CCNA DHCP Questions — Page 2 of 2

MCQmedium

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

A.Change the helper address on interface Vlan20 to 10.50.0.10.

B.Convert the VLAN 20 user ports to trunk mode.

C.Configure a default gateway on the user PCs manually.

D.Disable DHCP snooping on VLAN 20.

AnswerA

The DHCP server is not on VLAN 20, so the router interface Vlan20 must use the ip helper-address command to forward DHCP client broadcasts as unicasts to the actual DHCP server at 10.50.0.10. Without a correctly configured helper address, the DHCP messages never leave the local VLAN and clients remain unaddressed. This is the standard fix for a DHCP relay problem.

Why this answer

The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here.

DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Exam trap

A frequent exam trap is assuming that user ports must be trunks or that disabling DHCP snooping will fix DHCP address assignment issues. In reality, user ports should remain in access mode to maintain VLAN membership, and DHCP snooping is unrelated to this specific forwarding problem because the exhibit shows a misconfigured helper address while other VLANs function normally. Another common mistake is thinking that manually configuring a default gateway on clients solves DHCP problems, but DHCP discovery requires proper relay configuration on the Layer 3 interface.

Misconfiguring or omitting the ip helper-address on the VLAN interface causes DHCP requests to fail, which is the core issue here.

Why the other options are wrong

Disabling DHCP snooping is unnecessary because the other VLANs work, and the scenario does not indicate a trust misconfiguration; the real problem is the incorrect helper address on Vlan20.

Practice this question →

MCQhard

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

A.Enable Dynamic ARP Inspection on VLAN 10.

B.Configure interface Gi0/1 as a DHCP snooping trusted port.

C.Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

D.Reconfigure the DHCP server scope to include DHCP Option 82.

AnswerB

DHCP snooping treats all ports as untrusted by default and drops DHCP server messages (OFFER, ACK) that arrive on untrusted ports. The DHCP server is connected to interface Gi0/1, so the switch is currently dropping its valid reply. By configuring Gi0/1 as a DHCP snooping trusted port, the switch will forward DHCP offers and acknowledgments from that port, allowing clients on VLAN 10 to obtain addresses while still protecting against rogue DHCP servers on other ports.

Why this answer

DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Exam trap

Cisco often tests the default behavior of DHCP snooping where all ports are untrusted, and the trap is that candidates may think the issue is a routing problem (ip helper-address) or a server-side configuration (Option 82) rather than recognizing the need to mark the server-facing port as trusted.

Why the other options are wrong

Misunderstanding that DAI controls DHCP traffic rather than ARP packets.

Assuming DHCP snooping introduces routing changes or that the server is on a different subnet.

Confusing DHCP snooping with DHCP relay agent functionality and option 82 insertion.

Practice this question →

MCQmedium

A DHCP server is located on a different VLAN from the clients. Which feature is required so the clients can still receive addresses?

A.DHCP snooping

B.DHCP relay

C.Port security

D.NAT overload

AnswerB

DHCP relay is the correct solution because DHCP clients send broadcast DISCOVER messages, and routers do not forward broadcasts between VLANs. A relay agent such as an ip helper-address command on the router's SVI intercepts the broadcast, unicasts it to the DHCP server's IP, and relays the server's OFFER/ACK back to the client, enabling cross-subnet address assignment.

Why this answer

DHCP relay forwards client broadcasts to a remote server as unicast, typically using ip helper-address on the Layer 3 interface.

Exam trap

A common exam trap is selecting DHCP snooping as the solution for clients on different VLANs to receive DHCP addresses. DHCP snooping is a security mechanism that filters DHCP messages to prevent rogue servers but does not forward DHCP broadcasts across VLANs. Another tempting but incorrect choice is port security, which controls MAC address access on switch ports but does not affect DHCP broadcast forwarding.

NAT overload is unrelated to DHCP address assignment and only translates IP addresses for outbound traffic. The key misunderstanding is confusing DHCP relay’s role in forwarding broadcasts with security or address translation features.

Why the other options are wrong

DHCP snooping is a security feature that prevents unauthorized DHCP servers by filtering DHCP messages. It does not forward DHCP broadcasts across VLANs, so it cannot enable clients on different VLANs to receive addresses.

Port security restricts the number and identity of MAC addresses on switch ports to enhance security. It does not affect DHCP broadcast forwarding or enable clients to receive addresses from servers on different VLANs.

