A network technician is investigating reports that several workstations on a corporate sub… — CompTIA Network+

A network technician is investigating reports that several workstations on a corporate subnet ( $10.250.12.0/24$ ) are intermittently assigned IP addresses in an unrecognized pool ( $172.16.99.0/24$ ), causing them to lose connection to internal network resources. Place the following troubleshooting and remediation steps in the correct chronological order from the initial diagnostic step to final verification.

1Run `ipconfig /all` on an affected workstation to record the assigned IP address, subnet mask, default gateway, and DHCP Server IP address.
2Cross-reference the reported DHCP Server IP address ( $172.16.99.254$ ) against documented enterprise DHCP server addresses to confirm the presence of a rogue DHCP server.
3Query the access switch MAC address table for the rogue server MAC address to identify the specific physical switch port transmitting unauthorized DHCP Offer packets.
4Administrative shut down of the compromised access port and enable DHCP Snooping with trusted uplink ports across the switch infrastructure.
5Execute `ipconfig /release` and `ipconfig /renew` on affected client workstations to obtain valid leases from the authorized DHCP server and verify gateway connectivity.

Answer

The correct troubleshooting sequence is: 1) Run `ipconfig /all` on an affected endpoint, 2) Compare the DHCP server IP address against authorized documentation, 3) Query switch MAC address tables to locate the rogue server switch port, 4) Shut down the switch port and enable DHCP Snooping on untrusted ports, 5) Perform `ipconfig /release` and `ipconfig /renew` on client endpoints and verify connectivity.

Following CompTIA's troubleshooting methodology, an engineer must first identify problem symptoms on affected endpoints (`ipconfig /all`). Analyzing the output reveals an unauthorized DHCP server IP address. Next, checking network documentation confirms the server is rogue. The engineer must then locate the rogue hardware by looking up its MAC address in access switch MAC tables. Once located, the engineer disables the rogue server's port and enables DHCP Snooping to prevent unauthorized DHCP offer packets on untrusted switch ports. Finally, affected clients release and renew their IP configurations to receive valid leases from the legitimate server.

Step-by-Step Solution

Identify client-side symptoms using terminal commands

Obtained the anomaly details, specifically that the client DHCP server IP is

172.16.99.254

CompTIA troubleshooting methodology dictates establishing the problem by gathering information directly from affected devices first.

Evaluate findings against baseline network documentation

Confirmed

172.16.99.254

is not listed among authorized corporate DHCP servers, confirming a rogue DHCP server.

Distinguishing between authorized network servers and rogue devices requires comparing configuration details against established documentation.

Locate the physical source of the rogue service

Mapped the rogue server's MAC address to a specific access port on the switch.

Tracing the MAC address through switch forwarding tables pins down the exact physical location of the rogue hardware.

Remediate the immediate vulnerability and implement hardening

The port hosting the rogue device is disabled, and DHCP Snooping is configured to drop unauthorized DHCP offers.

Administrative shutdown contains the issue, and security controls prevent recurrences of rogue DHCP servers on user ports.

Restore functionality and verify solution

Workstations obtain valid IP addresses from the legitimate server (

10.250.12.0/24

) and re-establish gateway connectivity.

Releasing and renewing leases clears invalid network settings and verifies that normal DHCP operations are restored.

Key Concept

Rogue DHCP Server Identification, Isolation, and DHCP Snooping Mitigation

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic