352-001 · Question #755
A customer requests a design that ensures that client devices are not dynamically configured with incorrect DNS information. Which security technology must be configured on core switches when…
The correct answer is A. DHCP snooping. DNS server addresses are typically delivered to client devices dynamically as part of the DHCP lease (DHCP Option 6). A rogue or misconfigured DHCP server on the network can hand out malicious or incorrect DNS server addresses, redirecting clients to attacker-controlled…
Question
A customer requests a design that ensures that client devices are not dynamically configured with incorrect DNS information. Which security technology must be configured on core switches when finalising the network design?
Options
- ADHCP snooping
- BIGMP snooping
- Croot guard
- DDNS snooping
How the community answered
(46 responses)- A72% (33)
- B15% (7)
- C4% (2)
- D9% (4)
Explanation
DNS server addresses are typically delivered to client devices dynamically as part of the DHCP lease (DHCP Option 6). A rogue or misconfigured DHCP server on the network can hand out malicious or incorrect DNS server addresses, redirecting clients to attacker-controlled resolvers. DHCP snooping is a Layer 2 security feature configured on switches that classifies switch ports as either 'trusted' (uplinks to legitimate DHCP servers) or 'untrusted' (client-facing ports). It drops DHCP server responses (OFFER, ACK, NAK) arriving on untrusted ports, ensuring only the authorized DHCP server can configure clients. This directly prevents incorrect DNS information from being distributed. IGMP snooping is for multicast optimization, root guard is for STP topology protection, and 'DNS snooping' is not a standard security technology.
Topics
Community Discussion
No community discussion yet for this question.