Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
6Step 6
CCNA Network Services and Security Practice Question
Drag and drop the following steps into the correct order to configure a Layer 3 switch to perform DHCP relay agent and DHCP snooping for a remote DHCP server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
On the DHCP server, create a DHCP pool for the client subnet with the correct network, default gateway, and lease parameters.
Correct order: 1) Create DHCP pool on the server to have valid lease parameters; 2) Assign IP address to the SVI so it can act as the gateway and relay agent for the subnet; 3) Globally enable DHCP snooping to activate the feature; 4) Enable snooping on the client VLAN so that only that VLAN’s DHCP traffic is filtered; 5) Set the interface facing the server as trusted to allow DHCP replies; 6) Configure ip helper-address on the SVI to forward client DHCP broadcasts to the server. Each step depends on the previous: the server must be ready; the SVI needs an IP before the helper can be applied; snooping must be globally on before per-VLAN settings; trusted port must be defined before relayed replies are accepted; finally, the helper address enables the actual relay.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
On the DHCP server, create a DHCP pool for the client subnet with the correct network, default gateway, and lease parameters.
Why this is correct
Creating a DHCP pool on the DHCP server is the foundational step: the pool must match the client subnet's network ID and subnet mask, and include the default gateway option (option 3) and lease parameters. Without a properly defined pool, the server cannot determine which IP address range to offer when it receives a DHCPDISCOVER, so even a correctly relayed request will be ignored or fail. The pool's network statement effectively defines the scope that the server is allowed to lease, making this configuration mandatory for any DHCP service.
- ✓
On the Layer 3 switch, assign an IP address to the VLAN SVI that serves the client subnet.
Why this is correct
Assigning an IP address to the VLAN SVI on the Layer 3 switch gives the switch a Layer 3 presence in the client subnet, which is required for the switch to act as the client's default gateway and to originate or forward DHCP relay packets. If the SVI has no IP address, the switch cannot route traffic for that VLAN, and the 'ip helper-address' command on that SVI will have no effect because the interface does not participate in IP routing. Additionally, the SVI must be in an up/up state for clients to reach the DHCP server.
- ✓
Enable DHCP snooping globally on the switch using the 'ip dhcp snooping' command.
Why this is correct
Enabling DHCP snooping globally with 'ip dhcp snooping' is the master switch that turns on the DHCP snooping feature at the switch level, but it does not yet apply to any VLAN. This global command activates the framework that will later monitor and filter DHCP messages, yet without the subsequent per-VLAN command, the switch will not actually inspect DHCP traffic in any VLAN. Be careful: many engineers mistakenly stop after this global command and assume protection is active, but it is only the prerequisite.
- ✓
Enable DHCP snooping on the specific client VLAN(s) with the 'ip dhcp snooping vlan' command.
Why this is correct
The command 'ip dhcp snooping vlan <vlan-id>' is what actually applies DHCP snooping to the specific client VLAN(s), causing the switch to examine every DHCP packet in that VLAN and enforce trust policies. Without this per-VLAN configuration, DHCP snooping remains globally enabled but dormant, so rogue DHCP servers or spoofed DHCP replies would still be accepted in the client VLAN. You must list each VLAN that contains DHCP clients for the feature to have any security effect.
- ✓
Configure the switch interface that connects toward the DHCP server as a trusted DHCP snooping port using 'ip dhcp snooping trust'.
Why this is correct
Configuring the switch interface that connects toward the legitimate DHCP server as a trusted DHCP snooping port is critical because DHCP snooping marks all ports as untrusted by default. When the trusted DHCP server sends DHCPOFFER and DHCPACK replies, the switch will forward them from the trusted port; if that port were left untrusted, these legitimate replies would be dropped as potentially rogue, breaking DHCP entirely. This trust setting is the security boundary that separates the authorized server from untrusted access ports.
- ✓
On the same VLAN SVI, configure the 'ip helper-address' command pointing to the DHCP server’s IP address.
Why this is correct
The 'ip helper-address' command on the client VLAN SVI configures the switch to act as a DHCP relay agent, converting the client's broadcast DHCPDISCOVER into a unicast message forwarded to the server's IP address. Without this command and with the DHCP server on a different subnet, the client's broadcast never leaves the local VLAN and the server never sees the request. The helper must be configured on the Layer 3 interface serving the client subnet, not on the server-facing interface, and it points to the server's actual IP address.
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.