312-50 Question 187
Single answer▪ Sniffing Technique: DHCP AttacksDuring an internal security assessment, you connect a test laptop to a corporate access switch and observe that some newly connected client systems intermittently receive incorrect default gateway and DNS settings. Packet captures show DHCP Offer messages arriving from both the legitimate DHCP server and an unknown host on the same VLAN. The security team wants to stop this DHCP-based sniffing/man-in-the-middle risk at the switch level without breaking normal DHCP service. Which control should be implemented first?
- A
Enable DHCP snooping on the VLAN and mark only the uplink toward the authorized DHCP server as trusted
- B
Enable Dynamic ARP Inspection on all switch ports and leave DHCP unchanged
- C
Configure port mirroring on the access switch to monitor DHCP traffic from all clients
- D
Deploy Network Address Translation on the access switch to rewrite DHCP replies
Show answer and explanation
Correct answer: A
Explanation
This scenario describes a classic rogue DHCP attack, often used to support traffic interception. An attacker on the same broadcast domain responds faster than, or alongside, the legitimate DHCP server and provides malicious network parameters such as a fake default gateway or attacker-controlled DNS server. That can position the attacker for sniffing, redirection, or man-in-the-middle attacks. The most appropriate first control at the switch layer is DHCP snooping, which is specifically designed to filter DHCP server messages based on port trust. On enterprise switches, best practice is to configure access ports as untrusted by default and trust only the interface(s) leading to the legitimate DHCP infrastructure. DHCP snooping is also foundational for other protections such as IP source guard and Dynamic ARP Inspection. Vendor documentation from major switch platforms, including Cisco, consistently identifies DHCP snooping as the primary mitigation for rogue DHCP servers.
- A. Correct.
Correct. This is the standard switch-level defense against rogue DHCP servers. DHCP snooping classifies interfaces as trusted or untrusted, permits DHCP server replies only on trusted ports, and drops unauthorized DHCP Offer/Ack packets arriving on untrusted access ports. This directly mitigates rogue DHCP attacks that can redirect clients to an attacker-controlled gateway or DNS server for sniffing or man-in-the-middle activity.
- B. Incorrect.
Incorrect. Dynamic ARP Inspection helps defend against ARP spoofing/poisoning, not rogue DHCP Offer messages. Although DAI often relies on the DHCP snooping binding table and is valuable in a layered defense, enabling DAI alone does not stop an attacker from acting as a rogue DHCP server and handing out malicious gateway or DNS information.
- C. Incorrect.
Incorrect. Port mirroring is a monitoring feature, not a preventive control. It can help an analyst capture and investigate DHCP traffic, but it does not block rogue DHCP responses or protect clients from accepting malicious lease information.
- D. Incorrect.
Incorrect. NAT is not used to control or sanitize DHCP server replies on access switches in this context. DHCP is a broadcast-based client/server configuration protocol, and NAT does not solve the problem of unauthorized DHCP Offers from a rogue host on the local VLAN.