200-301 Question 440
Single answerYou are tasked with securing a Layer 2 network in your organization. The DHCP server is located in VLAN 10, and you have configured DHCP snooping to protect against rogue DHCP servers. After implementing DHCP snooping, users in VLAN 20 are unable to obtain IP addresses. What could be the issue and how can you resolve it?
- A
The DHCP snooping database is out of sync and needs to be manually updated.
- B
You need to configure trusted interfaces for the uplink ports connecting to the DHCP server.
- C
Dynamic ARP Inspection (DAI) is not enabled, which is preventing IP address assignment.
- D
The VLAN 20 interface is not configured as a DHCP snooping-enabled VLAN.
Show answer and explanation
Correct answer: B
Explanation
In DHCP snooping, all interfaces are untrusted by default. For ports connecting to a legitimate DHCP server, they must be configured as trusted interfaces. If this is not done, the DHCP server's responses will be dropped, causing clients to fail in obtaining IP addresses. In this scenario, users in VLAN 20 are unable to get IP addresses due to the uplink port not being set as trusted.
- A. Incorrect.
While DHCP snooping uses a database to track bindings, the issue in this scenario is not related to the database being out of sync.
- B. Correct.
DHCP snooping requires trusted interfaces to be explicitly configured for ports where DHCP servers are connected. Without this configuration, DHCP traffic from the server will be dropped.
- C. Incorrect.
Dynamic ARP Inspection (DAI) is a separate security feature that relies on DHCP snooping but does not directly impact IP address assignment by DHCP servers.
- D. Incorrect.
VLANs must be explicitly enabled for DHCP snooping, but the scenario does not mention any misconfiguration related to enabling VLAN 20 for DHCP snooping.