Examkin

Question

Difficulty: EasyLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

When DHCP snooping is enabled globally on a Cisco switch, what default trust state is assigned to all Layer 2 interfaces across the switch?

  1. UntrustedAnswer
  2. B
    Trusted
  3. C
    Disabled
  4. D
    Promiscuous

Answer

Untrusted is the default trust state assigned to all switch interfaces when DHCP snooping is enabled.
When DHCP snooping is enabled, all interfaces default to an untrusted state. Untrusted interfaces can send DHCP requests but are prohibited from forwarding DHCP server responses like DHCP OFFER, ACK, or NAK packets.

Step-by-Step Solution

1
Identify the global default operational mode of DHCP snooping upon activation on a Cisco switch.
DHCP snooping classifies switch interfaces into two operational categories: trusted and untrusted.
Security features operate under the principle of least privilege, defaulting to untrusted to immediately filter unverified DHCP responses.
2
Determine the default status of switch ports.
All Layer 2 switch ports start as untrusted ports.
Only designated ports connected to legitimate DHCP servers or network uplink switches should be manually set to trusted using the 'ip dhcp snooping trust' command.

Key Concept

DHCP Snooping Interface Trust States
Estimated Time:45s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic