N10-009 Network Troubleshooting Practice Question
Users in VLAN 10 cannot obtain IP addresses from a DHCP server located in VLAN 20. The router has an ip helper-address configured on VLAN 10 interface pointing to the DHCP server. Users can ping the DHCP server IP from the router. However, users are receiving APIPA addresses. What is the most likely cause?
⚠ Common exam trap
The N10-009 exam often tests the misconception that a successful ping from the router to the DHCP server guarantees DHCP functionality, but the trap here is that the ip helper-address only relays the request; the server must still have a scope for the client's subnet to assign an address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DHCP server scope does not include the VLAN 10 subnet
The DHCP server must have a scope configured for the subnet of the requesting clients (VLAN 10) to assign IP addresses from that range. Since users receive APIPA addresses (169.254.x.x), the DHCP discovery process is failing, which typically occurs when the server receives the request via the ip helper-address but has no matching scope for VLAN 10. The router's ability to ping the server confirms Layer 3 reachability, isolating the issue to the server's scope configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DHCP server is not reachable from the router
Why it's wrong here
The scenario explicitly states that users can successfully ping the DHCP server from the router. This successful ping confirms end-to-end Layer 3 connectivity and reachability between the router, which is responsible for forwarding DHCP requests, and the DHCP server itself. If the DHCP server were truly unreachable from the router, the router would be unable to forward any DHCP Discover messages, and the server would never receive the requests to begin with, making it impossible for it to offer an IP address. Therefore, network reachability is not the underlying issue.
When this WOULD be correct
In a scenario where the router cannot ping the DHCP server and users get APIPA addresses, the most likely cause would be that the DHCP server is not reachable from the router, possibly due to a routing issue or ACL blocking traffic.
- ✓
The DHCP server scope does not include the VLAN 10 subnet
Why this is correct
A DHCP server scope defines the range of IP addresses and associated configuration parameters (like subnet mask, default gateway, and DNS servers) that the server can lease to clients within a specific subnet. If the DHCP server receives a DHCP Discover request from a client in VLAN 10 but lacks a configured scope for the VLAN 10 subnet, it will be unable to generate a valid DHCP Offer. Consequently, clients in VLAN 10 will not receive an IP address, even if the initial broadcast request successfully reaches the server via an IP helper address.
- ✗
The router's ip helper-address is configured incorrectly
Why it's wrong here
The `ip helper-address` command on a router's interface is crucial for forwarding broadcast DHCP Discover messages from clients on one subnet as unicast packets to a DHCP server located on a different subnet. If this address were configured incorrectly, the DHCP server would never receive the initial Discover requests from VLAN 10 clients. However, the problem implies that the server *could* be receiving requests, and the ability to ping the server from the router confirms basic network path functionality, making an incorrect helper address less likely to be the primary cause of the server not offering an IP.
When this WOULD be correct
This option would be correct if the router could not ping the DHCP server, or if the ip helper-address was pointing to the wrong IP address or was missing from the VLAN 10 interface configuration.
- ✗
The switch ports are not configured for VLAN 10
Why it's wrong here
If the switch ports connected to users in VLAN 10 were not correctly assigned to VLAN 10, these clients would be isolated from their intended network segment and default gateway. This misconfiguration would prevent their DHCP Discover broadcasts from reaching the router's VLAN 10 interface, thereby blocking any possibility of the request being forwarded to a DHCP server. Clients would likely fail to establish any network communication beyond their immediate segment, potentially resulting in APIPA addresses rather than a failure to obtain an IP from a reachable server.
When this WOULD be correct
This would be correct if users in VLAN 10 cannot communicate at all (e.g., cannot ping the router or other VLANs) and receive APIPA addresses because the switch ports are not assigned to VLAN 10, isolating them from the network.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The DHCP server scope does not include the VLAN 10 subnetCorrect answer▾
Why this is correct
A DHCP server scope defines the range of IP addresses and associated configuration parameters (like subnet mask, default gateway, and DNS servers) that the server can lease to clients within a specific subnet. If the DHCP server receives a DHCP Discover request from a client in VLAN 10 but lacks a configured scope for the VLAN 10 subnet, it will be unable to generate a valid DHCP Offer. Consequently, clients in VLAN 10 will not receive an IP address, even if the initial broadcast request successfully reaches the server via an IP helper address.
✗The DHCP server is not reachable from the routerWrong answer — click to see why▾
Why this is wrong here
The router can ping the DHCP server, so the server is reachable. The issue is that users get APIPA addresses, indicating DHCP requests are not reaching the server or replies are not returning, but reachability is confirmed.
★ When this WOULD be the correct answer
In a scenario where the router cannot ping the DHCP server and users get APIPA addresses, the most likely cause would be that the DHCP server is not reachable from the router, possibly due to a routing issue or ACL blocking traffic.
Why candidates choose this
Candidates may assume that if users cannot get IP addresses, the server must be unreachable, overlooking that the router's successful ping confirms reachability and the real issue lies in DHCP scope configuration.
✗The router's ip helper-address is configured incorrectlyWrong answer — click to see why▾
Why this is wrong here
The router can ping the DHCP server, indicating the ip helper-address is correctly configured and reachable. The issue is that the DHCP server's scope lacks a subnet for VLAN 10, not the helper-address configuration.
★ When this WOULD be the correct answer
This option would be correct if the router could not ping the DHCP server, or if the ip helper-address was pointing to the wrong IP address or was missing from the VLAN 10 interface configuration.
Why candidates choose this
Candidates may assume that any DHCP relay issue is due to misconfiguration of the ip helper-address, overlooking that the relay itself is working but the server lacks the appropriate scope.
✗The switch ports are not configured for VLAN 10Wrong answer — click to see why▾
Why this is wrong here
The question states users can ping the DHCP server from the router, indicating connectivity. Switch port misconfiguration for VLAN 10 would prevent all communication, but users can still obtain APIPA addresses, meaning they are on VLAN 10 but DHCP fails. The issue is at the DHCP server scope, not switch ports.
★ When this WOULD be the correct answer
This would be correct if users in VLAN 10 cannot communicate at all (e.g., cannot ping the router or other VLANs) and receive APIPA addresses because the switch ports are not assigned to VLAN 10, isolating them from the network.
Why candidates choose this
Candidates may think DHCP relies on switch port configuration for VLAN membership, but the problem is specifically about DHCP relay and scope, not basic connectivity.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Cable and Physical Layer
Key term
Ping
Ping is a network utility used to test whether a remote computer or device is reachable across an IP network and to measure the round-trip time of data packets.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every N10-009 question from scratch — 464 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.