Which command sequence correctly enables DHCP snooping on a switch and configures VLANs and interface trust to prevent rogue DHCP servers from affecting the network?

Which command sequence correctly enables DHCP snooping on a switch and configures VLANs and interface trust to prevent rogue DHCP servers from affecting the network?

• A. dhcp-snooping enable no dhcp-snooping option 82 dhcp-snooping vlan 100-120 vlan 100 name cornmill vlan 120 name packagtng interface lag 1 no shutdown description Uplink-to-Core no routing vlan trunk native 1 vlan trunk allowed all lacp mode active dhcp-snooping trust
• B. dhcp snooping enable no dhcp-snooping option 82 vlan 100 name cornflakes dhcp-snooping vlan 110 name cornmlll dhcp-snooping vlan 120 name packagtng dhcp-snooping interface lag 1 no shutdown description Uplink-to-Core no routing vlan trunk native 1 vlan trunk allowed all lacp mode active dhcp snooping trust
• C. dncpv4-snooptng all vlans no dhcpv4-snooping option 82 interface lag 1 no shutdown description Uplink-to-Core no routing vian trunk native 1 vian trunk allowed all lacp mode active dhcpv4-snooping trust
• D. dhcpv4-snoopjng no dhcpv4-snooping option 82 vian 100 name cornflakes dhcpv4-snooping vlan 110 name cornmll dhcpv4-snooptng vian 120 name packagjng dhcpv4-snooping interface lag 1 no shutdown descnptlion Uplink-to-Core no routing vian trunk native 1 vian trunk allowed all lacp mode active dhcnva-snooping trust

Answer: (B)

DHCP snooping protects the network by allowing DHCP responses only from trusted servers and by tying client ports to the networks that have those servers. To implement this, you enable DHCP snooping globally, decide whether to use option 82 relay, specify which VLANs will participate, and mark the uplink or server-facing interfaces as trusted so legitimate DHCP replies can pass to clients. In the sequence that works, DHCP snooping is enabled globally, and option 82 is turned off (no dhcp-snooping option 82) to avoid injecting relay information unless you specifically need it. The relevant VLANs that carry client traffic are defined and have DHCP snooping enabled for them, ensuring only legitimate DHCP messages on those VLANs are processed. Finally, the uplink interface (the path to the DHCP servers or core) is configured as trusted, allowing the DHCP server responses to flow through, while client ports on access VLANs remain untrusted to block rogue servers from issuing IP addresses. The other options either mix up syntax or fail to enable DHCP snooping on the correct VLANs, omit enabling per-VLAN snooping, or neglect to designate a trusted uplink, which would leave client ports vulnerable to rogue DHCP servers.

DHCP snooping protects the network by allowing DHCP responses only from trusted servers and by tying client ports to the networks that have those servers. To implement this, you enable DHCP snooping globally, decide whether to use option 82 relay, specify which VLANs will participate, and mark the uplink or server-facing interfaces as trusted so legitimate DHCP replies can pass to clients.

In the sequence that works, DHCP snooping is enabled globally, and option 82 is turned off (no dhcp-snooping option 82) to avoid injecting relay information unless you specifically need it. The relevant VLANs that carry client traffic are defined and have DHCP snooping enabled for them, ensuring only legitimate DHCP messages on those VLANs are processed. Finally, the uplink interface (the path to the DHCP servers or core) is configured as trusted, allowing the DHCP server responses to flow through, while client ports on access VLANs remain untrusted to block rogue servers from issuing IP addresses.

The other options either mix up syntax or fail to enable DHCP snooping on the correct VLANs, omit enabling per-VLAN snooping, or neglect to designate a trusted uplink, which would leave client ports vulnerable to rogue DHCP servers.