Network Services and Security

A router interface applies this ACL inbound: 10 deny tcp any any eq 80 20 permit ip any any A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?

A switch has DHCP snooping enabled, but users still experience IP-to-MAC spoofing attacks. Which additional feature should be considered to help address that specific problem?

What is a key difference between SNMPv3 and earlier SNMP versions?

In AAA, what does the second A stand for?

Which ACL type can filter using source and destination IP addresses as well as TCP or UDP port numbers?

Which wireless security method is considered strongest among these choices for modern enterprise WLAN deployments?

Which traffic type is typically most sensitive to delay and jitter and is commonly prioritized with QoS?

Why might voice traffic be placed in a priority queue on a WAN link?

Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?

A network engineer successfully logs in to a router, but cannot enter configuration mode because the command is rejected by policy. Which AAA function is controlling this behavior?

Which DHCP message does the client send to formally accept an offered address?

Which switch security feature uses DHCP snooping bindings to validate ARP packets and help stop ARP spoofing?

An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?

Users can reach a server by IP address but not by hostname. Which service should be checked first?

What problem does DHCP snooping help prevent?

A show ip nat translations command displays this entry: Inside global 203.0.113.10:30001 Inside local 192.168.10.25:51514 Outside local 198.51.100.20:443 Outside global 198.51.100.20:443 Which statement is correct?

Which port-security violation mode drops frames from unauthorized MAC addresses but keeps the interface up and does not send an SNMP trap or syslog message?

Why is SSH preferred over Telnet for remote device administration?

In AAA, which function determines what an authenticated user is allowed to do after login?

Which protocol is preferred over Telnet for remote CLI management because it encrypts the session?

A PC in VLAN 30 must obtain an address from a DHCP server in VLAN 99. Which feature is required on the Layer 3 interface for VLAN 30?

Why is Telnet generally discouraged for network device administration?

A DHCP server is located on a different VLAN from the clients. Which feature is required so the clients can still receive addresses?

As a general rule, where should an extended ACL be placed?

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

Why is an extended ACL usually placed close to the source of the traffic being filtered?

A client on VLAN 20 must obtain an IPv4 lease from a DHCP server located on VLAN 100. Which feature is required on the Layer 3 interface for VLAN 20?

A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped. What is the best fix?

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

Which two statements about NTP are correct? (Choose two.)

Which field is modified by each router hop in an IPv4 packet to prevent endless forwarding loops?

Dynamic ARP Inspection is most effective at preventing which attack?

A packet is larger than the outgoing interface MTU and the DF bit is set in the IPv4 header. What should the router do?

A router performing PAT is using a single public IPv4 address for many inside hosts. Which value most often distinguishes one inside flow from another on the same outside address?

Why is multifactor authentication generally stronger than password-only access?

Which two features commonly strengthen access-switch security for user-facing ports? (Choose two.)

A switch port is configured with port security using these commands: switchport port-security switchport port-security maximum 1 switchport port-security violation restrict switchport port-security mac-address sticky A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity. Which statement best explains what happened?

A host sends a packet larger than the outgoing interface MTU, and the IPv4 header has the Don't Fragment bit set. What will a router do with the packet?

A router is configured as follows: interface g0/1 ip address 172.16.1.1 255.255.255.0 ip helper-address 10.20.20.10 Hosts on 172.16.1.0/24 are not receiving addresses from the DHCP server at 10.20.20.10. The server is reachable by ping from the router. What is the purpose of the ip helper-address command in this scenario?

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs. Which combination of features best meets that requirement?

Which two statements accurately describe DNS and DHCP?

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry should appear first in the ACL?

A host at 192.168.50.10/24 needs to send traffic to 192.168.60.20. Which MAC address will it normally place in the Ethernet destination field for the first frame?

Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows: interface GigabitEthernet0/0 ip address 192.168.10.1 255.255.255.0 ip nat outside ! interface GigabitEthernet0/1 ip address 203.0.113.10 255.255.255.0 ip nat inside ! ip nat inside source list 1 interface GigabitEthernet0/1 overload access-list 1 permit 192.168.10.0 0.0.0.255 Based on this configuration, which change is required to make PAT work correctly?

