How many DHCP Troubleshooting Scenarios questions are on this page?

This page has 5 DHCP Troubleshooting Scenarios scenario questions for the 350-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 350-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco SCOR / CCNP Security Core 350-701 questions

Scenario-based practice

DHCP Troubleshooting Scenarios

Practise 350-701 DHCP questions covering DORA flow, scopes, excluded addresses, default gateway options, helper addresses, and troubleshooting clients that receive APIPA or cannot get an IP address.

Start full practice test Read exam guide

scenario questions

350-701

exam code

Cisco

vendor

Scenario guide

How to approach dhcp troubleshooting scenarios

DHCP questions cover server configuration, relay agents (ip helper-address), DHCP snooping, and the four-step DORA handshake. Common exam scenarios: a host isn't getting an IP, a relay agent isn't forwarding requests, or a rogue DHCP server is handing out wrong addresses.

Quick answer

DHCP questions usually test address assignment, scopes, relay agents, excluded addresses and why a client cannot obtain an IP address.

DHCP discovery, offer, request and acknowledgement flow.

DHCP scopes, excluded addresses and default gateway options.

DHCP relay using helper addresses.

Troubleshooting clients that receive APIPA or no address.

Practice scenarios

Question 1mediummultiple choice

Read the full DHCP explanation →

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip verify source
!
interface GigabitEthernet0/1
 ip address 192.168.2.1 255.255.255.0
 ip verify source
!
ip dhcp snooping vlan 1-100
ip dhcp snooping information option
ip dhcp snooping
!
ip source binding 00:11:22:33:44:55 vlan 10 192.168.1.10 interface GigabitEthernet0/0
!

A
The DHCP snooping database is not updated because interface Gi0/1 is not trusted
Gi0/1 is not configured as trust, so DHCP replies from the server are dropped, and the host may not have a valid lease. However, the static binding exists, but dynamic bindings fail.
B
The static IP source binding is configured on the wrong VLAN
Why wrong: The binding is for VLAN 10, and the host is on VLAN 10 (implied by IP 192.168.1.10/24).
C
ARP inspection is not enabled, so the switch drops ARP replies
Why wrong: DAI is not configured, but without it, ARP works normally.
D
The 'ip verify source' command is missing the 'port-security' keyword
Why wrong: Without 'port-security', IP Source Guard only checks IP, not MAC, but the host's IP matches.

Full breakdown with real-world context →

Question 2mediummultiple choice

Open the full VLAN trunking answer →

An engineer is troubleshooting a user who cannot access the network after successful 802.1X authentication. The user's PC receives an IP address from DHCP, but cannot reach the internet. The switch port is in the correct VLAN (10) after authentication. The ISE posture policy requires the user to install a corporate certificate, but the user skipped that step. What is the most likely cause of the internet access failure?

A
The user is not logged into the domain
Why wrong: Domain login is not required for internet access.
B
The switchport is still in the default VLAN
Why wrong: The stem states the port is in VLAN 10 after authentication.
C
The DHCP server does not have a scope for VLAN 10
Why wrong: The user received an IP address from DHCP, so the scope is available.
D
The ISE posture policy returned 'NonCompliant' and ISE applied a Change of Authorization (CoA) to place the port in a remediation VLAN
ISE can use CoA to dynamically move the port to a remediation VLAN with no internet access.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full DHCP explanation →

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Exhibit

Refer to the exhibit.

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip verify source
 ip dhcp snooping limit rate 10
 ip dhcp snooping trust
!
interface GigabitEthernet0/2
 switchport mode access
 ip verify source
 ip dhcp snooping limit rate 5
!
ip dhcp snooping vlan 10
!
ip source binding 0050.7966.6801 vlan 10 192.168.1.10 interface GigabitEthernet0/2

A
The switch drops all traffic from the host with source IP 192.168.1.20.
IP Source Guard filters traffic based on the binding table; unmatched source IPs are dropped.
B
The switch sends an ARP probe to verify the IP is unused, then updates the binding.
Why wrong: IP Source Guard does not perform ARP probes; it drops mismatched traffic.
C
The switch updates the binding table to allow 192.168.1.20.
Why wrong: The binding table is not dynamic; it requires DHCP or manual entry.
D
The switch allows the traffic because the host is trusted on that port.
Why wrong: The port is not trusted; trust is only on G0/1. The binding table restricts allowed IPs.

Full breakdown with real-world context →

Question 4mediumdrag order

Read the full DHCP explanation →

Drag and drop the steps to configure a Cisco router as a DHCP server in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 5hardmultiple choice

Read the full DHCP explanation →

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?

A
NetFlow probe
NetFlow probe analyzes traffic flows and can profile endpoints based on IP and port information.
B
DHCP probe
Why wrong: DHCP probe relies on DHCP traffic, which is not present.
C
HTTP probe
Why wrong: HTTP probe requires HTTP traffic, which may not be present.
D
DNS probe
Why wrong: DNS probe can identify hostnames but not if DNS queries are not sent.

Full breakdown with real-world context →

These 350-701 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 350-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

DHCP Troubleshooting Scenarios

How to approach dhcp troubleshooting scenarios

Quick answer

Related 350-701 topic practice pages

Endpoint Protection and Detection practice questions

Secure Network Access, Visibility and Enforcement practice questions

Security Concepts practice questions

Network Security practice questions

Cloud Security practice questions

Content Security practice questions

350-701 fundamentals practice questions

350-701 scenario practice questions

350-701 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. An engineer has configured IP Source Guard and DHCP Snooping. A host with MAC 00:11:22:33:44:55 on Gi0/0 is assigned IP 192.168.1.10 via DHCP. However, the host cannot ping its default gateway 192.168.1.1. What is the most likely cause?

Exhibit

Refer to the exhibit. A network administrator configured IP Source Guard and DHCP Snooping on a switch. A host connected to GigabitEthernet0/2 with MAC address 0050.7966.6801 has been assigned IP 192.168.1.10 via DHCP. The host now tries to use IP 192.168.1.20. What will happen?

Exhibit

Drag and drop the steps to configure a Cisco router as a DHCP server in the correct order.

An engineer is troubleshooting a Cisco ISE deployment where some endpoints are not being profiled correctly. The administrator notices that the endpoints are not sending DHCP requests. Which profiling probe should be primarily used to identify these endpoints?