350-601 · Question #330
An engineer must implement a solution that prevents untrusted DHCP servers from compromising the network. The feature must be configured on a Cisco Nexus 7000 Series Switch and applied to VLAN 10…
The correct answer is C. n7k-1(config)# ip dhcp snooping vlan 10. To prevent untrusted DHCP servers on VLAN 10 of a Cisco Nexus 7000 Series Switch, DHCP snooping must be enabled specifically for that VLAN.
Question
An engineer must implement a solution that prevents untrusted DHCP servers from compromising the network. The feature must be configured on a Cisco Nexus 7000 Series Switch and applied to VLAN 10. The legitimate DHCP servers are connected to interface Ethernet 2/4. Which configuration set must be used to meet these requirements?
Options
- An7k-1(config)# ip dhcp snooping vlan 10
- Bn7k-1(config)# ip dhcp snooping verify
- Cn7k-1(config)# ip dhcp snooping vlan 10
- Dn7k-1(config)# ip dhcp snooping verify
How the community answered
(24 responses)- A4% (1)
- C92% (22)
- D4% (1)
Why each option
To prevent untrusted DHCP servers on VLAN 10 of a Cisco Nexus 7000 Series Switch, DHCP snooping must be enabled specifically for that VLAN.
Choice A is identical to choice C; assuming C is the designated correct answer, A would also be functionally correct.
The command ip dhcp snooping verify is used for verification purposes and does not enable DHCP snooping on a VLAN.
The command ip dhcp snooping vlan 10 enables DHCP snooping specifically for VLAN 10, which is the necessary first step to prevent untrusted DHCP servers from operating within that VLAN on a Cisco Nexus switch. This command tells the switch to start inspecting DHCP messages on all untrusted ports within VLAN 10.
The command ip dhcp snooping verify is used for verification purposes and does not enable DHCP snooping on a VLAN.
Concept tested: DHCP Snooping configuration
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/security/config/n7k_security_config/sec_dhcp.html
Topics
Community Discussion
No community discussion yet for this question.