How many DHCP Troubleshooting Scenarios questions are on this page?

This page has 10 DHCP Troubleshooting Scenarios scenario questions for the 100-150 exam, each with detailed explanations and wrong-answer analysis.

How should I approach 100-150 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Cisco Certified Support Technician - Networking questions

Scenario-based practice

DHCP Troubleshooting Scenarios

Practise 100-150 DHCP questions covering DORA flow, scopes, excluded addresses, default gateway options, helper addresses, and troubleshooting clients that receive APIPA or cannot get an IP address.

Start full practice test Read exam guide

scenario questions

100-150

exam code

Cisco

vendor

Scenario guide

How to approach dhcp troubleshooting scenarios

DHCP questions cover server configuration, relay agents (ip helper-address), DHCP snooping, and the four-step DORA handshake. Common exam scenarios: a host isn't getting an IP, a relay agent isn't forwarding requests, or a rogue DHCP server is handing out wrong addresses.

Quick answer

DHCP questions usually test address assignment, scopes, relay agents, excluded addresses and why a client cannot obtain an IP address.

DHCP discovery, offer, request and acknowledgement flow.

DHCP scopes, excluded addresses and default gateway options.

DHCP relay using helper addresses.

Troubleshooting clients that receive APIPA or no address.

Practice scenarios

Question 1mediummultiple choice

Read the full DHCP explanation →

Which security feature is used to mitigate DHCP starvation attacks by limiting the number of DHCP messages per port?

A
DHCP Snooping
DHCP Snooping validates DHCP messages and limits the rate at which hosts can request IP addresses on untrusted ports. By tracking legitimate bindings in a database and rate-limiting incoming discovery messages, it effectively thwarts starvation attacks that aim to exhaust the scope of available IP addresses.
B
Port Security
Why it fails: Port Security is intended for limiting physical access based on MAC addresses. While it restricts the number of MAC addresses on a port, it does not understand the DHCP protocol or track DHCP lease information, making it ineffective against starvation attacks that use a single MAC address.
C
IP Source Guard
Why it fails: IP Source Guard prevents IP spoofing by verifying the source IP address against a binding table populated by DHCP Snooping. While it relies on DHCP snooping, it is not the primary mechanism for preventing the exhaustion of the DHCP scope itself, but rather for enforcing source-IP validity.
D
Dynamic ARP Inspection
Why it fails: Dynamic ARP Inspection focuses on preventing ARP spoofing and poisoning by validating ARP packets. It does not regulate DHCP request rates or manage the allocation of IP addresses in a DHCP scope; its primary purpose is protecting the integrity of the ARP cache on switches.

Full breakdown with real-world context →

Question 2mediummulti select

Read the full DHCP explanation →

A network engineer is troubleshooting a potential DHCP issue. Which THREE components are provided to a client during a successful DHCP 'Acknowledgment' (ACK) message? (Choose three.)

A
IP address for the client.
The primary purpose of DHCP is to assign a unique Layer 3 IP address to the client from a managed pool. Without this, the client cannot communicate using the IP protocol suite. This address is the most fundamental piece of information contained within the DHCP ACK message during the assignment process.
B
Default gateway address.
The default gateway allows the client to communicate with devices on other subnets. DHCP provides this option so that administrators do not have to manually configure the router's IP on every single host. Misconfiguration of this option in the DHCP pool is a common cause of remote connectivity failures.
C
Subnet mask.
The subnet mask defines the boundaries of the local network segment. It is required for the host to determine which IP addresses are local and which require the use of the default gateway. DHCP includes this to ensure all hosts on the segment agree on the network size and broadcast address.
D
The MAC address of the DHCP server.
Why it fails: While the client learns the server's MAC address through the Ethernet header of the DHCP messages, it is not a 'parameter' provided within the DHCP ACK payload for the client's configuration. The client does not store the server's MAC address as part of its permanent networking configuration settings.
E
The SSH private key for the management console.
Why it fails: DHCP is used for basic network provisioning and does not handle the distribution of sensitive security credentials like SSH private keys. Security features like SSH require separate configuration or specialized deployment tools. Including such information in a DHCP broadcast would be a significant security risk to the entire network environment.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full DHCP explanation →

Refer to the exhibit. What is the effect of the 'ip dhcp snooping trust' command on the designated interface?

