CCNA Network Services and Security Practice Question
Exhibit
R1# show running-config | section dhcp ip dhcp excluded-address 192.168.50.1 192.168.50.100 ip dhcp pool VLAN50 network 192.168.50.0 255.255.255.0 default-router 192.168.50.1 dns-server 8.8.8.8 ! interface GigabitEthernet0/0 ip address 10.0.0.1 255.255.255.252 no shutdown ! SW1# show running-config | section interface interface GigabitEthernet0/1 description uplink to R1 ip address 10.0.0.2 255.255.255.252 ip helper-address 10.0.0.1 ! interface VLAN50 ip address 192.168.50.1 255.255.255.0 ! interface FastEthernet0/5 description rogue server switchport mode access switchport access vlan 50 ! SW1# show ip dhcp snooping Switch DHCP snooping is disabled DHCP snooping is configured on the following VLANs: none DHCP snooping trust/untrusted ports: Trusted ports: Untrusted ports:
You are connected to R1. Configure DHCP server on R1 to assign addresses from 192.168.50.0/24 to hosts on VLAN 50, excluding 192.168.50.1-192.168.50.20, with default-router 192.168.50.1 and DNS server 8.8.8.8. On switch SW1, configure DHCP snooping globally and on VLAN 50, and enable trusted ports on the uplink to R1. Then, a host on VLAN 50 reports it received an incorrect IP address; troubleshoot and fix the issue: the wrong helper-address is configured on SW1, the excluded range is too large, and a rogue DHCP server is present on port Fa0/5.
⚠ Common exam trap
This question tests your ability to troubleshoot a multi-faceted DHCP issue. Common traps include: (1) forgetting that DHCP snooping must be enabled both globally and per VLAN, (2) assuming the helper-address should be the router's link IP instead of the server's SVI IP, (3) overlooking the excluded range configuration, and (4) thinking that only one of the issues needs to be fixed. Always verify all components: snooping, trust, helper-address, and pool configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, correct the excluded range on R1 to 192.168.50.1-192.168.50.20, and change the helper-address on SW1's G0/1 to 192.168.50.1.
The host received a wrong IP because a rogue DHCP server on Fa0/5 was responding. First, enable DHCP snooping globally with 'ip dhcp snooping' and on VLAN 50 with 'ip dhcp snooping vlan 50'. Then, trust the uplink port to R1 (G0/1) with 'ip dhcp snooping trust'. Next, fix the excluded range on R1: change it to exclude only the first 20 addresses (192.168.50.1-192.168.50.20) so that hosts can obtain other addresses. Finally, correct the helper-address on SW1's G0/1: change 'ip helper-address 10.0.0.1' to 'ip helper-address 192.168.50.1' because the DHCP server is on the VLAN 50 SVI, not on the point-to-point link.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, correct the excluded range on R1 to 192.168.50.1-192.168.50.20, and change the helper-address on SW1's G0/1 to 192.168.50.1.
Why this is correct
Ly addresses all issues: DHCP snooping blocks rogue DHCP servers, trusting the uplink allows legitimate DHCP offers, fixing the excluded range ensures hosts get addresses, and correcting the helper-address ensures DHCP requests reach the correct server.
- ✗
Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 10.0.0.1.
Why it's wrong here
This option sets the DHCP relay destination to 10.0.0.1, which is the IP address of R1's interface on the point-to-point link, not the DHCP server (192.168.50.1). Even though DHCP snooping would block rogue servers, the switch would forward DHCP requests to R1's own interface, which is not listening for DHCP and would drop them. Additionally, the excluded-range misconfiguration remains, so even if a request somehow reached the legitimate server, the server could not lease any address in the pool. The helper-address must always point to the actual DHCP server's IP address.
- ✗
Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and correct the excluded range on R1 to 192.168.50.1-192.168.50.20.
Why it's wrong here
This option correctly identifies the excluded-range problem on R1 and fixes it, but it leaves the wrong helper-address on SW1's G0/1 intact. DHCP snooping trusted on the uplink only permits DHCP replies from R1's direction; it does not correct the relay destination. With an incorrect helper-address, the switch forwards client DHCP discover messages to a non-DHCP IP address (likely R1's link interface), so requests never reach the 192.168.50.1 server. The root cause of the relay failure remains unresolved, so hosts still cannot obtain an IP address.
- ✗
Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 192.168.50.1.
Why it's wrong here
This option corrects the helper-address to point to the actual DHCP server, but it ignores the excluded-range problem on R1. The DHCP server is configured to exclude the entire 192.168.50.0/24 subnet, meaning even if the relayed requests arrive at the server, it has no addresses available to offer. DHCP snooping would prevent rogue server replies, but the legitimate server would still decline to allocate from an empty pool. Without restoring the address range, the server cannot lease any IP address, leaving the network hosts without connectivity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, correct the excluded range on R1 to 192.168.50.1-192.168.50.20, and change the helper-address on SW1's G0/1 to 192.168.50.1.Correct answer▾
Why this is correct
Ly addresses all issues: DHCP snooping blocks rogue DHCP servers, trusting the uplink allows legitimate DHCP offers, fixing the excluded range ensures hosts get addresses, and correcting the helper-address ensures DHCP requests reach the correct server.
✗Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 10.0.0.1.Wrong answer — click to see why▾
Why this is wrong here
The helper-address must be the IP of the DHCP server, which is the SVI address 192.168.50.1, not the link address 10.0.0.1.
Why candidates choose this
Candidates might think the helper-address should be the next-hop IP or the IP of the router interface facing the switch.
✗Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and correct the excluded range on R1 to 192.168.50.1-192.168.50.20.Wrong answer — click to see why▾
Why this is wrong here
The helper-address misconfiguration prevents DHCP requests from being forwarded to the correct server, so fixing only the excluded range is insufficient.
Why candidates choose this
Candidates might focus only on the excluded range issue and overlook the helper-address, especially if they assume the helper-address is correct.
✗Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 192.168.50.1.Wrong answer — click to see why▾
Why this is wrong here
The excluded range must be corrected to allow hosts to receive addresses from the pool; otherwise, the DHCP server will not assign addresses.
Why candidates choose this
Candidates might think that DHCP snooping alone will solve the issue, or they may forget to adjust the excluded range after troubleshooting.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.