DHCP Snooping operates as a firewall at which layer in a typical network security model?

DHCP Snooping operates as a firewall at which layer in a typical network security model?

• A. Layer 3
• B. Layer 2
• C. Physical layer
• D. Application layer

Answer: (B)

DHCP Snooping is a Layer 2 security feature. It’s implemented in switches to filter DHCP traffic at the data link level, based on switch ports. The switch watches DHCP messages (Discover/Offer/Request/Ack) as they pass through untrusted ports, builds a binding table of IP-to-MAC associations, and then only allows DHCP responses from trusted ports (usually the port connected to a real DHCP server) to reach clients. This prevents rogue DHCP servers from handing out IP configurations. It doesn’t perform routing decisions (Layer 3), it isn’t a function of the physical layer, and DHCP itself is an application-layer protocol, but the enforcement mechanism sits in the switch at Layer 2.

DHCP Snooping is a Layer 2 security feature. It’s implemented in switches to filter DHCP traffic at the data link level, based on switch ports. The switch watches DHCP messages (Discover/Offer/Request/Ack) as they pass through untrusted ports, builds a binding table of IP-to-MAC associations, and then only allows DHCP responses from trusted ports (usually the port connected to a real DHCP server) to reach clients. This prevents rogue DHCP servers from handing out IP configurations.

It doesn’t perform routing decisions (Layer 3), it isn’t a function of the physical layer, and DHCP itself is an application-layer protocol, but the enforcement mechanism sits in the switch at Layer 2.