N10-009 Network Troubleshooting Practice Question
Users in VLAN 10 cannot obtain IP addresses from the DHCP server located in VLAN 20. The router interface for VLAN 10 has an ip helper-address 192.168.20.5 command configured, and users can ping the DHCP server IP (192.168.20.5) from the router. However, users receive APIPA addresses. What is the most likely cause?
⚠ Common exam trap
CompTIA often tests the misconception that ip helper-address alone guarantees DHCP success, but the trap is that the DHCP server must have a scope matching the client's subnet (identified by the giaddr) to issue an address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DHCP server does not have a scope configured for the 192.168.1.0/24 subnet (VLAN 10)
The ip helper-address command on the router correctly forwards DHCPDISCOVER broadcasts from VLAN 10 to the DHCP server at 192.168.20.5. Since users can ping the server from the router, Layer 3 connectivity exists. However, the DHCP server must have a scope (or address pool) for the subnet of the requesting clients (192.168.1.0/24) to offer an IP address; without it, the server ignores the request, and clients fall back to APIPA (169.254.x.x).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The DHCP server does not have a scope configured for the 192.168.1.0/24 subnet (VLAN 10)
Why this is correct
When a DHCP relay agent (router) forwards a DHCP Discover broadcast from VLAN 10 users, it encapsulates it into a unicast packet and sets the 'giaddr' (gateway IP address) field to the IP address of the VLAN 10 interface (e.g., 192.168.1.1). The DHCP server uses this 'giaddr' to identify the originating subnet and select the appropriate IP address scope. If no scope exists on the DHCP server for the 192.168.1.0/24 network, the server will not find a matching pool of addresses and will consequently fail to generate a DHCP Offer, leaving users without an IP address.
- ✗
The router's ip helper-address is configured on the wrong interface
Why it's wrong here
The scenario states the helper address is on the VLAN 10 interface; if it were on the wrong interface, users would not reach the DHCP server at all, but they can ping the server from the router.
When this WOULD be correct
This would be correct if the ip helper-address were configured on the VLAN 20 interface instead of VLAN 10, or if it were missing on VLAN 10 entirely. For example, a question where clients in VLAN 10 cannot get IPs and the helper is on VLAN 20's interface would make B the answer.
- ✗
The switch port connecting users is configured as a trunk instead of an access port
Why it's wrong here
A trunk port would still allow traffic in VLAN 10, but if misconfiguration caused the user to be in the wrong VLAN, they might not be in VLAN 10. However, they could still likely reach the DHCP relay if routing works. A trunk misconfiguration is less likely to cause APIPA when the relay is working.
When this WOULD be correct
A question where users in VLAN 10 cannot reach the DHCP server at all (e.g., no ping), and the switch port connecting users is configured as a trunk, causing the client's VLAN tag to be mismatched or dropped, preventing DHCP communication.
- ✗
The router's ACL is blocking DHCP offers from the server
Why it's wrong here
If an ACL were blocking DHCP replies, the router would still receive them but drop them; however, the users would not get replies, leading to APIPA. But since the helper address is configured, the ACL would need to explicitly block UDP ports 67/68, which is less common than a missing scope.
When this WOULD be correct
In a scenario where the router can ping the DHCP server but clients cannot obtain IP addresses, and the router's ACL is configured to deny UDP ports 67/68 or the server's IP, this would be the cause. For example, an ACL applied inbound on the VLAN 10 interface blocking DHCP replies.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The N10-009 exam frequently reuses these exact scenarios with slightly different constraints.
✓The DHCP server does not have a scope configured for the 192.168.1.0/24 subnet (VLAN 10)Correct answer▾
Why this is correct
When a DHCP relay agent (router) forwards a DHCP Discover broadcast from VLAN 10 users, it encapsulates it into a unicast packet and sets the 'giaddr' (gateway IP address) field to the IP address of the VLAN 10 interface (e.g., 192.168.1.1). The DHCP server uses this 'giaddr' to identify the originating subnet and select the appropriate IP address scope. If no scope exists on the DHCP server for the 192.168.1.0/24 network, the server will not find a matching pool of addresses and will consequently fail to generate a DHCP Offer, leaving users without an IP address.
✗The router's ip helper-address is configured on the wrong interfaceWrong answer — click to see why▾
Why this is wrong here
The router interface for VLAN 10 already has the ip helper-address configured, and users can ping the DHCP server, indicating the helper address is correctly placed and reachable. The issue is that the DHCP server lacks a scope for VLAN 10's subnet, so it cannot assign addresses.
★ When this WOULD be the correct answer
This would be correct if the ip helper-address were configured on the VLAN 20 interface instead of VLAN 10, or if it were missing on VLAN 10 entirely. For example, a question where clients in VLAN 10 cannot get IPs and the helper is on VLAN 20's interface would make B the answer.
Why candidates choose this
Candidates may assume that if DHCP fails, the helper-address must be on the wrong interface, especially when they know it's configured but overlook that the server needs a matching scope.
✗The switch port connecting users is configured as a trunk instead of an access portWrong answer — click to see why▾
Why this is wrong here
Users in VLAN 10 can ping the DHCP server, so connectivity exists. The issue is that the DHCP server lacks a scope for VLAN 10's subnet, not that the switch port is misconfigured as a trunk.
★ When this WOULD be the correct answer
A question where users in VLAN 10 cannot reach the DHCP server at all (e.g., no ping), and the switch port connecting users is configured as a trunk, causing the client's VLAN tag to be mismatched or dropped, preventing DHCP communication.
Why candidates choose this
Candidates may confuse trunk vs. access port issues with DHCP relay problems, assuming that a trunk port could cause VLAN mismatch and block DHCP broadcasts.
✗The router's ACL is blocking DHCP offers from the serverWrong answer — click to see why▾
Why this is wrong here
The router can ping the DHCP server (192.168.20.5), indicating no ACL is blocking traffic. DHCP offers are unicast to the relay agent (router), which then forwards them to the client; an ACL on the router would also block the ping if it blocked DHCP offers.
★ When this WOULD be the correct answer
In a scenario where the router can ping the DHCP server but clients cannot obtain IP addresses, and the router's ACL is configured to deny UDP ports 67/68 or the server's IP, this would be the cause. For example, an ACL applied inbound on the VLAN 10 interface blocking DHCP replies.
Why candidates choose this
Candidates may think ACLs are a common cause of DHCP failures, but they overlook that the ip helper-address uses unicast forwarding, and a successful ping suggests no ACL blocking the server.
Analysis generated from the official N10-009blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Troubleshoot: Cable and Physical Layer
Key term
DHCP
Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses and network settings to devices on a network, so they can communicate without manual configuration.
Key term
VLAN
A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they are on the same physical network segment, regardless of their actual physical location.
About these practice questions
This N10-009 question is part of Courseiva's 464-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This N10-009 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the N10-009 exam.