CCNA Network Services and Security Practice Test 10 — 15 Questions

Question 1

A technician reports that users on a guest wireless SSID can reach the internet but can also browse internal file shares, which should be blocked. Which two design actions most directly address that issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place guest clients in a separate VLAN or VRF from internal users. Guest access should be isolated through segmentation and policy enforcement. Separate broadcast domains and ACLs are the practical way to allow internet-only access.

Answer

Increase the AP transmit power

Answer

Disable DHCP on the guest WLAN

Question 2

An engineer configures 802.1X port-based authentication on a Cisco IOS-XE switch for a voice VLAN deployment. After applying the configuration, IP phones on interface GigabitEthernet1/0/1 fail to receive a voice VLAN and remain in an unauthenticated state. The switchport is configured as an access port with voice VLAN 10. What is the most likely cause of the failure?

Accepted Answer

Configure 'authentication host-mode multi-domain' on the interface. In a voice VLAN deployment with 802.1X, the switchport must be configured with 'authentication host-mode multi-domain' to allow both a voice device (IP phone) and a data device (PC behind the phone) to authenticate separately. Without this mode, the port defaults to single-host mode, which prevents the phone from receiving the voice VLAN and keeps it in an unauthenticated state.

Answer

Re-authenticate the phone using 'dot1x reauthenticate interface Gi1/0/1'

Answer

Add 'switchport voice vlan 10' under the interface

Answer

Change the port to 'authentication port-control force-authorized'

Question 3

Drag and drop the AAA and 802.1X terms on the left to the correct descriptions on the right.

Accepted Answer

Authentication: Verifies the identity of the user or device attempting to access the network.. In this matching exercise, the term 'Authentication' correctly pairs with 'Verifies the identity of the user or device'. Option B is incorrect because it describes 'Authorization', which is a different AAA component; the correct description for Authorization is 'Determines what resources the authenticated user is allowed to access', but that description belongs to the term Authorization, not to the term used in the stem. Similarly, Option C describes 'Accounting', and Option D describes 'Supplicant', which are also distinct terms. Therefore, only Option A correctly matches the description for Authentication as per the standard AAA definitions.

Answer

Authorization: Determines what resources the authenticated user or device is allowed to access.

Answer

Accounting: Logs and tracks user activities, such as login times, commands executed, and data transferred.

Answer

Supplicant: The client device that requests network access and provides credentials to the authenticator.

Question 4

A network administrator is troubleshooting connectivity from the 192.168.10.0/24 subnet to the server at 10.10.10.10. Users report that they can reach the server initially, but after a few minutes, connectivity drops and only returns after the interface is cleared. The administrator reviews the router's running configuration and ACL configuration. What is the most likely cause of the intermittent connectivity loss?

Accepted Answer

Remove the 'established' keyword from the ACL to allow initial TCP connections.. The 'established' keyword in a Cisco ACL matches only TCP segments that have the ACK or RST bit set. It does not match the initial TCP SYN segment used to start a new connection. In this scenario, existing TCP sessions that were already established before the ACL was applied can continue to work because their subsequent data segments carry the ACK bit. After a few minutes, when the application opens a new TCP session or the existing session times out and must be re-established, the client sends a SYN without ACK/RST. The ACL denies that new SYN, causing the observed connectivity drop. Clearing the interface briefly resets the connection state and can make it appear that connectivity returns, but the real fix is to remove the 'established' keyword or add an explicit permit for the initial SYN so new TCP connections can be initiated.

Answer

Apply the ACL inbound on the interface instead of outbound.

Answer

Add a permit statement for UDP traffic to allow DNS resolution.

Answer

Change the wildcard mask to 0.0.0.255 to match the subnet more accurately.

Question 5

Drag and drop the ACL commands and concepts on the left to their correct descriptions on the right.

Accepted Answer

Standard ACL. All descriptions are correctly matched. Standard ACLs filter traffic based on source IP address only. Extended ACLs filter based on source/destination IP, protocol, and port numbers. Named ACLs allow identification by name instead of number. Implicit deny is the default rule at the end of every ACL that denies all traffic not explicitly permitted.

Answer

Extended ACL

Answer

Named ACL

Answer

Implicit Deny

Question 6

Drag and drop the DNS record types on the left to their correct descriptions or purposes on the right.

