How many DHCP Troubleshooting Scenarios questions are on this page?

This page has 9 DHCP Troubleshooting Scenarios scenario questions for the 350-601 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-601 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco DCCOR / CCNP Data Center Core 350-601 questions

Scenario-based practice

DHCP Troubleshooting Scenarios

Practise 350-601 DHCP questions covering DORA flow, scopes, excluded addresses, default gateway options, helper addresses, and troubleshooting clients that receive APIPA or cannot get an IP address.

Start full practice test Read exam guide

scenario questions

350-601

exam code

Cisco

vendor

Scenario guide

How to approach dhcp troubleshooting scenarios

DHCP questions cover server configuration, relay agents (ip helper-address), DHCP snooping, and the four-step DORA handshake. Common exam scenarios: a host isn't getting an IP, a relay agent isn't forwarding requests, or a rogue DHCP server is handing out wrong addresses.

Quick answer

DHCP questions usually test address assignment, scopes, relay agents, excluded addresses and why a client cannot obtain an IP address.

DHCP discovery, offer, request and acknowledgement flow.

DHCP scopes, excluded addresses and default gateway options.

DHCP relay using helper addresses.

Troubleshooting clients that receive APIPA or no address.

Practice scenarios

Question 1mediummulti select

Read the full DHCP explanation →

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

A
Port Security
Why wrong: Port Security uses MAC address tables, not DHCP snooping bindings.
B
IP Source Guard
IP Source Guard uses the DHCP snooping binding to permit only valid IP/MAC addresses.
C
Private VLANs
Why wrong: Private VLANs are a Layer 2 isolation technique, not dependent on DHCP snooping.
D
Dynamic ARP Inspection
DAI intercepts ARP packets and validates them against the DHCP snooping database.
E
MACsec
Why wrong: MACsec provides encryption and is independent of DHCP snooping.

Full breakdown with real-world context →

Question 2hardmultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting a DHCP issue in a data center VLAN. Clients are unable to obtain IP addresses from the DHCP server. The switch has DHCP snooping enabled on the VLAN, and the DHCP server is connected to a trusted port. The clients are on untrusted ports. Which additional security feature is most likely causing the problem if the DHCP server is on a different subnet and the switch is not configured as a DHCP relay?

A
DHCP snooping with no IP helper address configured
DHCP snooping on untrusted ports drops DHCPOFFER from outside the subnet unless relay is set up.
B
Dynamic ARP Inspection (DAI)
Why wrong: DAI validates ARP packets, not DHCP.
C
Control Plane Policing (CoPP) dropping DHCP packets
Why wrong: CoPP might drop if rate-limited, but DHCP is typically not rate-limited aggressively.
D
Port security with maximum MAC limit
Why wrong: Port security limits MACs but does not block DHCP.

Full breakdown with real-world context →

Question 3easymultiple choice

Open the full VLAN trunking answer →

A startup company is deploying a new web application on UCS B-Series blades. They want to use PXE boot for rapid provisioning. The network team has configured a DHCP server and a PXE server on the same VLAN as the UCS service profiles. The system administrator creates a service profile for a blade and sets the boot policy to 'PXE' as the first boot device, and local disk as second. However, when the blade powers on, it boots from the local disk instead of PXE. The PXE server logs show no request from the blade's MAC address. The DHCP server logs show no activity. The fabric interconnect is configured with a default VLAN. What is the most likely cause?

A
The vNIC on the service profile is not configured with the correct native VLAN
Native VLAN mismatch prevents DHCP from reaching the server
B
The boot policy order lists local disk before PXE
Why wrong: The stem says PXE is first
C
The service profile is not properly associated with the blade
Why wrong: Association would not affect PXE; server boots anyway
D
The fabric interconnect uplinks are not in trunk mode
Why wrong: Uplinks usually trunk; would affect all traffic, not just PXE

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

An engineer is configuring PXE boot for a UCS B-series blade. The blade's vNIC is associated with a VLAN that has no IP helper address configured. What is required to allow the blade to obtain an IP address from a DHCP server on a different subnet?

