CCNA Practice Exam 66 — 20 Questions

Question 1

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk port G0/1. The trunk is currently using VLAN 1 as native VLAN, but the network administrator wants to change the native VLAN to VLAN 99 for security. Configure the trunk on G0/1 to use native VLAN 99 and verify.

Accepted Answer

SW1(config)# interface g0/1
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# end
SW1# show interfaces trunk. Changing the native VLAN on a trunk prevents VLAN hopping attacks. The native VLAN carries untagged traffic; here it is changed from default VLAN 1 to VLAN 99.

Answer

SW1(config)# interface g0/1
SW1(config-if)# switchport trunk allowed vlan 99
SW1(config-if)# end
SW1# show vlan brief

Answer

SW1(config)# vlan 99
SW1(config-vlan)# name Native
SW1(config-vlan)# exit
SW1(config)# interface g0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# end
SW1# show interfaces trunk

Answer

SW1(config)# interface g0/1
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# end
SW1# show vlan id 99

Question 2

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs (10 - Sales, 20 - Engineering). Port G0/1 is connected to a PC in VLAN 10, and port G0/2 is connected to a PC in VLAN 20. The switch needs to be configured to allow inter-VLAN communication using an external router connected to port G0/3. Currently, the PCs cannot communicate across VLANs. Configure the switch to support Router-on-a-Stick with VLAN 10 as the native VLAN on the trunk.

Accepted Answer

Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on the trunk.. Access ports assign PCs to their respective VLANs. The trunk port carries multiple VLANs to the router, and setting the native VLAN to 10 ensures untagged frames on the trunk belong to VLAN 10, which the router's subinterface for VLAN 10 will handle as untagged.

Answer

Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 1, and allow VLANs 10 and 20 on the trunk.

Answer

Configure G0/1 as access VLAN 10, G0/2 as access VLAN 20, G0/3 as trunk with native VLAN 10, but do not allow VLAN 10 on the trunk.

Answer

Configure G0/1 as trunk with native VLAN 10, G0/2 as trunk with native VLAN 20, G0/3 as trunk with native VLAN 10, and allow VLANs 10 and 20 on all trunks.

Question 3

You are connected to R1 via console. R1 has two upstream paths to the Internet: a primary via ISP1 (G0/0 10.1.1.1/30) and a backup via ISP2 (G0/1 10.2.2.1/30). The backup path should only be used when the primary fails. The default route to ISP1 has been configured, but you must now configure a floating static default route to ISP2 with an administrative distance of 200.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.2 200. A floating static route ensures backup connectivity by using an administrative distance (AD) higher than the primary route's AD. Here, the primary default route has an AD of 1, so the backup must be configured with AD 200 as specified. Crucially, the next-hop address must be the ISP's IP address (10.2.2.2) in the /30 subnet, not R1's own interface IP (10.2.2.1). Using the local interface IP creates an invalid static route. Option A is correct only with the next-hop set to 10.2.2.2. Options B and C fail because they use AD 2 and 1 respectively (not the required 200) and also point to the wrong next-hop. Option D uses AD 250 instead of 200 and has the same next-hop error.

Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.1 2

Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.1 1

Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.1 250

Question 4

You are connected to R1 via console. R1 is connected to three routers (R2, R3, R4) over Ethernet links, all in OSPF area 0. Due to network topology, R1 should not become the Designated Router (DR) or Backup Designated Router (BDR) on any of its interfaces. You need to configure R1's OSPF priority appropriately to ensure it never participates in DR/BDR elections.

Accepted Answer

Set the OSPF priority to 0 on all interfaces of R1.. Setting the OSPF priority to 0 on each Ethernet interface excludes R1 from DR/BDR elections entirely, as a priority of 0 signals that the router is ineligible. In contrast, option B (priority 255) is incorrect because the highest priority makes a router the most likely to become DR/BDR, not prevent it. Option C (priority 1) allows the router to participate in elections and could still become DR/BDR if no higher-priority router exists. Option D is wrong because setting priority to 0 on the loopback interface does not affect the physical Ethernet interfaces where elections occur.

Answer

Set the OSPF priority to 255 on all interfaces of R1.

Answer

Set the OSPF priority to 1 on all interfaces of R1.

Answer

Set the OSPF priority to 0 on the loopback interface of R1.

Question 5

You are connected to R1 via the console. R1 is a newly deployed router that connects two subnets: 192.168.1.0/24 on GigabitEthernet0/0 and 192.168.2.0/24 on GigabitEthernet0/1. There is a default route to the Internet via ISP router at 203.0.113.1, but the network policy requires that traffic from 192.168.1.0/24 to the Internet must exit via a different next-hop 203.0.113.2. You need to implement policy-based routing on R1 to forward traffic from source 192.168.1.0/24 to 203.0.113.2, while all other traffic uses the default route via 203.0.113.1.

Accepted Answer

Create an access list matching source 192.168.1.0/24, a route-map with set ip next-hop 203.0.113.2, and apply the route-map inbound on GigabitEthernet0/0.. Policy-based routing (PBR) allows overriding the routing table for specific traffic. The access list identifies traffic from 192.168.1.0/24, the route-map sets the next-hop to 203.0.113.2, and applying it to the incoming interface G0/0 ensures that traffic entering from that subnet follows the policy.

Answer

Create an access list matching source 192.168.1.0/24, a route-map with set ip next-hop 203.0.113.2, and apply the route-map outbound on GigabitEthernet0/1.

Answer

Create an access list matching destination 203.0.113.2, a route-map with set ip next-hop 203.0.113.2, and apply the route-map inbound on GigabitEthernet0/0.

Answer

Configure a static route for 192.168.1.0/24 with next-hop 203.0.113.2 and rely on the default route for other traffic.

Question 6

You are connected to R1 via console. R1 connects three subnets: 10.0.1.0/24 (area 0), 10.0.2.0/24 (area 0), and 10.0.3.0/24 (area 0). The serial link to R2 uses IP subnet 10.0.0.0/30 and is in OSPF area 1. The network administrator wants to advertise a single summary route for these three subnets to R2, reducing the OSPF link-state database size in area 1. R1 is already running OSPF with network statements for its connected subnets in their respective areas. You need to configure route summarization on R1 so that only the summary route is advertised to R2 via the serial link.

Accepted Answer

router ospf 1
 area 0 range 10.0.0.0 255.255.252.0. The 'area 0 range' command creates a summary route for the specified range, which is then advertised as a type 3 summary LSA to other areas. This reduces routing table size and prevents flapping.

Answer

router ospf 1
 summary-address 10.0.0.0 255.255.252.0

Answer

interface serial 0/0/0
 ip summary-address ospf 1 10.0.0.0 255.255.252.0

Answer

router ospf 1
 area 0 range 10.0.0.0 255.255.255.0

Question 7

You are connected to R1 via console. R1 is connected to R2 via GigabitEthernet0/0 (10.0.0.1/30) and to R3 via GigabitEthernet0/1 (10.0.0.5/30). R1 has a management subnet 192.168.1.0/24 connected to GigabitEthernet0/2. The network administrator wants to ensure that traffic from the management subnet to the Internet (203.0.113.0/24) uses R2 as the primary path and R3 as a backup. Currently, OSPF is running with default metrics. You must configure a floating static route that will be used only if the OSPF route fails.

Accepted Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.6 150. The floating static route is configured with an administrative distance of 150, which is higher than OSPF's default AD of 110. This ensures that the static route is only installed in the routing table when the OSPF route is not present (e.g., due to a failure). The next-hop is R3's IP on the directly connected link.

Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.2 150

Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.6 110

Answer

ip route 0.0.0.0 0.0.0.0 10.0.0.6 150

Question 8

You are connected to R1 via console. R1 has three directly connected subnets: 192.168.1.0/24 (G0/0), 192.168.2.0/24 (G0/1), and 192.168.3.0/24 (G0/2). You need to configure a summary route to be advertised to a neighbor via a static route pointing to Null0 to prevent routing loops. The summary should cover all three subnets.

Accepted Answer

ip route 192.168.0.0 255.255.252.0 Null0. The three subnets 192.168.1.0/24, 192.168.2.0/24, and 192.168.3.0/24 can be summarized as 192.168.0.0/22, which covers 192.168.0.0 to 192.168.3.255. A static route to Null0 ensures that traffic matching the summary but not a more specific route is dropped, preventing routing loops.

Answer

ip route 192.168.1.0 255.255.252.0 Null0

Answer

ip route 192.168.0.0 255.255.255.0 Null0

Answer

ip route 192.168.0.0 255.255.254.0 Null0

Question 9

You are connected to R1 via console. R1 has two paths to the Internet: primary via ISP1 (G0/0) and backup via ISP2 (G0/1). The primary route has an administrative distance of 1, and the backup should only be used if the primary fails. Currently, both routes are active. You need to configure a floating static route for the backup.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 G0/1 200. A floating static route with a higher administrative distance (200) than the primary route (1) ensures it is only used when the primary route is removed from the routing table, providing redundancy.

Answer

ip route 0.0.0.0 0.0.0.0 G0/1 1

Answer

ip route 0.0.0.0 0.0.0.0 G0/1 0

Answer

ip route 0.0.0.0 0.0.0.0 G0/1 255

Question 10

You are connected to R1 via console. R1 and R2 are connected via a serial link. OSPFv2 has been configured, but the adjacency is stuck in EXSTART state. You suspect a mismatched MTU. On R1, the interface MTU is currently set to 1400, while R2 uses the default MTU of 1500. You need to verify and fix the issue.

Accepted Answer

On R1, configure the interface MTU to 1500 and then clear the OSPF process using 'clear ip ospf process'.. OSPF requires matching MTU values on a link. The incorrect MTU on R1 (1400) caused the adjacency to stall in EXSTART. Setting MTU to 1500 and clearing the OSPF process allows proper adjacency formation.

Answer

On R1, configure the interface MTU to 1500 and then reload the router to apply the change.

Answer

On R1, configure the interface MTU to 1500 and then change the OSPF network type to point-to-point.

Answer

On R1, configure the interface MTU to 1500 and then adjust the OSPF hello and dead timers to match R2.

Question 11

You are connected to R1 via the console. R1 and R2 are configured with EIGRP AS 100. R1 has two paths to the 172.16.1.0/24 network: one via a FastEthernet link to R2 (bandwidth 100 Mbps, delay 100 microseconds) and another via a serial link to R2 (bandwidth 1.544 Mbps, delay 20000 microseconds). The EIGRP metric is calculated using the default K-values. The FastEthernet link is preferred, but you need to make the serial link the backup by adjusting the administrative distance.

Accepted Answer

Configure a static route to 172.16.1.0/24 with next-hop 10.0.0.6 and administrative distance 170.. A floating static route is configured with an administrative distance of 170, which is higher than EIGRP's default distance of 90. This ensures that the static route is only used when the EIGRP route is not available. The static route points to the next-hop IP address of R2's serial interface.

Answer

Configure a static route to 172.16.1.0/24 with next-hop 10.0.0.6 and administrative distance 90.

Answer

Configure a static route to 172.16.1.0/24 with next-hop 10.0.0.6 and administrative distance 1.

Answer

Configure a static route to 172.16.1.0/24 with next-hop 10.0.0.6 and administrative distance 255.

Question 12

You are connected to R1 via the console. R1 and R2 are running OSPFv2 in area 0. R1's router ID is 1.1.1.1, and R2's router ID is 2.2.2.2. Both routers are connected via GigabitEthernet0/0 on the 192.168.12.0/30 subnet. You need to ensure that R1 does not send OSPF hello messages out of its Loopback0 interface, while still advertising the loopback network into OSPF.

Accepted Answer

Configure the passive-interface Loopback0 command under the OSPF process.. Configuring the Loopback0 interface as passive under the OSPF process suppresses the sending of hello messages on that interface, preventing unnecessary adjacencies. The network is still advertised because OSPF includes the subnet in its LSAs.

Answer

Remove the network 192.168.12.0 0.0.0.3 area 0 command from the OSPF configuration.

Answer

Configure the ip ospf passive-interface command on GigabitEthernet0/0.

Answer

Configure the network 192.168.12.0 0.0.0.3 area 0 command under the OSPF process.

Question 13

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to R2 (10.0.0.2/30). Hosts on the LAN (192.168.1.0/24) need DHCP services. The DHCP server is located at 172.16.1.100 on a different subnet reachable via R2. Configure R1 to forward DHCP broadcasts to the DHCP server.

Accepted Answer

ip helper-address 172.16.1.100. The ip helper-address command on the LAN interface forwards DHCP broadcast requests to the DHCP server at 172.16.1.100, allowing clients to obtain IP addresses across subnets.

Answer

ip dhcp relay information option

Answer

ip forward-protocol udp 67

Answer

ip dhcp-server 172.16.1.100

Question 14

You are connected to R1 via the console. R1 connects two networks: GigabitEthernet0/0 (192.168.1.1/24) and GigabitEthernet0/1 (192.168.2.1/24). Create an extended ACL named BLOCK_HTTP that denies HTTP traffic (tcp port 80) from the 192.168.1.0/24 network to the 192.168.2.0/24 network, but permits all other IP traffic. Apply this ACL inbound on GigabitEthernet0/0.

Accepted Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP in. The named extended ACL BLOCK_HTTP denies TCP port 80 from 192.168.1.0/24 to 192.168.2.0/24, then permits all other traffic. Applying it inbound on G0/0 filters traffic from LAN A before routing.

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/1
ip access-group BLOCK_HTTP in

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP out

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP in
interface GigabitEthernet0/1
ip access-group BLOCK_HTTP in

Question 15

You are connected to R1 via console. R1 is a router that needs to provide DHCP services to hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The router has two subinterfaces on GigabitEthernet0/0: G0/0.10 (192.168.10.1/24) and G0/0.20 (192.168.20.1/24) with 802.1Q encapsulation. Configure R1 as a DHCP server for both VLANs, excluding addresses 192.168.10.1-10 and 192.168.20.1-10, with a lease of 1 day. Ensure DNS server 8.8.8.8 is provided.

