Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCNA Network Services and Security Practice Question
Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.
First, the DHCP server must be properly configured on the router. Next, DHCP snooping is enabled globally on the switch to protect against rogue servers. Then, the specific client VLANs must be added to the snooping database. After that, the uplink interface to the DHCP server must be trusted to allow legitimate server responses. Finally, the ip helper-address command is placed on the client's SVI to forward DHCP broadcasts to the remote server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.
Why this is correct
The router acting as the DHCP server must have a DHCP pool defined using the `ip dhcp pool` command, followed by the `network` statement to specify the client subnet, the `default-router` command to supply the gateway address, and the `lease` command to control lease duration. Without these parameters, clients will not receive an IP address, subnet mask, or default gateway, leaving them without network connectivity.
- ✓
Enable DHCP snooping globally on the switch with the ip dhcp snooping command.
Why this is correct
Executing `ip dhcp snooping` in global configuration mode enables DHCP snooping on the switch. This is a required first step before DHCP snooping can be applied to any specific VLAN, and it allows the switch to inspect DHCP messages, build an IP-to-MAC binding database, and filter untrusted DHCP responses. Without this global command, the switch will not enforce DHCP security policies, leaving the network vulnerable to rogue DHCP servers.
- ✓
Enable DHCP snooping on the client VLAN(s) using ip dhcp snooping vlan <vlan-id>.
Why this is correct
The `ip dhcp snooping vlan <vlan-id>` command activates DHCP snooping on the client VLAN, which is necessary for the switch to monitor and validate DHCP traffic in that VLAN. Although DHCP snooping is enabled globally, it has no effect unless at least one VLAN is specified. This per-VLAN step ensures that DHCP packets from clients are inspected, and the switch begins building a DHCP snooping binding table for that VLAN, providing security and IP tracking.
- ✓
Configure the switch port connecting toward the DHCP server as a trusted port using ip dhcp snooping trust.
Why this is correct
The switch port that connects toward the legitimate DHCP server must be explicitly configured as trusted with `ip dhcp snooping trust`. By default, all ports are untrusted, meaning any DHCPOFFER or DHCPACK message arriving on them will be discarded. Designating the server-facing port as trusted permits the server's replies to reach clients, while preventing rogue DHCP offers from untrusted ports, an essential step to avoid DHCP spoofing attacks.
- ✓
On the SVI for the client VLAN, assign an IP address and add the ip helper-address <dhcp-server-ip> command.
Why this is correct
The SVI for the client VLAN must first be assigned an IP address to function as the client gateway and to ensure Layer 3 connectivity. Adding the `ip helper-address <dhcp-server-ip>` command on that SVI enables DHCP relay, so broadcast DHCPDISCOVER messages from clients are forwarded as unicast to the DHCP server located on a different subnet. Without this helper-address, clients would never receive a response from the remote server, causing DHCP timeouts and no IP assignment.
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.