Examkin

Question

Difficulty: MediumTroubleshooting IP Addressing and DHCP Services

Users on a corporate network segment suddenly report an inability to access internal intranet resources and the internet. A technician checks an affected client workstation and runs the `ipconfig /all` command, obtaining the following network output:

IPv4 Address. . . . . . . . . . . : 192.168.1.105(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1

The corporate network standard uses the 10.45.0.0/1610.45.0.0/16 address space, and authorized enterprise DHCP servers reside at 10.45.1.1010.45.1.10 and 10.45.1.1110.45.1.11. Which of the following is the most likely root cause of this connectivity failure?

  1. An unauthorized rogue DHCP server connected to the broadcast domain is responding to client lease requests before the enterprise server.Answer
  2. B
    The client workstation failed to communicate with any DHCP server and assigned itself an Automatic Private IP Addressing (APIPA) address.
  3. C
    The IP helper address configured on the Layer 3 switch interface is missing, blocking DHCP traffic from reaching the remote server.
  4. D
    The authorized corporate DHCP server scope has exhausted all usable host IP addresses in the subnet pool.

Answer

An unauthorized rogue DHCP server connected to the broadcast domain is responding to client lease requests before the enterprise server.
The output demonstrates that the client host successfully obtained an IP address lease (192.168.1.105192.168.1.105) from a DHCP server operating at 192.168.1.1192.168.1.1. Because the authorized corporate network utilizes the 10.45.0.0/1610.45.0.0/16 range and authorized DHCP servers at 10.45.1.1010.45.1.10 and 10.45.1.1110.45.1.11, the presence of a server issuing 192.168.1.x192.168.1.x leases indicates an unauthorized rogue DHCP server on the local broadcast domain.

Step-by-Step Solution

1
Analyze the output of `ipconfig /all` on the affected host
The host has been assigned IPv4 address 192.168.1.105192.168.1.105 by DHCP server 192.168.1.1192.168.1.1.
Determines the current IP parameters and identifies the server originating the lease.
2
Compare the assigned lease parameters against official enterprise baseline documentation
The assigned address (192.168.1.105192.168.1.105) and server (192.168.1.1192.168.1.1) do not match authorized corporate enterprise DHCP servers (10.45.1.1010.45.1.10 / 10.45.1.1110.45.1.11) or subnet bounds (10.45.0.0/1610.45.0.0/16).
Distinguishes between authorized network services and unauthorized/extraneous network devices.
3
Identify the cause of unauthorized lease assignment
A rogue DHCP server (such as a misconfigured SOHO router plugged into an Ethernet wall port) is replying to local broadcast DHCPDISCOVER requests faster than the legitimate remote enterprise DHCP servers.
DHCP operates on a first-come, first-served basis; local rogue responses often arrive before relayed responses from remote servers.

Key Concept

Rogue DHCP Server Detection and Troubleshooting
Rate this question

Topics

Troubleshooting IP Addressing and DHCP Services

More questions from this topic