CCNA Network Services and Security Practice Question
A client on VLAN 20 must obtain an IPv4 lease from a DHCP server located on VLAN 100. Which feature is required on the Layer 3 interface for VLAN 20?
⚠ Common exam trap
A common exam trap is selecting NAT overload or port security as the required feature for DHCP communication across VLANs. NAT overload is used for IP address translation and does not forward DHCP broadcasts, while port security restricts MAC addresses on switch ports but does not relay DHCP messages. Another trap is confusing private VLANs with DHCP relay; private VLANs isolate Layer 2 domains but do not forward DHCP requests between VLANs. The key is understanding that DHCP relay is the only feature that forwards DHCP broadcasts as unicast messages across Layer 3 boundaries, enabling clients on VLAN 20 to obtain leases from a DHCP server on VLAN 100.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP relay
A DHCP relay agent forwards client broadcasts as unicast to the remote server, typically using ip helper-address.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NAT overload
Why it's wrong here
NAT overload (PAT) translates private source IP addresses and ports to a single public IP address, typically to enable Internet access. DHCP uses UDP ports 67 and 68, and the initial client request is a broadcast to 255.255.255.255, which NAT overload cannot relay across VLANs because it only rewrites IP addresses in unicast packets. Furthermore, the DHCP server may be on the same private network, so address translation is neither required nor helpful in this scenario.
When this WOULD be correct
If the question were about a scenario where a device on a private network needed to access the internet through a single public IP address, NAT overload would be the correct answer, as it allows multiple devices to share one public IP for outbound connections.
- ✓
DHCP relay
Why this is correct
A DHCP relay agent, configured on the VLAN 20 SVI or routed interface, listens for DHCPDISCOVER broadcasts sent by the client. It then forwards the request as a unicast to the DHCP server's IP address while adding the interface's IP address in the giaddr field, which tells the server the correct subnet for allocating an IPv4 address. The server's DHCPOFFER is relayed back to the client, enabling a successful lease across VLANs.
- ✗
Port security
Why it's wrong here
Port security restricts which MAC addresses can send frames on an access port, dropping frames from unknown hosts. The DHCP client's broadcast UDP frame has a valid source MAC address and is normally allowed, so port security does not impede DHCP discovery. However, port security operates only at Layer 2 and cannot forward the broadcast to a DHCP server located in a different VLAN or subnet, so it cannot solve the lease request.
When this WOULD be correct
In a scenario where a question asks about securing access to a switch port for devices on VLAN 20, and the focus is on preventing unauthorized devices from connecting, port security would be the correct answer. For example, if the question specifies that only certain MAC addresses should be allowed on a port in VLAN 20, port security would be essential.
- ✗
Private VLAN
Why it's wrong here
Private VLANs split a Layer 2 broadcast domain into isolated or community subdomains to restrict traffic between ports, but they do not perform Layer 3 forwarding. A DHCP client on VLAN 20 still sends a broadcast that stays within its local VLAN unless a DHCP relay agent is configured. Private VLANs neither block nor forward DHCP broadcasts to a server in another VLAN, making them irrelevant to the requirement.
When this WOULD be correct
If the question were about configuring a network where multiple devices within the same VLAN need to communicate without directly interacting with each other, and the goal is to enhance security by isolating traffic, then private VLANs would be the correct answer. For example, a question could ask about securing a data center environment with multiple servers that should not communicate directly.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP relayCorrect answer▾
Why this is correct
A DHCP relay agent, configured on the VLAN 20 SVI or routed interface, listens for DHCPDISCOVER broadcasts sent by the client. It then forwards the request as a unicast to the DHCP server's IP address while adding the interface's IP address in the giaddr field, which tells the server the correct subnet for allocating an IPv4 address. The server's DHCPOFFER is relayed back to the client, enabling a successful lease across VLANs.
✗NAT overloadWrong answer — click to see why▾
Why this is wrong here
NAT overload (PAT) translates private IP addresses to a public IP, but does not forward DHCP broadcast messages between different VLANs. DHCP relay is the correct feature for this purpose.
★ When this WOULD be the correct answer
If the question were about a scenario where a device on a private network needed to access the internet through a single public IP address, NAT overload would be the correct answer, as it allows multiple devices to share one public IP for outbound connections.
Why candidates choose this
Students might confuse NAT with DHCP relay because both involve IP address translation or forwarding, but NAT is for address translation across networks, not for relaying broadcast-based DHCP requests.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security limits the number of MAC addresses on a switch port and prevents unauthorized access, but it does not forward DHCP broadcasts across VLANs. DHCP relay is required for inter-VLAN DHCP.
★ When this WOULD be the correct answer
In a scenario where a question asks about securing access to a switch port for devices on VLAN 20, and the focus is on preventing unauthorized devices from connecting, port security would be the correct answer. For example, if the question specifies that only certain MAC addresses should be allowed on a port in VLAN 20, port security would be essential.
Why candidates choose this
Port security is a common security feature on switches, and students might think it is needed to protect the DHCP process, but it has no role in forwarding DHCP requests between VLANs.
✗Private VLANWrong answer — click to see why▾
Why this is wrong here
Private VLANs isolate ports within the same VLAN, but they do not provide DHCP relay functionality. DHCP relay is a separate feature configured on the Layer 3 interface.
★ When this WOULD be the correct answer
If the question were about configuring a network where multiple devices within the same VLAN need to communicate without directly interacting with each other, and the goal is to enhance security by isolating traffic, then private VLANs would be the correct answer. For example, a question could ask about securing a data center environment with multiple servers that should not communicate directly.
Why candidates choose this
Private VLANs are used for traffic isolation, and students might mistakenly believe they are needed to separate DHCP traffic, but the actual requirement is to forward DHCP broadcasts across VLANs, which is done by DHCP relay.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
Key term
DHCP server
A DHCP server is a network device or service that automatically assigns IP addresses and other network configuration parameters to devices on a network, eliminating the need for manual configuration.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.