N10-009 Question 60
Single answerDHCP: 67/68A network administrator installs a new DHCP server for a small branch office. After the change, users report that newly connected laptops are not receiving IPv4 addresses automatically. The administrator confirms the DHCP scope is active and has available addresses. A packet capture from a client shows repeated DHCPDISCOVER broadcasts leaving the laptop, but no DHCPOFFER responses are received. A firewall between the client VLAN and the DHCP server was recently updated. Which firewall change is most likely needed to restore DHCP service?
- A
Allow UDP 67 from clients to the DHCP server and UDP 68 from the DHCP server back to clients
- B
Allow TCP 67 from clients to the DHCP server and TCP 68 from the DHCP server back to clients
- C
Allow UDP 53 in both directions between clients and the DHCP server
- D
Allow TCP 443 from clients to the DHCP server for secure address assignment
Show answer and explanation
Correct answer: A
Explanation
In DHCPv4, the initial client exchange relies on UDP port 68 on the client side and UDP port 67 on the server side. The standard DORA process is Discover, Offer, Request, and Acknowledge. A client without an address sends a DHCPDISCOVER broadcast using UDP 68 to UDP 67, and the DHCP server responds with a DHCPOFFER from UDP 67 to UDP 68. If a firewall update blocks either direction, clients may fail to obtain leases even when the DHCP scope is healthy. This matches vendor documentation and standard references such as RFC 2131, which defines DHCP message exchange and port usage. In practice, administrators should verify firewall rules, ACLs, and any DHCP relay configuration when clients can transmit discovery traffic but do not receive offers.
- A. Correct.
Correct. DHCP for IPv4 uses UDP, not TCP. Clients send DHCP messages such as DHCPDISCOVER from UDP source port 68 to destination port 67 on the server or relay agent, and servers reply from UDP 67 to client UDP 68. If a firewall blocks these ports, clients may broadcast discovery messages but never receive offers.
- B. Incorrect.
Incorrect. A common misconception is that core infrastructure services use TCP for reliability. DHCPv4 uses UDP ports 67 and 68, not TCP, because the client does not yet have a fully established IP configuration when the exchange begins.
- C. Incorrect.
Incorrect. UDP 53 is used for DNS queries and responses, not for DHCP address assignment. Someone might choose this because name resolution problems can also affect network access, but DNS would not prevent a client from receiving an IP lease in the first place.
- D. Incorrect.
Incorrect. TCP 443 is used for HTTPS. DHCP does not use HTTPS or web-based secure sessions to assign addresses. This distractor reflects confusion between management interfaces on network appliances and the DHCP protocol itself.