CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the DHCP server with an IP address pool for the 192.168.10.0/24 subnet and ensure connectivity to VLAN 20.

  Why this is correct

  The DHCP server must have a valid address pool for the 192.168.10.0/24 subnet so it can allocate correct addressing to VLAN 10 clients. Additionally, the server must be reachable from VLAN 10; this requires proper Layer 3 routing between VLAN 10 and VLAN 20, typically via a routed interface or SVI on the Layer 3 switch, as well as VLAN 20 connectivity from the server's access port.

• ✓

  On the Layer 3 device acting as the default gateway for VLAN 10, configure the ip helper-address command pointing to the DHCP server's IP address.

  Why this is correct

  The ip helper-address command is applied to the VLAN 10 SVI (the default gateway interface) on the Layer 3 device. This converts the broadcast DHCPDISCOVER messages from VLAN 10 clients into unicast packets and forwards them to the DHCP server's IP address, because the server is in a different broadcast domain (VLAN 20). Without this relay configuration, the client's DHCP request would never leave VLAN 10.

• ✓

  Enable DHCP snooping globally on the access switch with the command ip dhcp snooping.

  Why this is correct

  Before DHCP snooping can filter messages, it must be enabled globally on the switch with 'ip dhcp snooping'. This command activates the DHCP snooping feature on the switch as a whole, but it does not yet apply to any specific VLAN; a separate per-VLAN enablement is required. It is a mandatory prerequisite, and failing to enable it globally will make all subsequent per-VLAN snooping commands ineffective.

• ✓

  Configure the switch port that connects toward the DHCP server as a trusted interface for DHCP snooping.

  Why this is correct

  When the switch has a direct uplink to the DHCP server, that switchport must be configured as 'trusted' using 'ip dhcp snooping trust'. This is critical because DHCP snooping treats all ports as untrusted by default, and untrusted ports drop DHCP server packets like DHCPOFFER and DHCPACK. If this port is not trusted, the DHCP server's responses will be discarded, and clients will never receive an IP address even though the relay configuration is correct.

• ✓

  Enable DHCP snooping on VLAN 10 using the ip dhcp snooping vlan 10 command.

  Why this is correct

  The command 'ip dhcp snooping vlan 10' is needed to apply DHCP snooping specifically to VLAN 10, which is the client VLAN. Global enabling alone only turns on the process; DHCP snooping only filters DHCP traffic on VLANs explicitly listed with this command. Since VLAN 10 is the VLAN where rogue DHCP servers might be plugged in and where legitimate clients reside, it must be included for the binding table to be populated and for untrusted traffic to be filtered.

• ✓

  Connect a client device to an access port in VLAN 10 and verify that it receives a correct IP address, then check the DHCP snooping binding table with show ip dhcp snooping binding.

  Why this is correct

  The ultimate validation is to place a client device in VLAN 10 and ensure it obtains an IP address via DHCP from the server in VLAN 20. Afterward, the command 'show ip dhcp snooping binding' should display a dynamic binding entry containing the client's MAC address, IP address, lease time, and interface. If a binding appears, it proves that DHCP relay is functioning, the server sent valid offers, and that DHCP snooping has observed the successful transaction; absence of a binding indicates a failure somewhere in the relay, server pool, or port trust configuration.