An administrator wants to permit SSH management access but block Telnet access to a device. Which statement best reflects that design goal?

Match each security concept to its most accurate purpose.

Which protocol is most directly responsible for keeping device clocks synchronized across a network?

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Users in a branch office can reach internal networks but cannot browse the Internet. The router has a correct default route and PAT is configured. Which missing item is the most likely cause if inside hosts are still using private source addresses on the WAN?

Which security concept is most closely associated with ensuring data has not been altered in an unauthorized way?

Which two statements accurately describe ACL behavior on Cisco devices?

Which two statements accurately describe Syslog in a Cisco network environment?

A company wants to reduce the chance that unused switch ports can be exploited. Which action best aligns with that goal?

A switch should disable an edge port immediately if a BPDU is received on it. Which feature is intended for that specific behavior?

A router has this command configured: `ip nat inside source static 192.168.1.50 203.0.113.50`. What is the main effect of this configuration?

Why is NTP especially valuable when a network uses centralized Syslog servers?

A router is performing PAT for inside users. Which detail allows multiple inside sessions to share one public IPv4 address at the same time?

Which two actions are reasonable examples of basic device-hardening practice?

Which service would a client most directly rely on to convert `server.example.com` into an IP address?

Match each service to the kind of problem it most directly helps solve.

Which term in the CIA triad refers to ensuring systems and data remain accessible when needed?

A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?

A company wants a server on the inside network to be reachable consistently from outside using one known public IP address. Which NAT approach best fits that goal?

Which option correctly matches an IP service symptom to the most likely service involved?

An engineer wants remote administrative access to remain available but also wants session contents protected in transit. Which management choice best supports that goal?

A router is configured for PAT using the WAN interface address. Which command element is most directly associated with allowing many internal users to share that single outside address?

A host reaches websites by IP address but fails when using hostnames. Which service is the strongest suspect?

A branch router uses PAT for Internet access. Users can browse out, but the administrator wants a specific internal web server to be reachable from outside on a consistent public address. Which design fits that requirement best?

Match each NAT term to its most accurate description.

A host receives its IP address automatically but cannot resolve hostnames. Which additional service information is most likely missing from its configuration?

A router is configured with a static NAT mapping for an internal server. What is the main operational advantage of this design for outside clients?

Which two statements accurately describe DNS in normal network operation?

A switchport is configured with sticky MAC learning and a maximum secure MAC value of 2. What is the main benefit of sticky learning in this situation?

Why is NTP especially useful when devices send logs to a centralized Syslog server?

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

A user can reach a remote web server by IP address but not by hostname. Which service should be checked first?

Select the options that correctly pair the security principle or control with its meaning.

A company wants internal users to share one public IPv4 address for outbound Internet access, while keeping sessions separate. Which NAT approach best meets that requirement?

A host has a valid IP address and subnet mask from DHCP but cannot reach remote networks because no gateway was provided. What is the best explanation?

A router is configured with PAT for inside users. Which symptom most strongly suggests the NAT inside/outside roles are reversed on the interfaces?

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

A host can reach remote websites by IP address but fails when using their hostnames. Which missing configuration item is the strongest suspect?

Which two statements accurately describe DNS in everyday network use?

Users on the inside network can browse the web, but the company now needs an internal web server at 192.168.10.50 to be reachable consistently from outside using one public IP address. Which design is most appropriate?

A company wants unauthorized devices plugged into unused wall ports to have as little chance of gaining access as possible. Which action most directly supports that goal?

Match each access-control term to its most accurate meaning.

Why is centralized logging especially useful when combined with NTP?

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Why is DHCP often preferred over manual addressing on larger user networks?

If a host has a valid IP address and subnet mask but no default gateway, what is the most likely result?

A company wants an internal web server to be reachable consistently from the Internet using one known public IPv4 address. Which NAT approach best fits that requirement?

