CCNA Network Services and Security Practice Test 13 — 15 Questions

Question 1

You are connected to R1 via console. R1 is a router that should restrict SSH access to only the management station at 192.168.1.100. Currently, SSH is enabled but any IP can connect. Configure a standard named ACL called 'SSH_ACL' to permit only the management station, and apply it to the VTY lines to filter incoming SSH connections. Ensure the VTY lines use SSH only (no Telnet). The SSH version should be set to 2.

Accepted Answer

R1(config)# ip access-list standard SSH_ACL
R1(config-std-nacl)# permit host 192.168.1.100
R1(config-std-nacl)# deny any
R1(config-std-nacl)# exit
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL in
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2. Option A correctly uses a named standard ACL created via 'ip access-list standard SSH_ACL', permits the single management host with 'permit host 192.168.1.100', and applies it to the VTY lines with the correct syntax 'ip access-class SSH_ACL in' (which filters inbound VTY sessions). It also sets 'transport input ssh' to disable Telnet and 'ip ssh version 2' to enforce SSHv2, satisfying every requirement in the scenario.

Answer

R1(config)# access-list SSH_ACL permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# access-group SSH_ACL in
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2

Answer

R1(config)# ip access-list standard SSH_ACL
R1(config-std-nacl)# permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL out
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2

Answer

R1(config)# access-list SSH_ACL permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL in
R1(config-line)# transport input all
R1(config)# ip ssh version 2

Question 2

You are connected to R1 via console. R1 connects two networks: GigabitEthernet0/0 (10.0.0.1/30) to the ISP, and GigabitEthernet0/1 (172.16.1.1/24) to an internal network. The internal hosts (172.16.1.0/24) need to communicate with a server at 10.0.0.2 (ISP side) using a static NAT mapping. Configure static NAT so that internal host 172.16.1.100 is mapped to public IP 10.0.0.3 (which is not assigned to any interface; assume ISP routes 10.0.0.3 to R1). Also configure a static route to reach 10.0.0.3 via the ISP router (next-hop 10.0.0.2).

Accepted Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2. The correct syntax maps the inside local address first and the inside global address second: ip nat inside source static 172.16.1.100 10.0.0.3. The inside interface (Gi0/1 facing 172.16.1.0/24) must be marked ip nat inside, and the outside interface (Gi0/0 facing the ISP) must be marked ip nat outside. The static route to 10.0.0.3/32 via 10.0.0.2 ensures return traffic for the global address is routed correctly.

Answer

ip nat inside source static 10.0.0.3 172.16.1.100
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat outside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Question 3

You are connected to R1 via the console. R1 is configured as an NTP client that should synchronize with the NTP server at 203.0.113.1. You need to verify that R1 is synchronizing correctly and also ensure that the system clock is updated. Additionally, configure R1 to act as an NTP server for downstream devices on the internal network 192.168.1.0/24.

Accepted Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.. The correct command set is 'show ntp status' to verify synchronization (it shows the stratum and reference clock), 'clock set' to manually update the system clock, and 'ntp master' plus 'ntp broadcast' on the interface facing 192.168.1.0/24 to serve downstream devices. 'ntp master' makes R1 an authoritative NTP source, and 'ntp broadcast' sends time updates to the internal subnet. This combination satisfies both verification and server-role requirements.

Answer

Use 'show ntp associations' to verify synchronization, 'clock update' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp associations' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Question 4

You are connected to R1 via console. R1's GigabitEthernet0/0 (203.0.113.1/30) connects to the internet, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal LAN hosts need to access the internet using PAT (overload) with the public IP 203.0.113.1 assigned to GigabitEthernet0/0. An internal web server at 192.168.1.100 must be accessible from the internet via static NAT to 203.0.113.5. Your task is to configure NAT/PAT on R1.

Accepted Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside. Ly defines a NAT pool with the exact public IP 203.0.113.1 and enables overload for PAT. The static NAT rule maps the internal web server to 203.0.113.5. Interfaces are correctly labeled inside/outside. Option B uses the interface overload method, which also translates to 203.0.113.1, but the requirement specifies a public IP that should be explicitly defined in a pool. Using a pool ensures the IP is reserved for NAT and is the standard approach when a specific IP is given. Therefore, option A is correct and option B is incorrect.

