Tech Challenge

On an Ethernet LAN with no switch-level protections, an attacker connects a machine running its own DHCP server. It races the legitimate server to answer clients' broadcast DHCPDISCOVER messages and hands out a lease whose default gateway and DNS server point to the attacker's host, so victim traffic flows through the attacker. Why does this succeed, and which switch feature most directly prevents it?