How many DHCP Troubleshooting Scenarios questions are on this page?

This page has 12 DHCP Troubleshooting Scenarios scenario questions for the 350-601 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-601 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco DCCOR / CCNP Data Center Core 350-601 questions

Scenario-based practice

DHCP Troubleshooting Scenarios

Practise 350-601 DHCP questions covering DORA flow, scopes, excluded addresses, default gateway options, helper addresses, and troubleshooting clients that receive APIPA or cannot get an IP address.

Start full practice test Read exam guide

scenario questions

350-601

exam code

Cisco

vendor

Scenario guide

How to approach dhcp troubleshooting scenarios

DHCP questions cover server configuration, relay agents (ip helper-address), DHCP snooping, and the four-step DORA handshake. Common exam scenarios: a host isn't getting an IP, a relay agent isn't forwarding requests, or a rogue DHCP server is handing out wrong addresses.

Quick answer

DHCP questions usually test address assignment, scopes, relay agents, excluded addresses and why a client cannot obtain an IP address.

DHCP discovery, offer, request and acknowledgement flow.

DHCP scopes, excluded addresses and default gateway options.

DHCP relay using helper addresses.

Troubleshooting clients that receive APIPA or no address.

Practice scenarios

Question 1hardmultiple choice

Read the full DHCP explanation →

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

A
Enable dynamic ARP inspection on all VLANs.
Why wrong: DAI prevents ARP spoofing, not DHCP.
B
Enable IP source guard on all access ports.
Why wrong: IP source guard prevents IP spoofing but requires DHCP snooping.
C
Enable DHCP snooping globally and configure uplink ports as trusted.
DHCP snooping filters DHCP offers from untrusted ports.
D
Enable MAC port security on all access ports.
Why wrong: MAC port security does not prevent DHCP spoofing.

Full breakdown with real-world context →

Question 2easymultiple choice

Open the full VLAN trunking answer →

A network engineer is configuring DHCP snooping on a Cisco Nexus 9000 switch to prevent rogue DHCP server attacks. The switch connects to the legitimate DHCP server on Ethernet 1/1. Clients are connected to ports Ethernet 1/2 through 1/24. The engineer enables DHCP snooping globally and on VLAN 10, but clients are unable to obtain IP addresses from the DHCP server. Other connectivity between clients and the server works (e.g., static IPs). What is the most likely cause and solution?

A
Disable DHCP snooping as it is not needed in this topology.
Why wrong: This would remove protection; not the recommended solution.
B
Configure a static DHCP binding for each client on the switch.
Why wrong: Static bindings are used for DHCP reservation, not to fix the trust issue.
C
Ethernet 1/1 is untrusted by default. Configure it as trusted with 'ip dhcp snooping trust' and verify DHCP snooping is enabled on VLAN 10.
Correct. DHCP snooping requires the port towards the trusted server to be set as trusted to allow server messages.
D
Add 'ip dhcp snooping information option' on Ethernet 1/1 to allow DHCP option 82.
Why wrong: Option 82 insertion is not required for basic DHCP snooping and may cause issues if the server does not support it.

Full breakdown with real-world context →

Question 3easymultiple choice

Open the full VLAN trunking answer →

A startup company is deploying a new web application on UCS B-Series blades. They want to use PXE boot for rapid provisioning. The network team has configured a DHCP server and a PXE server on the same VLAN as the UCS service profiles. The system administrator creates a service profile for a blade and sets the boot policy to 'PXE' as the first boot device, and local disk as second. However, when the blade powers on, it boots from the local disk instead of PXE. The PXE server logs show no request from the blade's MAC address. The DHCP server logs show no activity. The fabric interconnect is configured with a default VLAN. What is the most likely cause?

A
The vNIC on the service profile is not configured with the correct native VLAN
Native VLAN mismatch prevents DHCP from reaching the server
B
The boot policy order lists local disk before PXE
Why wrong: The stem says PXE is first
C
The service profile is not properly associated with the blade
Why wrong: Association would not affect PXE; server boots anyway
D
The fabric interconnect uplinks are not in trunk mode
Why wrong: Uplinks usually trunk; would affect all traffic, not just PXE

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full DHCP explanation →

An attacker attempts to spoof a legitimate client's IP address to intercept traffic. DHCP snooping is enabled. Which feature prevents this spoofing by validating source IP in data packets?

