hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures DHCP snooping on a switch…
An engineer configures DHCP snooping on a switch to prevent rogue DHCP servers. After enabling, legitimate DHCP clients on VLAN 10 cannot obtain addresses. The DHCP server is connected to a trusted port. The switch shows 'show ip dhcp snooping binding' with no entries. Which is the most likely explanation?
⚠ Common exam trap
Cisco often tests the misconception that DHCP snooping automatically works across subnets, when in fact a DHCP relay (ip helper-address) is required for the switch to see the server's unicast reply and build bindings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DHCP server is on a different subnet, and no DHCP relay is configured; the switch only snoops broadcast traffic within the VLAN.
DHCP snooping builds its binding database by monitoring DHCPACK messages from trusted ports. If the DHCP server is on a different subnet than the clients (VLAN 10) and no DHCP relay (ip helper-address) is configured, the server's unicast reply never reaches the switch, so no snooping bindings are created. The switch only snoops broadcast DHCP traffic within the VLAN; without relay, the server's response is unicast and may not be seen by the snooping switch, leaving the binding table empty and clients unable to obtain addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The DHCP server is on a different subnet, and no DHCP relay is configured; the switch only snoops broadcast traffic within the VLAN.
Why this is correct
Correct: DHCP snooping relies on seeing the DHCP packets. Without a relay, the server may not be reachable, or the packets may not traverse the switch.
- ✗
The trusted port is configured as an access port in VLAN 10, but the server is in VLAN 20.
Why it's wrong here
Incorrect: The trusted port should be in the same VLAN as the server, but the issue is about relay.
- ✗
The switch has 'ip dhcp snooping information option' disabled, preventing binding creation.
Why it's wrong here
Incorrect: Option 82 is not required for binding creation; it is an additional feature.
- ✗
The DHCP server is using a different MAC address than expected, causing the switch to drop the packets.
Why it's wrong here
Incorrect: DHCP snooping does not filter based on server MAC unless configured.
Visual reference
Go deeper
Related to this question
Learn chapter
ACL-Based Traffic Filtering and Policy-Based Routing
Key term
DHCP Relay Configuration
A DHCP relay configuration allows a router to forward DHCP broadcast requests from clients on one subnet to a DHCP server on a different subnet, enabling centralized IP address management across multiple networks.
Key term
DHCP Client and Server
A DHCP client is any device that requests network configuration settings from a DHCP server, which automatically assigns IP addresses and other parameters to devices on a network.
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.