DHCP Troubleshooting Scenarios

Your company has deployed a Cisco Catalyst 9300 switch stack as the distribution layer for a campus network. The network uses VLANs 10 (data), 20 (voice), and 30 (management). The switch stack is configured with DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) on access ports. Recently, users in VLAN 10 report intermittent connectivity issues. You notice that some users receive duplicate IP addresses from the DHCP server. The DHCP server is connected to a trunk port on the switch stack. After reviewing logs, you see that DHCPACK messages are being dropped on the trunk port. The DHCP snooping binding table shows entries for legitimate clients, but also some entries with MAC addresses from a different vendor. Which action should you take to resolve the issue?

A
Manually shut down the access ports that have unknown MAC addresses in the binding table.
Why wrong: This does not address the DHCP server response being dropped.
B
Disable Dynamic ARP Inspection on VLAN 10.
Why wrong: DAI validates ARP packets, not DHCP messages.
C
Configure the trunk port connecting to the DHCP server as a trusted port for DHCP snooping.
DHCP snooping drops DHCP server responses on untrusted ports.
D
Disable IP Source Guard on all access ports in VLAN 10.
Why wrong: IPSG filters IP traffic based on binding table, not DHCP messages.

Question 2hardmultiple choice

A network administrator is troubleshooting a DHCP snooping issue on a Cisco switch. The switch is configured with DHCP snooping globally and on VLAN 10. The trusted interface is GigabitEthernet0/1 connected to the DHCP server. However, clients on VLAN 10 are not receiving IP addresses from the DHCP server. What is the most likely cause?

A
The switch has IP Source Guard enabled, blocking valid DHCP traffic.
Why wrong: IP Source Guard uses DHCP snooping binding table, but it would not block initial DHCP exchanges.
B
The interface GigabitEthernet0/1 is not configured as a trusted port for DHCP snooping.
Correct: Untrusted ports drop DHCP server messages; the server port must be trusted.
C
The DHCP server is on a different subnet and the switch lacks an IP helper address.
Why wrong: If server is on same VLAN, no helper needed.
D
The DHCP server is sending offers too quickly, exceeding the rate-limit on the switch.
Why wrong: Rate-limit is on untrusted ports for client messages, not server responses.

Question 3easymultiple choice

Refer to the exhibit. A network administrator notices that some DHCP packets are being dropped due to 'MAC Address Mismatch'. What is the most likely cause of this drop?

Exhibit

Refer to the exhibit.

Switch# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1A:2B:3C:4D:5E  192.168.1.10     86400       dhcp-snooping   10    GigabitEthernet0/1
00:1A:2B:3C:4D:5F  192.168.1.11     86400       dhcp-snooping   10    GigabitEthernet0/2

Switch# show ip dhcp snooping statistics
Packets Processed by DHCP Snooping   = 100
Packets Dropped Because               = 5
  MAC Address Mismatch                 = 3
  Invalid Server Replies               = 2

A
The DHCP server is sending packets with an incorrect server identifier option.
Why wrong: Server identifier mismatch would be an invalid server reply.
B
The DHCP client is using a different MAC address in the DHCP packet than the source MAC in the Ethernet frame.
MAC address mismatch occurs when the chaddr field does not match the source MAC.
C
The DHCP client is sending a request with an incorrect transaction ID.
Why wrong: Transaction ID mismatch is not a DHCP snooping drop reason.
D
The DHCP offer packet is arriving on an untrusted port.
Why wrong: That would cause 'Invalid Server Replies' drop.

Question 4mediummultiple choice

A network engineer is configuring a Cisco router as a DHCP relay agent to forward DHCP requests from a client VLAN to a centralized DHCP server located in a different subnet. The engineer configures the ip helper-address command on the VLAN interface. However, clients in the VLAN are not receiving IP addresses. The DHCP server is reachable from the router. What is the most likely cause?

A
The ip helper-address command is applied on the wrong interface (e.g., the interface facing the DHCP server).
Why wrong: Incorrect because the command must be applied on the interface that receives the client broadcast, not on the server-facing interface.
B
The DHCP server is not configured with a scope for the client subnet.
Why wrong: Incorrect because the DHCP server would still send a reply (possibly with no offer) but the client would not receive it; however, the most common issue is routing of the reply.
C
The router does not have a return route to the client subnet, so the DHCP server's reply is dropped.
Correct because the DHCP server sends the reply to the relay agent (router), which then forwards it as a broadcast to the client. If the router cannot reach the client subnet, the reply is lost.
D
The DHCP client is using DHCPv6 instead of DHCPv4.
Why wrong: Incorrect because the scenario implies IPv4 DHCP; the ip helper-address command works for DHCPv4 broadcasts.

