CCNA Network Services and Security Practice Question
Which TWO statements correctly describe the operation of the ip helper-address command in a DHCP relay agent configuration?
⚠ Common exam trap
Cisco often tests the misconception that `ip helper-address` forwards all UDP broadcasts, when in reality it only forwards specific UDP ports (default: 67, 68, 53, 69, 37, 137, 138, 161, 162) and can be customized with the `ip forward-protocol` command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.
The `ip helper-address` command is configured on the router interface facing the client, and it converts the client's DHCPDISCOVER broadcast into a unicast directed to the specified DHCP server, allowing the client to obtain an IP address from a server on a different subnet. Option D is also correct because the relay agent sets the giaddr (gateway IP address) field in the DHCP packet to its own interface IP address. This is how the DHCP server knows which subnet the client is on and can assign an appropriate IP address and return the reply. Option B is incorrect because the command is configured on the interface facing the DHCP clients, not on the server-facing interface. Option C is incorrect because `ip helper-address` does not forward all UDP broadcasts; it only forwards broadcasts for specific UDP ports (DHCP, DNS, TFTP, etc.) by default, and this list can be modified. Option E is incorrect because the command does not perform any MAC address validation or spoofing protection; it simply relays DHCP messages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.
Why this is correct
The relay agent listens for DHCP broadcasts on one interface and forwards them as unicasts to the configured server IP.
- ✗
It is configured on the DHCP server interface to allow replies to reach clients on remote subnets.
Why it's wrong here
The ip helper-address is configured on the router interface facing the clients, not on the server.
- ✗
It automatically forwards all UDP broadcasts by default.
Why it's wrong here
By default, only DHCP and a few other UDP services (like TFTP, DNS, and Time) are forwarded. Not all UDP broadcasts.
- ✓
It sets the gateway IP address (giaddr) field in the DHCP packet to the relay agent's IP address.
Why this is correct
This allows the DHCP server to know which subnet the client is on and assign an appropriate IP address.
- ✗
It prevents DHCP spoofing by validating the source MAC address of DHCP packets.
Why it's wrong here
This describes DHCP snooping, not the ip helper-address command.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.Correct answer▾
Why this is correct
The relay agent listens for DHCP broadcasts on one interface and forwards them as unicasts to the configured server IP.
✗It is configured on the DHCP server interface to allow replies to reach clients on remote subnets.Wrong answer — click to see why▾
Why this is wrong here
The ip helper-address command is configured on the router interface that receives the client broadcast, not on the DHCP server. The server does not need this command; it relies on the relay agent to forward requests and set the giaddr field.
Why candidates choose this
Students may think the helper address helps the server send replies back, but it actually helps the client reach the server. The command is placed on the client-facing interface, not the server-facing one.
✗It automatically forwards all UDP broadcasts by default.Wrong answer — click to see why▾
Why this is wrong here
By default, ip helper-address forwards only specific UDP broadcasts: DHCP (ports 67/68), TFTP (69), DNS (53), Time (37), NetBIOS (137,138), and TACACS (49). It does not forward all UDP broadcasts; additional services require the 'ip forward-protocol' command.
Why candidates choose this
The term 'helper' might imply it forwards all broadcasts, but Cisco restricts forwarding to common services to prevent unnecessary broadcast traffic. Students often overlook the default forwarding list.
✗It prevents DHCP spoofing by validating the source MAC address of DHCP packets.Wrong answer — click to see why▾
Why this is wrong here
DHCP spoofing prevention is a function of DHCP snooping, a security feature that filters untrusted DHCP messages and builds a binding database. The ip helper-address command does not perform any validation; it simply forwards packets.
Why candidates choose this
Both features relate to DHCP security and relay, but they serve different purposes. Students may confuse the helper address with DHCP snooping because both involve DHCP packet handling.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Packet
A packet is a small unit of data that is sent over a network, containing both the actual data and control information for delivery.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.