nerdexam
GIAC

GCIH · Question #388

In a network switch, what is the benefit of comparing the MAC address of a host to a known list of DHCP assignments?

The correct answer is B. Protection from rogues DHCP serves. DHCP snooping builds a binding table mapping MAC addresses to DHCP-assigned IPs and uses it to block responses from unauthorized DHCP servers on untrusted switch ports.

Incident Response & Cyber Kill Chain

Question

In a network switch, what is the benefit of comparing the MAC address of a host to a known list of DHCP assignments?

Options

  • AConfirmation of the correct MAC addresses assigned to the subnets
  • BProtection from rogues DHCP serves
  • CEfficient distribution of IP addresses to reduce network congestion
  • DProtection from ARP based session hijacking attacks

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    73% (19)
  • C
    8% (2)
  • D
    15% (4)

Why each option

DHCP snooping builds a binding table mapping MAC addresses to DHCP-assigned IPs and uses it to block responses from unauthorized DHCP servers on untrusted switch ports.

AConfirmation of the correct MAC addresses assigned to the subnets

Confirming correct MAC addresses assigned to subnets describes general address management, not a security function derived from comparing MACs to DHCP lease records.

BProtection from rogues DHCP servesCorrect

DHCP snooping operates by comparing incoming DHCP offer/ack messages against a trusted binding table of known MAC-to-IP assignments. When a DHCP response arrives on an untrusted port and does not match the binding table, the switch drops the packet, preventing a rogue DHCP server from distributing false gateway or DNS configurations to clients.

CEfficient distribution of IP addresses to reduce network congestion

Efficient IP distribution and congestion reduction are handled by the DHCP protocol itself and QoS policies, not by validating MAC addresses against a DHCP binding table.

DProtection from ARP based session hijacking attacks

ARP-based session hijacking is mitigated by Dynamic ARP Inspection (DAI), a distinct feature that references the DHCP snooping binding table but is not itself DHCP snooping.

Concept tested: DHCP snooping binding table and rogue server prevention

Source: https://www.cisco.com/c/en/us/tech/lan-switching/dhcp-snooping/index.html

Topics

#DHCP snooping#rogue DHCP#MAC address validation#network defense

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice