Objective 5.7
200-301Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security).
Objective 5.7 sits in Security Fundamentals, which carries 15% of the CCNA exam. The questions below are original, written from the official objective title above, and each explanation cites the Cisco page it rests on.
Objective title verbatim from the official objectives. Cisco exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Clients in VLAN 20 stopped getting addresses after snooping was turned on. Gi1/0/24 is the uplink toward the DHCP server.
Device# show ip dhcp snoopingSwitch DHCP snooping is enabledDHCP snooping is configured on following VLANs:20Insertion of option 82 is enabledInterface Trusted Rate limit (pps)------------------------- ------- ----------------GigabitEthernet1/0/1 no unlimitedGigabitEthernet1/0/24 no unlimitedWhich change restores addressing?
Correct.
Checked against cisco.com, August 2026Concept
A switch that filters DHCP has to be told where the legitimate server sits. Every port starts out suspect, and server-sourced messages are only handed on out of ports an operator has marked as safe.
Why D
The uplink carrying replies from the server is still untrusted, so the offer coming back is discarded rather than handed to the client. Marking Gi1/0/24 as trusted lets server messages through while the access ports stay filtered.
Source
Cisco: Layer 2 security features, Catalyst 9300 configuration guides (IOS XE Amsterdam 17.3.x), checked August 2026For DHCP snooping to function properly, all DHCP servers must be connected to the switch through trusted interfaces, as untrusted DHCP messages will be forwarded only to trusted interfaces. An untrusted DHCP message is a message that is received through an untrusted interface. By default, the switch considers all interfaces untrusted.
Now you: objective 5.7 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A second PC was plugged into an access port through a hub and the link went down.
Device# show port-security interface gigabitethernet1/0/12Port Security : EnabledPort Status : Secure-shutdownViolation Mode : ShutdownAging Time : 0 minsMaximum MAC Addresses : 1Total MAC Addresses : 1Sticky MAC Addresses : 0Last Source Address:Vlan : 0025.4b3a.19c0:20Security Violation Count : 1Which action returns the port to service?
Sample question 2 of 3
A file server with a hand-configured address stops answering after dynamic ARP inspection is enabled on VLAN 30. Hosts that lease addresses are unaffected. What restores the server?
Sample question 3 of 3
An attacker sends faked ARP messages so that traffic for the gateway's IP goes to the attacker's MAC. What is the immediate effect?
That’s 3 of the full CCNA bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
- Cisco: Layer 2 security features, Catalyst 9300 configuration guides (IOS XE Amsterdam 17.3.x) ↗
- Cisco: Layer 2 security features, Catalyst 9300 configuration guides (IOS XE Amsterdam 17.3.x) ↗
- Cisco: Layer 2 security features, Catalyst 9300 configuration guides (IOS XE Amsterdam 17.3.x) ↗
- Juniper Junos OS: Protecting Against ARP Spoofing Attacks ↗
More objectives in Security Fundamentals
- 5.1 Define key security concepts (threats, vulnerabilities, exploits, and mitigation techniques).
- 5.2 Describe security program elements (user awareness, training, and physical access control).
- 5.4 Describe security password policy elements, such as management, complexity, and password alternatives (multifactor authentication, certificates, and biometrics).
- 5.5 Describe IPsec remote access and site-to-site VPNs.
- 5.6 Configure and verify access control lists.
- 5.8 Compare authentication, authorization, and accounting concepts.
- 5.9 Describe wireless security protocols (WPA, WPA2, and WPA3).
- 5.10 Configure and verify WLAN within the GUI using WPA2 PSK.