CCNA Network Services and Security Practice Question
After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the default untrusted state of all ports when DHCP snooping is enabled, leading candidates to overlook the need to manually trust the server port.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port Gi0/24 has not been configured as a trusted port for DHCP snooping.
When DHCP snooping is enabled, all ports are untrusted by default. Untrusted ports will drop DHCP server messages (OFFER, ACK, etc.) unless the port is explicitly configured as trusted. Since the DHCP server is connected to Gi0/24 and the technician did not configure it as a trusted port, the switch discards the server's responses, preventing clients from obtaining IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The port Gi0/24 has not been configured as a trusted port for DHCP snooping.
Why this is correct
DHCP snooping immediately blocks all DHCP server messages on untrusted ports. Because Gi0/24 is the uplink to the DHCP server, it must be explicitly set as trusted (ip dhcp snooping trust), otherwise the switch will drop the DHCP offers sent by the server.
- ✗
The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.
Why it's wrong here
If the server were on a different subnet, clients would have needed an IP helper address to obtain addresses even before DHCP snooping was enabled. Since they were receiving addresses prior to the change, an IP helper is either already configured or the server resides in the same broadcast domain. Enabling snooping does not alter this requirement.
- ✗
The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.
Why it's wrong here
The DHCP snooping database stores bindings for restoration after a reboot; it does not act as a real-time filter. Without a database, the switch still forwards DHCP messages normally and populates the binding table in memory. Server messages are not dropped because of an absent database.
- ✗
The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.
Why it's wrong here
The binding table maps client IP addresses, MAC addresses, lease times, and ports; it does not store entries for DHCP servers. The switch does not need to learn the server’s MAC to forward DHCP traffic. The table is used to validate client messages like DHCPRELEASE or DECLINE, not to permit server messages.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The port Gi0/24 has not been configured as a trusted port for DHCP snooping.Correct answer▾
Why this is correct
DHCP snooping immediately blocks all DHCP server messages on untrusted ports. Because Gi0/24 is the uplink to the DHCP server, it must be explicitly set as trusted (ip dhcp snooping trust), otherwise the switch will drop the DHCP offers sent by the server.
✗The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.Wrong answer — click to see why▾
Why this is wrong here
This option assumes that the loss of DHCP service is due to a missing relay agent, but the symptom started only after enabling snooping, not after an infrastructure change that would affect the relay path.
✗The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.Wrong answer — click to see why▾
Why this is wrong here
The idea that a missing database causes immediate traffic blocking is a common misinterpretation of the database’s role—it is purely for persistency, not for runtime filtering.
✗The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.Wrong answer — click to see why▾
Why this is wrong here
Many candidates assume that DHCP snooping uses a reverse-check against the binding table for any DHCP server messages, but the filtering is based solely on the trusted/untrusted port state, not on a learned server entry.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.