CCNA Network Services and Security Practice Test 12 — 15 Questions

Question 1

You are connected to R1. Configure AAA with RADIUS server at 192.0.2.10 (key = Cisco123) so that console login uses local authentication as fallback. Then troubleshoot why a host connected to R1's GigabitEthernet0/1 (802.1X enabled) remains in unauthorized state. The RADIUS server is reachable. Fix the issue so the port authorizes successfully.

Accepted Answer

The RADIUS server is not defined in a AAA group; create 'aaa group server radius RAD_GROUP' and 'server name RADIUS_SERVER', then update the login default to reference the group.. The initial configuration already has the RADIUS server properly defined with 'radius-server host' and key. The 'aaa authentication login default group radius local' command correctly references the default group 'radius'. However, for 802.1X authentication, a separate AAA method list for dot1x is required. The command 'aaa authentication dot1x default group radius' is missing. Without this, the RADIUS server will not be consulted for 802.1X, leaving the port unauthorized. None of the options address this missing configuration. Option A incorrectly claims a group must be created; in Cisco IOS, the 'radius-server host' command automatically creates the default group 'radius'. Option B is false because the key is correct. Option C is false because the port already has 'authentication port-control auto' and 'dot1x pae authenticator' which enable 802.1X. Option D is false because the server is reachable.

Answer

The RADIUS server key is incorrect; change the key to match the server's configuration.

Answer

The 802.1X port is not enabled; enable 'dot1x port-control auto' on GigabitEthernet0/1.

Answer

The RADIUS server is not reachable; check IP connectivity and firewall rules.

Question 2

You are connected to R1. The network has two routers (R1 and R2) connected via a serial link (S0/0/0). R1's GigabitEthernet0/0 connects to the 192.168.1.0/24 LAN. An extended ACL must be configured on R1 to permit only HTTPS traffic (TCP port 443) from host 192.168.1.10 to server 203.0.113.5 (reachable via R2), and deny all other traffic from the LAN to the server. Currently, the ACL is applied inbound on G0/0 but valid HTTPS traffic is being blocked. Troubleshoot and fix the configuration.

Accepted Answer

The ACL is missing an explicit permit statement for HTTPS traffic from host 192.168.1.10 to server 203.0.113.5, and the current permit ip any any allows all traffic, including HTTP, which violates the requirement to deny HTTP.. The ACL is missing an explicit permit statement for HTTPS traffic from host 192.168.1.10 to server 203.0.113.5, and the current permit ip any any allows all traffic, including HTTP, which violates the requirement to deny HTTP. Without a specific permit for TCP port 443 from the host to the server, the ACL's implicit deny (or the overly permissive permit ip any any) prevents the valid HTTPS traffic from being matched and permitted. The correct fix is to add a permit statement for TCP 443 from 192.168.1.10 to 203.0.113.5 and remove the permit ip any any to enforce the deny-all requirement.

Answer

The ACL is applied inbound on G0/0, but it should be applied outbound on G0/0 to filter traffic leaving the LAN.

Answer

The ACL should be applied to the serial interface S0/0/0 instead of G0/0 to filter traffic going to R2.

Answer

The ACL is missing a deny statement for all other traffic from the LAN to the server, and the permit ip any any allows everything, including unwanted traffic.

Question 3

You are connected to R1. The network consists of three routers: R1, R2, and R3. R1's G0/0 connects to R2 (10.0.0.0/30), and R1's G0/1 connects to R3 (10.0.1.0/30). A server at 203.0.113.100 on R2's LAN must be reachable from R3's LAN (203.0.113.0/24) via ICMP, but all other traffic from R3 to R2 must be blocked. The current ACL on R1 is too permissive, allowing all traffic. Configure and apply an extended ACL to permit only ICMP echo requests from R3 to the server, with the implicit deny blocking everything else.

Accepted Answer

Remove ACL 10 from G0/0, delete ACL 10, then configure extended ACL 100 with 'permit icmp 203.0.113.0 0.0.0.255 host 203.0.113.100 echo' and apply it inbound on G0/1.. The current ACL 10 on G0/0 is too permissive for outgoing traffic toward R2, so it must be removed (no ip access-group 10 out) and deleted. Since standard ACLs cannot filter ICMP type, an extended ACL (100) is required. Configure 'permit icmp 203.0.113.0 0.0.0.255 host 203.0.113.100 echo' and apply it inbound on G0/1, which is the interface facing R3. The implicit deny blocks all other traffic from R3 to R2.

