Which of the following is a typical step in configuring DHCP Snooping to prevent rogue servers, as shown in example configurations?

Which of the following is a typical step in configuring DHCP Snooping to prevent rogue servers, as shown in example configurations?

• A. Enable DHCP Snooping with Option 82 enabled
• B. Enable DHCP Snooping with Option 82 disabled
• C. Disable DHCP Snooping entirely
• D. Enable DHCP Snooping and use static bindings only

Answer: (B)

DHCP Snooping protects endpoints by watching DHCP traffic and constructing a binding table, so only legitimate DHCP server responses are allowed back to clients on trusted ports. The Relay Agent Information option (Option 82) carries switch-port details to the DHCP server, which can support more precise policy and address assignment. In many Aruba example configurations aimed at preventing rogue servers, the typical step shown is enabling DHCP Snooping while keeping Option 82 disabled. This provides the essential protection without adding the complexity of relay-agent data management, ensuring rogue servers on untrusted ports can’t respond to clients while the switch filters communications based on the binding table. Enabling Option 82 is an additional capability that isn’t necessary for this baseline protection, and other options either remove protection entirely or impose a stricter, less flexible setup.

DHCP Snooping protects endpoints by watching DHCP traffic and constructing a binding table, so only legitimate DHCP server responses are allowed back to clients on trusted ports. The Relay Agent Information option (Option 82) carries switch-port details to the DHCP server, which can support more precise policy and address assignment. In many Aruba example configurations aimed at preventing rogue servers, the typical step shown is enabling DHCP Snooping while keeping Option 82 disabled. This provides the essential protection without adding the complexity of relay-agent data management, ensuring rogue servers on untrusted ports can’t respond to clients while the switch filters communications based on the binding table. Enabling Option 82 is an additional capability that isn’t necessary for this baseline protection, and other options either remove protection entirely or impose a stricter, less flexible setup.