Exhibit

switch(config)# ip dhcp snooping
switch(config)# ip dhcp snooping vlan 10
switch(config-if)# ip dhcp snooping trust

A
It forces the port to drop all DHCP traffic.
Why it fails: The 'trust' command is the exact opposite of blocking traffic. It explicitly tells the switch that this interface is connected to an authorized DHCP server, allowing the server to communicate with clients through this port. Ports not marked as trusted would block these server responses.
B
It permits DHCP server messages on the port.
By default, all ports are untrusted and block DHCP server-originated messages. The 'ip dhcp snooping trust' command explicitly configures the interface as a source of legitimate DHCP traffic, permitting server-side messages to reach clients, which is necessary for proper DHCP functionality in a snooping-enabled environment.
C
It enables port security on the interface.
Why it fails: DHCP Snooping and Port Security are two distinct features. Marking an interface as a trusted DHCP port does not activate MAC-address-based port security. Port security requires independent configuration commands and serves a completely different purpose related to physical device identification and access restriction.
D
It prevents ARP spoofing on the port.
Why it fails: Trusting an interface for DHCP snooping has no direct effect on ARP packet validation. ARP spoofing protection is provided by Dynamic ARP Inspection (DAI), which requires its own specific configuration and uses the DHCP snooping database, but is not enabled simply by trusting the interface.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full DHCP explanation →

An administrator wants to ensure that only legitimate DHCP servers provide IP addresses to clients on the network. Which feature should be enabled?

A
DHCP Snooping
DHCP Snooping allows administrators to configure specific ports as 'trusted' for DHCP server traffic. All other ports are considered untrusted by default, and any DHCP server messages (such as DHCPOFFER or DHCPACK) originating from these untrusted ports are dropped, preventing rogue servers from interfering with network clients.
B
Port Security
Why it fails: Port Security limits physical access based on MAC addresses. It has no mechanism for filtering DHCP traffic based on the identity of the server. It cannot distinguish between a legitimate DHCP server and a rogue one, making it ineffective for preventing unauthorized address allocation on the network.
C
Dynamic ARP Inspection
Why it fails: DAI protects against ARP spoofing by validating ARP packets. It does not manage DHCP server discovery or enforce trust levels for DHCP services. While it uses the DHCP Snooping database for its own operation, it is not the feature responsible for identifying or blocking rogue DHCP servers.
D
IP Source Guard
Why it fails: IP Source Guard is designed to prevent IP address spoofing by verifying traffic against a source-binding database. It does not influence the DHCP server selection process or prevent rogue DHCP servers from offering addresses to clients, as its purpose is to validate the source IP of packets.

Full breakdown with real-world context →

Question 5mediummulti select

Read the full DHCP explanation →

A technician is troubleshooting a workstation that cannot connect to the network. The workstation has a link light, but ipconfig shows an IP address of 169.254.10.20. The technician suspects a DHCP-related issue. Which two commands should the technician use to attempt to obtain a new IP address from the DHCP server? (Choose two.)

A
ipconfig /release
The ipconfig /release command releases the current DHCP lease, which in this case is the APIPA address. Releasing the lease clears the existing configuration and prepares the workstation to request a new lease from a DHCP server. This is a necessary step before attempting to renew or obtain a new address, especially when the current address is an APIPA address that indicates DHCP failure.
B
ipconfig /flushdns
Why it fails: ipconfig /flushdns clears the DNS resolver cache on the workstation. While this can resolve name resolution issues, it does not affect DHCP lease acquisition. The workstation's problem is an APIPA address indicating DHCP failure, not a DNS caching issue. Flushing DNS would not help obtain a new IP address from the DHCP server.
C
ipconfig /displaydns
Why it fails: ipconfig /displaydns shows the contents of the DNS resolver cache. It is a diagnostic command for viewing cached DNS entries, not for obtaining a DHCP lease. It does not interact with the DHCP process and would not help the workstation acquire a valid IP address from the DHCP server.
D
netstat -a
Why it fails: netstat -a displays all active TCP and UDP connections and listening ports. It is used to troubleshoot network connections and services, but it does not interact with DHCP. It would not release or renew an IP address, and it is not relevant to resolving an APIPA address issue on the workstation.
E
ipconfig /renew
The ipconfig /renew command requests a new IP address from a DHCP server. After releasing the APIPA address, running ipconfig /renew will attempt to contact a DHCP server and obtain a valid lease. If the DHCP server is reachable and functioning, the workstation will receive a proper IP configuration, resolving the APIPA issue.

Full breakdown with real-world context →

Question 6hardmultiple choice

Open the full VLAN trunking answer →

A technician is troubleshooting a wireless client that associates successfully with an access point but cannot obtain an IP address from the DHCP server on the wired network. The access point is configured with a management IP on the correct VLAN, and other wired clients on that VLAN obtain leases normally. Which is the MOST likely cause?

