CCNA Network Services and Security Practice Question
A DHCP server is located on a different VLAN from the clients. Which feature is required so the clients can still receive addresses?
⚠ Common exam trap
A common exam trap is selecting DHCP snooping as the solution for clients on different VLANs to receive DHCP addresses. DHCP snooping is a security mechanism that filters DHCP messages to prevent rogue servers but does not forward DHCP broadcasts across VLANs. Another tempting but incorrect choice is port security, which controls MAC address access on switch ports but does not affect DHCP broadcast forwarding. NAT overload is unrelated to DHCP address assignment and only translates IP addresses for outbound traffic. The key misunderstanding is confusing DHCP relay’s role in forwarding broadcasts with security or address translation features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP relay
DHCP relay forwards client broadcasts to a remote server as unicast, typically using ip helper-address on the Layer 3 interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a switch security feature that builds a binding table of trusted DHCP messages and filters untrusted traffic to prevent rogue DHCP servers or DHCP starvation attacks. It operates only within the same Layer 2 broadcast domain and has no capability to forward or relay DHCP packets across VLAN boundaries, so it cannot enable a DHCP server on a different VLAN to serve these clients.
When this WOULD be correct
In a scenario where a network administrator is asked about securing a DHCP environment, a question may ask how to prevent rogue DHCP servers while allowing legitimate ones. In this case, DHCP snooping would be the correct answer as it protects the network from unauthorized DHCP responses.
- ✓
DHCP relay
Why this is correct
DHCP relay is the correct solution because DHCP clients send broadcast DISCOVER messages, and routers do not forward broadcasts between VLANs. A relay agent such as an ip helper-address command on the router's SVI intercepts the broadcast, unicasts it to the DHCP server's IP, and relays the server's OFFER/ACK back to the client, enabling cross-subnet address assignment.
- ✗
Port security
Why it's wrong here
Port security is an access-control feature on Layer 2 switchports that limits the number and identity of MAC addresses allowed on a given interface, protecting against MAC flooding or unauthorized devices. It neither inspects nor forwards DHCP broadcast traffic between VLANs, nor does it act as a relay, so configuring port security would leave DHCP clients isolated from the server.
When this WOULD be correct
In a scenario where a question asks about securing a network by limiting the number of devices that can connect to a specific switch port, port security would be the correct answer. For example, if the question involves preventing unauthorized devices from accessing the network while allowing legitimate DHCP clients, port security would apply.
- ✗
NAT overload
Why it's wrong here
NAT overload (PAT) translates private source IP addresses to a public IP with unique port numbers for internet-bound traffic. DHCP discovery relies on broadcast forwarding, not address translation, and running PAT would not cause a router to relay a broadcast to a DHCP server in another VLAN, so it has no relevance to solving this inter-VLAN broadcast problem.
When this WOULD be correct
In a scenario where the question asks about enabling multiple internal devices to access the internet using a single public IP address, NAT overload would be the correct answer. This would involve a setup where clients need to communicate externally while conserving public IP addresses.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP relayCorrect answer▾
Why this is correct
DHCP relay is the correct solution because DHCP clients send broadcast DISCOVER messages, and routers do not forward broadcasts between VLANs. A relay agent such as an ip helper-address command on the router's SVI intercepts the broadcast, unicasts it to the DHCP server's IP, and relays the server's OFFER/ACK back to the client, enabling cross-subnet address assignment.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is a security feature that prevents unauthorized DHCP servers from offering IP addresses to clients. It does not facilitate communication between clients and a DHCP server located on a different VLAN.
★ When this WOULD be the correct answer
In a scenario where a network administrator is asked about securing a DHCP environment, a question may ask how to prevent rogue DHCP servers while allowing legitimate ones. In this case, DHCP snooping would be the correct answer as it protects the network from unauthorized DHCP responses.
Why candidates choose this
Candidates may choose this option because they associate DHCP snooping with DHCP functionality and security, mistakenly believing it plays a role in enabling clients to communicate with a DHCP server across VLANs.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security is a feature that restricts the number of MAC addresses allowed on a switch port, primarily for security purposes. It does not facilitate communication between different VLANs or assist clients in obtaining DHCP addresses from a server on another VLAN.
★ When this WOULD be the correct answer
In a scenario where a question asks about securing a network by limiting the number of devices that can connect to a specific switch port, port security would be the correct answer. For example, if the question involves preventing unauthorized devices from accessing the network while allowing legitimate DHCP clients, port security would apply.
Why candidates choose this
Candidates may choose this option because they associate port security with network access control, mistakenly believing it relates to managing DHCP traffic across VLANs.
✗NAT overloadWrong answer — click to see why▾
Why this is wrong here
NAT overload, also known as Port Address Translation (PAT), is used to allow multiple devices on a private network to share a single public IP address. It does not facilitate communication between clients and a DHCP server located on a different VLAN, which is the requirement of the question.
★ When this WOULD be the correct answer
In a scenario where the question asks about enabling multiple internal devices to access the internet using a single public IP address, NAT overload would be the correct answer. This would involve a setup where clients need to communicate externally while conserving public IP addresses.
Why candidates choose this
Candidates may confuse NAT overload with DHCP functionality, thinking that since both involve IP address management, NAT could somehow assist in DHCP address assignment across VLANs. This misconception can lead to selecting it as a viable option.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
DHCP relay
A network device or feature that forwards DHCP broadcast messages between clients and servers on different subnets so that IP address assignment works across multiple network segments without a separate DHCP server on each one.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.