hardMultiple Choice
350-401 Practice Question: An enterprise uses VRF-lite on a Cisco Catalyst…
An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?
⚠ Common exam trap
Cisco often tests the misconception that configuring ip helper-address alone is sufficient for DHCP relay across VRFs, ignoring the need for inter-VRF reachability or route leaking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DHCP server is in a different VRF, and the switch does not have a route from the GUEST VRF to the CORP VRF for the DHCP server.
The DHCP server resides in VRF CORP, but the DHCP relay agent on the guest SVI forwards the discover packet within VRF GUEST. Without a route from VRF GUEST to the DHCP server's subnet in VRF CORP, the relayed packet cannot reach the server. Inter-VRF routing (e.g., a route leak or VRF-aware service) is required for the relay to forward the packet across VRFs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DHCP relay agent is not configured to use the VRF GUEST; the ip helper-address command must be applied under the VRF interface, but the DHCP server is in a different VRF, requiring inter-VRF routing or the use of the ip dhcp relay information option.
Why it's wrong here
This is incorrect because the helper-address is correctly placed on the GUEST VRF interface; the issue is not the presence of the helper-address but the relay agent's inability to reach the DHCP server across VRFs. In Cisco IOS, DHCP relay uses the routing table of the VRF on the incoming interface to forward the unicast packet to the server. Since the server lives in the CORP VRF, the GUEST VRF lacks a route to it, so inter-VRF route leak or a shared reachable address is required—not the DHCP relay information option, which only adds option 82 and does not create inter-VRF reachability.
- ✓
The DHCP server is in a different VRF, and the switch does not have a route from the GUEST VRF to the CORP VRF for the DHCP server.
Why this is correct
When the DHCP relay agent receives a broadcast on an interface in the GUEST VRF, it generates a unicast DHCP request to the server address specified by ip helper-address, but it consults the GUEST VRF routing table to determine the egress interface and next hop. Because the DHCP server resides in the CORP VRF, the GUEST VRF routing table does not have a route to that server IP, so the relay packet is silently dropped. A route leak or a static route from the GUEST VRF to the CORP VRF (and back) is required to allow the unicast relay traffic to span the VRFs.
- ✗
The DHCP server is not configured with a scope for the guest subnet.
Why it's wrong here
If the scope were missing, the server would receive the relayed request and simply not have an address pool to offer, so it would either drop the packet or send a DHCPNAK; however, in this scenario, the switch's relay logic cannot even deliver the packet to the server because the GUEST VRF has no route to the CORP VRF. The relay requires a valid next hop before any server-side configuration errors can manifest. Therefore, a missing scope is not the root cause—the failure occurs before the DHCP server is reached.
- ✗
The guest VRF is missing the ip dhcp relay command globally.
Why it's wrong here
In Cisco IOS, DHCP relay is inherently enabled on the device; the 'ip dhcp relay' global command exists to control certain relay behaviors like the information option or source-interface selection, but it does not toggle the relay function itself. To relay for a specific VRF, you simply configure ip helper-address on the interface in that VRF and ensure a route to the server is present. A missing global command cannot be the cause of relay failure to a different VRF, as the relay function is active by default.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.