CCNA Network Services and Security Practice Test 11 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router for outbound traffic, including ACL creation, NAT statement, interface marking, and the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create an ACL to match internal traffic, apply NAT with overload using the outside interface.. The only correct sequence for configuring PAT is B: enter global config mode, mark inside and outside interfaces, create an ACL to match internal traffic, then apply NAT with overload using the outside interface. This order aligns with standard Cisco best practices. Options A, C, and D are incorrect because they place marking interfaces after the NAT command or place the ACL after NAT, which may lead to errors or incomplete configuration. Although some devices may accept commands out of order, the proper and most reliable order is B.

Answer

Enter global configuration mode, create an ACL to match internal traffic, apply NAT with overload using the outside interface, mark inside and outside interfaces.

Answer

Enter global configuration mode, apply NAT with overload using the outside interface, create an ACL to match internal traffic, mark inside and outside interfaces.

Answer

Create an ACL to match internal traffic, enter global configuration mode, apply NAT with overload using the outside interface, mark inside and outside interfaces.

Question 2

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router.

Accepted Answer

Enter global configuration mode, define inside and outside interfaces, create a NAT pool with the public IP address range, and enable overload on the pool.. The correct sequence is: enter global configuration mode, designate inside and outside interfaces, create the NAT pool, and then enable overload on the pool. Interfaces must be designated first so that NAT translation can identify which interfaces are inside/outside. The pool must exist before you apply overload to it; otherwise the overload command will refer to an undefined pool. The other options incorrectly place the pool creation or overload instruction before interface designation or in an impossible order.

Answer

Enter global configuration mode, create a NAT pool, define inside and outside interfaces, and enable overload on the pool.

Answer

Enter global configuration mode, define inside and outside interfaces, enable overload on the pool, and create a NAT pool.

Answer

Enter global configuration mode, create a NAT pool, enable overload on the pool, and define inside and outside interfaces.

Question 3

Drag and drop the following steps into the correct order to configure PAT (NAT overload) on a Cisco IOS-XE router so that internal hosts can share a single public IP when accessing the internet. Note: The NAT overload command is applied globally, not on the interface.

Accepted Answer

Enter global configuration mode, configure inside and outside interfaces, create an ACL to match internal traffic, configure NAT overload with the ACL and outside interface. [CORRECT]. Both A and C are valid sequences. On Cisco IOS-XE, after entering global configuration mode, you may create the ACL before or after configuring the inside/outside interfaces. There is no mandatory order between ACL creation and interface configuration. Option B is invalid because ACLs cannot be created outside global config. Option D is invalid because interfaces cannot be configured without first entering global config mode.

Answer

Create an ACL to match internal traffic, enter global configuration mode, configure inside and outside interfaces, configure NAT overload with the ACL and outside interface.

Answer

Configure inside and outside interfaces, enter global configuration mode, create an ACL to match internal traffic, configure NAT overload with the ACL and outside interface.

Question 4

Drag and drop the configuration steps into the correct order to configure Port Address Translation (PAT) on a Cisco router.

Accepted Answer

Define interesting traffic using an access list to identify the internal source addresses to be translated.. The correct sequence to configure PAT on a Cisco router is: first define the internal addresses to translate with an access list (A); then mark the inside interface with 'ip nat inside' (B); next mark the outside interface with 'ip nat outside' (C); finally, enable PAT globally with the 'ip nat inside source list ACL_NUMBER interface INTERFACE_NAME overload' command (D). All options A, B, C, and D are correct steps in that order. The overload command is not applied to an interface—it references the outside interface to translate source addresses to that interface’s IP.

Question 5

Drag and drop the following steps into the correct order to configure PAT (overload) on a Cisco router using a single public IP address on the outside interface.

Accepted Answer

Enter global configuration mode. The correct order of the given steps is A, B, C, D. First, enter global configuration mode. Second, create an access list to match the traffic to be translated. Third, configure the inside interface with `ip nat inside`. Fourth, configure the outside interface with `ip nat outside`. However, note that the essential step of applying PAT with `ip nat inside source list interface overload` is missing from the drag options. Without this command, PAT is not enabled. In a complete configuration, the PAT command would follow step D.

Question 6

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, including the use of nslookup and dig for diagnosis.

Accepted Answer

Client sends DNS query to configured recursive resolver (e.g., ISP or public DNS). All four steps are correct and represent the complete DNS resolution process in the correct order. Step A: The client sends a DNS query to its configured recursive resolver. Step B: The recursive server queries the root, TLD, and authoritative servers to resolve the domain name. Step C: The authoritative DNS server returns the A-record to the recursive resolver. Step D: The client uses nslookup or dig to verify the resolved A-record. This sequence ensures proper resolution and diagnosis.

Question 7

Drag and drop the following steps into the correct order to trace the DNS resolution process from a client query to receiving an A-record response.