A
Port security
Why wrong: Port security filters based on MAC address, not IP.
B
IP Source Guard
IPSG validates source IP in data packets using the DHCP snooping binding table.
C
Dynamic ARP Inspection
Why wrong: DAI validates ARP packets, not data IP packets.
D
DHCP Snooping binding database
Why wrong: The binding database is used by IPSG; it does not filter traffic itself.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full DHCP explanation →

A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?

A
Enable the DHCP snooping information option
Why wrong: The information option (Option 82) is for relay agent information, not for blocking unauthorized servers.
B
Set Ethernet 1/2 as a trusted port
Why wrong: Setting the unauthorized port as trusted would allow it to act as a DHCP server, which is undesirable.
C
Disable DHCP snooping globally
Why wrong: Disabling DHCP snooping would remove all protection, not just stop the unauthorized server.
D
Set Ethernet 1/1 as a trusted port
The DHCP server port must be trusted to permit DHCP server messages such as OFFER and ACK.

Full breakdown with real-world context →

Question 6mediummulti select

Read the full DHCP explanation →

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

A
Control Plane Policing (CoPP)
Why wrong: CoPP protects the CPU from floods, but not DHCP attack specific.
B
DHCP snooping
DHCP snooping filters untrusted DHCP messages.
C
Port security
Why wrong: Port security limits MAC addresses, not DHCP-specific.
D
IP Source Guard
IP Source Guard prevents IP spoofing using DHCP binding.
E
Dynamic ARP Inspection (DAI)
DAI validates ARP packets using DHCP snooping binding to prevent ARP spoofing.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full DHCP explanation →

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

A
Port Security
Why wrong: Port Security uses MAC address tables, not DHCP snooping bindings.
B
IP Source Guard
IP Source Guard uses the DHCP snooping binding to permit only valid IP/MAC addresses.
C
Private VLANs
Why wrong: Private VLANs are a Layer 2 isolation technique, not dependent on DHCP snooping.
D
Dynamic ARP Inspection
DAI intercepts ARP packets and validates them against the DHCP snooping database.
E
MACsec
Why wrong: MACsec provides encryption and is independent of DHCP snooping.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full DHCP explanation →

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?

A
Configure the port connected to the DHCP server as trusted
Trusted ports are allowed to forward DHCP server messages, preventing rogue servers.
B
Disable DHCP snooping on the DHCP server VLAN
Why wrong: Disabling snooping on the VLAN would allow rogue servers.
C
Set the DHCP server IP address in the binding database
Why wrong: The binding database is built dynamically from trusted port traffic.
D
Enable DHCP snooping on all VLANs
Why wrong: Enabling on all VLANs is not a best practice; trust configuration is key.

Full breakdown with real-world context →

Question 9easymultiple choice

Open the full VLAN trunking answer →

Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?

Exhibit

```
ip dhcp snooping
ip dhcp snooping vlan 10,20
interface Ethernet1/1
  ip dhcp snooping trust
interface Ethernet1/2
  ip dhcp snooping verify mac-address
```

A
The DHCP server is in VLAN 20
Why wrong: Not necessarily; the server could be in any VLAN that is snooped.
B
The DHCP client is using a static IP address
Why wrong: The client obtained an IP via DHCP, not static.
C
The DHCP server port is trusted for all VLANs
The 'ip dhcp snooping trust' command on the interface makes it trusted for all snooped VLANs.
D
The DHCP client MAC address is not verified
Why wrong: The verify mac-address is configured, so MAC verification is enabled.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full DHCP explanation →

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

Exhibit

Switch# show running-config | section interface
interface Ethernet1/1
 description DHCP Server
 switchport mode access
!
interface Ethernet1/2
 description Client
 switchport mode access
 ip verify source
!
ip dhcp snooping
ip dhcp snooping vlan 10
ip dhcp snooping information option

A
The DHCP snooping information option is disabled
Why wrong: The option is enabled (ip dhcp snooping information option), so this is not the issue.
B
The DHCP server is on a different VLAN
Why wrong: DHCP snooping is enabled for VLAN 10, and the server is likely on that VLAN.
C
The DHCP snooping trust configuration is missing on the server port
Without trust, DHCP server messages are dropped on the untrusted port.
D
IP source guard is enabled on the client port
Why wrong: IP source guard can block IP spoofing, but DHCP replies are sent as Layer 2 broadcasts; source guard typically does not block valid DHCP.

