CCNA Network Services and Security Practice Question
A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.
⚠ Common exam trap
Cisco often tests the interaction between DHCP snooping and DHCP relay, where candidates mistakenly think the relay bypasses snooping or that the issue is with the helper-address configuration, rather than the untrusted port blocking the server's unicast reply.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.
DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.
Why it's wrong here
The ip helper-address command must be configured on the SVI of the client VLAN because DHCP clients broadcast their DISCOVER messages, which do not route across VLANs. Placing it on VLAN 200, the server VLAN, means the relay agent never sees the client broadcast, so the request is never forwarded. Additionally, the relay agent uses the SVI's IP as the giaddr, so configuring the wrong SVI would cause the server to allocate addresses from the wrong subnet.
- ✓
The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.
Why this is correct
DHCP snooping drops DHCPOFFER and DHCPACK messages received on untrusted ports, since only trusted ports are allowed to accept server-originated replies. The switch port connected to the legitimate DHCP server in VLAN 200 must be explicitly configured as trusted with 'ip dhcp snooping trust'. Without that, the relay agent forwards the client's DISCOVER, but the server's OFFER/ACK are silently discarded, leaving clients without a lease despite the relay configuration.
- ✗
DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.
Why it's wrong here
DHCP snooping and DHCP relay agent are fully compatible; the relay agent changes BOOTP broadcasts to unicast and forwards them, while snooping inspects those messages and maintains the DHCP binding table. They can coexist if the interface facing the DHCP server is marked as trusted, as snooping does not block valid unicast relayed messages by default. Disabling snooping globally would only weaken security and is unnecessary; the real fix is to trust the server-facing port.
- ✗
The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.
Why it's wrong here
When relaying DHCP, the server replies to the giaddr IP address provided by the relay agent, which is the SVI IP of the switch. Since the server is reachable on that subnet (as validated), it can unicast the reply directly to that SVI without needing a default gateway—the destination is on a directly connected or already routed network. A missing default gateway would affect only traffic to off-subnet destinations, but the reply to the relay agent is sent to a local address, so it does not apply here.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.Correct answer▾
Why this is correct
DHCP snooping drops DHCPOFFER and DHCPACK messages received on untrusted ports, since only trusted ports are allowed to accept server-originated replies. The switch port connected to the legitimate DHCP server in VLAN 200 must be explicitly configured as trusted with 'ip dhcp snooping trust'. Without that, the relay agent forwards the client's DISCOVER, but the server's OFFER/ACK are silently discarded, leaving clients without a lease despite the relay configuration.
✗The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.Wrong answer — click to see why▾
Why this is wrong here
Many engineers mistakenly think the helper should reside on the server VLAN; however, it must reside on the client-facing L3 interface.
✗DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.Wrong answer — click to see why▾
Why this is wrong here
A common misconception is that DHCP relay bypasses snooping, but snooping still inspects the server's unicast response and drops it unless the ingress port is trusted.
✗The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.Wrong answer — click to see why▾
Why this is wrong here
Candidates often suspect routing issues, but verified reachability eliminates this. The problem lies in the snooping policy, not IP connectivity.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.