Answer

Remove ACL 10 from G0/0, delete ACL 10, then configure standard ACL 10 with 'permit 203.0.113.0 0.0.0.255' and apply it inbound on G0/1.

Answer

Remove ACL 10 from G0/0, delete ACL 10, then configure extended ACL 100 with 'permit icmp host 203.0.113.100 203.0.113.0 0.0.0.255 echo' and apply it inbound on G0/0.

Answer

Keep the existing ACL 10 applied inbound on G0/0, but add an extended ACL 100 with 'permit icmp 203.0.113.0 0.0.0.255 host 203.0.113.100 echo' applied inbound on G0/1.

Question 4

You are connected to R1. The network uses OSPF between R1 and R2. Configure an extended ACL on R1 so that hosts in VLAN 10 (192.168.10.0/24) can reach the web server at 203.0.113.100 only via HTTP/HTTPS, and hosts in VLAN 20 (192.168.20.0/24) can reach it via any TCP service except HTTP/HTTPS. All other traffic to the server must be denied. Apply the ACL outbound on the interface facing the server. Currently, the ACL is missing the permit for VLAN 20 traffic, causing connectivity loss.

Accepted Answer

Remove the two deny statements and add: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 79, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 81 442, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 444 65535, then deny ip any any. The ACL BLOCK_HTTP should be applied outbound on G0/0, which is the interface facing the server. The first two deny statements incorrectly block HTTP/HTTPS from any source, including VLAN 20 which should be allowed. The correct approach is to permit HTTP/HTTPS only for VLAN 10, and permit all other TCP services (except HTTP/HTTPS) for VLAN 20, then deny all other traffic. The solution removes the overly broad deny statements and adds specific permits for VLAN 20 to reach the server on any TCP port except 80 and 443, followed by an explicit deny ip any any to enforce the implicit deny. After configuring the ACL, it must be applied outbound on G0/0 with the command `ip access-group BLOCK_HTTP out`.

Answer

Add a permit statement for VLAN 20 before the deny statements: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 65535

Answer

Remove the two deny statements and add: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq www, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq 443

Answer

Add a deny statement for VLAN 20 HTTP/HTTPS before the existing permit statements: deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq www, deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq 443, then add a permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 65535

Question 5

You are connected to R1. The network has a web server at 203.0.113.10 and a DNS server at 203.0.113.20. Hosts in the 192.168.1.0/24 subnet should be able to access HTTP to the web server and DNS queries to the DNS server, but all other traffic from that subnet to the servers must be blocked. Configure an extended ACL on R1 to achieve this, and apply it inbound on the correct interface. The current configuration is shown below.

Accepted Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip 192.168.1.0 0.0.0.255 203.0.113.0 0.0.0.255
interface GigabitEthernet0/0
ip access-group 100 in. The ACL permits HTTP from 192.168.1.0/24 to the web server (203.0.113.10) and DNS to the DNS server (203.0.113.20). It then explicitly denies all other IP traffic from the 192.168.1.0/24 subnet to the 203.0.113.0/24 server subnet. The implicit deny any any at the end blocks any other traffic. The ACL is applied inbound on GigabitEthernet0/0, which faces the 192.168.1.0/24 subnet, so traffic from those hosts is filtered as it enters R1.

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip any any
interface GigabitEthernet0/1
ip access-group 100 in

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip 192.168.1.0 0.0.0.255 203.0.113.0 0.0.0.255
interface GigabitEthernet0/0
ip access-group 100 out

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip 192.168.1.0 0.0.0.255 203.0.113.0 0.0.0.255
interface GigabitEthernet0/1
ip access-group 100 in

Question 6

You are connected to R1. Configure an extended ACL on R1 to permit HTTP traffic from the 192.168.1.0/24 network to the 10.0.0.0/30 network, and deny all other IP traffic. Apply the ACL inbound on the interface facing the 192.168.1.0/24 network. The current configuration has an ACL that is too permissive; you must explicitly remove the existing ACL before applying the new one. Correct the configuration.

Accepted Answer

ip access-list extended HTTP_ONLY
 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.3 eq 80
 interface gigabitEthernet0/0
 no ip access-group PERMIT_ALL in
 ip access-group HTTP_ONLY in. Both A and B correctly create the ACL with the required HTTP permit, remove the old ACL, and apply the new one inbound. The implicit deny at the end already denies all other IP traffic, so an explicit deny statement (as in B) is redundant but not incorrect. Therefore, both A and B satisfy the requirements.

Answer

ip access-list extended HTTP_ONLY
 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.3 eq 80
 interface gigabitEthernet0/0
 ip access-group HTTP_ONLY in

Answer

ip access-list extended HTTP_ONLY
 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.3 eq 80
 permit ip any any
 interface gigabitEthernet0/0
 no ip access-group PERMIT_ALL in
 ip access-group HTTP_ONLY in

Question 7

You are connected to R1 in a small office network. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the public IP 203.0.113.1 (the IP assigned to interface G0/0). Also configure a static NAT for the internal web server at 192.168.1.10 to the public IP 203.0.113.6. The current configuration has errors: the inside/outside interface assignments are swapped, the ACL for PAT does not match the inside subnet, and the PAT rule points to the wrong ACL. Fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6. The main issues: (1) Interfaces were swapped — G0/0 (public) was inside and G0/1 (private) was outside. They should be reversed: G0/0 outside, G0/1 inside. (2) ACL 1, which should be used for PAT, permitted 192.168.2.0/24 instead of the inside subnet 192.168.1.0/24. This ACL must be corrected to permit 192.168.1.0 0.0.0.255. (3) The PAT command currently references ACL 2, which is the wrong ACL. After correcting ACL 1, the PAT command must reference list 1 and the correct outside interface G0/0. The static NAT is correctly configured but depends on correct inside/outside interface assignments. After these fixes, PAT translates inside hosts to 203.0.113.1 (the G0/0 interface IP) and the static NAT translates 192.168.1.10 to 203.0.113.6.

Answer

Configure G0/0 as inside, G0/1 as outside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/1 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.2.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 2 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Question 8

You are connected to R1, a Cisco IOS-XE router. The network uses a DNS server at 203.0.113.10 for name resolution. Users report that 'ping server.example.com' fails, but 'ping 203.0.113.50' succeeds. Assume proper routing is configured between R1 and the DNS server. Diagnose and resolve the DNS resolution issue so that the hostname resolves correctly, and verify the fix using appropriate Cisco IOS commands (e.g., ping, show hosts, debug domain).

Accepted Answer

Configure R1 to use a different DNS server, such as 198.51.100.10, that has the correct A record for server.example.com.. The issue is that the DNS server at 203.0.113.10 does not have a valid A record for server.example.com, returning NXDOMAIN. Since ping to the IP address works, connectivity is fine. To resolve, configure R1 to use a different DNS server (e.g., 198.51.100.10) that has the correct A record. After configuration, verify with 'show hosts' to see the resolved hostname entry and 'ping server.example.com' to confirm successful resolution. The options involving DNS cache clearing or enabling domain lookup are irrelevant because the problem lies with the DNS server itself, not with caching or disabled DNS lookup.

Answer

Add the command 'ip domain lookup' under global configuration to enable DNS resolution on R1.

Answer

Clear the DNS cache on R1 using 'clear host *' to remove any stale entries.

Answer

Configure the router to use the IP address 203.0.113.50 as the DNS server instead of 203.0.113.10.

Question 9

You are connected to R1, a multilayer switch acting as a DNS client for internal name resolution. The network uses a private DNS server at 192.168.1.100. Users report that resolving the hostname 'server01.courseiva.local' fails intermittently. Diagnose and fix the DNS resolution issue by examining the current configuration and using appropriate show commands to verify.

Accepted Answer

Re-enter the 'ip name-server 192.168.1.100' command and verify with 'show hosts' or 'show run | include ip name-server'.. The 'ip name-server 192.168.1.100' command is needed to direct DNS queries to the specific DNS server. Without it, the switch uses broadcast DNS queries, which can be intermittent. After configuration, verify with 'show hosts' (or 'show run | include ip name-server') to confirm the DNS server is configured. A 'ping server01.courseiva.local' will then trigger DNS resolution and confirm success if the server is reachable.

Answer

Configure 'ip domain lookup' to enable DNS resolution on the switch.

Answer

Change the 'ip domain name' to 'courseiva.local' to match the hostname being resolved.

Answer

Use 'debug ip dns' to monitor DNS queries and identify the problem.

Question 10

You are connected to R1. Configure R1 as a DHCP server for the 192.168.100.0/24 subnet, reserving the first 10 addresses and the address 192.168.100.254 for static assignments, with default gateway 192.168.100.1 and DNS server 8.8.8.8. Then, on the same router, enable DHCP relay for the 10.1.1.0/24 subnet by configuring the helper address pointing to the DHCP server at 192.168.100.1. Finally, verify that the DHCP pool is correctly configured and that the helper address is set.

Accepted Answer

Both the default-router and the ip helper-address are correctly configured as 192.168.100.1.. The configuration described in the stem is correct: the default-router is set to 192.168.100.1, and the ip helper-address is configured to point to the DHCP server at 192.168.100.1. The excluded addresses (first 10 and .254) do not affect the gateway or helper address. Therefore both are correctly configured.

Answer

The default-router is incorrectly set to 192.168.100.254 instead of 192.168.100.1, and the ip helper-address on G0/1 points to 192.168.100.254 instead of 192.168.100.1.

Answer

The default-router is correctly set to 192.168.100.1, but the ip helper-address on G0/1 points to 192.168.100.254 instead of 192.168.100.1.

Answer

The default-router is incorrectly set to 192.168.100.254 instead of 192.168.100.1, but the ip helper-address on G0/1 correctly points to 192.168.100.1.

Question 11

You are connected to R1 via the console. R1 is the DHCP server for the 192.168.50.0/24 LAN. Configure DHCP on R1 to assign addresses from 192.168.50.10 to 192.168.50.200, with default gateway 192.168.50.1 and DNS server 8.8.8.8. Also, configure R1 to act as a DHCP relay agent for the 10.0.0.0/30 link to reach a remote DHCP server at 203.0.113.10. Then, troubleshoot and fix a misconfiguration that causes clients on VLAN 50 to not receive IP addresses.

Accepted Answer

The DHCP pool is misconfigured: the excluded-address range covers most of the pool (192.168.50.1 through 192.168.50.200), but leaves 192.168.50.201-254 assignable, violating the requirement. The correct configuration should exclude 192.168.50.1-9 (gateway) and 192.168.50.201-254 (upper end). The 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1.. The DHCP pool is misconfigured: the excluded-address range of 192.168.50.1 through 192.168.50.200 covers most of the pool, but leaves addresses 192.168.50.201 to 192.168.50.254 assignable, which violates the requirement to assign addresses only from 192.168.50.10 to 192.168.50.200. To meet the requirement, you must exclude both the lower range (192.168.50.1 to 192.168.50.9, reserving the gateway) and the upper range (192.168.50.201 to 192.168.50.254). Additionally, the 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1 so that broadcasts from the 10.0.0.0/30 subnet are forwarded.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9, but the helper-address on GigabitEthernet0/0 is correct because it forwards DHCP requests to the remote server. The relay agent configuration is missing on GigabitEthernet0/1.

Answer

The DHCP pool is correctly configured with excluded-address 192.168.50.1 192.168.50.9. The issue is that the 'ip helper-address' on GigabitEthernet0/1 is missing; it should be added to forward requests to the remote server. Additionally, the 'ip helper-address' on GigabitEthernet0/0 is correct because it forwards requests from VLAN 50 to the remote server.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9. The 'ip helper-address' on GigabitEthernet0/0 should be removed. The relay agent configuration is correct because 'ip helper-address 203.0.113.10' is already configured on GigabitEthernet0/1.

Question 12

You are connected to R1 (a router acting as DHCP server) via the console. Configure R1 to provide DHCP addresses for VLAN 10 (192.168.10.0/24) on the switch SW1, which is connected via R1's G0/0. Exclude the first 10 addresses (192.168.10.1-10) and the last address (192.168.10.254). Set the default gateway to 192.168.10.1 and DNS server to 203.0.113.10. On SW1, enable DHCP snooping globally and for VLAN 10, configure G0/1 as trusted toward R1, and ensure the ip helper-address on the switch's VLAN 10 SVI points to R1's G0/0 IP. The current config has a wrong helper-address and an oversized excluded range; identify and fix all issues.

