무료 온라인 액세스 Cisco.200-301-KR.v2026-03-23.q473 모의 시험 (Page 23)

200-301-KR 문제 106

가짜 DHCP 서버를 식별하는 데 무엇이 사용됩니까?

A. DHCP요청

B. DHCP 검색

C. DHCPACK

D. DHCP 제안

정답: D

DHCPOFFER is used to identify spurious DHCP servers. A spurious DHCP server is any device that is configured to act as a DHCP server without the network administrator's knowledge or permission. A spurious DHCP server can cause network problems by assigning incorrect or duplicate IP addresses to clients, or by redirecting traffic to malicious gateways. To prevent such attacks, the DHCP snooping feature can be enabled on switches to filter out invalid or unauthorized DHCP messages from untrusted sources1.
DHCP snooping works by intercepting and validating DHCP messages on a per-VLAN basis. The switch maintains a DHCP snooping binding database that contains information about the trusted hosts with leased IP addresses, such as MAC address, IP address, lease time, binding type, VLAN number, and interface information2. The switch also classifies its ports as trusted or untrusted. Trusted ports are those that connect to authorized DHCP servers or other trusted switches. Untrusted ports are those that connect to untrusted hosts or devices. The switch only allows DHCP messages from trusted ports, and drops any DHCP messages from untrusted ports that do not match the information in the binding database3.
The switch uses DHCPOFFER messages to identify spurious DHCP servers. A DHCPOFFER message is a response from a DHCP server to a client's request for an IP address. The message contains the offered IP address, subnet mask, default gateway, and other configuration parameters for the client4. When the switch receives a DHCPOFFER message from an untrusted port, it compares the source MAC address and the offered IP address with the binding database. If there is no match, the switch considers the message as coming from a spurious DHCP server and drops it. The switch also logs an error message and increments a counter for the number of dropped messages5.
References:
* 1: Configuring DHCP Snooping - Cisco
* 2: Catalyst 6500 Release 12.2SX Software Configuration Guide - DHCP Snooping Binding Database
* 3: What is DHCP Snooping? - IONOS
* 4: Dynamic Host Configuration Protocol (DHCP) and Bootstrap Protocol (BOOTP) Parameters
* 5: Configuring DHCP Snooping - Cisco

200-301-KR 문제 107

전시물을 참고하세요.

라우터 R4의 FastEthernetO/1 인터페이스에 연결된 호스트에 대해 DHCP 주소 지정을 활성화하는 구성은 무엇입니까?

A. FastEthernet0/0 인터페이스
IP 도우미 주소 10.0.1.1
나
액세스 목록 100 허용 udp 호스트 10.0.1.1 eq bootps 호스트 10.148.2.1

B. FastEthernet0/1 인터페이스
IP 도우미 주소 10.0.1.1
!
액세스 목록 100 허용 udp 호스트 10.0.1.1 eq bootps 호스트 10.148.2.1

C. FastEthernot0/1 인터페이스
IP 도우미 주소 10.0.1.1
!
액세스 목록 100 허용 tcp 호스트 10.0.1.1 eq 67 호스트 10.148.2.1

D. FastEthernetO/0 인터페이스
IP 도우미 주소 10.0.1.1
나
액세스 목록 100 허용 호스트 10.0.1.1 호스트 10.148.2.1 eq bootps

200-301-KR 문제 108

네트워크 엔지니어는 새 Cisco IOS 라우터에서 액세스 목록을 구성해야 합니다. 액세스 목록은 192.168.240.0/20 네트워크에서 10.125.128.32/27 네트워크로의 HTTP 트래픽을 거부해야 하지만 192.168.240.0/20 네트워크가 10.0.0.0/8 네트워크의 나머지 부분에 도달하도록 허용해야 합니다. 엔지니어는 어떤 구성을 적용해야 합니까?