DHCP questions cover server configuration, relay agents (ip helper-address), DHCP snooping, and the four-step DORA handshake. Common exam scenarios: a host isn't getting an IP, a relay agent isn't forwarding requests, or a rogue DHCP server is handing out wrong addresses.
Start Scenario PracticeWhich TWO security features rely on the DHCP snooping binding table? (Select exactly 2)
Explanation: IP Source Guard (IPSG) uses the DHCP snooping binding table to validate the source IP address of packets received on untrusted ports. It drops any packet whose source IP does not match an entry in the binding table, preventing IP spoofing attacks. Dynamic ARP Inspection (DAI) also relies on the DHCP snooping binding table to validate ARP packets, ensuring that the sender MAC and IP addresses match a legitimate binding, thereby blocking ARP poisoning attacks.
An engineer is troubleshooting a DHCP issue in a data center VLAN. Clients are unable to obtain IP addresses from the DHCP server. The switch has DHCP snooping enabled on the VLAN, and the DHCP server is connected to a trusted port. The clients are on untrusted ports. Which additional security feature is most likely causing the problem if the DHCP server is on a different subnet and the switch is not configured as a DHCP relay?
Explanation: When the DHCP server resides on a different subnet and the switch lacks an IP helper address (ip helper-address) configuration, DHCP snooping will not forward the DHCP broadcast from the client to the server. DHCP snooping relies on the switch to relay DHCP packets across subnets; without the helper address, the broadcast is dropped at the VLAN interface, preventing clients from obtaining IP addresses.
A startup company is deploying a new web application on UCS B-Series blades. They want to use PXE boot for rapid provisioning. The network team has configured a DHCP server and a PXE server on the same VLAN as the UCS service profiles. The system administrator creates a service profile for a blade and sets the boot policy to 'PXE' as the first boot device, and local disk as second. However, when the blade powers on, it boots from the local disk instead of PXE. The PXE server logs show no request from the blade's MAC address. The DHCP server logs show no activity. The fabric interconnect is configured with a default VLAN. What is the most likely cause?
Explanation: PXE boot requires the vNIC to have an untagged native VLAN that matches the PXE/DHCP subnet. If the native VLAN on the vNIC is different, DHCP requests are not forwarded. Option B wrong because PXE boot order is usually correct. Option C wrong because it would cause different symptoms. Option D wrong because service profile association is fine.
An engineer is configuring PXE boot for a UCS B-series blade. The blade's vNIC is associated with a VLAN that has no IP helper address configured. What is required to allow the blade to obtain an IP address from a DHCP server on a different subnet?
Explanation: PXE boot requires DHCP. Without IP helper, broadcast DHCP requests cannot cross subnets. A DHCP relay or IP helper is needed.
Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)
Explanation: DHCP snooping is a security feature that acts as a firewall between untrusted hosts and DHCP servers. It filters DHCP messages by validating DHCP packets received on untrusted ports, dropping those that are invalid (e.g., DHCP server messages from a client port), and building a DHCP snooping binding database that maps client MAC addresses, IP addresses, VLAN, and port information. This database is then used by other features like IP Source Guard and Dynamic ARP Inspection to prevent IP spoofing and ARP poisoning attacks.
+4 more scenario questions available
Practice all DHCP Troubleshooting ScenariosDHCP questions cover server configuration, relay agents (ip helper-address), DHCP snooping, and the four-step DORA handshake. Common exam scenarios: a host isn't getting an IP, a relay agent isn't forwarding requests, or a rogue DHCP server is handing out wrong addresses. These appear throughout the 350-601 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 350-601. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 350-601 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full DHCP Troubleshooting Scenarios session with instant scoring and detailed explanations.
Start Scenario Practice →