Accepted Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 1
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 1. Option A correctly uses `lease 1` for a 1-day lease, dotted decimal subnet masks, and proper DHCP pool settings. Option B incorrectly uses CIDR notation `/24` in the network command, which IOS does not accept. Option C uses `lease 24`, which is interpreted as 24 days, not 1 day. Option D also incorrectly uses `lease 24`, resulting in a 24-day lease instead of the required 1-day lease.

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 /24
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 1 0 0
ip dhcp pool VLAN20
 network 192.168.20.0 /24
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 1 0 0

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 24
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 24

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 24
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 24

Question 16

You are connected to R1 via console. R1 connects two networks: GigabitEthernet0/0 (10.0.0.1/30) to the ISP, and GigabitEthernet0/1 (172.16.1.1/24) to an internal network. The internal hosts (172.16.1.0/24) need to communicate with a server at 10.0.0.2 (ISP side) using a static NAT mapping. Configure static NAT so that internal host 172.16.1.100 is mapped to public IP 10.0.0.3 (which is not assigned to any interface; assume ISP routes 10.0.0.3 to R1). Also configure a static route to reach 10.0.0.3 via the ISP router (next-hop 10.0.0.2).

Accepted Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2. Static NAT provides a one-to-one mapping between a private and public IP. The inside/outside interface designations are critical for NAT to function. The static route ensures that return traffic to 10.0.0.3 is routed via the ISP.

Answer

ip nat inside source static 10.0.0.3 172.16.1.100
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat outside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Question 17

You are connected to R1 via console. R1's GigabitEthernet0/0 (203.0.113.1/30) connects to the internet, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal LAN hosts need to access the internet using PAT (overload) with the public IP 203.0.113.1 assigned to GigabitEthernet0/0. An internal web server at 192.168.1.100 must be accessible from the internet via static NAT to 203.0.113.5. Your task is to configure NAT/PAT on R1.

Accepted Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside. The access list selects the internal LAN traffic. The NAT pool uses the single public IP for overload. The static NAT translates the internal web server's HTTP traffic to a second public IP. The interface commands mark inside and outside for NAT processing.

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat inside source list NAT_ACL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

Question 18

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to a WAN link to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN with hosts needing Internet access. The ISP has allocated public IP pool 203.0.113.16/28 (203.0.113.17-203.0.113.30). The internal LAN should use NAT overload (PAT) to translate all internal traffic to the public IP 203.0.113.18. The router currently has no NAT configuration. Configure NAT overload on R1 to allow internal hosts to access the Internet.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool ISP_POOL overload
ip nat pool ISP_POOL 203.0.113.18 203.0.113.18 netmask 255.255.255.240
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside. The requirement is to translate all internal traffic to the specific public IP 203.0.113.18, not the physical interface's address. Option C achieves this with a NAT pool containing that IP and the overload keyword, enabling PAT. Option A translates to the interface's IP (10.0.0.1), contradicting the requirement. Option B references the wrong interface in the translation command and lacks overload, while Option D omits the overload keyword entirely, providing only one-to-one NAT.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Question 19

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The security policy requires that only SSH traffic (TCP port 22) from the internal network (192.168.1.0/24) be permitted to reach the router itself, and all other inbound traffic to the router from internal hosts should be blocked. Additionally, the router must be hardened for SSH access: generate RSA keys of 2048 bits, set SSH version 2, enable SSH on vty lines, and disable Telnet. Currently, there is no security configuration. Configure R1 to meet these requirements.

Accepted Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2. The extended ACL VTY_ACL permits SSH from the internal subnet and denies all other IP traffic. The access-class command applies it inbound to VTY lines. SSH hardening includes generating 2048-bit RSA keys, setting SSH version 2, and disabling Telnet by specifying transport input ssh. A local username is required for SSH authentication. Note that a domain name (e.g., ip domain-name example.com) must be configured before generating RSA keys; without it, the crypto key generation fails or requires interactive input.

Answer

ip access-list standard VTY_ACL
 permit 192.168.1.0 0.0.0.255
 deny any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp any any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL out
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Question 20

You are connected to SW1, a Cisco switch that is experiencing intermittent connectivity issues. The network administrator suspects a duplex mismatch between SW1 and the connected router R1. Use CDP to verify the status and check interface statistics.

Accepted Answer

The switch port is set to half duplex, and the router is set to full duplex, causing CRC errors and late collisions.. The switch port is manually set to half duplex while the router likely negotiates to full duplex, causing a mismatch. CDP output from the switch will show the router's duplex as full. Interface statistics will show increasing CRC errors and late collisions. The solution is to set the switch port to auto-negotiation or match the duplex setting with the router.

Answer

The switch port is set to full duplex, and the router is set to half duplex, causing runts and FCS errors.

Answer

The switch port and router are both set to half duplex, but the cable is faulty, causing CRC errors.

Answer

The switch port is set to auto-negotiation, and the router is set to half duplex, causing late collisions.