Accepted Answer

Client sends DNS query to recursive resolver. The DNS resolution process begins with the client sending a query to a recursive resolver. The resolver then queries a root name server to find the TLD server, followed by querying the TLD server to obtain the authoritative name server, and finally queries the authoritative server for the A-record. Each step depends on the previous because higher-level servers delegate to lower levels.

Question 8

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a different subnet.

Accepted Answer

Configure the 'ip helper-address' command on the interface facing the client subnet.. The correct order is: First configure ip helper-address on the client-facing interface (A). Verify the DHCP relay configuration using show commands (B). Enable 'debug ip dhcp relay' (D) before initiating the client DORA process. Then trigger the DORA process on the client by releasing and renewing the IP address (C). This ensures debug captures the DHCP relay packet exchange.

Question 9

Drag and drop the following steps into the correct order to configure a DHCP server on a Cisco IOS-XE router and enable DHCP relay on a remote subnet, following Cisco's recommended configuration sequence.

Accepted Answer

1. Create DHCP pool with network and default-router. 2. Exclude addresses. 3. Enable DHCP relay on the remote interface.. All four sequences are correct because the Cisco IOS-XE DHCP server and relay configuration commands can be applied in any order. The router will accept the commands regardless of the sequence. However, to ensure the DHCP server is fully configured before the relay starts forwarding requests, the recommended practice is to configure the DHCP pool and excluded addresses before enabling relay. Nevertheless, all options listed are functionally valid.

Question 10

You are connected to R1. Configure AAA with RADIUS authentication on R1 so that SSH login attempts first contact the RADIUS server at 192.0.2.10 (key 'cisco123'), and if the server is unreachable, fall back to the local database. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on a connected switch remains in the 'unauthorized' state despite RADIUS being functional; identify and fix the misconfiguration on the switch (SW1).

Accepted Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.. For R1, the 'aaa authentication login default group radius local' command ensures SSH login attempts first contact the RADIUS server at 192.0.2.10 and fall back to the local database if the server is unreachable. Option C omits the 'local' keyword, so it is incorrect. For SW1, the correct 802.1X AAA method is 'aaa authentication dot1x default group radius', not 'aaa authentication login' (which is for device access). Option B uses the wrong AAA list type. Option D is missing the 'dot1x pae authenticator' command under the interface, which explicitly sets the port as an 802.1X authenticator; without it, the port may remain unauthorized. Option A contains all required commands for both R1 and SW1.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto'.

Question 11

You are connected to R1. Configure AAA with RADIUS authentication for all login methods. The RADIUS server is at 203.0.113.10 with key 'CiscoKey123'. Then troubleshoot why the 802.1X port on interface GigabitEthernet0/1 remains in unauthorized state. The port is configured for dot1x port-control auto, but authentication fails. Ensure that the AAA authentication default method uses RADIUS first, then local fallback, and that the RADIUS server is correctly reachable and configured for authentication.

Accepted Answer

Configure RADIUS server with IP 203.0.113.10 and key 'CiscoKey123', then configure 'aaa authentication login default group radius local' and 'aaa authentication dot1x default group radius local'.. To fix the 802.1X port, configure AAA with a RADIUS server and create method lists for both login and dot1x. The command 'aaa authentication login default group radius local' applies to login methods, while 'aaa authentication dot1x default group radius local' is required for 802.1X authentication. Option A includes both method lists, so RADIUS is used first with local fallback, and the port can authenticate.

Answer

Change the interface port-control to 'force-authorized' to bypass authentication and bring the port up.

Answer

Configure AAA authentication login default local radius to use local authentication first, then RADIUS.

Answer

Add the command 'aaa new-model' and configure the RADIUS server with IP 203.0.113.10 and key 'CiscoKey123'.

Question 12

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2/30 (key 'cisco123') so that console and VTY login use RADIUS first, then local authentication. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on R1 is stuck in the unauthorized state. The RADIUS server is reachable but authentication fails. Verify using 'show aaa servers' and 'show dot1x interface GigabitEthernet0/1 details'.

Accepted Answer

Configure 'aaa authentication login default group radius local' and enable 802.1X globally with 'dot1x system-auth-control'.. The AAA login method must use the keyword 'radius' (lowercase) to reference the default RADIUS server group; uppercase 'RADIUS' would refer to a named server group that has not been configured. The fully correct login AAA command is 'aaa authentication login default group radius local'. For the 802.1X port stuck in unauthorized state, the missing global command 'dot1x system-auth-control' prevents the switch from processing 802.1X authentication, leaving the port unauthorized even though the RADIUS server is reachable. Option C provides the correct AAA syntax and enables 802.1X globally. Option A uses invalid uppercase 'RADIUS', option B checks an already-reachable server's IP address instead of the actual 802.1X control issue, and option D removes RADIUS entirely.

Answer

Configure 'aaa authentication login default group RADIUS local' and correct the RADIUS server key to match the actual server key.

Answer

Configure 'aaa authentication login default group radius local' and verify the RADIUS server IP address is correct.

