Examkin

Question

Difficulty: EasyLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network administrator is deploying Layer 2 security controls on a Cisco Catalyst switch. Which two statements accurately describe the operational requirements and default behaviors of DHCP Snooping? (Select two.)

  1. DHCP server messages such as DHCP OFFER and DHCP ACK are dropped when received on untrusted ports.Answer
  2. DHCP snooping must be enabled globally on the switch as well as explicitly enabled for target VLANs.Answer
  3. C
    All switch interfaces default to trusted ports immediately after DHCP snooping is enabled globally.
  4. D
    Dynamic ARP Inspection functions independently without referencing the DHCP snooping binding database.

Answer

DHCP server response messages (OFFER/ACK) received on untrusted interfaces are dropped, and DHCP snooping requires both global enablement and VLAN-specific configuration.
DHCP snooping categorizes switch interfaces into trusted and untrusted states. By default, all ports are untrusted and drop DHCP server responses (such as OFFER and ACK) to prevent rogue DHCP servers. Additionally, enabling the feature requires both global activation ('ip dhcp snooping') and VLAN-specific activation ('ip dhcp snooping vlan').

Step-by-Step Solution

1
Determine default port trust behavior for DHCP Snooping.
When DHCP snooping is enabled, all switch interfaces default to an untrusted state. Untrusted ports block incoming DHCP server response messages (OFFER, ACK, LEASEQUERY) to prevent rogue DHCP server attacks.
Restricting server traffic on user-facing access ports is the primary security function of DHCP snooping.
2
Identify mandatory switch configuration steps.
DHCP snooping requires global activation using the 'ip dhcp snooping' command in global configuration mode, as well as enabling the feature on specific VLANs via 'ip dhcp snooping vlan <vlan-id>'.
Both global and VLAN configuration commands are necessary for the switch to begin inspecting DHCP traffic.

Key Concept

DHCP Snooping Operational Rules and Port Trust Behavior
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic