CCNA Network Services and Security Practice Test 11 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router and describe the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create a pool of global addresses, then enable PAT with overload.. For PAT configuration on a Cisco IOS-XE router, the correct order is: first enter global configuration mode (configure terminal), then define inside and outside interfaces (ip nat inside / ip nat outside under interface configuration), then create the global address pool (ip nat pool), and finally enable PAT with overload (ip nat inside source list ... pool ... overload). This sequence matches only option A. Option B is incorrect because creating the pool must be done after entering global configuration mode, not before. Option C is incorrect because marking interfaces must be done from global configuration mode, and enabling PAT requires a pool to exist. Option D is incorrect because enabling PAT without a pool will fail, and marking interfaces must be done before enabling PAT.

Answer

Create a pool of global addresses, mark inside and outside interfaces, enter global configuration mode, then enable PAT with overload.

Answer

Mark inside and outside interfaces, enter global configuration mode, enable PAT with overload, then create a pool of global addresses.

Answer

Enter global configuration mode, enable PAT with overload, create a pool of global addresses, then mark inside and outside interfaces.

Question 2

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router for outbound traffic, including ACL creation, NAT statement, interface marking, and the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create an ACL to match internal traffic, apply NAT with overload using the outside interface.. The only correct sequence for configuring PAT is B: enter global config mode, mark inside and outside interfaces, create an ACL to match internal traffic, then apply NAT with overload using the outside interface. This order aligns with standard Cisco best practices. Options A, C, and D are incorrect because they place marking interfaces after the NAT command or place the ACL after NAT, which may lead to errors or incomplete configuration. Although some devices may accept commands out of order, the proper and most reliable order is B.

Answer

Enter global configuration mode, create an ACL to match internal traffic, apply NAT with overload using the outside interface, mark inside and outside interfaces.

Answer

Enter global configuration mode, apply NAT with overload using the outside interface, create an ACL to match internal traffic, mark inside and outside interfaces.

Answer

Create an ACL to match internal traffic, enter global configuration mode, apply NAT with overload using the outside interface, mark inside and outside interfaces.

Question 3

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router.

Accepted Answer

Enter global configuration mode, define inside and outside interfaces, create a NAT pool with the public IP address range, and enable overload on the pool.. The correct sequence is: enter global configuration mode, designate inside and outside interfaces, create the NAT pool, and then enable overload on the pool. Interfaces must be designated first so that NAT translation can identify which interfaces are inside/outside. The pool must exist before you apply overload to it; otherwise the overload command will refer to an undefined pool. The other options incorrectly place the pool creation or overload instruction before interface designation or in an impossible order.

Answer

Enter global configuration mode, create a NAT pool, define inside and outside interfaces, and enable overload on the pool.

Answer

Enter global configuration mode, define inside and outside interfaces, enable overload on the pool, and create a NAT pool.

Answer

Enter global configuration mode, create a NAT pool, enable overload on the pool, and define inside and outside interfaces.

Question 4

Drag and drop the following steps into the correct order to configure PAT (NAT overload) on a Cisco IOS-XE router so that internal hosts can share a single public IP when accessing the internet. Note: The NAT overload command is applied globally, not on the interface.

Accepted Answer

Enter global configuration mode, configure inside and outside interfaces, create an ACL to match internal traffic, configure NAT overload with the ACL and outside interface.. Both A and C are valid sequences. On Cisco IOS-XE, after entering global configuration mode, you may create the ACL before or after configuring the inside/outside interfaces. There is no mandatory order between ACL creation and interface configuration. Option B is invalid because ACLs cannot be created outside global config. Option D is invalid because interfaces cannot be configured without first entering global config mode.

Answer

Create an ACL to match internal traffic, enter global configuration mode, configure inside and outside interfaces, configure NAT overload with the ACL and outside interface.

Answer

Configure inside and outside interfaces, enter global configuration mode, create an ACL to match internal traffic, configure NAT overload with the ACL and outside interface.

Question 5

Drag and drop the configuration steps into the correct order to configure Port Address Translation (PAT) on a Cisco router.

Accepted Answer

Define interesting traffic using an access list to identify the internal source addresses to be translated.. The correct sequence to configure PAT on a Cisco router is: first define the internal addresses to translate with an access list (A); then mark the inside interface with 'ip nat inside' (B); next mark the outside interface with 'ip nat outside' (C); finally, enable PAT globally with the 'ip nat inside source list ACL_NUMBER interface INTERFACE_NAME overload' command (D). All options A, B, C, and D are correct steps in that order. The overload command is not applied to an interface—it references the outside interface to translate source addresses to that interface’s IP.

Question 6

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, including the use of nslookup and dig for diagnosis.

Accepted Answer

Client sends DNS query to configured recursive resolver (e.g., ISP or public DNS). All four steps are correct and represent the complete DNS resolution process in the correct order. Step A: The client sends a DNS query to its configured recursive resolver. Step B: The recursive server queries the root, TLD, and authoritative servers to resolve the domain name. Step C: The authoritative DNS server returns the A-record to the recursive resolver. Step D: The client uses nslookup or dig to verify the resolved A-record. This sequence ensures proper resolution and diagnosis.

Question 7

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Accepted Answer

1. Exclude addresses from the pool. 2. Configure the DHCP pool for VLAN 10 with network, default-router, and DNS. 3. Enable DHCP relay on the VLAN 20 interface. 4. Verify DHCP operations.. The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Answer

1. Enable DHCP relay on the VLAN 20 interface. 2. Configure the DHCP pool for VLAN 10. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Answer

1. Exclude addresses from the pool. 2. Enable DHCP relay on the VLAN 20 interface. 3. Configure the DHCP pool for VLAN 10. 4. Verify DHCP operations.

Answer

1. Configure the DHCP pool for VLAN 10. 2. Enable DHCP relay on the VLAN 20 interface. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Question 8

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a different subnet.

Accepted Answer

Configure the 'ip helper-address' command on the interface facing the client subnet.. The correct order is: First configure ip helper-address on the client-facing interface (A). Verify the DHCP relay configuration using show commands (B). Enable 'debug ip dhcp relay' (D) before initiating the client DORA process. Then trigger the DORA process on the client by releasing and renewing the IP address (C). This ensures debug captures the DHCP relay packet exchange.

Question 9

Drag and drop the following steps into the correct order to configure a DHCP server on a Cisco IOS-XE router and enable DHCP relay on a remote subnet, following Cisco's recommended configuration sequence.

Accepted Answer

1. Create DHCP pool with network and default-router. 2. Exclude addresses. 3. Enable DHCP relay on the remote interface.. All four sequences are correct because the Cisco IOS-XE DHCP server and relay configuration commands can be applied in any order. The router will accept the commands regardless of the sequence. However, to ensure the DHCP server is fully configured before the relay starts forwarding requests, the recommended practice is to configure the DHCP pool and excluded addresses before enabling relay. Nevertheless, all options listed are functionally valid.

Question 10

Which TWO statements correctly describe the operation of the ip helper-address command in a DHCP relay agent configuration?

Accepted Answer

It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.. Option A is correct because the ip helper-address command on a router interface enables the relay agent to receive the client's broadcast DHCPDISCOVER and unicast it to the specified DHCP server IP address on a different subnet, allowing DHCP to work across broadcast domains. Option D is correct because when relaying, the router sets the giaddr field in the DHCP packet to the IP address of the interface that received the request, which the DHCP server uses to select the correct address pool and scope. Option B is wrong because ip helper-address is configured on the client-facing interface of the relay agent, not on the DHCP server interface. Option C is wrong because the command does not forward all UDP broadcasts by default; it relays specific UDP services (DHCP/BOOTP on ports 67/68, plus TFTP, DNS, NetBIOS, etc.) unless additional ports are explicitly configured. Option E is wrong because ip helper-address does not validate source MAC addresses or provide DHCP snooping; DHCP snooping is a separate Layer 2 security feature.

Answer

It is configured on the DHCP server interface to allow replies to reach clients on remote subnets.

Answer

It automatically forwards all UDP broadcasts by default.

Answer

It prevents DHCP spoofing by validating the source MAC address of DHCP packets.

Question 11

You are connected to R1. Configure AAA with RADIUS authentication on R1 so that SSH login attempts first contact the RADIUS server at 192.0.2.10 (key 'cisco123'), and if the server is unreachable, fall back to the local database. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on a connected switch remains in the 'unauthorized' state despite RADIUS being functional; identify and fix the misconfiguration on the switch (SW1).

Accepted Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.. For R1, the 'aaa authentication login default group radius local' command ensures SSH login attempts first contact the RADIUS server at 192.0.2.10 and fall back to the local database if the server is unreachable. Option C omits the 'local' keyword, so it is incorrect. For SW1, the correct 802.1X AAA method is 'aaa authentication dot1x default group radius', not 'aaa authentication login' (which is for device access). Option B uses the wrong AAA list type. Option D is missing the 'dot1x pae authenticator' command under the interface, which explicitly sets the port as an 802.1X authenticator; without it, the port may remain unauthorized. Option A contains all required commands for both R1 and SW1.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto'.

Question 12

You are connected to R1. Configure AAA with RADIUS authentication so that SSH users are authenticated first against the RADIUS server (198.51.100.10) and fall back to the local user database if the server is unreachable. Additionally, troubleshoot why an 802.1X-enabled interface (GigabitEthernet0/1) remains in the unauthorized state. The RADIUS server shares a key of 'cisco123' and uses UDP port 1812. The local user 'admin' with secret 'adminpass' must be available as a fallback.

Accepted Answer

The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.. The RADIUS server is unreachable (not reachable), but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. When the server cannot be reached (e.g., timeout), no fallback exists, so the port stays unauthorized. The fix is to modify the dot1x authentication list to include 'local' as a fallback method. Adding local fallback allows the switch to authenticate the supplicant using the local database when the RADIUS server is unreachable.

Answer

The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.

Answer

The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.

Answer

The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.

Question 13

You are connected to R1. Configure AAA with RADIUS authentication for all login methods. The RADIUS server is at 203.0.113.10 with key 'CiscoKey123'. Then troubleshoot why the 802.1X port on interface GigabitEthernet0/1 remains in unauthorized state. The port is configured for dot1x port-control auto, but authentication fails. Ensure that the AAA authentication default method uses RADIUS first, then local fallback, and that the RADIUS server is correctly reachable and configured for authentication.

Accepted Answer

Configure RADIUS server with IP 203.0.113.10 and key 'CiscoKey123', then configure 'aaa authentication login default group radius local' and 'aaa authentication dot1x default group radius local'.. To fix the 802.1X port, configure AAA with a RADIUS server and create method lists for both login and dot1x. The command 'aaa authentication login default group radius local' applies to login methods, while 'aaa authentication dot1x default group radius local' is required for 802.1X authentication. Option A includes both method lists, so RADIUS is used first with local fallback, and the port can authenticate.

Answer

Change the interface port-control to 'force-authorized' to bypass authentication and bring the port up.

Answer

Configure AAA authentication login default local radius to use local authentication first, then RADIUS.

Answer

Add the command 'aaa new-model' and configure the RADIUS server with IP 203.0.113.10 and key 'CiscoKey123'.

Question 14

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2/30 (key 'cisco123') so that console and VTY login use RADIUS first, then local authentication. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on R1 is stuck in the unauthorized state. The RADIUS server is reachable but authentication fails. Verify using 'show aaa servers' and 'show dot1x interface GigabitEthernet0/1 details'.

Accepted Answer

Configure 'aaa authentication login default group radius local' and enable 802.1X globally with 'dot1x system-auth-control'.. The AAA login method must use the keyword 'radius' (lowercase) to reference the default RADIUS server group; uppercase 'RADIUS' would refer to a named server group that has not been configured. The fully correct login AAA command is 'aaa authentication login default group radius local'. For the 802.1X port stuck in unauthorized state, the missing global command 'dot1x system-auth-control' prevents the switch from processing 802.1X authentication, leaving the port unauthorized even though the RADIUS server is reachable. Option C provides the correct AAA syntax and enables 802.1X globally. Option A uses invalid uppercase 'RADIUS', option B checks an already-reachable server's IP address instead of the actual 802.1X control issue, and option D removes RADIUS entirely.

Answer

Configure 'aaa authentication login default group RADIUS local' and correct the RADIUS server key to match the actual server key.

Answer

Configure 'aaa authentication login default group radius local' and verify the RADIUS server IP address is correct.

Answer

Configure 'aaa authentication login default local' and remove the RADIUS server configuration.

Question 15

You are connected to R1, a router acting as a network access server for 802.1X authentication on interface GigabitEthernet0/1. Configure AAA with a RADIUS server at 192.0.2.10 (key 'cisco123') so that the default login authentication uses RADIUS first, then local fallback. Additionally, troubleshoot why a connected supplicant on G0/1 remains in the unauthorized state even though RADIUS is reachable and the supplicant credentials are correct.

Accepted Answer

Enable AAA with 'aaa new-model', configure RADIUS server 'RADIUS_SERVER' with key 'cisco123', and apply 'aaa authentication login default group radius local'.. The problem is that AAA is not enabled, so the router cannot use the RADIUS server for any authentication, including the 802.1X authentication required for the supplicant. By enabling AAA with 'aaa new-model', configuring the RADIUS server with 'radius server RADIUS_SERVER' and its key, and applying 'aaa authentication login default group radius local', the router is now configured to use RADIUS as the primary authentication method. In this scenario, the router uses the login authentication list to authenticate 802.1X supplicants; therefore, this configuration allows the supplicant to be authenticated via the RADIUS server, resolving the unauthorized state.

Answer

Configure 'aaa authentication login default local' and add the RADIUS server with 'radius-server host 192.0.2.10 key cisco123'.

Answer

Enable AAA with 'aaa new-model' and configure 'aaa authentication login default group radius' without local fallback.

Answer

Configure 'aaa new-model', then apply 'dot1x system-auth-control' and 'aaa authentication dot1x default group radius'.