Why is the combination of strong authentication and centralized logging better than either control by itself?

A user reports that websites can be opened by IP address but not by hostname. Which service is the strongest suspect?

A branch office uses PAT for user Internet access. The administrator notices that inside users can browse out, but an internal server still cannot be reached consistently from outside. Which change is most appropriate?

A host can reach other devices on its local subnet, but it cannot reach remote networks. The host has a valid IP address and subnet mask. Which missing item is the strongest suspect?

Why is shutting down unused switch ports considered a useful hardening measure?

Which NAT design is most appropriate when many inside users need outbound Internet access through one public IPv4 address, but no inbound server publishing is required?

Which two statements accurately describe DHCP?

A host receives a correct IP address and subnet mask from DHCP but still cannot reach remote networks. Local subnet communication works. Which missing DHCP option is the strongest suspect?

Users on the inside network can browse the Internet through PAT, but an internal web server must now be reachable from outside on a predictable public IP. Which change best fits the requirement?

Why is administratively shutting down unused switch ports considered a useful hardening measure?

Why does DNS make networks easier for people to use?

Why is NTP especially valuable when a company uses a centralized Syslog server?

Match each operations or assurance technology to its most accurate purpose.

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

A network team wants visibility into which flows are consuming the most bandwidth between internal subnets. Which technology is most directly associated with that goal?

An ACL is intended to block Telnet from 10.1.1.0/24 to router VTY access while still allowing SSH from the same subnet. Which statement best explains why an extended ACL is appropriate here?

A network administrator wants to receive an immediate notification from a device when a significant event occurs, rather than polling the device repeatedly. Which SNMP feature is most associated with that requirement?

A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?

A security policy requires that only one management subnet be able to initiate SSH to a router. Which approach most directly supports that requirement?

Why is disabling unused services on network devices considered a sound security practice?

An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?

An operations team wants a monitoring platform to periodically read interface counters and CPU statistics from routers. Which technology is most closely associated with that requirement?

An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?

A router allows SSH management from anywhere on the internal network. A new policy requires that only the management subnet 10.50.50.0/24 be allowed to initiate SSH to the device. Which approach best enforces that requirement?

Match each service or visibility technology to the most appropriate use case.

A team wants to know which internal hosts are sending the most traffic to a specific data center subnet. Which technology is most directly associated with that visibility goal?

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

Which two statements accurately describe good management-plane security practice on network devices?

An administrator wants to prevent a specific subnet from using Telnet to reach network devices, while still allowing SSH from that same subnet. What is the strongest reason a standard ACL is not enough by itself?

A security team wants device administrators to log in with individual named accounts instead of sharing one generic admin account. Which security objective does that most directly improve?

Match each security control or idea to its most accurate purpose.

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

Which two statements accurately describe common uses of NTP in network operations?

A monitoring system already collects Syslog and SNMP data. The network team now wants visibility into which applications or host conversations are driving link utilization. What is the strongest addition?

Which two statements accurately describe why NetFlow is useful for operations teams?

Users can reach an internal server by IP address but not by hostname. What is the most likely cause?

Which two statements accurately describe why SSH is preferred over Telnet for device administration?

A switch is configured with DHCP snooping and Dynamic ARP Inspection. Hosts suddenly lose connectivity after changing IP settings manually. Which explanation is strongest?

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Which two statements accurately describe why logs and accounting records both matter in secure operations?

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

Based on the exhibit, what is the most likely reason PAT is not working correctly?

Which two statements accurately describe the purpose of least privilege in administration and operations?

An administrator needs to configure an ACL to block HTTP traffic from subnet 10.10.10.0/24 to the web server at 172.16.1.10 while permitting all other traffic. Which ACL entry should be placed first?

Based on the exhibit, what is the strongest explanation for why clients can browse by IP address but not by hostname?

Based on the exhibit, why is the ACL not meeting the requirement to block only HTTPS traffic to the server?

Which two statements accurately describe the value of source restriction on administrative access?

Which two statements accurately describe why least privilege and source restriction work well together for administrative access?

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

Based on the exhibit, why is the ACL blocking more traffic than intended?

Based on the exhibit, why does the ACL still allow HTTPS traffic from the branch subnet to the server?

Which two statements accurately describe the value of named administrative accounts?

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Which two statements accurately describe why NTP and Syslog are often configured together?

Which two statements accurately describe why source restriction and logging are often used together for administrative access?

Two switches are connected by an 802.1Q trunk. CDP reports a native VLAN mismatch. Which issue is most likely to appear because of this?

Match each REST API method to the action it most closely represents in a typical network automation workflow.

R1 has the following routes installed: O 10.10.10.0/24 via 192.0.2.2 S 10.10.10.128/25 via 198.51.100.2 S* 0.0.0.0/0 via 203.0.113.1 A packet destined for 10.10.10.200 arrives at R1. Which route is used?

A branch router has only one WAN link connected to an Ethernet handoff from the provider. Which static default route is generally the better choice?

Match each DHCPv4 message in the DORA process to its role.

An engineer successfully authenticates to a controller and receives a token. What is the usual reason for including that token in later API requests?

A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?

An ACL entry reads: access-list 25 permit 192.168.8.0 0.0.0.15 Which address range does this statement match?

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

R1 and R2 should form an OSPF adjacency on their shared GigabitEthernet link, but they remain stuck in EXSTART. What is the most likely cause?

R1 learns three OSPF routes to different destinations: O 10.10.10.0/24 O IA 10.20.20.0/24 O E2 10.30.30.0/24 Which statement is correct about these route types?

A wireless site reports that users can connect to the SSID, but performance drops sharply around the conference area whenever the room fills up. Based on the exhibit, what is the most likely cause?

Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?

An ACL on R1 contains only these entries: access-list 101 permit tcp 10.10.10.0 0.0.0.255 any eq 443 access-list 101 permit icmp any any What happens to an HTTP packet sourced from 10.10.10.25 and destined for 198.51.100.10 if ACL 101 is applied in the traffic path?

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

Two switches are configured to form an EtherChannel, but the bundle never comes up. Which explanation best describes this scenario?

Which OSPF neighbor state indicates that the routers have already exchanged full link-state databases?

A switch interface connected to a Cisco IP phone with a PC behind it must carry voice and data correctly. Which two switchport commands are appropriate on that access port?

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

A controller-based WLAN uses 5 GHz in an open office. Clients keep disconnecting when users roam between APs, but signal strength remains strong. Based on the exhibit, what is the most likely problem?

Which two statements about standard and extended IPv4 ACLs are correct?

Clients on a network can browse the internet by IP address but fail when using hostnames. What is the most likely problem?

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

An engineer applies this command on an access interface connected to a user PC: switchport port-security violation restrict. What happens if a second unauthorized MAC address appears on the port?

Match each HTTP method to its common REST API action.

R1 receives an OSPF route to 10.55.0.0/16 and already has a static route to 10.55.10.0/24. Which route will be used for traffic sent to 10.55.10.25?

Which STP role identifies the port on a non-root switch that has the best path back to the root bridge?

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

An administrator wants an access-layer interface to shut down immediately if another switch is connected accidentally. Which feature best meets that requirement?

An engineer configures NAT overload on a router for inside users. Which resource is primarily used to let many internal hosts share one public IPv4 address?

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?

An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Exhibit: A collector is receiving traffic metadata from a router, including source IP, destination IP, protocol, and byte counts. Which feature is being used?

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

A client receives an IP address but cannot reach remote networks. Which DHCP option is most likely missing or incorrect?

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

Match each network service to its primary function.

Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

On a router performing NAT, where should ip nat inside be applied?

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Exhibit: An engineer wants a device to send only warning messages and more critical events to a syslog server. Which logging level should be configured?

Exhibit: A user can ping 8.8.8.8 successfully but cannot browse to www.example.com by name. Which service is the most likely failing component?

