CCNA Network Services and Security Practice Test 12 — 15 Questions

Question 1

You are connected to R1. The network uses OSPF between R1 and R2. Configure an extended ACL on R1 so that hosts in VLAN 10 (192.168.10.0/24) can reach the web server at 203.0.113.100 only via HTTP/HTTPS, and hosts in VLAN 20 (192.168.20.0/24) can reach it via any TCP service except HTTP/HTTPS. All other traffic to the server must be denied. Apply the ACL outbound on the interface facing the server. Currently, the ACL is missing the permit for VLAN 20 traffic, causing connectivity loss.

Accepted Answer

Remove the two deny statements and add: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 79, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 81 442, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 444 65535, then deny ip any any. The ACL BLOCK_HTTP should be applied outbound on G0/0, which is the interface facing the server. The first two deny statements incorrectly block HTTP/HTTPS from any source, including VLAN 20 which should be allowed. The correct approach is to permit HTTP/HTTPS only for VLAN 10, and permit all other TCP services (except HTTP/HTTPS) for VLAN 20, then deny all other traffic. The solution removes the overly broad deny statements and adds specific permits for VLAN 20 to reach the server on any TCP port except 80 and 443, followed by an explicit deny ip any any to enforce the implicit deny. After configuring the ACL, it must be applied outbound on G0/0 with the command `ip access-group BLOCK_HTTP out`.

Answer

Add a permit statement for VLAN 20 before the deny statements: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 65535

Answer

Remove the two deny statements and add: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq www, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq 443

Answer

Add a deny statement for VLAN 20 HTTP/HTTPS before the existing permit statements: deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq www, deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq 443, then add a permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 65535

Question 2

You are connected to R1. The network has a web server at 203.0.113.10 and a DNS server at 203.0.113.20. Hosts in the 192.168.1.0/24 subnet should be able to access HTTP to the web server and DNS queries to the DNS server, but all other traffic from that subnet to the servers must be blocked. Configure an extended ACL on R1 to achieve this, and apply it inbound on the correct interface. The current configuration is shown below.

Accepted Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip 192.168.1.0 0.0.0.255 203.0.113.0 0.0.0.255
interface GigabitEthernet0/0
ip access-group 100 in. The ACL permits HTTP from 192.168.1.0/24 to the web server (203.0.113.10) and DNS to the DNS server (203.0.113.20). It then explicitly denies all other IP traffic from the 192.168.1.0/24 subnet to the 203.0.113.0/24 server subnet. The implicit deny any any at the end blocks any other traffic. The ACL is applied inbound on GigabitEthernet0/0, which faces the 192.168.1.0/24 subnet, so traffic from those hosts is filtered as it enters R1.

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip any any
interface GigabitEthernet0/1
ip access-group 100 in

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip 192.168.1.0 0.0.0.255 203.0.113.0 0.0.0.255
interface GigabitEthernet0/0
ip access-group 100 out

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
access-list 100 permit udp 192.168.1.0 0.0.0.255 host 203.0.113.20 eq 53
access-list 100 deny ip 192.168.1.0 0.0.0.255 203.0.113.0 0.0.0.255
interface GigabitEthernet0/1
ip access-group 100 in

Question 3

You are connected to R1. Configure an extended ACL on R1 to permit HTTP traffic from the 192.168.1.0/24 network to the 10.0.0.0/30 network, and deny all other IP traffic. Apply the ACL inbound on the interface facing the 192.168.1.0/24 network. The current configuration has an ACL that is too permissive; you must explicitly remove the existing ACL before applying the new one. Correct the configuration.

Accepted Answer

ip access-list extended HTTP_ONLY
 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.3 eq 80
 interface gigabitEthernet0/0
 no ip access-group PERMIT_ALL in
 ip access-group HTTP_ONLY in. Both A and B correctly create the ACL with the required HTTP permit, remove the old ACL, and apply the new one inbound. The implicit deny at the end already denies all other IP traffic, so an explicit deny statement (as in B) is redundant but not incorrect. Therefore, both A and B satisfy the requirements.

