CCNA Switching and Network Access Practice Question
Exhibit
interface Vlan30 ip address 10.30.30.1 255.255.255.0 no shutdown interface Vlan99 ip address 10.99.99.1 255.255.255.0 no shutdown DHCP server IP: 10.99.99.20
Clients in VLAN 30 are not receiving addresses from the DHCP server located in VLAN 99. Which configuration change should be made on the Layer 3 interface for VLAN 30?
⚠ Common exam trap
Remember that DHCP snooping and trunk mode do not facilitate DHCP relay. Focus on the purpose of `ip helper-address` for relaying requests across VLANs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add ip helper-address 10.99.99.20 under interface Vlan30.
The DHCP server is on a different subnet, so the client broadcast messages from VLAN 30 will not naturally cross the Layer 3 boundary. In simple terms, the clients are asking for an address by shouting on their own floor of the building, but the server lives on another floor and cannot hear that broadcast directly. The router or Layer 3 switch must relay the request for them. On Cisco devices, that relay function is usually configured with `ip helper-address` on the interface that receives the client broadcasts. Here, that receiving interface is Vlan30, because that is the default gateway for the clients in VLAN 30. Pointing `ip helper-address` to 10.99.99.20 tells the Layer 3 device to forward DHCP requests to the remote server. DHCP snooping trust is a separate security feature, trunk mode is unrelated to an SVI, and `ip default-gateway` is not the correct solution for relaying DHCP across subnets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add ip dhcp snooping trust under interface Vlan30.
Why it's wrong here
`ip dhcp snooping trust` is a Layer 2 security feature applied to switch ports to whitelist DHCP server responses; it prevents spoofed DHCP offers but does not perform any packet forwarding. An SVI is a virtual Layer 3 interface, and DHCP snooping configuration on it is invalid because snooping only inspects commands on access/trunk ports. The failure to receive addresses across VLANs is a routing/relay problem, not a security filtering problem, so adding this would leave DHCPDISCOVER broadcasts stranded in VLAN 30.
When this WOULD be correct
In a different scenario where the question asks about securing a network with multiple VLANs and preventing unauthorized DHCP servers, adding 'ip dhcp snooping trust' under interface Vlan30 would be correct to allow trusted DHCP responses from a legitimate server.
- ✗
Add switchport mode trunk under interface Vlan30.
Why it's wrong here
`switchport mode trunk` is only valid on Layer 2 physical or port-channel interfaces, whereas `interface Vlan30` is a Layer 3 SVI that does not support switchport commands. A trunk would allow VLAN 30 traffic to reach other switches, but it cannot convert a client broadcast into a unicast DHCP packet to a server in VLAN 99. The root cause is the absence of a DHCP relay agent on the VLAN 30 gateway, which only `ip helper-address` can supply.
When this WOULD be correct
In a different scenario where the question asks about configuring a Layer 2 switch port that connects to another switch, and the requirement is to allow multiple VLANs to traverse that link, 'switchport mode trunk' would be the correct configuration to enable trunking on that interface.
- ✗
Add ip default-gateway 10.99.99.20 under interface Vlan30.
Why it's wrong here
The `ip default-gateway` command is a global command that defines the management gateway for a switch, not a per-interface parameter for an SVI. Even if it were accepted, it would only set the device's default route for management traffic; it has no mechanism to intercept broadcast DHCPDISCOVER messages and forward them as unicast to a server in another broadcast domain. DHCP relay requires `ip helper-address` on the client VLAN's gateway interface, not a default-gateway statement.
When this WOULD be correct
In a scenario where the question asks about configuring a Layer 2 switch that needs to communicate with a router for routing purposes, using 'ip default-gateway 10.99.99.20' would be correct to ensure the switch can reach the router for management traffic.
- ✓
Add ip helper-address 10.99.99.20 under interface Vlan30.
Why this is correct
This is correct because the SVI for VLAN 30 is the interface that receives the client DHCP broadcasts. By adding `ip helper-address 10.99.99.20`, the Layer 3 device forwards the request as a unicast packet to the DHCP server in VLAN 99.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Add ip helper-address 10.99.99.20 under interface Vlan30.Correct answer▾
Why this is correct
This is correct because the SVI for VLAN 30 is the interface that receives the client DHCP broadcasts. By adding `ip helper-address 10.99.99.20`, the Layer 3 device forwards the request as a unicast packet to the DHCP server in VLAN 99.
✗Add ip dhcp snooping trust under interface Vlan30.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because enabling DHCP snooping trust on VLAN 30 does not facilitate communication with the DHCP server in VLAN 99; it only protects against rogue DHCP servers.
★ When this WOULD be the correct answer
In a different scenario where the question asks about securing a network with multiple VLANs and preventing unauthorized DHCP servers, adding 'ip dhcp snooping trust' under interface Vlan30 would be correct to allow trusted DHCP responses from a legitimate server.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of DHCP snooping, believing that it directly relates to the DHCP process rather than its role in securing the network against rogue servers.
✗Add switchport mode trunk under interface Vlan30.Wrong answer — click to see why▾
Why this is wrong here
Adding 'switchport mode trunk' under interface Vlan30 is incorrect because VLAN 30 is already configured as a Layer 3 interface, and trunking is not applicable to Layer 3 interfaces. This command is used for Layer 2 interfaces to allow multiple VLANs over a single link.
★ When this WOULD be the correct answer
In a different scenario where the question asks about configuring a Layer 2 switch port that connects to another switch, and the requirement is to allow multiple VLANs to traverse that link, 'switchport mode trunk' would be the correct configuration to enable trunking on that interface.
Why candidates choose this
Candidates may choose this option because they might confuse Layer 3 interfaces with Layer 2 configurations, thinking that trunking is necessary for VLAN communication, especially if they are familiar with VLAN setups in general.
✗Add ip default-gateway 10.99.99.20 under interface Vlan30.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the command 'ip default-gateway' is used to set a default gateway for a Layer 2 device, not for enabling DHCP relay on a Layer 3 interface. Clients in VLAN 30 need a helper address to reach the DHCP server in VLAN 99.
★ When this WOULD be the correct answer
In a scenario where the question asks about configuring a Layer 2 switch that needs to communicate with a router for routing purposes, using 'ip default-gateway 10.99.99.20' would be correct to ensure the switch can reach the router for management traffic.
Why candidates choose this
Candidates may choose this option because they recognize the need for a default gateway for devices in a VLAN, mistakenly believing it applies to enabling DHCP services instead of understanding the specific role of DHCP relay.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Configuring Switch Ports for Desktops, VoIP Phones, APs, IoT, and Virtualized Hosts
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.