CCNP Security Question of the Week: Disable DHCP Server Service

July 24, 2015 Johnny Bass Cisco, Cloudera, Featured, Professional Development, Project Management, Routing & Switching, Technology, Training in Business

A network printer has a DHCP server service that cannot be disabled. How can a layer 2 switch be configured to block the printer from causing any issues on the network?

A. Remove the ip helper-address
B. Configure an ACL to block outbound TCP port 68
C. Configure DHCP snooping
D. Configure port-security

Reveal Answer

Answer: C.

Removing the helper address won’t stop a device, within the VLAN, from seeing the DHCP server on the printer. Although port 68 is used for DHCP, blocking in the outbound direction would not stop DHCP from functioning, although inbound would. Port security will lock the port down to the single MAC address of the printer and the DHCP server built into the printer would use the same MAC, so there would be no impact. Enabling DHCP snooping will make all ports untrusted for a DHCP server, therefore all offers would be dropped before they could get to the clients.

Related Resources
Cisco White Papers

Related Course
CCNP Security e-Camp

CCNP Security Question of the Week Series

CCNP Security Question of the Week: Cisco ASA Security Context
CCNP Security Question of the Week: Authenticating ASDM Users
CCNP Security Question of the Week: Layer 5–7 Policy Maps
CCNP Security Question of the Week: 802.1X
CCNP Security Question of the Week: IPS Updates
CCNP Security Question of the Week: IPsec VPN Tunnels
CCNP Security Question of the Week: AnyConnect VPN Client
CCNP Security Question of the Week: ASA AIP-SSM and ASA AIP-SSC
CCNP Security Question of the Week: Disable DHCP Server Service

Please support our Sponsors here :