350-401 Question #995: Real Exam Question with Answer & Explanation

Question

Refer to the exhibit. The CPE router acts as a DHCP server for the locally attached LAN. After DHCP snooping is enabled on the switch where the DHCP clients are connected, clients are unable to obtain their configuration from the DHCP server. What is the cause of this issue?

Options

• AThe IP address of the DHCP server is in the excluded DHCP range.
• BThe configuration of Gi0/1 is missing the ip helper-address 192.168.255.1 command.
• CThe DHCP server drops DHCP packets carrying Option 82 and an empty relay agent IP address.
• DThe excluded DHCP range contains the subnet address of the entire LAN network.

Explanation

DHCP Snooping & Option 82 Explanation

When DHCP snooping is enabled on a switch, it automatically inserts Option 82 (Relay Agent Information) into DHCP discovery packets before forwarding them upstream. However, because the clients are on the same local subnet as the CPE router/DHCP server, the relay agent IP address (giaddr) remains empty (0.0.0.0) - a combination that many DHCP servers interpret as invalid or spoofed, causing them to silently drop the packets.

Why the distractors are wrong:

• A is incorrect because excluding the DHCP server's own IP from the pool is normal practice and doesn't affect client discovery
• B is incorrect because ip helper-address is only needed when the DHCP server is on a different subnet, which isn't the case here since the CPE router is locally attached
• D is incorrect because excluding a subnet address is also standard DHCP configuration and wouldn't prevent clients from receiving addresses

💡 Memory Tip

Think of it as a "suspicious package" rule: Option 82 without a relay agent IP looks like a tampered packet to the DHCP server - it arrives with a tracking label but no return address, so the server refuses to process it. Remember: snooping + local DHCP server = Option 82 conflict.

No community discussion yet for this question.