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

A DHCP client on VLAN 30 is not receiving an IP address from a DHCP server (10.99.99.20) on another subnet. The SVI for VLAN 30 is configured with an IP address and is up, but the DHCP relay command is missing. Which command should be added to the SVI configuration?

A branch router should automatically learn the IP address of a time source so logs from all devices show matching timestamps. Which service provides that function?

A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?

Exhibit: Hosts on the inside network can reach the internet, but inbound connections to a published web server fail. Static NAT is configured. What is the most likely missing piece?

Exhibit: A network engineer wants to identify which applications are consuming most WAN bandwidth over time. Which feature should be enabled on the router?

Port security is enabled with a maximum of 2 MAC addresses, but a third device connected through a small hub causes a violation. Which result is expected in restrict mode?

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Users receive addresses from the correct subnet and can reach destinations by IP address, but they cannot browse by hostname.

A small office wants branch routers to automatically hand out IP addresses, default gateway values, and DNS servers to clients. Which service should be configured?

Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?

A switch port is configured with port-security violation mode restrict. Which two statements are true when an unauthorized MAC address appears?

A named standard ACL is configured to permit only the 192.168.30.0/24 subnet, but users from 192.168.31.0/24 are still passing traffic. What is the most likely reason?

A router is configured for PAT overload. What does the inside global address represent for an internal PC?

Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?

Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?

Which two statements correctly describe syslog severity levels?

Which two actions help protect access-layer switch ports from rogue DHCP servers?

Which protocol is used to resolve a hostname such as www.example.com into an IP address?

A branch router is acting as a DHCP server. Which two parameters can it provide directly to clients through DHCP?

A router is configured as a DHCP server for VLAN 20. Clients on the VLAN can reach the default gateway, but they do not receive leases. Which two configuration issues on the router would directly prevent successful address assignment?

A company wants all routers and switches to use a common time source so log timestamps line up during incident review. Which two statements about NTP are correct?

Users can browse websites by IP address but not by hostname. The default gateway is reachable and general internet connectivity works. Which two causes are the most likely?

A network team wants to collect flow-level traffic statistics from routers to identify top talkers and bandwidth consumers. Which two statements about NetFlow are correct?

A branch office uses PAT overload on the edge router. Inside users can reach the internet, but return traffic for a newly deployed server must be mapped to a specific inside host. Which two statements are correct?

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch port connected to a single PC. The port is in the 'authorized' state, but the PC cannot reach any network resources beyond its directly connected switch. The switch is configured to use RADIUS for authentication. What is the most likely cause of this issue?

Which TWO statements correctly describe the differences between RADIUS and TACACS+ when configuring AAA on IOS-XE?

Which TWO statements correctly describe the configuration and verification of AAA with RADIUS/TACACS+ and 802.1X port-based authentication on IOS-XE?

Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?

Which TWO statements correctly describe the behavior of standard ACLs when applied to an interface?

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

A user reports that they cannot access the company's internal web server at 'intranet.company.local' from their workstation. The workstation can ping the web server's IP address 192.168.10.50 successfully, and other internal services like email (mail.company.local) are reachable. Which DNS record issue is most likely causing this problem?

A network administrator is troubleshooting an issue where internal hosts can ping the company's web server by IP address (192.0.2.10) but cannot access it using the fully qualified domain name www.example.com. The DNS server (192.0.2.5) is reachable and responds to queries. The administrator runs nslookup www.example.com from a host and receives the following output: C:\> nslookup www.example.com Server: UnKnown Address: 192.0.2.5 Name: www.example.com Address: 192.0.2.20 Based on the output, what is the most likely cause of the problem?

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Drag and drop the following steps into the correct order to configure and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.1, with the ACL applied inbound on the router's GigabitEthernet0/0 interface, and then verify the configuration.

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.100, and then verify the configuration.

Which of the following is the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the router's G0/0 interface?

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server 10.0.0.10, applied inbound on interface GigabitEthernet0/1.

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router and describe the translation process for an outbound packet.

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the diagnostic workflow using nslookup and dig to identify a missing or incorrect A-record.