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat inside source list NAT_ACL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

Question 5

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to a WAN link to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN with hosts needing Internet access. The ISP has allocated public IP pool 203.0.113.16/28 (203.0.113.17-203.0.113.30). The internal LAN should use NAT overload (PAT) to translate all internal traffic to the public IP 203.0.113.18. The router currently has no NAT configuration. Configure NAT overload on R1 to allow internal hosts to access the Internet.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool ISP_POOL overload
ip nat pool ISP_POOL 203.0.113.18 203.0.113.18 netmask 255.255.255.240
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside. The requirement is to translate all internal traffic to the specific public IP 203.0.113.18, not the physical interface's address. Option C achieves this with a NAT pool containing that IP and the overload keyword, enabling PAT. Option A translates to the interface's IP (10.0.0.1), contradicting the requirement. Option B references the wrong interface in the translation command and lacks overload, while Option D omits the overload keyword entirely, providing only one-to-one NAT.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Question 6

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The security policy requires that only SSH traffic (TCP port 22) from the internal network (192.168.1.0/24) be permitted to reach the router itself, and all other inbound traffic to the router from internal hosts should be blocked. Additionally, the router must be hardened for SSH access: generate RSA keys of 2048 bits, set SSH version 2, enable SSH on vty lines, and disable Telnet. Currently, there is no security configuration. Configure R1 to meet these requirements.

Accepted Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2. Option A correctly configures an extended ACL that permits TCP port 22 from the internal subnet 192.168.1.0/24 to any destination, then denies all other IP traffic. It applies the ACL inbound on the VTY lines with 'access-class VTY_ACL in', which restricts incoming SSH connections to the router. It also includes the necessary SSH hardening: generating 2048-bit RSA keys, setting SSH version 2, enabling SSH on VTY lines with 'transport input ssh', and using local authentication with a username and secret. This meets all requirements.

Answer

ip access-list standard VTY_ACL
 permit 192.168.1.0 0.0.0.255
 deny any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp any any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL out
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Question 7

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network has an NTP server at 192.168.1.200. R1 must be configured as an NTP client to synchronize its time with the server. Additionally, R1 should serve as an NTP server for internal devices on the LAN with a stratum of 5 to maintain proper hierarchy. The time zone is UTC. No NTP configuration exists. Configure NTP on R1 as specified.

Accepted Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0. The correct configuration requires 'ntp server 192.168.1.200' to make R1 an NTP client of the LAN server, 'ntp master 5' to make R1 an NTP server with stratum 5 for internal devices, and 'clock timezone UTC 0' to set the time zone to UTC with zero offset. Option A matches all three requirements exactly. The 'ntp master 5' command sets the stratum level R1 advertises when acting as a master.

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master
R1(config)# clock timezone UTC 0

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone EST 5

Answer

R1(config)# ntp server 10.0.0.2
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0

Question 8

Which three of the following are characteristics of IP Source Guard on a Cisco switch? (Choose three.)

Accepted Answer

It filters IP traffic based on the source IP address and the DHCP snooping binding.. IP Source Guard (IPSG) filters IP traffic on a per-port basis by validating the source IP address of incoming packets against the DHCP snooping binding database or a manually configured static IP source binding. This prevents IP spoofing attacks by dropping any packet whose source IP does not match a legitimate binding for that port. It is typically enabled on untrusted access ports where DHCP snooping is also active, ensuring that only assigned IP addresses are allowed.

Answer

It inspects the destination IP address of all incoming packets.

Answer

It dynamically updates the MAC address table for each detected host.

Answer

It replaces the routing table to enforce security policies.

Question 9

Which three of the following are considered best practices for securing device access in a Cisco network? (Choose three.)

Accepted Answer

Implement a login banner to display a warning against unauthorized access.. SSH encrypts all traffic, including authentication credentials, protecting against eavesdropping and man-in-the-middle attacks, whereas Telnet sends everything in plaintext. Role-based access control (RBAC) via privilege levels or AAA limits users to only the commands necessary for their job, reducing the risk of accidental or malicious misconfiguration. A login banner provides legal notice that unauthorized access is prohibited, which is essential for prosecution and deters casual intruders.

Answer

Allow SNMPv1 read-write community strings for ease of management.

Answer

Disable password encryption using the 'service password-encryption' command.

Answer

Use the same simple password for all devices to simplify administration.

Question 10

Which four of the following are characteristics or configuration requirements of NTP client/server operation in a secure enterprise network? (Choose all that apply. There are four correct answers.)

Accepted Answer

NTP stratum levels indicate the distance from the reference clock; a lower stratum number is more accurate.. NTP clients can synchronize with multiple servers to provide redundancy and improve accuracy through algorithms like Marzullo's algorithm. NTP uses UDP port 123 for all communication, as specified in RFC 5905. NTP authentication (using symmetric keys or MD5 hashes) ensures that time updates originate from a trusted source, preventing spoofing attacks. The stratum level indicates the distance from the primary reference clock; a lower stratum number (e.g., 1) is closer to the authoritative time source and thus more accurate.

Answer

A Cisco device configured as an NTP server will automatically become the stratum 1 server for all clients.

