Preventing Unauthorized DHCP Servers on Cisco Switches
A network administrator has configured DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers from assigning IP addresses. During configuration, a device with MAC address 04:66:96:79:0:AB received an IP address from an unauthorized DHCP server. Which configuration step must the network administrator take to accomplish the requirement?
Community Votes
56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept is distinguishing between DHCP Option 82 (relay agent info for tracking/identification) and ACLs (traffic filtering). The trap is confusing Option 82's role in identifying client location with its ability to block unauthorized responses.
This question addresses the configuration of DHCP snooping to mitigate rogue DHCP server attacks. The correct approach involves filtering traffic at the switch level using an Access Control List (ACL) to ensure only trusted servers can respond.
Many candidates select D, incorrectly believing that DHCP Option 82 prevents rogue servers from assigning IPs. In reality, Option 82 adds information to requests but does not filter incoming DHCPOFFER packets from unauthorized sources.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The primary defense against a rogue DHCP server already active on the network segment is to filter the specific traffic it generates. While DHCP snooping builds a binding database, applying an ACL on the interface or VLAN allows the administrator to explicitly permit DHCP messages (specifically DHCPOFFERS and DHCPACKs) only from the MAC address or IP of the trusted server. This effectively blocks the rogue server's replies from reaching clients.Why the Other Options Are Wrong
Option A and D suggest using DHCP Option 82. Option 82 is the Relay Agent Information option, used by switches to insert circuit ID and port information into DHCP requests so the server can identify the client's physical location. It does not have a mechanism to drop or filter incoming response packets from unauthorized servers. Option B suggests manual configuration, which is operationally unscalable and defeats the purpose of dynamic addressing.Community Comment Notes
Community discussion highlights the confusion around Option 82. User 'luismg' correctly notes that "an ACL will not do anything on the same VLAN" is false; ACLs work perfectly within a VLAN to filter traffic. User 'dfb0b7d' links to Cisco documentation regarding Option 82 on untrusted ports, but this feature typically controls whether the switch drops packets containing Option 82, not packets from rogue servers. User 'kloug' votes for C, aligning with the filtering logic required to stop the rogue assignment.Exam Strategy
When dealing with DHCP security questions, always distinguish between identification (Option 82) and enforcement (ACLs/Snooping). If the goal is to stop an active rogue server from responding, look for filtering mechanisms like ACLs or strict snooping enforcement, not informational options.
Frequently Asked Questions
Why isn't DHCP Option 82 the solution?
Option 82 inserts relay agent info into requests for tracking. It does not filter or drop incoming DHCPOFFER packets from unauthorized servers.
Can ACLs block DHCP on the same VLAN?
Yes. An inbound ACL on the switch port or VLAN interface can filter DHCP reply packets based on source MAC/IP, blocking rogue servers.