Question 371 of 1,389
CCNA Network Services and Security Practice Question
Exhibit
Router# show running-config | section interface GigabitEthernet0/1 interface GigabitEthernet0/1 description VLAN 200 ip address 192.168.200.1 255.255.255.0 ip helper-address 192.168.100.10 no shutdown ! Router# show ip dhcp relay information trusted DHCP relay information trusted: Not configured Router# show ip dhcp server statistics Memory usage: 12345 Address pools: 1 Database agents: 0 Automatic bindings: 0 Manual bindings: 0 Expired bindings: 0 Malformed messages: 0 Message received: BOOTREQUEST: 0 DHCPDISCOVER: 0 DHCPREQUEST: 0 DHCPDECLINE: 0 DHCPRELEASE: 0 DHCPINFORM: 0 Message sent: BOOTREPLY: 0 DHCPOFFER: 0 DHCPACK: 0 DHCPNAK: 0
A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?
⚠ Common exam trap
Cisco often tests the misconception that a correctly configured DHCP relay alone guarantees DHCP operation, ignoring that DHCP snooping can silently drop relayed messages if the relay interface is not trusted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DHCP snooping is blocking the relay agent because the relay interface is not trusted.
The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped. Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place. Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DHCP server is on a different subnet and the relay address is incorrect.
Why it's wrong here
The DHCP server resides on VLAN 100, which is a different subnet from the clients on VLAN 200, so a DHCP relay is required. However, the relay address 192.168.100.10 shown in the exhibit is the server's correct IP address, and the ip helper-address command is properly configured. Therefore, the relay address is not incorrect; it accurately points to the server. The real issue is that DHCP snooping drops the server's responses because the interface facing the DHCP server is not marked as trusted, not because of any relay addressing problem.
- ✓
DHCP snooping is blocking the relay agent because the relay interface is not trusted.
Why this is correct
The 'show ip dhcp relay information trusted' output shows 'Not configured', which means the relay agent is not trusting the DHCP server's responses. This causes the switch to drop DHCP server responses when DHCP snooping is enabled. The fix is to configure 'ip dhcp relay information trusted' on the interface facing the DHCP server.
- ✗
The DHCP server is unreachable from the router.
Why it's wrong here
The DHCP server is not a remote device; it is hosted on the router itself, with the VLAN 100 interface assigned 192.168.100.10. Because the server is directly connected to the router, the relay agent cannot experience a reachability failure—the packets are sent to a local address. Even if the server were remote, the relay configuration would still provide a path, making unreachability highly unlikely. The actual cause of the failure is that DHCP snooping on the switch discards the DHCPOFFER and DHCPACK messages from the server because the relay interface is untrusted.
- ✗
The ip helper-address command is missing from the VLAN 200 interface.
Why it's wrong here
The configuration output in the exhibit explicitly shows 'ip helper-address 192.168.100.10' is present on GigabitEthernet0/1, which is the interface in VLAN 200. Therefore, the helper-address command is not missing, and the relay is correctly set to forward client DHCP broadcasts to the server. If this command were absent, clients would never receive any DHCP replies at all. The true reason clients are failing is that the switch has DHCP snooping enabled and the port connecting to the DHCP server is not configured as trusted, so the relayed server responses are silently dropped.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DHCP snooping is blocking the relay agent because the relay interface is not trusted.Correct answer▾
Why this is correct
The 'show ip dhcp relay information trusted' output shows 'Not configured', which means the relay agent is not trusting the DHCP server's responses. This causes the switch to drop DHCP server responses when DHCP snooping is enabled. The fix is to configure 'ip dhcp relay information trusted' on the interface facing the DHCP server.
✗The DHCP server is on a different subnet and the relay address is incorrect.Wrong answer — click to see why▾
Why this is wrong here
The relay address 192.168.100.10 is correctly configured to point to the DHCP server on VLAN 100. The issue is not with the relay address being incorrect.
Why candidates choose this
Students often think that DHCP relay requires the server to be on a different subnet, but here the server is on a different VLAN (100) and the relay address is correct. They might assume the address is wrong because clients are on a different subnet.
✗The DHCP server is unreachable from the router.Wrong answer — click to see why▾
Why this is wrong here
The DHCP server is on the same router (VLAN 100 interface) and is reachable; the relay configuration is correct. The server is not unreachable.
Why candidates choose this
A common troubleshooting step is to check reachability. Since clients cannot get IP addresses, one might assume the server is unreachable, but the router can reach it directly.
✗The ip helper-address command is missing from the VLAN 200 interface.Wrong answer — click to see why▾
Why this is wrong here
The exhibit shows 'ip helper-address 192.168.100.10' is configured on GigabitEthernet0/1, which is the VLAN 200 interface. The command is present.
Why candidates choose this
The 'ip helper-address' command is essential for DHCP relay. If a student misses the exhibit or misreads it, they might think the command is missing.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.