350-701 · Question #190
Refer to the exhibit. An organization is using DHCP Snooping within their network. A user on VLAN 41 on a new switch is complaining that an IP address is not being obtained. Which command should be co
The correct answer is D. ip dhcp snooping trust. To resolve the IP address acquisition issue with DHCP Snooping enabled, the interface connected to the legitimate DHCP server or other trusted network device must be configured as trusted.
Question
Refer to the exhibit. An organization is using DHCP Snooping within their network. A user on VLAN 41 on a new switch is complaining that an IP address is not being obtained. Which command should be configured on the switch interface in order to provide the user with network connectivity?
Exhibit
Options
- Aip dhcp snooping verify mac-address
- Bip dhcp snooping limit 41
- Cip dhcp snooping vlan 41
- Dip dhcp snooping trust
How the community answered
(29 responses)- A3% (1)
- B17% (5)
- C7% (2)
- D72% (21)
Why each option
To resolve the IP address acquisition issue with DHCP Snooping enabled, the interface connected to the legitimate DHCP server or other trusted network device must be configured as trusted.
The `ip dhcp snooping verify mac-address` command enables MAC address verification, which is not the primary issue preventing DHCP offers from reaching the user.
The `ip dhcp snooping limit` command sets a rate limit for DHCP messages on an untrusted interface, which would further restrict traffic rather than enable necessary DHCP communication.
The `ip dhcp snooping vlan 41` command enables DHCP snooping globally for a specific VLAN but does not configure the trust state of an individual interface through which the DHCP server communicates.
DHCP snooping is a security feature that filters untrusted DHCP messages; therefore, interfaces connected to legitimate DHCP servers or to other trusted switches must be configured with `ip dhcp snooping trust` to allow DHCP offer and ACK messages to pass. Without this trust configuration, the user on VLAN 41 will not receive an IP address.
Concept tested: DHCP Snooping trusted interface configuration
Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/security/configuration_guide/b_sec_3se_3850_cg/b_sec_3se_3850_cg_chapter_0100.html
Topics
Community Discussion
No community discussion yet for this question.