Answer

ip access-list extended HTTP_ONLY
 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.3 eq 80
 interface gigabitEthernet0/0
 ip access-group HTTP_ONLY in

Answer

ip access-list extended HTTP_ONLY
 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.3 eq 80
 permit ip any any
 interface gigabitEthernet0/0
 no ip access-group PERMIT_ALL in
 ip access-group HTTP_ONLY in

Question 4

You are connected to R1. The inside network 192.168.10.0/24 must be able to reach the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.2/30. Additionally, the internal server at 192.168.10.100 must be statically mapped to public IP 203.0.113.10. The current configuration is incomplete and contains errors. Fix the NAT configuration on R1 so that both requirements are met.

Accepted Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside. All options contain a critical error: they use 'ip access-list standard 100', which is invalid because standard ACL numbers must be 1-99 or 1300-1999. Number 100 is reserved for extended ACLs. Additionally, option B's ACL only matches the server host, not the entire subnet; option C lacks the 'overload' keyword; option D configures the outside interface as 'ip nat inside'. Therefore, no option provides a fully correct configuration.

Answer

ip access-list standard 100 permit host 192.168.10.100
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside

Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside

Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat inside

Question 5

You are connected to R1 in a small office network. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the public IP 203.0.113.1 (the IP assigned to interface G0/0). Also configure a static NAT for the internal web server at 192.168.1.10 to the public IP 203.0.113.6. The current configuration has errors: the inside/outside interface assignments are swapped, the ACL for PAT does not match the inside subnet, and the PAT rule points to the wrong ACL. Fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6. The main issues: (1) Interfaces were swapped — G0/0 (public) was inside and G0/1 (private) was outside. They should be reversed: G0/0 outside, G0/1 inside. (2) ACL 1, which should be used for PAT, permitted 192.168.2.0/24 instead of the inside subnet 192.168.1.0/24. This ACL must be corrected to permit 192.168.1.0 0.0.0.255. (3) The PAT command currently references ACL 2, which is the wrong ACL. After correcting ACL 1, the PAT command must reference list 1 and the correct outside interface G0/0. The static NAT is correctly configured but depends on correct inside/outside interface assignments. After these fixes, PAT translates inside hosts to 203.0.113.1 (the G0/0 interface IP) and the static NAT translates 192.168.1.10 to 203.0.113.6.

Answer

Configure G0/0 as inside, G0/1 as outside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/1 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.2.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 2 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Question 6

You are connected to R1, a Cisco IOS-XE router. The network uses a DNS server at 203.0.113.10 for name resolution. Users report that 'ping server.example.com' fails, but 'ping 203.0.113.50' succeeds. Assume proper routing is configured between R1 and the DNS server. Diagnose and resolve the DNS resolution issue so that the hostname resolves correctly, and verify the fix using appropriate Cisco IOS commands (e.g., ping, show hosts, debug domain).

Accepted Answer

Configure R1 to use a different DNS server, such as 198.51.100.10, that has the correct A record for server.example.com.. The issue is that the DNS server at 203.0.113.10 does not have a valid A record for server.example.com, returning NXDOMAIN. Since ping to the IP address works, connectivity is fine. To resolve, configure R1 to use a different DNS server (e.g., 198.51.100.10) that has the correct A record. After configuration, verify with 'show hosts' to see the resolved hostname entry and 'ping server.example.com' to confirm successful resolution. The options involving DNS cache clearing or enabling domain lookup are irrelevant because the problem lies with the DNS server itself, not with caching or disabled DNS lookup.

Answer

Add the command 'ip domain lookup' under global configuration to enable DNS resolution on R1.

Answer

Clear the DNS cache on R1 using 'clear host *' to remove any stale entries.

Answer

Configure the router to use the IP address 203.0.113.50 as the DNS server instead of 203.0.113.10.

Question 7

You are connected to R1, a multilayer switch acting as a DNS client for internal name resolution. The network uses a private DNS server at 192.168.1.100. Users report that resolving the hostname 'server01.courseiva.local' fails intermittently. Diagnose and fix the DNS resolution issue by examining the current configuration and using appropriate show commands to verify.

Accepted Answer

Re-enter the 'ip name-server 192.168.1.100' command and verify with 'show hosts' or 'show run | include ip name-server'.. The 'ip name-server 192.168.1.100' command is needed to direct DNS queries to the specific DNS server. Without it, the switch uses broadcast DNS queries, which can be intermittent. After configuration, verify with 'show hosts' (or 'show run | include ip name-server') to confirm the DNS server is configured. A 'ping server01.courseiva.local' will then trigger DNS resolution and confirm success if the server is reachable.