Question 5mediummultiple choice

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

A
The DHCP pool is not associated with the correct VLAN interface using the network command.
Correct because if the network command in the DHCP pool does not match the subnet of the VLAN, the DHCP server may assign addresses but not apply the pool-specific options like DNS.
B
The DNS server is unreachable from the DHCP server.
Why wrong: Incorrect because the DHCP server does not need to reach the DNS server to include its address in the DHCP offer; it only needs to provide the IP.
C
The ip dhcp excluded-address command is blocking the DNS server IP.
Why wrong: Incorrect because the excluded-address command prevents the DHCP server from assigning an IP address; it does not affect option delivery.
D
The DHCP client is configured with a static DNS server address.
Why wrong: Incorrect because if the client had a static DNS, it would ignore the DHCP option, but the scenario implies the client is using DHCP for all settings.

Question 6easymultiple choice

A network engineer is configuring a Cisco router to act as a DHCP server for a branch office. The engineer creates a DHCP pool for the 192.168.1.0/24 subnet and configures the default-router, dns-server, and domain-name options. However, clients are able to obtain IP addresses but cannot ping the default gateway. The engineer verifies that the router's interface IP is 192.168.1.1. What is the most likely cause?

A
The router's interface is not configured with an IP address in the 192.168.1.0/24 subnet.
Correct because if the router interface is not in the same subnet, the clients will have a default gateway that is unreachable.
B
The DHCP pool is missing the lease command.
Why wrong: Incorrect because the lease command is optional; without it, a default lease is used, and clients can still ping the gateway.
C
The router's interface is administratively down.
Why wrong: Incorrect because if the interface were down, the DHCP server would not be able to assign addresses from that subnet (the pool would be inactive).
D
The ip dhcp excluded-address command is blocking the default gateway IP.
Why wrong: Incorrect because the excluded-address command prevents the DHCP server from assigning that IP to a client, but the router still owns it.

Question 7mediummultiple choice

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

A
The router's interface is configured with the no ip forward-protocol udp bootps command.
Why wrong: Incorrect because that command would affect DHCP relay, not the local DHCP server.
B
The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.
Correct because if the router is not directly connected to the client's VLAN, the DHCP broadcast will not reach the router unless a DHCP relay (ip helper-address) is configured on the client's VLAN interface.
C
The DHCP pool is configured with the wrong default-router option.
Why wrong: Incorrect because the default-router option is only sent in the DHCP offer; it does not affect whether the discover message is received.
D
The router's DHCP server is disabled globally with the no service dhcp command.
Why wrong: Incorrect because if the DHCP server were disabled, no pool would be active, but the engineer would likely see an error message.

Question 8mediummultiple choice

A network engineer runs the following command on Router R2:

R2# debug ip dhcp server events
*Mar  1 00:05:23.123: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 on interface GigabitEthernet0/1
*Mar  1 00:05:23.124: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)
*Mar  1 00:05:23.125: DHCPD: DHCPREQUEST received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30
*Mar  1 00:05:23.126: DHCPD: Sending DHCPACK to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)

Based on this debug output, what can be concluded?

A
The DHCP server failed to allocate an IP address to the client.
Why wrong: The sequence ends with DHCPACK, indicating successful allocation.
B
The client is using DHCPv6 because of the long client ID.
Why wrong: The client ID is a DHCPv4 client identifier; DHCPv6 uses DUIDs.
C
The DHCP server successfully assigned IP address 10.0.0.2 to the client.
The DHCPACK sent with address 10.0.0.2 confirms successful assignment.
D
The DHCP server is configured with a pool that excludes 10.0.0.2.
Why wrong: The server assigned 10.0.0.2, so it is not excluded.

Question 9mediummultiple choice

A network engineer runs the following command on Router R6:

R6# show ip dhcp conflict
IP address       Detection method     Detection time         VRF
10.0.0.10        Ping                 Mar 01 2025 10:00 AM   default
10.0.0.15        Gratuitous ARP       Mar 01 2025 10:05 AM   default

Based on this output, what can be concluded?

