CCNA Network Services and Security Practice Question
A PC in VLAN 30 must obtain an address from a DHCP server in VLAN 99. Which feature is required on the Layer 3 interface for VLAN 30?
⚠ Common exam trap
A frequent exam trap is selecting DHCP snooping or port security as the solution for inter-VLAN DHCP communication. DHCP snooping is often misunderstood as a relay mechanism, but it only validates DHCP messages to prevent unauthorized servers and does not forward broadcasts between VLANs. Similarly, port security controls MAC address access on switchports but does not affect DHCP message forwarding. Candidates may also confuse Dynamic ARP Inspection with DHCP relay, but DAI only inspects ARP traffic for security purposes. The key mistake is overlooking that DHCP broadcasts are Layer 2 broadcasts and require DHCP relay on the Layer 3 interface to reach servers in other VLANs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP relay
DHCP Discover messages are broadcasts and do not cross Layer 3 boundaries on their own. DHCP relay, commonly configured with ip helper-address, forwards the requests to a server on another subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Port security
Why it's wrong here
Port security is a Layer 2 access-control feature that limits which MAC addresses are allowed to send frames through a specific switchport, either by statically configuring allowed addresses or by restricting the maximum number of learned addresses. It operates only on the individual switchport and does not inspect or forward DHCP broadcast traffic beyond the local segment, so it cannot bridge the client's DHCP request to a server located in another VLAN.
When this WOULD be correct
In a scenario where the question asks about securing access to a specific port on a switch to prevent unauthorized devices from connecting, port security would be the correct answer. For example, if the question specifies that only certain MAC addresses are allowed on a port, port security would be necessary.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a security feature that validates DHCP packets and maintains a binding table to distinguish trusted and untrusted ports, thereby preventing rogue DHCP server attacks and DHCP starvation. However, it only filters and logs DHCP messages on the local switch, and it does not forward broadcasts across VLAN boundaries; it offers no mechanism to propagate a DHCPDISCOVER from VLAN 30 to a server in a different subnet.
When this WOULD be correct
In a scenario where a network administrator is asked to secure a network by preventing rogue DHCP servers while allowing legitimate DHCP traffic, a question might specify that DHCP snooping should be enabled on all access ports to ensure only trusted servers can provide IP addresses. This would make DHCP snooping the correct answer.
- ✓
DHCP relay
Why this is correct
DHCP relay, configured with the ip helper-address command on the VLAN interface, intercepts the client's DHCPDISCOVER broadcast and unicasts it to the DHCP server's IP address on another subnet. The relay agent also relays DHCPOFFER, DHCPREQUEST, and DHCPACK messages, allowing the client in VLAN 30 to obtain an address despite the server being in a different VLAN or subnet. Without this relay, DHCP broadcasts would remain confined to VLAN 30 and never reach the remote server.
- ✗
Dynamic ARP inspection
Why it's wrong here
Dynamic ARP inspection (DAI) prevents ARP spoofing by intercepting and validating ARP packets on untrusted ports against the DHCP snooping binding table. It exclusively inspects Address Resolution Protocol traffic and has no capability to relay DHCP broadcasts or route them to a server on another network, making it irrelevant for cross-subnet address assignment.
When this WOULD be correct
In a different exam question, if the scenario involved ensuring the integrity of ARP requests and responses in a network where multiple VLANs are present, and the focus was on preventing ARP spoofing, then Dynamic ARP inspection would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP relayCorrect answer▾
Why this is correct
DHCP relay, configured with the ip helper-address command on the VLAN interface, intercepts the client's DHCPDISCOVER broadcast and unicasts it to the DHCP server's IP address on another subnet. The relay agent also relays DHCPOFFER, DHCPREQUEST, and DHCPACK messages, allowing the client in VLAN 30 to obtain an address despite the server being in a different VLAN or subnet. Without this relay, DHCP broadcasts would remain confined to VLAN 30 and never reach the remote server.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security is used to restrict access to a switch port based on MAC addresses and does not facilitate communication between VLANs or enable DHCP services. Therefore, it does not address the requirement for a PC in VLAN 30 to obtain an IP address from a DHCP server in VLAN 99.
★ When this WOULD be the correct answer
In a scenario where the question asks about securing access to a specific port on a switch to prevent unauthorized devices from connecting, port security would be the correct answer. For example, if the question specifies that only certain MAC addresses are allowed on a port, port security would be necessary.
Why candidates choose this
Candidates may choose this option because they associate VLANs with security measures, thinking that controlling access to ports is relevant to managing DHCP traffic across VLANs.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is used to prevent unauthorized DHCP servers from providing IP addresses to clients, but it does not facilitate the relay of DHCP requests between different VLANs. Therefore, it is not the required feature for a PC in VLAN 30 to obtain an address from a DHCP server in VLAN 99.
★ When this WOULD be the correct answer
In a scenario where a network administrator is asked to secure a network by preventing rogue DHCP servers while allowing legitimate DHCP traffic, a question might specify that DHCP snooping should be enabled on all access ports to ensure only trusted servers can provide IP addresses. This would make DHCP snooping the correct answer.
Why candidates choose this
Candidates might choose this option because they associate DHCP snooping with DHCP operations and security, leading them to mistakenly believe it is relevant to the process of obtaining an IP address across VLANs.
✗Dynamic ARP inspectionWrong answer — click to see why▾
Why this is wrong here
Dynamic ARP inspection is used to prevent ARP spoofing attacks by validating ARP packets in a network. It does not facilitate the process of obtaining an IP address from a DHCP server across different VLANs, which is required in this scenario.
★ When this WOULD be the correct answer
In a different exam question, if the scenario involved ensuring the integrity of ARP requests and responses in a network where multiple VLANs are present, and the focus was on preventing ARP spoofing, then Dynamic ARP inspection would be the correct answer.
Why candidates choose this
Candidates may confuse the need for security features in a network with the requirements for DHCP communication, leading them to select Dynamic ARP inspection due to its relevance in VLAN environments.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
VLAN
A VLAN logically segments a physical network into isolated broadcast domains without requiring separate physical switches.
Key term
DHCP relay
A network device or feature that forwards DHCP broadcast messages between clients and servers on different subnets so that IP address assignment works across multiple network segments without a separate DHCP server on each one.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.