Answer

Configure 'ip domain lookup' to enable DNS resolution on the switch.

Answer

Change the 'ip domain name' to 'courseiva.local' to match the hostname being resolved.

Answer

Use 'debug ip dns' to monitor DNS queries and identify the problem.

Question 8

You are connected to R1. Configure R1 as a DHCP server for the 192.168.100.0/24 subnet, reserving the first 10 addresses and the address 192.168.100.254 for static assignments, with default gateway 192.168.100.1 and DNS server 8.8.8.8. Then, on the same router, enable DHCP relay for the 10.1.1.0/24 subnet by configuring the helper address pointing to the DHCP server at 192.168.100.1. Finally, verify that the DHCP pool is correctly configured and that the helper address is set.

Accepted Answer

Both the default-router and the ip helper-address are correctly configured as 192.168.100.1.. The configuration described in the stem is correct: the default-router is set to 192.168.100.1, and the ip helper-address is configured to point to the DHCP server at 192.168.100.1. The excluded addresses (first 10 and .254) do not affect the gateway or helper address. Therefore both are correctly configured.

Answer

The default-router is incorrectly set to 192.168.100.254 instead of 192.168.100.1, and the ip helper-address on G0/1 points to 192.168.100.254 instead of 192.168.100.1.

Answer

The default-router is correctly set to 192.168.100.1, but the ip helper-address on G0/1 points to 192.168.100.254 instead of 192.168.100.1.

Answer

The default-router is incorrectly set to 192.168.100.254 instead of 192.168.100.1, but the ip helper-address on G0/1 correctly points to 192.168.100.1.

Question 9

You are connected to R1 (a router acting as DHCP server) via the console. Configure R1 to provide DHCP addresses for VLAN 10 (192.168.10.0/24) on the switch SW1, which is connected via R1's G0/0. Exclude the first 10 addresses (192.168.10.1-10) and the last address (192.168.10.254). Set the default gateway to 192.168.10.1 and DNS server to 203.0.113.10. On SW1, enable DHCP snooping globally and for VLAN 10, configure G0/1 as trusted toward R1, and ensure the ip helper-address on the switch's VLAN 10 SVI points to R1's G0/0 IP. The current config has a wrong helper-address and an oversized excluded range; identify and fix all issues.

Accepted Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10 and ip dhcp excluded-address 192.168.10.254; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 10.0.0.1.. The existing configuration contains 'ip dhcp excluded-address 192.168.10.1 192.168.10.254', which excludes the entire subnet. Cisco IOS appends new exclusions, so adding .1-.10 and .254 does not remove the old broad exclusion. The correct fix must first run 'no ip dhcp excluded-address 192.168.10.1 192.168.10.254', then add 'ip dhcp excluded-address 192.168.10.1 192.168.10.10' and 'ip dhcp excluded-address 192.168.10.254'. The rest of option A is correct: the DHCP pool, default-router, dns-server, global DHCP snooping, VLAN 10 snooping, trust on G0/1, and helper-address 10.0.0.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 192.168.10.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface Vlan10: ip helper-address 10.0.0.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.254; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 10.0.0.1.

Question 10

You are connected to R1 via console. R1's GigabitEthernet0/0 (203.0.113.1/30) connects to the internet, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal LAN hosts need to access the internet using PAT (overload) with the public IP 203.0.113.1 assigned to GigabitEthernet0/0. An internal web server at 192.168.1.100 must be accessible from the internet via static NAT to 203.0.113.5. Your task is to configure NAT/PAT on R1.

Accepted Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside. Ly defines a NAT pool with the exact public IP 203.0.113.1 and enables overload for PAT. The static NAT rule maps the internal web server to 203.0.113.5. Interfaces are correctly labeled inside/outside. Option B uses the interface overload method, which also translates to 203.0.113.1, but the requirement specifies a public IP that should be explicitly defined in a pool. Using a pool ensures the IP is reserved for NAT and is the standard approach when a specific IP is given. Therefore, option A is correct and option B is incorrect.

