CCNA Switching and Network Access Practice Question
After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?
⚠ Common exam trap
Cisco often tests the default behavior of DHCP snooping where all ports are untrusted, and the trap is that candidates may think the issue is a routing problem (ip helper-address) or a server-side configuration (Option 82) rather than recognizing the need to mark the server-facing port as trusted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure interface Gi0/1 as a DHCP snooping trusted port.
DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Dynamic ARP Inspection on VLAN 10.
Why it's wrong here
Enabling DAI will not permit DHCP server replies because DAI validates ARP packets against the DHCP snooping binding table; it does not change the trust state of the DHCP server port. DHCP offers will still be blocked.
- ✓
Configure interface Gi0/1 as a DHCP snooping trusted port.
Why this is correct
DHCP snooping treats all ports as untrusted by default and drops DHCP server messages (OFFER, ACK) that arrive on untrusted ports. The DHCP server is connected to interface Gi0/1, so the switch is currently dropping its valid reply. By configuring Gi0/1 as a DHCP snooping trusted port, the switch will forward DHCP offers and acknowledgments from that port, allowing clients on VLAN 10 to obtain addresses while still protecting against rogue DHCP servers on other ports.
- ✗
Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.
Why it's wrong here
An ip helper-address is used to forward DHCP broadcasts across IP subnets. Here, clients and server are in the same VLAN, so no forwarding is needed; the server's replies are simply being blocked by snooping.
- ✗
Reconfigure the DHCP server scope to include DHCP Option 82.
Why it's wrong here
DHCP Option 82 is the relay-agent information option inserted by a DHCP relay agent, not by the DHCP server itself. Reconfiguring the server's scope to include Option 82 does not change the switch's DHCP snooping trust state, so the switch will continue to discard the server's OFFER packets on the untrusted Gi0/1 port. The root cause is port trust, not server configuration; Option 82 is irrelevant in a same-L2 segment where clients and server are directly in VLAN 10.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure interface Gi0/1 as a DHCP snooping trusted port.Correct answer▾
Why this is correct
DHCP snooping treats all ports as untrusted by default and drops DHCP server messages (OFFER, ACK) that arrive on untrusted ports. The DHCP server is connected to interface Gi0/1, so the switch is currently dropping its valid reply. By configuring Gi0/1 as a DHCP snooping trusted port, the switch will forward DHCP offers and acknowledgments from that port, allowing clients on VLAN 10 to obtain addresses while still protecting against rogue DHCP servers on other ports.
✗Enable Dynamic ARP Inspection on VLAN 10.Wrong answer — click to see why▾
Why this is wrong here
Misunderstanding that DAI controls DHCP traffic rather than ARP packets.
✗Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.Wrong answer — click to see why▾
Why this is wrong here
Assuming DHCP snooping introduces routing changes or that the server is on a different subnet.
✗Reconfigure the DHCP server scope to include DHCP Option 82.Wrong answer — click to see why▾
Why this is wrong here
Confusing DHCP snooping with DHCP relay agent functionality and option 82 insertion.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
Key term
DHCP snooping
DHCP snooping is a network security feature that filters untrusted DHCP messages to prevent rogue DHCP servers from giving out false IP addresses.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.