nerdexam
Cisco

350-701 · Question #689

A network administrator has configured DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers from assigning IP addresses. During configuration, a device with MAC address…

The correct answer is D. Implement DHCP option 82 to relay DHCP requests to the trusted DHCP server. To prevent unauthorized DHCP servers from assigning IP addresses, the administrator must ensure DHCP requests are handled by a trusted server, potentially leveraging DHCP option 82 for enhanced security.

Submitted by deeparc· Mar 30, 2026Implement Layer 2 Security

Question

A network administrator has configured DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers from assigning IP addresses. During configuration, a device with MAC address 04:66:96:79:0:AB received an IP address from an unauthorized DHCP server. Which configuration step must the network administrator take to accomplish the requirement?

Options

  • AApply DHCP option 82 to identify the trusted DHCP server.
  • BConfigure each device on the network to use authorize DHCP server manually.
  • CConfigure an access control list to only allow DHCP traffic from trusted DHCP server.
  • DImplement DHCP option 82 to relay DHCP requests to the trusted DHCP server.

How the community answered

(20 responses)
  • A
    15% (3)
  • B
    5% (1)
  • C
    5% (1)
  • D
    75% (15)

Why each option

To prevent unauthorized DHCP servers from assigning IP addresses, the administrator must ensure DHCP requests are handled by a trusted server, potentially leveraging DHCP option 82 for enhanced security.

AApply DHCP option 82 to identify the trusted DHCP server.

DHCP option 82 is inserted by the switch (relay agent) into client requests, not applied to identify the trusted DHCP server itself.

BConfigure each device on the network to use authorize DHCP server manually.

Configuring each device to use an authorized DHCP server manually is impractical at scale and bypasses the automated benefits and security features of DHCP snooping.

CConfigure an access control list to only allow DHCP traffic from trusted DHCP server.

While an access control list can filter traffic, DHCP snooping is a more specific and robust Layer 2 security feature designed precisely to prevent unauthorized DHCP server activity, offering more granular control than a simple ACL for DHCP traffic.

DImplement DHCP option 82 to relay DHCP requests to the trusted DHCP server.Correct

Implementing DHCP option 82 allows the switch to insert relay agent information into DHCP requests, which helps a trusted DHCP server enforce policies and validate the origin of requests, making it harder for unauthorized servers to provide valid leases, especially in a relay scenario.

Concept tested: DHCP snooping and option 82 security

Source: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/dps/dhcpsnop.html

Topics

#DHCP snooping#Layer 2 security#DHCP Option 82#DHCP relay

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 350-701 Practice