Full breakdown with real-world context →

Question 11hardmultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting a DHCP issue in a data center VLAN. Clients are unable to obtain IP addresses from the DHCP server. The switch has DHCP snooping enabled on the VLAN, and the DHCP server is connected to a trusted port. The clients are on untrusted ports. Which additional security feature is most likely causing the problem if the DHCP server is on a different subnet and the switch is not configured as a DHCP relay?

A
DHCP snooping with no IP helper address configured
DHCP snooping on untrusted ports drops DHCPOFFER from outside the subnet unless relay is set up.
B
Dynamic ARP Inspection (DAI)
Why wrong: DAI validates ARP packets, not DHCP.
C
Control Plane Policing (CoPP) dropping DHCP packets
Why wrong: CoPP might drop if rate-limited, but DHCP is typically not rate-limited aggressively.
D
Port security with maximum MAC limit
Why wrong: Port security limits MACs but does not block DHCP.

Full breakdown with real-world context →

Question 12hardmultiple choice

Open the full VLAN trunking answer →

An organization is deploying Cisco Nexus 9000 switches with NX-OS and needs to prevent ARP spoofing attacks. The network engineer enables Dynamic ARP Inspection (DAI) on all VLANs. However, some legitimate hosts are unable to obtain IP addresses via DHCP. What is the most likely reason?

A
The ARP rate limit on the port is too low, causing all ARP requests to be dropped.
Why wrong: Rate limiting drops excessive ARPs but does not block all.
B
IP Source Guard is enabled and is blocking ARP packets.
Why wrong: IP Source Guard blocks IP traffic, not ARP, and is separate from DAI.
C
DHCP snooping is not enabled, so DAI lacks the DHCP snooping binding table.
DAI validates ARP against DHCP snooping database; without it, DAI drops all ARP on untrusted ports.
D
An ARP ACL is not configured to allow static IP bindings.
Why wrong: ARP ACLs are not required for DAI to work with DHCP.

Full breakdown with real-world context →

These 350-601 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-601 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

DHCP Troubleshooting Scenarios

How to approach dhcp troubleshooting scenarios

Quick answer

Related 350-601 topic practice pages

Network practice questions

Compute practice questions

Storage Network practice questions

Automation practice questions

Security practice questions

350-601 fundamentals practice questions

350-601 scenario practice questions

350-601 troubleshooting practice questions

Practice scenarios

A network administrator suspects that a rogue DHCP server is active on the data center network. The switches are Cisco Nexus 9000 series running NX-OS. Which configuration should be applied to prevent DHCP spoofing?

An attacker attempts to spoof a legitimate client's IP address to intercept traffic. DHCP snooping is enabled. Which feature prevents this spoofing by validating source IP in data packets?

A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?

Which THREE security features are commonly used on Cisco Nexus switches to prevent DHCP-based attacks? (Choose three.)

Which TWO security features rely on the DHCP snooping binding table? (Select exactly 2)

A data center switch has DHCP snooping enabled globally. Which of the following is a best practice to ensure DHCP server legitimacy?

Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?

Exhibit

Refer to the exhibit. A client connected to Ethernet1/2 cannot obtain an IP address via DHCP. What is the most likely cause?

Exhibit

An organization is deploying Cisco Nexus 9000 switches with NX-OS and needs to prevent ARP spoofing attacks. The network engineer enables Dynamic ARP Inspection (DAI) on all VLANs. However, some legitimate hosts are unable to obtain IP addresses via DHCP. What is the most likely reason?