A
The access point's radio is operating on a channel with high interference from neighboring APs.
Why it fails: Interference degrades throughput and can cause disconnects or retries, but the client has already associated successfully. Association proves the radio link is functional enough to exchange management frames. Interference would more likely cause slow speeds or dropped sessions, not a clean association followed by total DHCP failure while wired clients work fine.
B
The DHCP server's scope for the wired VLAN has run out of available leases.
Why it fails: If the DHCP scope were exhausted, wired clients on the same VLAN would also fail to obtain addresses. The scenario states that wired clients on that VLAN obtain leases normally, so scope exhaustion is ruled out. The problem is specific to the wireless path, pointing to a VLAN or trunking issue rather than a server-side address shortage.
C
The wireless client is associated to an SSID mapped to a VLAN that is not trunked to the access point.
An access point can associate a client on an SSID even when the VLAN mapped to that SSID is not carried on the uplink trunk. Association happens at Layer 2 over the radio, but DHCP requires the client's broadcast to traverse the trunk into the correct VLAN. If that VLAN is missing from the trunk, DHCP requests never reach the server, and the client falls back to an APIPA address.
D
The wireless client has an incorrect DNS server address configured manually.
Why it fails: A wrong DNS server would cause name resolution failures but would not prevent the client from obtaining an IP address via DHCP. DNS settings are typically delivered by DHCP itself, so a manual misconfiguration would only matter after a lease is obtained. This symptom occurs before any DNS interaction, so DNS settings are not the cause.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full VLAN trunking answer →

A security analyst notices that an attacker on the same VLAN as a user is sending forged ARP replies so that the user's traffic to the default gateway is redirected through the attacker's workstation. The switch is a Cisco Catalyst with DHCP snooping already configured and working. Which feature should the analyst enable to block this specific attack?

A
Port security with a maximum of one MAC address per port
Why it fails: Port security limits how many MAC addresses a port can learn, which counters MAC flooding but not ARP spoofing. An attacker sending forged ARP replies uses their own legitimate MAC address, so port security sees nothing wrong. It does not inspect ARP payloads, so it cannot detect the IP-to-MAC mismatch this attack relies on.
B
Dynamic ARP Inspection on the user VLAN
Dynamic ARP Inspection validates ARP packets on untrusted ports against the DHCP snooping binding table, dropping replies that map an IP address to the wrong MAC. Because DHCP snooping is already operational, DAI can immediately use those bindings to stop the forged ARP replies that redirect the user's traffic to the attacker's workstation.
C
BPDU Guard on all access ports
Why it fails: BPDU Guard disables a port that receives spanning-tree BPDUs, protecting against rogue switches and topology changes. It has no visibility into ARP traffic and does not validate IP-to-MAC bindings. Enabling it would not stop the forged ARP replies described in the scenario, so it is the wrong tool for this specific attack.
D
Storm control configured to limit broadcast traffic
Why it fails: Storm control suppresses excessive broadcast, multicast, or unknown unicast traffic to protect bandwidth. ARP spoofing is not a volume-based attack; a single forged reply is enough to poison a victim's cache. Storm control would not detect or block the spoofed ARP packet, so it does not address the analyst's problem.

Full breakdown with real-world context →

Question 8hardmultiple choice

Open the full VLAN trunking answer →

A security administrator is reviewing logs and notices that an attacker on the internal network is sending forged ARP replies claiming to be the default gateway. The attacker's goal is to intercept traffic from multiple hosts. The switches in the network already have DHCP snooping enabled on the user VLAN. Which additional Cisco feature should the administrator enable to block the forged ARP replies?

A
Private VLANs
Why it fails: Private VLANs isolate ports within a VLAN so they can only communicate with a promiscuous port. While this can limit lateral movement, it does not inspect or validate ARP messages. The attacker could still send forged ARP replies to hosts that are allowed to communicate with the gateway, and the ARP cache poisoning would succeed unless ARP inspection is also in place.
B
Dynamic ARP Inspection
Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table and drops ARP replies that do not match a valid IP-to-MAC binding. Since DHCP snooping is already enabled, DAI can immediately use the binding table to block the attacker's forged gateway ARP replies. This directly stops the ARP cache poisoning and protects hosts from having their traffic redirected.
C
Port security with sticky MAC addresses
Why it fails: Port security restricts which source MAC addresses can appear on a switch port, but it does not inspect ARP payloads. An attacker using their own legitimate MAC address can still send forged ARP replies claiming to be the gateway, because the MAC address itself is allowed. Port security does not validate the IP-to-MAC binding inside ARP messages.
D
IP Source Guard
Why it fails: IP Source Guard uses the DHCP snooping binding table to filter IP packets based on source IP and MAC address, preventing IP spoofing. However, it filters IP traffic, not ARP messages. The attacker's forged ARP replies would still reach hosts and poison their ARP caches. IP Source Guard addresses a different Layer 3 spoofing threat than the ARP-based attack described.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full DHCP explanation →

A technician is configuring DHCP snooping on a Cisco switch to prevent rogue DHCP servers. On which type of port should the technician apply the 'ip dhcp snooping trust' command?