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the nslookup and dig diagnostic workflow for troubleshooting missing or wrong DNS records.

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet. OPTIONS: A: Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay. [CORRECT] B: Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet. C: Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet. D: Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a local subnet and enable a DHCP relay agent on a different interface to forward client requests to that server.

Which TWO statements correctly describe the operation of the ip helper-address command in a DHCP relay agent configuration?

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.

You are connected to R1. Configure AAA with RADIUS authentication so that SSH users are authenticated first against the RADIUS server (198.51.100.10) and fall back to the local user database if the server is unreachable. Additionally, troubleshoot why an 802.1X-enabled interface (GigabitEthernet0/1) remains in the unauthorized state. The RADIUS server shares a key of 'cisco123' and uses UDP port 1812. The local user 'admin' with secret 'adminpass' must be available as a fallback.

You are connected to R1. The network has two routers (R1 and R2) connected via a serial link (S0/0/0). R1's GigabitEthernet0/0 connects to the 192.168.1.0/24 LAN. An extended ACL must be configured on R1 to permit only HTTPS traffic (TCP port 443) from host 192.168.1.10 to server 203.0.113.5 (reachable via R2), and deny all other traffic from the LAN to the server. Currently, the ACL is applied inbound on G0/0 but valid HTTPS traffic is being blocked. Troubleshoot and fix the configuration.

You are connected to R1. The network has two routers (R1, R2) and a switch (SW1) in between. R1's G0/0 connects to SW1 (192.168.1.1/24), SW1 connects to R2's G0/0 (192.168.1.2/24). R2 has a loopback (Lo0: 203.0.113.1/32) used as a management address. Configure an extended ACL on R1 so that only SSH (TCP/22) traffic from the 10.0.0.0/24 network is permitted to reach R2's loopback; all other traffic to that loopback must be denied. Then apply the ACL in the correct direction on the correct interface.

You are connected to R1. The network currently permits all HTTP traffic from hosts on the 192.168.1.0/24 LAN to reach the web server at 203.0.113.10, but SSH traffic (TCP port 22) from the same LAN is being blocked. Additionally, you must ensure that no other traffic from the LAN reaches the server. Configure an extended ACL on R1 to allow only HTTP and SSH from the LAN to the server, and apply it inbound on the correct interface. Verify your solution.

You are connected to R1 via the console. An extended ACL named BLOCK_SMTP has been applied inbound on interface GigabitEthernet0/1, but users on the 192.168.10.0/24 network cannot send email to the SMTP server at 203.0.113.10. Additionally, the ACL is blocking all other traffic that should be permitted. Examine the running configuration and fix the ACL so that SMTP traffic (TCP port 25) from the 192.168.10.0/24 network to the SMTP server is permitted, and all other IP traffic is allowed.

You are connected to R1. The network uses a single router with two subnets: 192.168.1.0/24 (connected to GigabitEthernet0/0) and 10.0.0.0/30 (connected to GigabitEthernet0/1). Configure an extended named ACL called 'FILTER_HTTP' that permits HTTP traffic (TCP port 80) from the 192.168.1.0/24 subnet to any destination, and includes an explicit deny statement to deny all other IP traffic. Apply the ACL inbound on GigabitEthernet0/0. Then verify that HTTP traffic is allowed and all other traffic is blocked.

You are connected to R1 via console. R1 is a router that connects two internal subnets (192.168.1.0/24 and 192.168.2.0/24) to the internet via a serial link to ISP. Currently, no ACL is applied. Your task is to configure an extended named ACL on R1 that permits only HTTP (TCP/80) and HTTPS (TCP/443) traffic from the 192.168.1.0/24 subnet to the internet, and denies all other traffic from that subnet. Traffic from 192.168.2.0/24 must be permitted without restriction. Apply the ACL inbound on the interface facing the internal subnets. Additionally, verify that the implicit deny is not blocking necessary traffic by ensuring that the ACL correctly handles the traffic.

You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.