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat inside source list NAT_ACL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

Question 11

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to a WAN link to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN with hosts needing Internet access. The ISP has allocated public IP pool 203.0.113.16/28 (203.0.113.17-203.0.113.30). The internal LAN should use NAT overload (PAT) to translate all internal traffic to the public IP 203.0.113.18. The router currently has no NAT configuration. Configure NAT overload on R1 to allow internal hosts to access the Internet.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool ISP_POOL overload
ip nat pool ISP_POOL 203.0.113.18 203.0.113.18 netmask 255.255.255.240
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside. The requirement is to translate all internal traffic to the specific public IP 203.0.113.18, not the physical interface's address. Option C achieves this with a NAT pool containing that IP and the overload keyword, enabling PAT. Option A translates to the interface's IP (10.0.0.1), contradicting the requirement. Option B references the wrong interface in the translation command and lacks overload, while Option D omits the overload keyword entirely, providing only one-to-one NAT.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Question 12

Which three of the following are characteristics of IP Source Guard on a Cisco switch? (Choose three.)

Accepted Answer

It can be configured with a static IP source binding for hosts with fixed addresses.. IP Source Guard (IPSG) filters IP traffic on a per-port basis by validating the source IP address of incoming packets against the DHCP snooping binding database or a manually configured static IP source binding. This prevents IP spoofing attacks by dropping any packet whose source IP does not match a legitimate binding for that port. It is typically enabled on untrusted access ports where DHCP snooping is also active, ensuring that only assigned IP addresses are allowed.

Answer

It inspects the destination IP address of all incoming packets.

Answer

It dynamically updates the MAC address table for each detected host.

Answer

It replaces the routing table to enforce security policies.

Question 13

Which three of the following are considered best practices for securing device access in a Cisco network? (Choose three.)

Accepted Answer

Use SSH instead of Telnet for remote management.. SSH encrypts all traffic, including authentication credentials, protecting against eavesdropping and man-in-the-middle attacks, whereas Telnet sends everything in plaintext. Role-based access control (RBAC) via privilege levels or AAA limits users to only the commands necessary for their job, reducing the risk of accidental or malicious misconfiguration. A login banner provides legal notice that unauthorized access is prohibited, which is essential for prosecution and deters casual intruders.

Answer

Use the same simple password for all devices to simplify administration.

Answer

Allow SNMPv1 read-write community strings for ease of management.

Answer

Disable password encryption using the 'service password-encryption' command.

Question 14

Which four of the following are characteristics or configuration requirements of NTP client/server operation in a secure enterprise network? (Choose all that apply. There are four correct answers.)

Accepted Answer

NTP stratum levels indicate the distance from the reference clock; a lower stratum number is more accurate.. NTP clients can synchronize with multiple servers to provide redundancy and improve accuracy through algorithms like Marzullo's algorithm. NTP uses UDP port 123 for all communication, as specified in RFC 5905. NTP authentication (using symmetric keys or MD5 hashes) ensures that time updates originate from a trusted source, preventing spoofing attacks. The stratum level indicates the distance from the primary reference clock; a lower stratum number (e.g., 1) is closer to the authoritative time source and thus more accurate.

Answer

A Cisco device configured as an NTP server will automatically become the stratum 1 server for all clients.

Answer

The NTP server must be in the same subnet as the NTP client to synchronize.

Question 15

Which three options are valid ways to secure administrative access to a Cisco IOS device? (Choose three.)

Accepted Answer

Configure an ACL on the VTY lines to restrict source IP addresses.. All three correct options are valid methods to secure administrative access. Creating a local username/password with the 'username name secret password' command provides authentication for login (e.g., via SSH, console, or VTY). Configuring an ACL on VTY lines restricts which source IP addresses can initiate administrative sessions, adding a layer of network-based access control. Using 'enable secret' protects privileged EXEC mode with a strong hashed password. The three wrong options do not directly secure administrative access: 'shutdown' disables ports (port security, not administrative access), 'service password-encryption' only encrypts passwords in the running configuration (not in transit), and CDP is a neighbor discovery protocol unrelated to authentication.

Answer

Disable all unused ports using the 'shutdown' command.

Answer

Set the 'service password-encryption' command to encrypt all passwords in transit.

Answer

Configure CDP globally to verify neighbor devices before login.

CCNA Network Services and Security Practice Test 12 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 12 — 15 Questions

Exhibit