5.7 Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security).
Objective 5.7 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.
Objective title verbatim from the official objectives. Cisco exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Clients in VLAN 20 stopped getting addresses after snooping was turned on. Gi1/0/24 is the uplink toward the DHCP server.
Device# show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
20
Insertion of option 82 is enabled
Interface Trusted Rate limit (pps)
------------------------- ------- ----------------
GigabitEthernet1/0/1 no unlimited
GigabitEthernet1/0/24 no unlimitedWhich change restores addressing?
The concept
A switch that filters DHCP has to be told where the legitimate server sits. Every port starts out suspect, and server-sourced messages are only handed on out of ports an operator has marked as safe.
Why this answer
The uplink carrying replies from the server is still untrusted, so the offer coming back is discarded rather than handed to the client. Marking Gi1/0/24 as trusted lets server messages through while the access ports stay filtered.
- AOption 82 matters where an edge switch inserts it and an aggregation switch takes it in untrusted. Removing it changes nothing on this path.
- Correct. The server-facing port has to be trusted.
- CA rate limit caps how many DHCP packets a port may pass per second. Capping the client side would slow requests, not admit the replies.
- DThe output already lists VLAN 20 under snooping. Entering it again leaves the trust state of the uplink exactly where it is.
Now you: objective 5.7 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
A second PC was plugged into an access port through a hub and the link went down.
Device# show port-security interface gigabitethernet1/0/12
Port Security : Enabled
Port Status : Secure-shutdown
Violation Mode : Shutdown
Aging Time : 0 mins
Maximum MAC Addresses : 1
Total MAC Addresses : 1
Sticky MAC Addresses : 0
Last Source Address:Vlan : 0025.4b3a.19c0:20
Security Violation Count : 1Which action returns the port to service?
Sample question 2 of 2
A file server with a hand-configured address stops answering after dynamic ARP inspection is enabled on VLAN 30. Hosts that lease addresses are unaffected. What restores the server?
That’s 2 of the full CCNA bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.