This 200-301 practice question tests your understanding of network services and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: a DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A client on VLAN 20 must obtain an IPv4 lease from a DHCP server located on VLAN 100. Which feature is required on the Layer 3 interface for VLAN 20?
NAT overload
Why wrong: NAT is not required just to relay DHCP across VLANs.
DHCP relay
Correct. The SVI or routed interface needs DHCP relay.
Port security
Why wrong: Port security does not forward DHCP broadcasts between VLANs.
Private VLAN
Why wrong: Private VLAN is unrelated to DHCP relay functionality.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
DHCP relay
A DHCP relay agent forwards client broadcasts as unicast to the remote server, typically using ip helper-address.
Key principle: A DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
NAT overload
When this WOULD be correct
If the question were about a scenario where a device on a private network needed to access the internet through a single public IP address, NAT overload would be the correct answer, as it allows multiple devices to share one public IP for outbound connections.
DHCP relay
Port security
Why it's wrong here
Port security does not forward DHCP broadcasts between VLANs.
When this WOULD be correct
In a scenario where a question asks about securing access to a switch port for devices on VLAN 20, and the focus is on preventing unauthorized devices from connecting, port security would be the correct answer. For example, if the question specifies that only certain MAC addresses should be allowed on a port in VLAN 20, port security would be essential.
Private VLAN
When this WOULD be correct
If the question were about configuring a network where multiple devices within the same VLAN need to communicate without directly interacting with each other, and the goal is to enhance security by isolating traffic, then private VLANs would be the correct answer. For example, a question could ask about securing a data center environment with multiple servers that should not communicate directly.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
Correct. The SVI or routed interface needs DHCP relay.
Why this is wrong here
NAT overload (PAT) translates private IP addresses to a public IP, but does not forward DHCP broadcast messages between different VLANs. DHCP relay is the correct feature for this purpose.
★ When this WOULD be the correct answer
If the question were about a scenario where a device on a private network needed to access the internet through a single public IP address, NAT overload would be the correct answer, as it allows multiple devices to share one public IP for outbound connections.
Why candidates choose this
Students might confuse NAT with DHCP relay because both involve IP address translation or forwarding, but NAT is for address translation across networks, not for relaying broadcast-based DHCP requests.
Why this is wrong here
Port security limits the number of MAC addresses on a switch port and prevents unauthorized access, but it does not forward DHCP broadcasts across VLANs. DHCP relay is required for inter-VLAN DHCP.
★ When this WOULD be the correct answer
In a scenario where a question asks about securing access to a switch port for devices on VLAN 20, and the focus is on preventing unauthorized devices from connecting, port security would be the correct answer. For example, if the question specifies that only certain MAC addresses should be allowed on a port in VLAN 20, port security would be essential.
Why candidates choose this
Port security is a common security feature on switches, and students might think it is needed to protect the DHCP process, but it has no role in forwarding DHCP requests between VLANs.
Why this is wrong here
Private VLANs isolate ports within the same VLAN, but they do not provide DHCP relay functionality. DHCP relay is a separate feature configured on the Layer 3 interface.
★ When this WOULD be the correct answer
If the question were about configuring a network where multiple devices within the same VLAN need to communicate without directly interacting with each other, and the goal is to enhance security by isolating traffic, then private VLANs would be the correct answer. For example, a question could ask about securing a data center environment with multiple servers that should not communicate directly.
Why candidates choose this
Private VLANs are used for traffic isolation, and students might mistakenly believe they are needed to separate DHCP traffic, but the actual requirement is to forward DHCP broadcasts across VLANs, which is done by DHCP relay.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A common exam trap is selecting NAT overload or port security as the required feature for DHCP communication across VLANs. NAT overload is used for IP address translation and does not forward DHCP broadcasts, while port security restricts MAC addresses on switch ports but does not relay DHCP messages. Another trap is confusing private VLANs with DHCP relay; private VLANs isolate Layer 2 domains but do not forward DHCP requests between VLANs. The key is understanding that DHCP relay is the only feature that forwards DHCP broadcasts as unicast messages across Layer 3 boundaries, enabling clients on VLAN 20 to obtain leases from a DHCP server on VLAN 100.
Detailed technical explanation
DHCP relay is a critical feature in Layer 3 devices that enables clients on one VLAN to obtain IP addresses from a DHCP server located on a different VLAN or subnet. Normally, DHCP clients send broadcast messages to discover DHCP servers, but broadcasts do not cross Layer 3 boundaries. A DHCP relay agent listens for these broadcasts on the client VLAN interface and forwards them as unicast messages to the DHCP server's IP address, typically configured with the ip helper-address command on Cisco devices. In the context of VLANs, each VLAN is a separate broadcast domain with its own subnet. When a client on VLAN 20 requests an IP address, the Layer 3 interface for VLAN 20 must be configured to relay DHCP requests to the DHCP server on VLAN 100. Without DHCP relay, the DHCP broadcast messages would not reach the server, and the client would fail to obtain an IP lease. This relay functionality is essential in routed VLAN interfaces (SVIs) or routed physical interfaces that serve multiple VLANs. A common exam trap is confusing DHCP relay with other Layer 2 or security features like port security or private VLANs, which do not forward DHCP broadcasts across VLANs. Also, NAT overload is unrelated to DHCP forwarding and only translates IP addresses for outbound traffic. Understanding the role of DHCP relay in forwarding DHCP messages across Layer 3 boundaries is crucial for correctly answering questions about inter-VLAN DHCP communication in Cisco networks.
Key takeaway
A DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets.
Real-world example
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Review a DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — A DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets..
The correct answer is: DHCP relay — A DHCP relay agent forwards client broadcasts as unicast to the remote server, typically using ip helper-address.
Review a DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets., then practise related 200-301 questions on the same topic to reinforce the concept.
A DHCP relay agent forwards DHCP client broadcast messages as unicast to a remote DHCP server across different VLANs or subnets.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.