CCNA Network Services and Security Practice Question
A client PC is receiving an APIPA address (169.254.x.x) instead of a valid IP from the DHCP server. The DHCP server is on the same subnet as the client. The technician runs the command 'show ip dhcp binding' and confirms that the correct scope is configured. The command 'show ip dhcp pool' shows that there are plenty of addresses remaining in the pool. The client's NIC status shows 'connected'. What should the technician do next?
⚠ Common exam trap
Cisco often tests the concept that APIPA addresses are self-assigned and indicate a failure to receive a DHCP offer, and the trap here is that candidates assume the problem is with the legitimate DHCP server's configuration or connectivity, rather than considering a rogue DHCP server that is interfering with the process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check for a rogue DHCP server on the network.
The client is receiving an APIPA address (169.254.x.x) despite the DHCP server having available addresses and being on the same subnet. This indicates that the client's DHCP discover broadcast is not reaching the legitimate DHCP server, or the server's offer is not reaching the client. Since the DHCP server is local and the scope is correctly configured, the most likely cause is a rogue DHCP server responding faster than the legitimate server, or a device (like a home router) acting as a DHCP server and handing out APIPA-like addresses or conflicting leases. Option D directly addresses this by suggesting to check for a rogue DHCP server, which can interfere with the DHCP process and cause the client to fail to obtain a valid IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the DHCP snooping configuration on the access switch.
Why it's wrong here
DHCP snooping is a switch security feature that filters untrusted DHCP messages. While it could block DHCP, there is no indication in the scenario that DHCP snooping is enabled, and the client is on the same subnet as the server, so the traffic does not typically traverse a switch where snooping would be configured upstream. This would be a premature and less likely next step.
- ✗
Verify that no firewall is blocking UDP ports 67 and 68 on the local network.
Why it's wrong here
Firewalls typically exist between different subnets or at network edges, not within the same broadcast domain. Since the DHCP server and client are on the same subnet, there is no router or firewall between them that would filter DHCP traffic. This step is unnecessary in this context.
- ✗
Run the ipconfig /release and /renew commands on the client.
Why it's wrong here
While releasing and renewing the IP address may temporarily resolve the issue, it does not address the underlying cause. If a rogue DHCP server is present, the client will likely fall back to APIPA again after the next lease attempt. This step is more of a reactive workaround than a diagnostic action.
- ✓
Check for a rogue DHCP server on the network.
Why this is correct
Given that the legitimate DHCP server is reachable, has a correct scope, and addresses are available, the most probable reason for persistent APIPA assignment is interference from an unauthorized DHCP server. A rogue server could be responding to DHCP Discover messages, preventing the client from obtaining a proper lease. The technician should use tools like packet captures or DHCP logs to detect any other DHCP Offer messages.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Check for a rogue DHCP server on the network.Correct answer▾
Why this is correct
Given that the legitimate DHCP server is reachable, has a correct scope, and addresses are available, the most probable reason for persistent APIPA assignment is interference from an unauthorized DHCP server. A rogue server could be responding to DHCP Discover messages, preventing the client from obtaining a proper lease. The technician should use tools like packet captures or DHCP logs to detect any other DHCP Offer messages.
✗Check the DHCP snooping configuration on the access switch.Wrong answer — click to see why▾
Why this is wrong here
Candidates often jump to switch security features when they see DHCP issues, but without evidence of a switch misconfiguration, it is not the most direct next action.
✗Verify that no firewall is blocking UDP ports 67 and 68 on the local network.Wrong answer — click to see why▾
Why this is wrong here
Test-takers often consider firewalls as universal blockers, forgetting that in a flat Layer 2 domain, broadcast traffic such as DHCP Discover is not filtered by a firewall.
✗Run the ipconfig /release and /renew commands on the client.Wrong answer — click to see why▾
Why this is wrong here
Candidates prefer simple client-side fixes, but CCNA troubleshooting emphasises identifying root causes before applying band-aid solutions.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
DHCP pool
A DHCP pool is a reserved set of IP addresses that a DHCP server can assign to devices on a network automatically when they request a connection.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.