Accepted Answer

A record: Maps a domain name to an IPv4 address. The correct matches are: A record maps a domain name to an IPv4 address; AAAA record maps a domain name to an IPv6 address; CNAME record maps an alias domain name to a canonical domain name; MX record specifies mail servers for a domain.

Question 7

Drag and drop the DNS record types on the left to the correct descriptions on the right.

Accepted Answer

A record: Maps a domain name to an IPv4 address. All four DNS record types are correctly matched. An A record maps a domain to an IPv4 address. An AAAA record maps a domain to an IPv6 address. A CNAME record maps an alias to another canonical domain name. An MX record maps a domain to a mail exchange server. These are standard DNS record types tested in CCNA.

Question 8

A network administrator has configured a Cisco switch as a DHCP server for the 192.168.1.0/24 subnet. Hosts in VLAN 10 are unable to obtain IP addresses via DHCP. The switch's SVI for VLAN 10 is up/up. What is the most likely cause of the problem?

Accepted Answer

The VLAN 10 SVI is not configured with an IP address in the 192.168.1.0/24 subnet.. The most likely cause is that the VLAN 10 SVI does not have an IP address in the 192.168.1.0/24 subnet. Although the SVI is up/up, that only indicates that the VLAN is active and has at least one port in it; it does not mean the SVI is configured with an IP address. For the DHCP server on the switch to service hosts in VLAN 10, the SVI must have an IP address in the same subnet as the DHCP pool. Without that, the switch cannot associate the DHCP requests with the correct pool and will not provide addresses. Option B is incorrect because Cisco IOS DHCP servers automatically exclude the network and broadcast addresses from the pool; you don't need to explicitly exclude them, and they would not be leased to hosts.

Answer

The DHCP server is including the network and broadcast addresses in the pool, causing conflicts. Use the 'ip dhcp excluded-address' command to exclude them.

Answer

DHCP snooping is blocking DHCP messages on the switch port connected to the hosts.

Answer

The DHCP pool is not bound to VLAN 10. Use the 'vlan' command under the pool configuration.

Question 9

A network administrator is troubleshooting a new branch office where hosts in VLAN 20 on switch SW1 cannot obtain IP addresses from the DHCP server located at 192.168.10.5 in the main data center. The router R1 is configured as the default gateway for VLAN 20 with interface GigabitEthernet0/1.20. The administrator verifies that the DHCP server is reachable and has available addresses. What configuration change should the administrator make to resolve the issue?

Accepted Answer

Configure the 'ip helper-address 192.168.10.5' command on the router interface GigabitEthernet0/1.20.. The DHCP server is on a different subnet than the hosts in VLAN 20. By default, DHCP broadcasts are not forwarded across routers. The 'ip helper-address 192.168.10.5' command on the router's subinterface GigabitEthernet0/1.20 converts the broadcast DHCP request into a unicast and forwards it to the DHCP server, allowing the hosts to obtain IP addresses.

Answer

Configure a static IP address on the DHCP server to ensure it is always reachable.

Answer

Enable DHCP snooping globally on the switch SW1.

Answer

Increase the DHCP lease time on the server to 30 days.

Question 10

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

1. Enter global configuration mode. 2. Enable AAA globally. 3. Configure RADIUS server host and key. 4. Define an authentication method list for 802.1X. 5. Enter interface configuration mode. 6. Enable 802.1X port authentication. 7. Apply the authentication method list to the interface. 8. Verify configuration.. The correct order is: 1) Enter global configuration mode, 2) Enable AAA globally (aaa new-model), 3) Configure RADIUS server host and key, 4) Define an authentication method list for 802.1X, 5) Enter interface configuration mode, 6) Enable 802.1X port authentication, 7) Apply the authentication method list to the interface, 8) Verify configuration. AAA must be enabled before creating any authentication method list. The RADIUS server should be configured before the method list references it. Option A places the server before AAA, which is not the recommended Cisco order and is unnecessary. Options C and D are incorrect because they define the method list before enabling AAA (C) or before configuring the RADIUS server (D).

Answer

1. Enter global configuration mode. 2. Configure RADIUS server host and key. 3. Enable AAA globally. 4. Define an authentication method list for 802.1X. 5. Enter interface configuration mode. 6. Enable 802.1X port authentication. 7. Apply the authentication method list to the interface. 8. Verify configuration.