A
Configure a static IP address in the service profile
Why wrong: PXE boot typically uses DHCP; static IP may not work with PXE.
B
Enable DHCP snooping on the Fabric Interconnect
Why wrong: DHCP snooping is security feature, not relay.
C
Add an IP helper address on the VLAN interface in the upstream switch
IP helper relays DHCP broadcasts to the DHCP server.
D
Use a local DHCP server on the same VLAN
Why wrong: Could work but not always feasible; IP helper is typical.

Full breakdown with real-world context →

Question 5mediummulti select

Read the full DHCP explanation →

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

A
Control Plane Policing (CoPP)
Why wrong: CoPP protects the CPU from floods, but not DHCP attack specific.
B
DHCP snooping
DHCP snooping filters untrusted DHCP messages.
C
Port security
Why wrong: Port security limits MAC addresses, not DHCP-specific.
D
IP Source Guard
IP Source Guard prevents IP spoofing using DHCP binding.
E
Dynamic ARP Inspection (DAI)
DAI validates ARP packets using DHCP snooping binding to prevent ARP spoofing.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full DHCP explanation →

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

Exhibit

Switch# show running-config | section interface
interface Ethernet1/1
 description DHCP Server
 switchport mode access
!
interface Ethernet1/2
 description Client
 switchport mode access
 ip verify source
!
ip dhcp snooping
ip dhcp snooping vlan 10
ip dhcp snooping information option

A
The DHCP snooping information option is disabled
Why wrong: The option is enabled (ip dhcp snooping information option), so this is not the issue.
B
The DHCP server is on a different VLAN
Why wrong: DHCP snooping is enabled for VLAN 10, and the server is likely on that VLAN.
C
The DHCP snooping trust configuration is missing on the server port
Without trust, DHCP server messages are dropped on the untrusted port.
D
IP source guard is enabled on the client port
Why wrong: IP source guard can block IP spoofing, but DHCP replies are sent as Layer 2 broadcasts; source guard typically does not block valid DHCP.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full DHCP explanation →

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

A
Dynamic ARP Inspection
Why wrong: DAI validates ARP, not DHCP.
B
DHCP Snooping
DHCP snooping blocks rogue DHCP servers.
C
IP Source Guard
Why wrong: IP Source Guard prevents IP spoofing.
D
Port Security
Why wrong: Port security limits MAC addresses.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full DHCP explanation →

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

A
IP Source Guard
IP Source Guard prevents IP spoofing.
B
DHCP snooping
Why wrong: DHCP snooping prevents rogue DHCP servers, not IP spoofing.
C
Port security
Why wrong: Port security limits MAC addresses.
D
Dynamic ARP Inspection
Why wrong: DAI prevents ARP spoofing.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full DHCP explanation →

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?

A
Configure the port connected to the DHCP server as trusted
Trusted ports are allowed to forward DHCP server messages, preventing rogue servers.
B
Disable DHCP snooping on the DHCP server VLAN
Why wrong: Disabling snooping on the VLAN would allow rogue servers.
C
Set the DHCP server IP address in the binding database
Why wrong: The binding database is built dynamically from trusted port traffic.
D
Enable DHCP snooping on all VLANs
Why wrong: Enabling on all VLANs is not a best practice; trust configuration is key.

Full breakdown with real-world context →

These 350-601 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-601 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

DHCP Troubleshooting Scenarios

How to approach dhcp troubleshooting scenarios

Quick answer

Related 350-601 topic practice pages

Network practice questions

Storage Network practice questions

Automation practice questions

Compute practice questions

Security practice questions

350-601 fundamentals practice questions

350-601 scenario practice questions

350-601 troubleshooting practice questions

Practice scenarios

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

An engineer is configuring PXE boot for a UCS B-series blade. The blade's vNIC is associated with a VLAN that has no IP helper address configured. What is required to allow the blade to obtain an IP address from a DHCP server on a different subnet?

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

Exhibit

An administrator wants to prevent a rogue DHCP server from assigning IP addresses on a Nexus switch. Which feature should be enabled?

Which feature prevents IP spoofing by ensuring that a client uses only the IP address assigned by DHCP?

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?