Exam 200-301 topic 1 question 701 discussion

DRAG DROP - Drag and drop the Cisco IOS attack mitigation features from the left onto the types of network attack they mitigate on the right. Select and Place:

Agree with Anon1216, given answer is not correct. DHCP snooping: a security technology on a Layer 2 network switch that can prevent unauthorized DHCP servers from accessing your network. It is a protection from the untrusted hosts that want to become DHCP servers. -- rogue server that spoofs IP configuration Dynamic ARP Inspection (DAI): helps prevent ARP cache poisoning attacks by validating ARP packets and ensuring they come from legitimate sources. (man-in-the-middle attack) -- cache poisoning IP source guard: only allow hosts which IP address was assigned by dhcp server(valid source), its relies on the information from DHCP snooping database to do its work. block all other traffic. -- rogue clients on the network Storm control: excessive broadcast storm makes netwrok suffer badly, Storm control enables the switch to monitor traffic levels and to drop broadcast, multicast, and unknown unicast packets (when storm control level—is exceeded). -- flood attacks

a rogue DHCP server is one that is not authorized to provide IP addresses to devices on your network. >>> prevented by DHCP snooping A rogue client is an unauthorized device that has been found communicating and accessing an authorized network. >>> prevented by IP source guard

I absolutely agree with you. What you have given is the correct answer. Thank you

I think you are correct. People are getting hung up on the "Rogue Server" and "spoofing IP configuration". It's extremely vague. Is it spoofing it's own IP configuration (IP Source Guard) or is it a DHCP server sending out spoofed DHCP packets (DHCP Snooping)? Spoofing IP Configuration would be a very odd way of saying sending out fake DHCP. So I think it would be IP source guard. Another terribly worded Cisco question.

The previous answers are correct, you did have the correct documentation but by cisco the best practices is to set DHCP snopping and trust just the dhcp server port meaning you don't need to validate anything else that way with the IP Source Guard. And you can have more than one rougue client on several ports, that's what you need to validate.

You can use IP source guard to prevent traffic attacks if a host tries to use the IP address of its neighbor and you can enable IP source guard when DHCP snooping is enabled on an untrusted interface....It filters traffic based on the DHCP snooping binding database and on manually configured IP source bindings...IPSG for static hosts allows IPSG to work without DHCP. https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_0110110.html#:~:text=You can use IP source,enabled on an untrusted interface.