Accepted Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10 and ip dhcp excluded-address 192.168.10.254; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 10.0.0.1.. The existing configuration contains 'ip dhcp excluded-address 192.168.10.1 192.168.10.254', which excludes the entire subnet. Cisco IOS appends new exclusions, so adding .1-.10 and .254 does not remove the old broad exclusion. The correct fix must first run 'no ip dhcp excluded-address 192.168.10.1 192.168.10.254', then add 'ip dhcp excluded-address 192.168.10.1 192.168.10.10' and 'ip dhcp excluded-address 192.168.10.254'. The rest of option A is correct: the DHCP pool, default-router, dns-server, global DHCP snooping, VLAN 10 snooping, trust on G0/1, and helper-address 10.0.0.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 192.168.10.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface Vlan10: ip helper-address 10.0.0.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.254; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 10.0.0.1.

Question 13

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP router at 10.0.0.2/30. The internal network has a web server at 192.168.1.10 and a mail server at 192.168.1.20. You need to configure NAT so that internal hosts can access the internet (PAT overload) and external users can reach the web server via public IP 203.0.113.10 and the mail server via public IP 203.0.113.11. The inside interface is GigabitEthernet0/1 (192.168.1.1/24) and the outside interface is GigabitEthernet0/0.

Accepted Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 extendable
ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25 extendable. Option A correctly configures NAT overload for internal hosts and static PAT for the web and mail servers using the 'extendable' keyword. The 'ip nat inside source static tcp' command with 'extendable' allows multiple static translations that can coexist with the overload translation, which is necessary when the same outside interface is used for both PAT and static NAT. The inside and outside interfaces are correctly marked.

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat outside
interface GigabitEthernet0/0
 ip nat inside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80
ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static 192.168.1.10 203.0.113.10
ip nat inside source static 192.168.1.20 203.0.113.11

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat outside source static tcp 203.0.113.10 80 192.168.1.10 80
ip nat outside source static tcp 203.0.113.11 25 192.168.1.20 25

Question 14

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to R2 (10.0.0.2/30). Hosts on the LAN (192.168.1.0/24) need DHCP services. The DHCP server is located at 172.16.1.100 on a different subnet reachable via R2. Configure R1 to forward DHCP broadcasts to the DHCP server.

Accepted Answer

ip helper-address 172.16.1.100. The ip helper-address command on the LAN interface forwards DHCP broadcast requests to the DHCP server at 172.16.1.100, allowing clients to obtain IP addresses across subnets.

Answer

ip dhcp relay information option

Answer

ip forward-protocol udp 67

Answer

ip dhcp-server 172.16.1.100

Question 15

You are connected to R1 via console. R1 has two interfaces: GigabitEthernet0/0 (10.0.0.1/30, connected to ISP) and GigabitEthernet0/1 (192.168.1.1/24, connected to internal LAN). The LAN hosts (192.168.1.0/24) need to access the internet. Configure dynamic NAT with PAT (overload) on R1 using a NAT pool so that internal hosts share the public IP 10.0.0.1 when accessing the internet. Assume the ISP router is already configured and reachable.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 10.0.0.1 10.0.0.1 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC overload
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside. It creates an ACL matching only the internal subnet (192.168.1.0/24), defines a NAT pool containing only the single public IP 10.0.0.1, enables PAT with the 'overload' keyword, and correctly assigns inside/outside interfaces. Option B is wrong because the pool includes 10.0.0.2, which is the ISP's IP and would cause conflicts, plus it lacks the 'overload' keyword so PAT is not activated. Option C is wrong because the ACL uses 'any', potentially matching unintended traffic, and the interface roles are reversed (G0/0 as inside, G0/1 as outside), breaking the NAT translation direction. Option D is incorrect because while it implements PAT correctly, it uses interface overload rather than a NAT pool, which does not meet the explicit requirement to use a pool.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 10.0.0.1 10.0.0.2 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside

Answer

access-list 1 permit any
ip nat pool PUBLIC 10.0.0.1 10.0.0.1 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC overload
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside

CCNA Network Services and Security Practice Test 12 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 12 — 15 Questions

Exhibit