You are connected to R1, a branch router. Configure an extended ACL named BRANCH_IN that permits only HTTP (TCP port 80) traffic from the internal network 192.168.1.0/24 to the web server at 203.0.113.10, and permits ICMP echo-reply from any source to any destination. Apply the ACL inbound on the interface facing the internal network. Then verify that only the specified traffic is allowed.

You are connected to R1. The network uses 192.168.1.0/24 for internal hosts and 203.0.113.0/29 for the public IP pool (203.0.113.2 is the outside interface). Configure PAT so that inside hosts can reach the Internet using the pool address 203.0.113.2. Also configure static NAT to map internal server 192.168.1.10 to 203.0.113.3. The initial config has errors; identify and fix them.

You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.

You are connected to R1. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 inside network can reach the Internet through the outside interface GigabitEthernet0/1 using the IP address 203.0.113.1. Additionally, configure static NAT to map internal server 192.168.1.10 to public IP 203.0.113.5. The current configuration has several errors. Identify and correct them.

You are connected to R1. The internal network 192.168.1.0/24 must be able to access the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.1. Additionally, a web server at 192.168.1.100 must be reachable from the Internet via static NAT to the same outside interface. The current configuration has errors. Correct the NAT configuration so that inside hosts can browse the web and the server is reachable from outside.

You are connected to R1. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the outside interface GigabitEthernet 0/1 with IP 203.0.113.2/29. The current configuration has an incorrect inside/outside interface assignment and a missing overload keyword. Fix all issues.

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

You are connected to R1. The network uses private IP 10.10.10.0/24 on the inside and must reach the Internet via the outside interface G0/1 with public IP 203.0.113.1/29. Configure PAT (NAT overload) so that inside hosts can access the Internet, and also configure a static NAT for the internal server 10.10.10.100 to public IP 203.0.113.2. The current configuration has errors: the inside and outside interfaces are swapped, the ACL is incorrectly defined, and the overload keyword is missing. Fix all issues.

You are connected to R1. The inside network 192.168.1.0/24 must be translated to the outside interface IP (198.51.100.1) using PAT (NAT overload). Additionally, a static NAT entry must map host 192.168.1.10 to 203.0.113.10. The current configuration is incomplete and contains errors. Correct the configuration so that both translations work properly.

You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.

You are troubleshooting PAT and static NAT on R1. The inside network 192.168.10.0/24 must be translated to the public IP 203.0.113.1 (interface G0/1) using port address translation. Additionally, the server at 192.168.10.100 must be reachable from the outside via static NAT to 203.0.113.5. The current configuration is not working. Identify and correct the errors in the running config on R1.

You are connected to R1. The inside network 192.168.1.0/24 must be able to access the internet using PAT (NAT overload) with the outside interface G0/1 IP 203.0.113.1. Additionally, the internal server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is incomplete and contains errors. Identify and fix all issues so that both PAT and static NAT work correctly.

You are connected to R1 via the console. The network has a DNS server at 203.0.113.10 that should resolve www.example.com to 203.0.113.100. However, when you ping www.example.com, it fails. Diagnose and resolve the DNS resolution issue. The DNS server is reachable via ping, but nslookup from R1 returns a server failure. Configure R1 so that it can successfully resolve www.example.com. Additionally, verify that the DNS server is correctly configured for forward and reverse lookups.

You are connected to R1, a Cisco IOS-XE router acting as the network's DNS client. The network uses a local DNS server at 203.0.113.10 for internal name resolution. Users report that the hostname 'fileserver.courseiva.local' cannot be resolved, while other names work fine. Diagnose and fix the DNS resolution failure so that 'fileserver.courseiva.local' resolves correctly.

You are connected to R1. The network uses DNS to resolve hostnames for remote device management. Currently, R1 cannot resolve the hostname 'ServerA' via DNS. Using the nslookup and dig commands, you have gathered the following outputs: nslookup ServerA Server: 203.0.113.1 Address: 203.0.113.1#53 Name: ServerA.example.com Address: 203.0.113.10 dig ServerA ... ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: ... ... The show running-config command shows that 'ip domain-lookup' is enabled, the name-server is 203.0.113.1, and no static host entries are configured. Diagnose and fix the DNS resolution failure. Ensure that R1 can successfully resolve 'ServerA' to its intended IP address 198.51.100.10.