A
The DHCP server has successfully assigned these addresses to clients.
Why wrong: Conflicted addresses are not assigned; they are removed from the pool.
B
The addresses 10.0.0.10 and 10.0.0.15 are unavailable for DHCP assignment.
Conflicted addresses are excluded from the pool until the conflict is cleared.
C
The DHCP server uses only ping to detect conflicts.
Why wrong: Both ping and gratuitous ARP methods are shown.
D
The conflicts were caused by the DHCP server itself.
Why wrong: Conflicts indicate another device on the network is using the same IP.

Question 10mediummultiple choice

Examine this DHCP configuration: ```

ip dhcp pool POOL1
 network 10.10.10.0 255.255.255.0

default-router 10.10.10.1 dns-server 8.8.8.8 lease 0 12 !

ip dhcp excluded-address 10.10.10.1 10.10.10.10

``` Which statement is true?

A
DHCP clients will receive a lease for 12 hours.
Correct. The lease command specifies 0 days, 12 hours.
B
The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.
Why wrong: Incorrect. The excluded-address range prevents assignment of 10.10.10.1 through 10.10.10.10.
C
The default lease is used because the lease command is incomplete.
Why wrong: Incorrect. The lease command is valid and specifies 12 hours.
D
The DNS server is set to 8.8.8.8, but clients will ignore it.
Why wrong: Incorrect. The DNS server option is provided to clients via DHCP.

Question 11mediummultiple choice

Examine this DHCP configuration: ```

service dhcp
ip dhcp pool POOL2
 network 10.20.20.0 255.255.255.0

default-router 10.20.20.1 lease infinite ``` What is the effect of the 'lease infinite' command?

A
Clients will receive an infinite lease and never need to renew.
Correct. Infinite lease means the IP address is valid indefinitely.
B
The lease time is set to the default value of 1 day.
Why wrong: Incorrect. The command explicitly sets infinite, not default.
C
Clients will be unable to obtain an IP address because infinite is invalid.
Why wrong: Incorrect. 'lease infinite' is a valid Cisco IOS command.
D
The router will ignore the lease command and use the default.
Why wrong: Incorrect. The command is accepted and applied.

Question 12mediumdrag order

Drag and drop the steps of DHCP snooping operation on a Cisco switch into the correct order, from first to last.

Question 13easymultiple choice

What is the default lease time for a DHCP pool in Cisco IOS?

A
1 day
Correct. The default lease is 1 day.
B
12 hours
Why wrong: Incorrect. 12 hours is not the default; it must be configured explicitly.
C
2 days
Why wrong: Incorrect. The default is 1 day, not 2.
D
Infinite
Why wrong: Incorrect. Infinite must be configured; it is not the default.

Question 14mediummultiple choice

A network engineer runs the following command on Router R4:

R4# show ip dhcp binding

Bindings from all pools not associated with VRF:

IP address       Client-ID/              Lease expiration        Type

Hardware address/ User name

10.0.0.10        0063.6973.636f.2d30.    Mar 01 2025 12:00 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.

10.0.0.11        0063.6973.636f.2d30.    Mar 01 2025 12:05 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.

Based on this output, what can be concluded?

A
Both clients have static DHCP reservations.
Why wrong: The type is 'Automatic', not 'Manual' which would indicate a reservation.
B
The DHCP server has two active leases.
Two bindings are listed, both with future lease expiration times.
C
The DHCP server is out of addresses.
Why wrong: Only two addresses are shown; there is no indication of exhaustion.
D
The clients are using DHCPv6.
Why wrong: The client-ID format is typical for DHCPv4; DHCPv6 uses DUID.

Question 15hardmultiple choice

A network engineer runs the following command on Router R8:

R8# show ip dhcp server statistics

Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 10 Manual bindings: 2 Expired bindings: 1 Malformed messages: 0

Message Received

BOOTREQUEST    0

DHCPDISCOVER 100 DHCPREQUEST 95 DHCPDECLINE 1 DHCPRELEASE 2 DHCPINFORM 0

Based on this output, what can be concluded?

A
The DHCP server has received more DHCPDISCOVER messages than DHCPREQUEST messages, indicating some clients did not proceed to request.
100 DISCOVER vs 95 REQUEST shows 5 clients did not send REQUEST.
B
The DHCP server has 12 active leases.
Why wrong: Automatic bindings are 10, manual are 2, but expired bindings are 1; the total active is 12, but the question asks about the discrepancy.
C
The DHCP server rejected 5 DHCPDISCOVER messages.
Why wrong: There is no indication of rejection; the DISCOVERs were received.
D
The DHCP server has 2 manual bindings that are static reservations.
Why wrong: This is true but not the best conclusion from the data; the key insight is the DISCOVER/REQUEST mismatch.