Configuring DHCP Snooping can be used to prevent bogus attacks. Which of the following steps need to be included in the configuration process? (Multiple choice)

Question

Options

• AEnable the DHCP Snooping function on the interface or VLAN
• BEnable global DAI Snooping function
• CConfigure interface trust status
• DEnable global DHCP function

• A
  74% (35)
• B
  26% (12)

Explanation

DHCP Snooping requires three key steps: enabling it globally (D), applying it to specific interfaces or VLANs (A), and defining which ports are "trusted" vs. "untrusted" (C) - trusted ports allow DHCP server replies, while untrusted ports (client-facing) block rogue DHCP responses. Without all three, either the feature isn't active, isn't applied where traffic flows, or can't distinguish legitimate from bogus DHCP servers.

Option B is wrong because DAI (Dynamic ARP Inspection) is a separate Layer 2 security feature - it uses the DHCP Snooping binding table but is configured independently and is not part of the DHCP Snooping setup process itself.

Memory tip: Think of it as Global → Local → Trust (D → A → C): you always go from the widest scope to the narrowest. If you see "DAI" in a DHCP Snooping question, it's a distractor - DAI is a consumer of DHCP Snooping data, not a step in configuring it.

No community discussion yet for this question.