CCNA Network Services and Security Practice Question
Exhibit
interface Vlan20 ip address 10.20.20.1 255.255.255.0 ip helper-address 10.50.0.100 interface Vlan30 ip address 10.30.30.1 255.255.255.0 ip helper-address 10.50.0.10 DHCP server address: 10.50.0.10
Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?
⚠ Common exam trap
A frequent exam trap is assuming that user ports must be trunks or that disabling DHCP snooping will fix DHCP address assignment issues. In reality, user ports should remain in access mode to maintain VLAN membership, and DHCP snooping is unrelated to this specific forwarding problem because the exhibit shows a misconfigured helper address while other VLANs function normally. Another common mistake is thinking that manually configuring a default gateway on clients solves DHCP problems, but DHCP discovery requires proper relay configuration on the Layer 3 interface. Misconfiguring or omitting the ip helper-address on the VLAN interface causes DHCP requests to fail, which is the core issue here.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the helper address on interface Vlan20 to 10.50.0.10.
The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here. DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Change the helper address on interface Vlan20 to 10.50.0.10.
Why this is correct
The DHCP server is not on VLAN 20, so the router interface Vlan20 must use the ip helper-address command to forward DHCP client broadcasts as unicasts to the actual DHCP server at 10.50.0.10. Without a correctly configured helper address, the DHCP messages never leave the local VLAN and clients remain unaddressed. This is the standard fix for a DHCP relay problem.
- ✗
Convert the VLAN 20 user ports to trunk mode.
Why it's wrong here
User ports on VLAN 20 should remain as access ports because each access port is assigned to a single untagged VLAN, which is correct for end-host connectivity. Trunk ports are intended for links carrying multiple VLANs, such as between switches or to a router on a stick, and do not change the DHCP relay behavior. Converting access ports to trunk mode would not deliver DHCP packets to the server and could introduce VLAN hopping or inconsistent tagging issues.
When this WOULD be correct
In a different scenario, if the question stated that VLAN 20 clients were connected to a switch port configured as an access port and needed to communicate with multiple VLANs, converting the user ports to trunk mode could be the correct solution to allow DHCP traffic to traverse between VLANs.
- ✗
Configure a default gateway on the user PCs manually.
Why it's wrong here
Manually configuring a default gateway only tells clients the router to use for off-subnet traffic, but it does not assist with DHCP address acquisition. A DHCP client sends broadcast discovery messages before it has any IP configuration, and a default gateway is irrelevant to that L2-only process. The root cause is the missing/incorrect ip helper-address on the VLAN 20 SVI, not the client's gateway setting.
When this WOULD be correct
In a different scenario where the question states that VLAN 20 clients are unable to communicate with the DHCP server due to incorrect routing or subnetting, manually configuring a default gateway on the user PCs could resolve the issue by ensuring they can reach the DHCP server's subnet.
- ✗
Disable DHCP snooping on VLAN 20.
Why it's wrong here
DHCP snooping is a security feature that filters untrusted DHCP messages and prevents rogue DHCP servers, but the exhibit gives no indication that it is enabled or that it is blocking legitimate DHCP traffic. Disabling it would weaken the network's security posture without addressing the actual configuration error, which is the helper address pointing to the wrong destination or missing entirely. The correct action is to verify the ip helper-address on Vlan20, not to disable a protective feature.
When this WOULD be correct
In a scenario where a question asks about troubleshooting DHCP issues and indicates that DHCP snooping is incorrectly blocking legitimate DHCP traffic from a server, disabling DHCP snooping could be the correct action to allow clients to receive IP addresses. This would be applicable if the configuration was preventing legitimate DHCP responses.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Change the helper address on interface Vlan20 to 10.50.0.10.Correct answer▾
Why this is correct
The DHCP server is not on VLAN 20, so the router interface Vlan20 must use the ip helper-address command to forward DHCP client broadcasts as unicasts to the actual DHCP server at 10.50.0.10. Without a correctly configured helper address, the DHCP messages never leave the local VLAN and clients remain unaddressed. This is the standard fix for a DHCP relay problem.
✗Convert the VLAN 20 user ports to trunk mode.Wrong answer — click to see why▾
Why this is wrong here
Converting VLAN 20 user ports to trunk mode is incorrect because it does not address the issue of DHCP packets not being forwarded to the centralized DHCP server. Trunking is used for carrying multiple VLANs, but the problem lies in the lack of a helper address for DHCP relay.
★ When this WOULD be the correct answer
In a different scenario, if the question stated that VLAN 20 clients were connected to a switch port configured as an access port and needed to communicate with multiple VLANs, converting the user ports to trunk mode could be the correct solution to allow DHCP traffic to traverse between VLANs.
Why candidates choose this
Candidates may choose this option because they associate trunking with VLAN communication and believe that enabling trunking would resolve connectivity issues, overlooking the specific requirement for DHCP relay configuration.
✗Configure a default gateway on the user PCs manually.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because configuring a default gateway on user PCs does not address the issue of VLAN 20 clients not receiving DHCP addresses. The problem lies in the DHCP relay configuration, not the individual PC settings.
★ When this WOULD be the correct answer
In a different scenario where the question states that VLAN 20 clients are unable to communicate with the DHCP server due to incorrect routing or subnetting, manually configuring a default gateway on the user PCs could resolve the issue by ensuring they can reach the DHCP server's subnet.
Why candidates choose this
Candidates may choose this option because they recognize that a default gateway is essential for network communication and might assume that configuring it on user PCs could resolve connectivity issues without considering the specific context of DHCP relay configurations.
✗Disable DHCP snooping on VLAN 20.Wrong answer — click to see why▾
Why this is wrong here
Disabling DHCP snooping on VLAN 20 would not resolve the issue of clients not receiving IP addresses, as DHCP snooping is a security feature that prevents unauthorized DHCP servers from providing IP addresses. The problem lies in the lack of a proper helper address for DHCP requests, not in the snooping configuration.
★ When this WOULD be the correct answer
In a scenario where a question asks about troubleshooting DHCP issues and indicates that DHCP snooping is incorrectly blocking legitimate DHCP traffic from a server, disabling DHCP snooping could be the correct action to allow clients to receive IP addresses. This would be applicable if the configuration was preventing legitimate DHCP responses.
Why candidates choose this
Candidates might choose this option because they recognize DHCP snooping as a common security feature that can interfere with DHCP operations, leading them to believe that disabling it could resolve connectivity issues without fully understanding the specific context of the problem.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
SVI
A Switch Virtual Interface (SVI) is a logical, software-based interface on a multilayer switch that provides Layer 3 routing capabilities for a VLAN, allowing devices in different VLANs to communicate without an external router.
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.