Answer

The NTP server must be in the same subnet as the NTP client to synchronize.

Question 11

Which three options are valid ways to secure administrative access to a Cisco IOS device? (Choose three.)

Accepted Answer

Create a local username and password with the 'username name secret password' command.. All three correct options are valid methods to secure administrative access. Creating a local username/password with the 'username name secret password' command provides authentication for login (e.g., via SSH, console, or VTY). Configuring an ACL on VTY lines restricts which source IP addresses can initiate administrative sessions, adding a layer of network-based access control. Using 'enable secret' protects privileged EXEC mode with a strong hashed password. The three wrong options do not directly secure administrative access: 'shutdown' disables ports (port security, not administrative access), 'service password-encryption' only encrypts passwords in the running configuration (not in transit), and CDP is a neighbor discovery protocol unrelated to authentication.

Answer

Disable all unused ports using the 'shutdown' command.

Answer

Set the 'service password-encryption' command to encrypt all passwords in transit.

Answer

Configure CDP globally to verify neighbor devices before login.

Question 12

Which three of the following are functions of Network Address Translation (NAT) overload (PAT)? (Choose three.)

Accepted Answer

It uses unique source port numbers to differentiate between internal sessions.. PAT (Port Address Translation), also known as NAT overload, enables multiple internal hosts to share a single public IP address by using unique source port numbers to differentiate sessions. It is configured with the 'ip nat inside source list' command referencing a standard ACL. Option A describes the many-to-one translation, option B describes port multiplexing, and option D describes the correct configuration command. Options C, E, and F are incorrect because PAT does not require a pool of IPs equal to the number of hosts, does not provide inbound-initiated connections without static entries, and does not perform one-to-one mapping.

Answer

It performs a one-to-one mapping between inside local and inside global addresses.

Answer

It provides inbound-initiated connections to internal servers without static entries.

Answer

It requires a pool of public IP addresses equal to the number of internal hosts.

Question 13

Drag and drop the following steps into the correct order to configure dynamic NAT with overload (PAT) using a pool of public IP addresses.

Accepted Answer

Define a NAT pool of public IP addresses using the ip nat pool command.. The correct order for configuring dynamic NAT with overload (PAT) is: first create an extended/standard ACL that identifies the inside local traffic to be translated, then define the NAT pool of public IP addresses, then configure the inside and outside interfaces with 'ip nat inside' and 'ip nat outside', and finally apply the overload rule using 'ip nat inside source list ACL pool POOL overload'. The ACL must be created before the pool because it defines what traffic will match; both are referenced by the translation rule, but the ACL is the logical first step in identifying the traffic.

Question 14

Drag and drop the following steps into the correct order to configure a secure Cisco switch, from enabling secure management access to implementing advanced dynamic ARP inspection.

Accepted Answer

Configure the switch hostname and IP domain name.. 1. Hostname and IP domain name: required to generate RSA keys for SSH in the next step. 2. RSA key generation: SSH cannot function without cryptographic keys. 3. SSH v2 enabled and Telnet disabled: ensures secure remote access before any authentication method is applied. 4. AAA authentication with RADIUS/TACACS+ on vty lines: controls who can access the switch after SSH transport is established. 5. Port security on access ports: protects the data plane by restricting MAC addresses once management plane is secured. 6. DHCP snooping: builds a binding database used to validate traffic; must be active before DAI can work. 7. Dynamic ARP Inspection: relies on the DHCP snooping database to filter ARP packets and prevent man-in-the-middle attacks, so it must be configured last.

Question 15

A network technician applies an extended ACL outbound on the WAN interface Gi0/0 to block traffic from the 10.0.0.0/8 network to internet hosts. After applying the ACL, internal users report they cannot access any web pages because return traffic from internet hosts is being dropped. The technician verifies the ACL entries and finds only statements controlling outbound traffic. What is the most appropriate next action?

Accepted Answer

Add the established keyword to the ACL to permit return traffic for existing sessions.. ACLs are directional. The outbound ACL blocks packets with source 10.0.0.0/8 going out to the internet. Return packets have a source from the internet and a destination in 10.0.0.0/8, so they do not match the outbound ACL. If internal users cannot reach web pages, it is because their outbound HTTP requests are being dropped by the ACL, not because of dropped return traffic. Adding the established keyword to the outbound ACL would only permit outbound packets with the ACK or RST bit set; the initial SYN packets would still be blocked, so web access would still fail.

Answer

Add a new access-list entry permitting all traffic from internet hosts to the 10.0.0.0/8 network.

Answer

Remove the outbound ACL and apply a new inbound ACL on the same interface.

Answer

Replace the ACL with a stateful firewall rule set.