Answer

1. Enter global configuration mode. 2. Configure RADIUS server host and key. 3. Define an authentication method list for 802.1X. 4. Enable AAA globally. 5. Enter interface configuration mode. 6. Enable 802.1X port authentication. 7. Apply the authentication method list to the interface. 8. Verify configuration.

Answer

1. Enter global configuration mode. 2. Enable AAA globally. 3. Define an authentication method list for 802.1X. 4. Configure RADIUS server host and key. 5. Enter interface configuration mode. 6. Enable 802.1X port authentication. 7. Apply the authentication method list to the interface. 8. Verify configuration.

Question 11

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode and enable AAA with the 'aaa new-model' command.. The correct order is: A, B, C, D. First, enter global configuration mode and enable AAA with 'aaa new-model'. Second, define the RADIUS server using the appropriate command. Third, configure AAA authentication for 802.1X to use the RADIUS group. Fourth, enable 802.1X on the interface with 'dot1x port-control auto'. This order ensures that AAA is enabled, the RADIUS server is defined before it is referenced in the authentication configuration, and the authentication method is configured before applying it to the interface.

Question 12

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode, enable AAA globally, configure RADIUS server parameters, define an authentication method list, then enable 802.1X on the interface.. The correct order for AAA with RADIUS and 802.1X on a Cisco IOS-XE switch is: first enter global configuration mode, then enable AAA globally using 'aaa new-model', then configure the RADIUS server parameters, then define the authentication method list for 802.1X, and finally enable 802.1X on the interface. This sequence ensures that AAA is available before defining server and method list, and the method list is defined before applying it to the interface.

Answer

Enter global configuration mode, configure RADIUS server parameters, enable AAA globally, define an authentication method list, then enable 802.1X on the interface.

Answer

Enter global configuration mode, enable AAA globally, define an authentication method list, configure RADIUS server parameters, then enable 802.1X on the interface.

Answer

Enter global configuration mode, enable AAA globally, configure RADIUS server parameters, enable 802.1X on the interface, then define an authentication method list.

Question 13

Drag and drop the AAA terms on the left to their correct definitions on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device before granting access to the network.. D is incorrect because RADIUS is a protocol that supports AAA, not one of the three AAA components (Authentication, Authorization, Accounting). The prompt specifically asks for AAA terms, so the correct matches are only A, B, and C. RADIUS's definition is true for RADIUS, but it does not answer the question.

Answer

RADIUS: A protocol that provides centralized authentication, authorization, and accounting for network access.

Question 14

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that denies Telnet from a specific host to a server subnet, then verify the configuration.

Accepted Answer

Enter global configuration mode, create the extended ACL with the deny statement for Telnet from the specific host to the server subnet, then permit other traffic.. The correct order is: A, B, D, C. First, create the extended ACL with the deny statement for Telnet from the specific host to the server subnet and permit other traffic (A). Then, apply the ACL inbound on the interface closest to the source host (B). Next, verify the ACL configuration using 'show access-lists' and test Telnet access from the host (D). Finally, save the running configuration to startup configuration (C). This sequence ensures that errors are caught before saving, preventing a faulty ACL from being persisted. Verifying after saving (C before D) risks locking in errors, which is not the Cisco recommended workflow.

Question 15

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router for outbound traffic from a private network to the Internet.

Accepted Answer

Enter global configuration mode, define an ACL to match private traffic, specify the outside interface, and apply ip nat inside source list ACL interface outside overload.. The correct order for configuring PAT on a Cisco IOS-XE router is: enter global configuration mode, define an ACL to match private traffic, specify the outside interface with 'ip nat outside', and then apply 'ip nat inside source list ACL interface outside overload'. Only option A follows this exact order. Option B places specifying the outside interface before defining the ACL, which is incorrect because the ACL must exist before it can be referenced. Option C applies the NAT command before specifying the outside interface, but the outside interface must be configured with 'ip nat outside' first. Option D applies the NAT command and defines the ACL after, which is out of order. Therefore, only option A is correct.

Answer

Enter global configuration mode, specify the outside interface, define an ACL to match private traffic, and apply ip nat inside source list ACL interface outside overload.

Answer

Enter global configuration mode, define an ACL to match private traffic, apply ip nat inside source list ACL interface outside overload, and then specify the outside interface.

Answer

Enter global configuration mode, apply ip nat inside source list ACL interface outside overload, define an ACL to match private traffic, and then specify the outside interface.