Answer

Configure 'aaa authentication login default local' and remove the RADIUS server configuration.

Question 13

You are connected to R1, a router acting as a network access server for 802.1X authentication on interface GigabitEthernet0/1. Configure AAA with a RADIUS server at 192.0.2.10 (key 'cisco123') so that the default login authentication uses RADIUS first, then local fallback. Additionally, troubleshoot why a connected supplicant on G0/1 remains in the unauthorized state even though RADIUS is reachable and the supplicant credentials are correct.

Accepted Answer

Enable AAA with 'aaa new-model', configure RADIUS server 'RADIUS_SERVER' with key 'cisco123', and apply 'aaa authentication login default group radius local'.. The problem is that AAA is not enabled, so the router cannot use the RADIUS server for any authentication, including the 802.1X authentication required for the supplicant. By enabling AAA with 'aaa new-model', configuring the RADIUS server with 'radius server RADIUS_SERVER' and its key, and applying 'aaa authentication login default group radius local', the router is now configured to use RADIUS as the primary authentication method. In this scenario, the router uses the login authentication list to authenticate 802.1X supplicants; therefore, this configuration allows the supplicant to be authenticated via the RADIUS server, resolving the unauthorized state.

Answer

Configure 'aaa authentication login default local' and add the RADIUS server with 'radius-server host 192.0.2.10 key cisco123'.

Answer

Enable AAA with 'aaa new-model' and configure 'aaa authentication login default group radius' without local fallback.

Answer

Configure 'aaa new-model', then apply 'dot1x system-auth-control' and 'aaa authentication dot1x default group radius'.

Question 14

You are connected to R1. Configure AAA with RADIUS server at 192.0.2.10 (key = Cisco123) so that console login uses local authentication as fallback. Then troubleshoot why a host connected to R1's GigabitEthernet0/1 (802.1X enabled) remains in unauthorized state. The RADIUS server is reachable. Fix the issue so the port authorizes successfully.

Accepted Answer

The RADIUS server is not defined in a AAA group; create 'aaa group server radius RAD_GROUP' and 'server name RADIUS_SERVER', then update the login default to reference the group.. The initial configuration already has the RADIUS server properly defined with 'radius-server host' and key. The 'aaa authentication login default group radius local' command correctly references the default group 'radius'. However, for 802.1X authentication, a separate AAA method list for dot1x is required. The command 'aaa authentication dot1x default group radius' is missing. Without this, the RADIUS server will not be consulted for 802.1X, leaving the port unauthorized. None of the options address this missing configuration. Option A incorrectly claims a group must be created; in Cisco IOS, the 'radius-server host' command automatically creates the default group 'radius'. Option B is false because the key is correct. Option C is false because the port already has 'authentication port-control auto' and 'dot1x pae authenticator' which enable 802.1X. Option D is false because the server is reachable.

Answer

The RADIUS server key is incorrect; change the key to match the server's configuration.

Answer

The 802.1X port is not enabled; enable 'dot1x port-control auto' on GigabitEthernet0/1.

Answer

The RADIUS server is not reachable; check IP connectivity and firewall rules.

Question 15

You are connected to R1. The network consists of three routers: R1, R2, and R3. R1's G0/0 connects to R2 (10.0.0.0/30), and R1's G0/1 connects to R3 (10.0.1.0/30). A server at 203.0.113.100 on R2's LAN must be reachable from R3's LAN (203.0.113.0/24) via ICMP, but all other traffic from R3 to R2 must be blocked. The current ACL on R1 is too permissive, allowing all traffic. Configure and apply an extended ACL to permit only ICMP echo requests from R3 to the server, with the implicit deny blocking everything else.

Accepted Answer

Remove ACL 10 from G0/0, delete ACL 10, then configure extended ACL 100 with 'permit icmp 203.0.113.0 0.0.0.255 host 203.0.113.100 echo' and apply it inbound on G0/1.. The current ACL 10 on G0/0 is too permissive for outgoing traffic toward R2, so it must be removed (no ip access-group 10 out) and deleted. Since standard ACLs cannot filter ICMP type, an extended ACL (100) is required. Configure 'permit icmp 203.0.113.0 0.0.0.255 host 203.0.113.100 echo' and apply it inbound on G0/1, which is the interface facing R3. The implicit deny blocks all other traffic from R3 to R2.

Answer

Remove ACL 10 from G0/0, delete ACL 10, then configure standard ACL 10 with 'permit 203.0.113.0 0.0.0.255' and apply it inbound on G0/1.

Answer

Remove ACL 10 from G0/0, delete ACL 10, then configure extended ACL 100 with 'permit icmp host 203.0.113.100 203.0.113.0 0.0.0.255 echo' and apply it inbound on G0/0.

Answer

Keep the existing ACL 10 applied inbound on G0/0, but add an extended ACL 100 with 'permit icmp 203.0.113.0 0.0.0.255 host 203.0.113.100 echo' applied inbound on G0/1.