NAT overload translates multiple private IP addresses to a single public IP address for outbound traffic. It does not address the issue of forwarding DHCP broadcasts between VLANs or enable DHCP clients to obtain addresses from remote servers.

Practice this question →

Multi-Selectmedium

Which TWO commands would a network engineer use to verify that a Windows client has received an IP address from a DHCP server and can resolve a domain name to an IP address?

Select 2 answers

A.ping 8.8.8.8

B.ipconfig /all

C.tracert www.courseiva.com

D.nslookup www.courseiva.com

E.arp -a

AnswersB, D

ipconfig /all is the correct command because it displays the full TCP/IP configuration for every network adapter on the system. It explicitly shows whether DHCP is enabled, the DHCP server address, the lease obtained and lease expiration times, and the IP address currently assigned by DHCP, which directly confirms that the DHCP process has completed successfully. It also lists the configured DNS servers and other vital Layer 3 details, making it the definitive tool for diagnosing IP addressing issues in a DHCP environment.

Why this answer

`ipconfig /all` displays the full TCP/IP configuration for all adapters, including whether the IP address was obtained from a DHCP server (the DHCP Enabled and DHCP Server fields). Option D is correct because `nslookup www.courseiva.com` queries the configured DNS server to resolve the domain name to an IP address, confirming DNS resolution works.

Exam trap

Cisco often tests the distinction between connectivity verification (ping) and configuration verification (ipconfig /all, nslookup), leading candidates to mistakenly select ping or tracert as tools for confirming DHCP and DNS functionality.

Why the other options are wrong

It checks network reachability, not DHCP or DNS.

It shows the path taken, not DHCP or DNS status.

It shows Layer 2 address mappings, not DHCP or DNS.

Practice this question →

Multi-Selectmedium

A branch router is acting as a DHCP server. Which two parameters can it provide directly to clients through DHCP?

Select 2 answers

A.Default gateway

B.DNS server address

C.OSPF area number

D.Switch port duplex setting

E.STP root bridge priority

AnswersA, B

DHCP Option 3 (Router) is used by clients to reach subnets beyond their local segment. When a branch router acts as a DHCP server, it must advertise a default gateway—typically its own LAN interface address—so endpoints can send off-subnet traffic. Without this parameter, clients can only communicate within the local broadcast domain.

Why this answer

DHCP (Dynamic Host Configuration Protocol) is designed to automatically assign IP configuration parameters to clients. The default gateway (option 3) and DNS server address (option 6) are standard DHCP options defined in RFC 2132, which a router acting as a DHCP server can directly provide to clients to enable network connectivity and name resolution.

Exam trap

Cisco often tests the distinction between DHCP-provided parameters (Layer 3/4) and switch-specific or routing protocol parameters (Layer 2/3), leading candidates to mistakenly select options like OSPF area or STP priority that are not DHCP options.

Why the other options are wrong

DHCP provides IP configuration parameters like default gateway and DNS server, not routing protocol parameters. OSPF area number is a routing protocol setting configured manually on routers, not assigned via DHCP.

DHCP provides IP configuration parameters like default gateway and DNS server, not physical layer settings like switch port duplex. Duplex is configured locally on the switch interface, not assigned via DHCP.

STP root bridge priority is a Spanning Tree Protocol parameter used to elect the root bridge in a switched network, not a DHCP-provided parameter. DHCP can only supply IP configuration parameters like default gateway and DNS server.

Practice this question →

MCQhard

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

A.Check the DHCP server logs to see if it is receiving Discover messages.

B.Verify that the ip helper-address command is configured on the router's VLAN 20 interface.

C.Attempt to ping the DHCP server's IP address from the host's APIPA address.

D.Restart the DHCP service on the server and recheck the host.

AnswerB

The router is the intervlan router, and the DHCP server is on a different subnet. For a DHCP Discover broadcast to cross VLANs, the router must have an IP helper-address pointing to the DHCP server's IP address on the VLAN 20 interface. Since all ports are up/up, the problem is almost certainly the missing relay. Checking this config directly addresses the most probable cause.

Why this answer

The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Exam trap

Cisco often tests the concept that a DHCP relay (ip helper-address) is required when the DHCP server is on a different subnet, and candidates mistakenly focus on server-side issues or ping tests instead of the router configuration.

Why the other options are wrong

This action assumes the DHCP request has already reached the server; it bypasses verifying the network path that would deliver the broadcast to the server, which is the most likely missing piece.

Candidates might think that if the ping fails, the problem is network connectivity, but APIPA addresses are non-routable and the test itself is invalid in this context.

