A water utility wants access ports to forward only traffic sourced from IP addresses learned via legitimate DHCP for that port. Which feature depends on the DHCP snooping binding table to enforce that?
Select an answer to reveal the explanation.
Short Explanation
IP Source Guard checks each packet’s source against the DHCP snooping guest list for that port. Spoofed IPs that never got a real lease get shown the door.
Full Explanation
IP Source Guard filters client traffic using the DHCP snooping binding table (optionally with static bindings) so only authorized source IP and typically MAC combinations leave the port. A water utility that wants access ports to forward only traffic sourced from IPs learned via legitimate DHCP depends on that binding-driven IPSG enforcement.
Flexible NetFlow sampled on the core only observes flows; it does not enforce DHCP-derived source validity on access ports. MST region name matching across closets is a spanning-tree consistency topic. LLDP-MED policy for voice VLANs without snooping does not build or enforce DHCP source bindings.
Exam caveat: IPSG needs the snooping binding table—enable and trust snooping correctly before expecting source guard to work.
Operational check: verify DHCP snooping bindings per water-utility access port, enable IPSG, attempt a spoofed source IP, confirm drops, and ensure legitimate leased hosts still pass. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change.