312-50 Question 189
Single answer▪ Sniffing Technique: DHCP AttacksDuring an internal security assessment, a tester connects to a user VLAN and notices intermittent loss of connectivity on multiple endpoints. Packet captures show a burst of DHCPDISCOVER messages from many spoofed source MAC addresses, followed by legitimate clients failing to obtain leases. The assessment objective is to identify the attack in progress and recommend the most effective switch-level control to stop it without disabling legitimate DHCP services. Which option best addresses this scenario?
- A
A DHCP starvation attack is occurring; enable DHCP snooping on the access switches and trust only the uplink toward the legitimate DHCP server
- B
A rogue DHCP server attack is occurring; configure Dynamic ARP Inspection on all switch ports to block unauthorized DHCP OFFER packets
- C
A MAC flooding attack is occurring; enable port mirroring so the switch can capture excess MAC addresses and preserve DHCP availability
- D
An ARP spoofing attack is occurring; enable IP Source Guard only on the DHCP server port so clients can continue requesting leases
Show answer and explanation
Correct answer: A
Explanation
This scenario matches a DHCP starvation attack: the attacker sends numerous DHCPDISCOVER or DHCPREQUEST messages using spoofed MAC addresses until the DHCP server's available lease pool is exhausted. The practical impact is denial of service for legitimate clients. In enterprise switched networks, the best-practice mitigation is DHCP snooping, a feature supported on many managed switches. DHCP snooping classifies interfaces as trusted or untrusted, permits DHCP server replies only from trusted ports, and builds a binding table that can also support related protections such as Dynamic ARP Inspection and IP Source Guard. The legitimate uplink toward the real DHCP server should be trusted, while user-facing access ports remain untrusted. Vendor guidance from common enterprise switch platforms consistently recommends DHCP snooping to mitigate DHCP-based attacks, including starvation and rogue DHCP exposure when properly configured.
- A. Correct.
Correct. The burst of DHCPDISCOVER messages from many spoofed MAC addresses is characteristic of a DHCP starvation attack. The attacker attempts to exhaust the DHCP scope so valid clients cannot obtain addresses. A standard mitigation is DHCP snooping on switches, with only the port toward the authorized DHCP server marked as trusted and untrusted access ports rate-limited or filtered. This helps prevent malicious DHCP behavior at the switch edge while allowing legitimate DHCP traffic.
- B. Incorrect.
Incorrect. A rogue DHCP server attack involves an unauthorized host sending DHCP OFFER or ACK messages to clients, often to redirect traffic through an attacker-controlled gateway or DNS server. The scenario instead describes exhaustion of leases through many spoofed client requests, which indicates starvation. Dynamic ARP Inspection is designed to validate ARP packets against DHCP snooping bindings, not to directly block unauthorized DHCP OFFER messages by itself.
- C. Incorrect.
Incorrect. MAC flooding targets the CAM table by overwhelming the switch with many fake source MAC addresses so the switch may fail open and flood frames. While spoofed MACs appear in DHCP starvation, the direct symptom here is depletion of DHCP leases, not switch CAM-table exhaustion. Port mirroring is a monitoring feature and does not mitigate the attack.
- D. Incorrect.
Incorrect. ARP spoofing manipulates Layer 2-to-Layer 3 address associations to intercept traffic, which is not the main issue described. IP Source Guard can help limit IP/MAC spoofing on untrusted ports when used with DHCP snooping bindings, but enabling it only on the DHCP server port would not stop clients on access ports from sending large numbers of fraudulent DHCP requests.