Exam 350-701 topic 1 question 622 discussion

Actual exam question from Cisco's 350-701

Question #: 622
Topic #: 1

A network administrator has configured DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers from assigning IP addresses. During configuration, a device with MAC address 04:66:96:79:0:AB received an IP address from an unauthorized DHCP server. Which configuration step must the network administrator take to accomplish the requirement?

A. Apply DHCP option 82 to identify the trusted DHCP server.
B. Configure each device on the network to use authorize DHCP server manually.
C. Configure an access control list to only allow DHCP traffic from trusted DHCP server.
D. Implement DHCP option 82 to relay DHCP requests to the trusted DHCP server.

Show Suggested Answer

Suggested Answer: D 🗳️

by Premium_Pils at Sept. 5, 2024, 7:43 p.m.

Comments

Submit Cancel

luismg

Highly Voted 9 months, 2 weeks ago

Selected Answer: D

D is correct an ACL will not do anything on the same VLAN

upvoted 5 times

...

madboy2

Most Recent 3 months, 2 weeks ago

Selected Answer: C

Since a rogue DHCP server has assigned an IP address to a device (MAC: 04:66:96:79:0:AB), the administrator must block DHCP replies from unauthorized sources using an ACL to only allow traffic from the trusted DHCP server. ❌ A. Apply DHCP option 82 to identify the trusted DHCP server. Option 82 (DHCP Relay Agent Information) is used for tracking clients, not blocking rogue DHCP servers. ❌ B. Configure each device manually to use the authorized DHCP server. Manually assigning DHCP servers on all clients is not scalable and defeats the purpose of automated DHCP. ❌ D. Implement DHCP option 82 to relay DHCP requests to the trusted server. Option 82 does not block rogue servers, it only helps track DHCP request origins.

upvoted 2 times

...

houhou12322

8 months ago

It can be that DHCP Option 82 allows the DHCP server to receive additional information about the requesting device, such as its MAC address, VLAN ID, and other relevant attributes. And it make it easy to find the rouge DHCP server if the scenario is looking for the rouge

upvoted 1 times

...

kloug

8 months, 1 week ago

Answer c

upvoted 1 times

...

dfb0b7d

8 months, 4 weeks ago

Selected Answer: D

With the DHCP option-82 on untrusted port feature enabled, the switch does not drop DHCP packets that include option-82 information that are received on untrusted ports. https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/snoodhcp.html#wp1109594

upvoted 1 times

...

Premium_Pils

10 months ago

Selected Answer: C

An access list is not the right tool for this purpose, but it is closer to it than option 82. Setting the DHCP server manually is not really practical. The purpose of dynamic IP assignment is to avoid cumbersome manual IP settings on each client.

upvoted 2 times

Premium_Pils

10 months ago

DHCP snooping is the appropriate tool to prevent rouge servers replying the requests, however, access-lists could be a temporary work around until DHCP snooping implementation is not finished.

upvoted 1 times

...

Premium_Pils

10 months ago

I think this is about a rouge DHCP server sending a DHCP reply to a DHCP client. Could someone explain to me please, how would the option 82 prevent that? I think that option 82 is rather for verifying if the client is legitimate for receiving a reply, and can also be used for assigning an IP based on the client information (provided by the switch).

upvoted 1 times

...