Preventing Unauthorized DHCP Servers on Cisco Switches

350-701 By islever Editorial Last updated

Short answer

C Configure an access control list to only allow DHCP traffic from trusted DHCP server.

Question

A network administrator has configured DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers from assigning IP addresses. During configuration, a device with MAC address 04:66:96:79:0:AB received an IP address from an unauthorized DHCP server. Which configuration step must the network administrator take to accomplish the requirement?
  1. Apply DHCP option 82 to identify the trusted DHCP server.
  2. Configure each device on the network to use authorize DHCP server manually.
  3. Configure an access control list to only allow DHCP traffic from trusted DHCP server. Correct Answer
  4. Implement DHCP option 82 to relay DHCP requests to the trusted DHCP server.

Key Takeaways

The core concept is distinguishing between DHCP Option 82 (relay agent info for tracking/identification) and ACLs (traffic filtering). The trap is confusing Option 82's role in identifying client location with its ability to block unauthorized responses.

This question addresses the configuration of DHCP snooping to mitigate rogue DHCP server attacks. The correct approach involves filtering traffic at the switch level using an Access Control List (ACL) to ensure only trusted servers can respond.

Common mistake: Many candidates select D, incorrectly believing that DHCP Option 82 prevents rogue servers from assigning IPs. In reality, Option 82 adds information to requests but does not filter incoming DHCPOFFER packets from unauthorized sources.

Expert Analysis

Why the Answer Is Correct

The primary defense against a rogue DHCP server already active on the network segment is to filter the specific traffic it generates. While DHCP snooping builds a binding database, applying an ACL on the interface or VLAN allows the administrator to explicitly permit DHCP messages (specifically DHCPOFFERS and DHCPACKs) only from the MAC address or IP of the trusted server. This effectively blocks the rogue server's replies from reaching clients.

Why the Other Options Are Wrong

Option A and D suggest using DHCP Option 82. Option 82 is the Relay Agent Information option, used by switches to insert circuit ID and port information into DHCP requests so the server can identify the client's physical location. It does not have a mechanism to drop or filter incoming response packets from unauthorized servers. Option B suggests manual configuration, which is operationally unscalable and defeats the purpose of dynamic addressing.

Community Comment Notes

Community discussion highlights the confusion around Option 82. User 'luismg' correctly notes that "an ACL will not do anything on the same VLAN" is false; ACLs work perfectly within a VLAN to filter traffic. User 'dfb0b7d' links to Cisco documentation regarding Option 82 on untrusted ports, but this feature typically controls whether the switch drops packets containing Option 82, not packets from rogue servers. User 'kloug' votes for C, aligning with the filtering logic required to stop the rogue assignment.

Exam Strategy

When dealing with DHCP security questions, always distinguish between identification (Option 82) and enforcement (ACLs/Snooping). If the goal is to stop an active rogue server from responding, look for filtering mechanisms like ACLs or strict snooping enforcement, not informational options.

Frequently Asked Questions

Why isn't DHCP Option 82 the solution?

Option 82 inserts relay agent info into requests for tracking. It does not filter or drop incoming DHCPOFFER packets from unauthorized servers.

Can ACLs block DHCP on the same VLAN?

Yes. An inbound ACL on the switch port or VLAN interface can filter DHCP reply packets based on source MAC/IP, blocking rogue servers.

More 350-701 FAQ →

Community Votes

D
56%
C
44%

56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. luismg 👍 4 Answered D
    D is correct an ACL will not do anything on the same VLAN
  2. madboy2 👍 2 Answered C
    Since a rogue DHCP server has assigned an IP address to a device (MAC: 04:66:96:79:0:AB), the administrator must block DHCP replies from unauthorized sources using an ACL to only allow traffic from the trusted DHCP server. ❌ A. Apply DHCP option 82 to identify the trusted DHCP server. Option 82 (DHCP Relay Agent Information) is used for tracking clients, not blocking rogue DHCP servers. ❌ B. Configure each device manually to use the authorized DHCP server. Manually assigning DHCP servers on all clients is not scalable and defeats the purpose of automated DHCP. ❌ D. Implement DHCP option 82 to relay DHCP requests to the trusted server. Option 82 does not block rogue servers, it only helps track DHCP request origins.
  3. Premium_Pils 👍 2 Answered C
    An access list is not the right tool for this purpose, but it is closer to it than option 82. Setting the DHCP server manually is not really practical. The purpose of dynamic IP assignment is to avoid cumbersome manual IP settings on each client.
  4. Premium_Pils 👍 1
    I think this is about a rouge DHCP server sending a DHCP reply to a DHCP client. Could someone explain to me please, how would the option 82 prevent that? I think that option 82 is rather for verifying if the client is legitimate for receiving a reply, and can also be used for assigning an IP based on the client information (provided by the switch).
  5. houhou12322 👍 1
    It can be that DHCP Option 82 allows the DHCP server to receive additional information about the requesting device, such as its MAC address, VLAN ID, and other relevant attributes. And it make it easy to find the rouge DHCP server if the scenario is looking for the rouge
Show 2 more comments
  1. dfb0b7d 👍 1 Answered D
    With the DHCP option-82 on untrusted port feature enabled, the switch does not drop DHCP packets that include option-82 information that are received on untrusted ports. https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/snoodhcp.html#wp1109594
  2. kloug 👍 1
    Answer c

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

IaaS Model Features and Customer Responsibilities

S-grade

← Back to 350-701 Study Guide