A
All access ports
Why it fails: Applying the trust command to all access ports would defeat the purpose of DHCP snooping. Access ports are where end-user devices connect, and these are the most likely places for a rogue DHCP server to be plugged in. Trusting these ports allows any device to send DHCP server messages.
B
Only ports connected to printers
Why it fails: Printers are end-node devices and should not be providing DHCP services to the network. Trusting ports connected to printers would create a security hole where an attacker could spoof a printer's identity to host a rogue DHCP server. Security best practices dictate that only known server ports should be trusted.
C
Ports connected to end-user workstations
Why it fails: End-user workstations are considered untrusted sources in a DHCP snooping environment. If these ports were trusted, a malicious user could run a DHCP server software on their PC and begin intercepting traffic from other users by providing incorrect gateway information. This is a common method for man-in-the-middle attacks.
D
Ports connected to legitimate DHCP servers or uplinks
The trust command must be applied to ports that lead to legitimate DHCP servers or to other trusted switches via uplink ports. This tells the switch that DHCP server responses, such as DHCPOFFER and DHCPACK, are allowed to enter the switch through these specific interfaces, ensuring clients receive valid addresses.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full DHCP explanation →

A network administrator is configuring a Cisco switch and wants to ensure that only the designated uplink port can send DHCP server replies, while all other ports are prevented from acting as DHCP servers. Which command should be applied to the uplink port?

A
ip dhcp snooping limit rate 10
Why it fails: The rate limit command restricts the number of DHCP messages per second on a port to mitigate starvation attacks. It does not designate a port as trusted for server replies. Applying it to the uplink would still leave the port untrusted, so legitimate DHCP offers would be dropped and clients would fail to obtain addresses.
B
ip dhcp snooping trust
The ip dhcp snooping trust command marks the uplink port as trusted, allowing DHCP server replies to pass. Untrusted ports drop such replies by default, so only the legitimate DHCP server reachable through the trusted uplink can respond. This directly enforces the requirement that only the designated port may send DHCP offers.
C
ip dhcp snooping vlan 10
Why it fails: This command enables DHCP snooping globally for a specific VLAN but does not set trust on any interface. Without a trusted port, all DHCP server replies are dropped, including those from the legitimate server. The administrator must still configure trust on the uplink to allow valid replies.
D
switchport port-security
Why it fails: Port security limits which MAC addresses can be learned on a switch port. It does not distinguish DHCP server replies from other traffic and cannot authorize an uplink for DHCP offers. This command addresses a different threat and does not satisfy the requirement to permit only the uplink to send DHCP replies.

Full breakdown with real-world context →

These 100-150 practice questions are part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style 100-150 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

DHCP Troubleshooting Scenarios

How to approach dhcp troubleshooting scenarios

Quick answer

Related 100-150 topic practice pages

Standards and Concepts practice questions

Addressing and Subnet Formats practice questions

Diagnosing Problems practice questions

Infrastructure practice questions

Security practice questions

Endpoints and Media Types practice questions

100-150 fundamentals practice questions

100-150 scenario practice questions

100-150 troubleshooting practice questions

Practice scenarios

Which security feature is used to mitigate DHCP starvation attacks by limiting the number of DHCP messages per port?

A network engineer is troubleshooting a potential DHCP issue. Which THREE components are provided to a client during a successful DHCP 'Acknowledgment' (ACK) message? (Choose three.)

Refer to the exhibit. What is the effect of the 'ip dhcp snooping trust' command on the designated interface?

Exhibit

An administrator wants to ensure that only legitimate DHCP servers provide IP addresses to clients on the network. Which feature should be enabled?

A technician is configuring DHCP snooping on a Cisco switch to prevent rogue DHCP servers. On which type of port should the technician apply the 'ip dhcp snooping trust' command?

A network administrator is configuring a Cisco switch and wants to ensure that only the designated uplink port can send DHCP server replies, while all other ports are prevented from acting as DHCP servers. Which command should be applied to the uplink port?