CCNA Network Services and Security Practice Question
Exhibit
R1#show running-config | section dhcp ip dhcp excluded-address 192.168.20.0 192.168.20.255 ip dhcp pool VLAN20_POOL network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 203.0.113.10 ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 no shutdown SW1#show running-config | section interface vlan 20 interface Vlan20 ip address 192.168.20.1 255.255.255.0 ip helper-address 192.0.2.99 SW1#show ip dhcp snooping Global DHCP Snooping is disabled DHCP Snooping is configured on following vlans: No VLANs configured SW1#show interfaces status | include Fa0/3 Fa0/3 connected 1 auto auto 10/100BaseTX
You are connected to R1. Configure R1 as a DHCP server for VLAN 20 clients (192.168.20.0/24) with DNS server 203.0.113.10 and default gateway 192.168.20.1. On switch SW1, enable DHCP snooping globally and on VLAN 20, configure the uplink to R1 as trusted, and ensure that the DHCP server is reachable via ip helper-address on the VLAN 20 SVI. Currently, clients are not receiving IP addresses because of misconfigurations: the excluded-address range on R1 is too large (excluding the entire subnet), the helper-address on SW1 points to a wrong IP (192.0.2.99), and a rogue DHCP server is connected to port Fa0/3 on SW1. Fix all issues so that clients can get addresses securely.
⚠ Common exam trap
A common trap is forgetting that the excluded-address range should only reserve specific addresses, not the whole subnet. Another trap is confusing the helper-address with the default gateway or leaving the incorrect IP. Also, many candidates enable DHCP snooping but forget to configure the trusted port, which breaks legitimate DHCP traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.
The DHCP server had an excluded-address range covering the entire subnet (192.168.20.0–255), which prevented any IP from being assigned. Fix: change the excluded range to only include the gateway (192.168.20.1) and optionally other reserved addresses. The helper-address on SW1 pointed to 192.0.2.99 (nonexistent) instead of the DHCP server at 10.0.0.1; correct it. DHCP snooping was disabled; enable it globally and on VLAN 20, then configure the uplink to R1 (port connecting to R1) as trusted and the port connecting the rogue server (Fa0/3) as untrusted (or simply leave it untrusted by default, but the rogue server will be blocked).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.
Why this is correct
Ly fixes all three issues: the excluded-address range is narrowed to only the gateway, the helper-address points to the correct DHCP server IP (10.0.0.1), and DHCP snooping is enabled with the uplink trusted, blocking the rogue server on Fa0/3.
- ✗
On R1, remove the excluded-address range entirely; on SW1, configure ip helper-address 192.168.20.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.
Why it's wrong here
This is incorrect because removing the excluded-address range entirely would allow the DHCP server to assign the gateway IP (192.168.20.1) to a client, causing an IP conflict. Also, the helper-address should point to the DHCP server (10.0.0.1), not the gateway.
- ✗
On R1, change the excluded-address range to 192.168.20.1 192.168.20.254; on SW1, configure ip helper-address 192.0.2.99 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.
Why it's wrong here
This is incorrect because the excluded-address range still excludes most of the subnet (only .0 and .255 are available, but .0 is network address and .255 is broadcast), leaving no usable addresses for clients. Also, the helper-address still points to the wrong IP (192.0.2.99).
- ✗
On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, but do not configure any trusted ports.
Why it's wrong here
This is incorrect because without configuring the uplink to R1 as trusted, DHCP snooping will treat all ports as untrusted by default, including the legitimate DHCP server's port. This will cause DHCP offers from the server to be dropped, preventing clients from getting addresses.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.Correct answer▾
Why this is correct
Ly fixes all three issues: the excluded-address range is narrowed to only the gateway, the helper-address points to the correct DHCP server IP (10.0.0.1), and DHCP snooping is enabled with the uplink trusted, blocking the rogue server on Fa0/3.
✗On R1, remove the excluded-address range entirely; on SW1, configure ip helper-address 192.168.20.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.Wrong answer — click to see why▾
Why this is wrong here
The helper-address must point to the DHCP server, not the default gateway. The excluded-address range should include the gateway to prevent conflicts.
Why candidates choose this
Candidates may think that the gateway IP can be assigned to clients and that the helper-address should be the gateway, confusing the roles of DHCP and routing.
✗On R1, change the excluded-address range to 192.168.20.1 192.168.20.254; on SW1, configure ip helper-address 192.0.2.99 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.Wrong answer — click to see why▾
Why this is wrong here
The excluded-address range must be limited to reserved addresses only, not the entire usable range. The helper-address must be corrected to 10.0.0.1.
Why candidates choose this
Candidates might think that excluding a large range is safe or that the helper-address is correct as given, not realizing the IP is incorrect.
✗On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, but do not configure any trusted ports.Wrong answer — click to see why▾
Why this is wrong here
DHCP snooping requires the port connected to the legitimate DHCP server to be explicitly trusted; otherwise, all DHCP server messages are discarded.
Why candidates choose this
Candidates may assume that enabling DHCP snooping globally and per VLAN is sufficient, forgetting to designate trusted ports, or they may think the uplink is automatically trusted.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Diagnosing DNS Record Issues — A, AAAA, CNAME, MX, NS, and PTR Records
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
SVI
A Switch Virtual Interface (SVI) is a logical, software-based interface on a multilayer switch that provides Layer 3 routing capabilities for a VLAN, allowing devices in different VLANs to communicate without an external router.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.