A bookstore provides a wired network for customers to learn online. However, one day, it was found that some users could not access the network, and after inspection, it was found that the IP resources of the DHCP address pool had been exhausted. Which of the following is the best way to solve the problem of the moment? ( Single choice questions).

The problem is DHCP address pool exhaustion, which is often caused by a DHCP starvation attack. In this attack, a malicious user on a single port rapidly sends DHCP requests with forged MAC addresses to consume all available IP addresses. The most direct and effective solution is to limit the rate or number of DHCP bindings per interface. By configuring a limit on the maximum number of DHCP Snooping binding table entries an interface can learn, the switch prevents a single port from consuming an excessive number of IP addresses, thus mitigating the attack and preserving the address pool for legitimate users.

A. Static ARP binding is used to prevent ARP spoofing, not DHCP pool exhaustion, and is impractical for a public network with many transient users.
B. IP Source Guard (IPSG) prevents IP address spoofing by filtering traffic based on the DHCP snooping binding table; it does not prevent the pool's exhaustion.
D. Dynamic ARP Inspection (DAI) prevents ARP poisoning attacks by validating ARP packets; it does not address DHCP starvation.

1. Huawei HedEx Documentation, S7700 V200R013C00 Configuration Guide - Security, Section: "DHCP Snooping Configuration". The guide describes features to mitigate DHCP attacks, including: "Limiting the number of MAC address entries that can be learned on an interface" as a direct countermeasure to DHCP server DoS attacks (starvation). This directly supports option C.