300-320 · Question #603
Which two actions can be taken on Cisco LAN switches to provide basic denial-of-service protection? (Choose two.)
The correct answer is A. Enable DHCP Snooping E. Enable IP Source Guard. DHCP Snooping (A) protects against DHCP-based DoS attacks such as DHCP starvation (exhausting the address pool) and rogue DHCP servers. It builds a binding table of legitimate IP-to-MAC-to-port mappings used by other features. IP Source Guard (E) uses the DHCP snooping binding…
Question
Which two actions can be taken on Cisco LAN switches to provide basic denial-of-service protection? (Choose two.)
Options
- AEnable DHCP Snooping
- BDisable PortFast
- CEnable BPDU Guard
- DDisable Spanning Tree Protocol
- EEnable IP Source Guard
How the community answered
(22 responses)- A86% (19)
- B9% (2)
- C5% (1)
Explanation
DHCP Snooping (A) protects against DHCP-based DoS attacks such as DHCP starvation (exhausting the address pool) and rogue DHCP servers. It builds a binding table of legitimate IP-to-MAC-to-port mappings used by other features. IP Source Guard (E) uses the DHCP snooping binding table to filter ingress traffic, blocking packets with spoofed source IP addresses - directly mitigating IP spoofing-based DoS attacks. Enabling BPDU Guard (C) protects STP topology but is not a DoS protection mechanism. Disabling PortFast (B) only slows convergence. Disabling STP (D) would actually create broadcast storms and loops, which is itself a DoS condition.
Topics
Community Discussion
No community discussion yet for this question.