You are connected to R1, a router that serves as the DNS resolver for the local network 192.168.10.0/24. Users report that they cannot resolve the hostname 'webserver.internal' to its IP address (192.168.10.50), and reverse DNS lookups for that IP return a different name. Additionally, some queries to an external domain 'example.com' time out. Diagnose and fix the DNS configuration on R1 using nslookup and dig commands where applicable, ensuring proper forward and reverse resolution for internal hosts and reachability to external DNS servers.

You are connected to R1, a multilayer switch acting as a DNS client and DNS server for the local network. The network uses 192.168.1.0/24 for internal hosts. Users report that hostnames like 'server1.example.com' fail to resolve. Diagnose and fix the DNS resolution issue using nslookup and dig. Ensure that R1 can resolve both forward and reverse DNS queries correctly.

You are connected to R1, a Cisco IOS-XE router that serves as the DNS resolver for the local network. The router can reach the DNS server at 198.51.100.53, but internal hosts cannot resolve the hostname 'fileserver.courseiva.com' (expected IP 203.0.113.10). Which configuration will resolve the issue?

You are connected to R1, a multilayer switch acting as a DNS forwarder for two VLANs. Users on VLAN 10 report that they cannot resolve 'files.example.com' while VLAN 20 works fine. The DNS server 198.51.100.53 is reachable but returns SERVFAIL for queries from subnet 192.168.10.0/24, while server 203.0.113.53 responds correctly for both VLANs. Diagnose and fix the DNS resolution issue using nslookup and dig, then adjust the IOS-XE configuration to ensure proper name resolution. Choose the best fix that permanently resolves the problem.

You are troubleshooting DNS resolution issues from R1. Using nslookup and dig commands, diagnose why the router cannot resolve the hostname 'fileserver.courseiva.com' to an IP address, and why reverse lookup for IP address 198.51.100.10 fails. Determine the appropriate fix to ensure successful forward and reverse DNS resolution.

You are connected to R1 via the console. R1 is the DHCP server for the 192.168.50.0/24 LAN. Configure DHCP on R1 to assign addresses from 192.168.50.10 to 192.168.50.200, with default gateway 192.168.50.1 and DNS server 8.8.8.8. Also, configure R1 to act as a DHCP relay agent for the 10.0.0.0/30 link to reach a remote DHCP server at 203.0.113.10. Then, troubleshoot and fix a misconfiguration that causes clients on VLAN 50 to not receive IP addresses.

You are connected to R1. Configure R1 as a DHCP server for VLAN 20 clients (192.168.20.0/24) with DNS server 203.0.113.10 and default gateway 192.168.20.1. On switch SW1, enable DHCP snooping globally and on VLAN 20, configure the uplink to R1 as trusted, and ensure that the DHCP server is reachable via ip helper-address on the VLAN 20 SVI. Currently, clients are not receiving IP addresses because of misconfigurations: the excluded-address range on R1 is too large (excluding the entire subnet), the helper-address on SW1 points to a wrong IP (192.0.2.99), and a rogue DHCP server is connected to port Fa0/3 on SW1. Fix all issues so that clients can get addresses securely.

You are connected to R1. Configure DHCP services so that hosts on VLAN 10 (192.168.10.0/24) can obtain IP addresses from R1. Additionally, configure the switch SW1 to prevent rogue DHCP server attacks on that VLAN. The current configuration has a misconfigured helper-address and an excluded-address range that is too broad.

You are connected to SW1, a multilayer switch. Configure DHCP snooping and an IP helper-address so that clients in VLAN 20 receive IP addresses from the DHCP server at 10.0.0.2. The DHCP server is already configured with a pool for 192.168.20.0/24, but clients are not getting addresses. Identify and correct the issues in the current configuration.