Many techs jump to rebooting a service when a simple configuration check would reveal the real problem. This violates the principle of least intrusive troubleshooting.

Practice this question →

MCQhard

A network administrator has configured a switch port to support a VoIP phone and a desktop PC. Users report that the desktop PC cannot obtain an IP address via DHCP, while the VoIP phone registers successfully. The switch port is up/up, and the desktop is connected to the phone's PC port. What is the most likely cause of the issue?

A.The switchport mode access should be changed to switchport mode trunk to allow both vlans.

B.The switchport access vlan should be changed to the data VLAN to match the subnet expected by the desktop.

C.The switchport voice vlan should be removed because the desktop cannot use it.

D.The spanning-tree portfast should be disabled to prevent DHCP delays.

AnswerB

In a typical IP phone daisy-chain topology, the desktop connects to the phone's PC port, and the switch sends all untagged desktop frames into the port's configured access VLAN. If that access VLAN is incorrectly set to, say, the native VLAN or a different number, the desktop's DHCP DISCOVER will not arrive at the DHCP server for its expected data subnet, leaving it without an IP address. Correctly changing the switchport access vlan to the data VLAN ensures the desktop's untagged traffic is placed in the proper L2 domain, allowing the DHCP server to respond with an appropriate address.

Why this answer

The desktop PC obtains its IP address from the data VLAN, but the switch port's access VLAN is likely misconfigured to the voice VLAN. Changing the access VLAN to the correct data VLAN places the PC in the proper subnet and allows DHCP to function. Option A is unnecessary because a voice-access port does not need to be a trunk.

Option C would break the VoIP phone without fixing the PC's VLAN assignment. Option D is irrelevant; PortFast speeds up STP convergence and does not block DHCP.

Exam trap

Cisco often tests the misconception that the PC uses the voice VLAN or that the port must be a trunk, when in reality the phone handles the VLAN separation internally and the switch port remains an access port with a separate voice VLAN.

Why the other options are wrong

The current configuration uses access mode with voice vlan, which is correct for a phone+PC setup. Trunk mode is unnecessary and could break the phone's untagged traffic expectations.

The voice vlan is correctly configured for the phone; the problem is with the data vlan assignment for the desktop.

Portfast is beneficial for host ports; disabling it would worsen the issue by introducing STP convergence delays.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe DHCP?

Select 2 answers

A.It can automatically provide an IP address to a client.

B.It can provide additional configuration such as default gateway and DNS server information.

C.It resolves hostnames into IP addresses.

D.It elects the designated router in OSPF.

E.It replaces the need for subnet masks.

AnswersA, B

DHCP's core function is dynamic address assignment: the server leases an available IPv4 address from its scope to a requesting client, removing manual configuration. This automatic provisioning is the defining characteristic distinguishing DHCP from static addressing.

Why this answer

Option A is correct because DHCP (Dynamic Host Configuration Protocol) automatically leases an IPv4 address to a client from a configured pool using the DORA process (Discover, Offer, Request, Acknowledge). Option B is correct because DHCP options, such as option 3 (default gateway/router) and option 6 (DNS servers), deliver additional configuration parameters alongside the IP address, subnet mask, and lease time. Option C is incorrect because hostname-to-IP resolution is performed by DNS, not DHCP.

Option D is incorrect because OSPF elects a Designated Router (DR) and Backup Designated Router (BDR) via hello packets and priority values, which is unrelated to DHCP. Option E is incorrect because DHCP still supplies a subnet mask (option 1) as part of the lease; it does not eliminate the need for subnet masks.

Exam trap

A common exam trap is confusing DHCP with DNS or routing protocol functions. Some candidates mistakenly believe DHCP resolves hostnames to IP addresses, but this is the role of DNS. Others incorrectly think DHCP participates in routing protocol processes such as OSPF designated router elections, which it does not.

Additionally, some may assume DHCP eliminates the need for subnet masks, but DHCP actually provides subnet mask information to clients. Recognizing that DHCP strictly handles IP address and related configuration assignment prevents these errors.

Why the other options are wrong

Incorrect. DHCP does not resolve hostnames to IP addresses; this is the responsibility of DNS, a separate IP service.

Incorrect. DHCP does not participate in routing protocol operations like OSPF designated router election, which is a function of OSPF itself.

Incorrect. DHCP supplies subnet masks to clients but does not replace the need for subnet masks; subnetting remains a fundamental network design concept.

Practice this question →