A network engineer wants to stop a rogue or misconfigured DHCP server plugged into an access port from handing out incorrect IP addresses to nurse-station devices on a ward switch. Which switch feature should be enabled to block DHCP server responses coming from untrusted ports?

DHCP snooping inspects DHCP traffic at the switch and enforces a trust boundary: only ports explicitly designated as trusted, typically the uplink toward the real DHCP server, are allowed to forward DHCP server messages like offers and acknowledgments, while any such message arriving on an untrusted access port, where the rogue device is plugged in, gets dropped before it ever reaches a client. This directly stops a nurse-station device from being handed a bad lease by whatever got connected to that ward's access port. Port security addresses a different problem entirely, limiting how many or which MAC addresses can appear on a port; a rogue DHCP server could easily have a single legitimate-looking MAC and still pass a MAC-count check while still handing out bad leases. BPDU guard protects against a device injecting spanning-tree bridge traffic that could alter the topology, which has nothing to do with filtering DHCP server responses. 802.1X authenticates the identity of whatever connects to the port before granting network access, but an already-authenticated or exempted device could still run a DHCP server; 802.1X doesn't inspect or filter DHCP message types at all. Caveat: DHCP snooping also builds a binding table that other features like dynamic ARP inspection rely on, so enabling it has value beyond this one scenario. A concrete check is connecting a test DHCP server to an untrusted port and confirming its offers never reach a client.