4. D
    The central DHCP server interface requires `ip helper-address` to be configured on egress trunk port GigabitEthernet0/1.

Answer

Trunk interface GigabitEthernet0/1 defaults to an untrusted state and drops incoming DHCP server response messages.
When DHCP Snooping is globally activated on a Cisco switch, every interface is set to an untrusted state by default. Untrusted interfaces only allow DHCP client broadcast requests to enter the switch, while dropping any incoming DHCP server response messages (DHCPOFFER, DHCPACK). Because GigabitEthernet0/1 connects to the central DHCP server, it must be explicitly configured with `ip dhcp snooping trust` to permit server responses to reach clients on VLAN 10.

Step-by-Step Solution

1
Analyze default DHCP Snooping port trust states upon enabling the feature.
By default, all switch interfaces are categorized as untrusted.
DHCP Snooping enforces security by filtering unauthorized DHCP server traffic on untrusted ports.
2
Evaluate packet handling rules on untrusted ports.
Untrusted ports permit client requests (DHCPDISCOVER, DHCPREQUEST) but drop server replies (DHCPOFFER, DHCPACK, DHCPNAK).
Prevents rogue DHCP servers from offering unauthorized IP configurations to clients.
3
Determine the required resolution to restore DHCP functionality.
Configure `ip dhcp snooping trust` on interface GigabitEthernet0/1.
Designating the server-facing uplink as trusted allows legitimate server offer and acknowledgment packets to pass.

Key Concept

DHCP Snooping Trusted vs Untrusted Port Operational Behavior
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic