CCNA Network Services and Security Practice Test 14 — 15 Questions

Question 1

A network engineer needs to allow SSH management access to a router from a single host, 172.16.5.25, while denying all other management traffic to the router's VTY lines. The engineer plans to use an ACL applied to the VTY lines. Which ACL type and application point is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An extended ACL applied inbound on the VTY lines using the access-class command. Restricting management access to a router requires an ACL that can match the source host and the SSH protocol, and it must be applied to the VTY lines with access-class. An extended ACL permits TCP port 22 from 172.16.5.25 and denies other sources, giving precise control over who can open SSH sessions to the device.

Answer

An extended ACL applied outbound on the router's LAN interface

Answer

A named standard ACL applied with the ip access-group command on Gi0/0

Answer

A standard numbered ACL applied inbound on the VTY lines

Question 2

A network administrator is configuring a Cisco IOS router as a DHCP server for the 192.168.10.0/24 subnet. The router interface GigabitEthernet0/0 has the address 192.168.10.1/24. The administrator enters the following commands:

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp pool LAN_POOL
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
dns-server 8.8.8.8

Hosts on the subnet are not receiving IP addresses, and the router does not show any DHCP bindings. Which command is missing from the configuration?

Accepted Answer

service dhcp. For the router to act as a DHCP server, the global service dhcp command must be enabled. Although the DHCP pool is properly configured with network, default-router, and dns-server parameters, the DHCP service itself is inactive by default on some IOS versions. Enabling the service allows the router to listen for DHCPDISCOVER messages and allocate addresses from the pool, resolving the issue of hosts not receiving addresses.

Answer

ip dhcp excluded-address 192.168.10.11 192.168.10.254

Answer

ip helper-address 192.168.10.1

Answer

ip dhcp relay information option

Question 3

A network administrator is configuring a Cisco Catalyst switch port for a conference room wall jack where visitors plug in laptops. The port must learn the first MAC address it sees and permanently associate that address with the port, dropping all frames from any other source MAC address. The administrator enters the interface configuration mode for GigabitEthernet0/12. Which command sequence accomplishes this requirement?

Accepted Answer

switchport port-security mac-address sticky. Sticky MAC learning dynamically captures the first source address seen on a port-security-enabled interface and writes it into the running configuration as a secure entry. Combined with the default maximum of one, the port then forwards only frames from that learned address. The other commands either set limits, change the violation action, or hardcode a single address, none of which provide the automatic first-learned binding the scenario requires.

Answer

switchport port-security violation shutdown

Answer

switchport port-security maximum 1

Answer

switchport port-security mac-address 0011.2233.4455

Question 4

A company has a Cisco IOS router performing NAT overload (PAT) for its internal network. The inside network is 192.168.1.0/24, and the router's outside interface is GigabitEthernet0/0 with IP address 203.0.113.5. An internal host 192.168.1.10 initiates a connection to an external web server at 198.51.100.20 on TCP port 80. Which translation entry will the router create in its NAT table?

Accepted Answer

Inside local 192.168.1.10:1024 to inside global 203.0.113.5:5001. NAT overload, or PAT, translates both IP addresses and port numbers. The inside local address is the private IP and port of the internal host, and the inside global is the public IP and translated port. The router creates a unique mapping for each flow. The translated port is usually a high-numbered port chosen by the router, not necessarily the same as the original source port. This allows many internal hosts to share a single public IP address.

Answer

Outside local 198.51.100.20:80 to outside global 203.0.113.5:80

Answer

Inside local 192.168.1.10:80 to inside global 203.0.113.5:80

Answer

Inside local 192.168.1.10:1024 to inside global 203.0.113.5:1024

Question 5

A network team is deploying DHCP snooping on access switches to prevent rogue DHCP servers from handing out addresses to clients. Which two statements correctly describe how DHCP snooping behaves in this deployment? (Choose two.)

Accepted Answer

DHCP snooping builds a binding table that maps client MAC addresses, IP addresses, leases, VLANs, and ports.. DHCP snooping drops server-originated DHCP messages on untrusted ports and records client bindings in a database, so the uplink and server-facing ports must be trusted while access ports remain untrusted by default. The binding table it builds later supports Dynamic ARP Inspection and IP Source Guard, making snooping a foundational Layer 2 security feature.

Answer

DHCP snooping inspects only client-to-server DHCP messages and ignores server-to-client replies.

Answer

By default, every switch port is trusted so that existing DHCP traffic is not disrupted during rollout.

Answer

DHCP snooping must be enabled globally and on each VLAN where client devices reside.

Question 6

A network engineer is troubleshooting a Cisco switch that is not forwarding traffic from a PC connected to Fa0/10. The PC has a valid IP address and can ping the default gateway. The switch port is configured with port security, and the output of show port-security interface Fa0/10 shows Violation Mode: Shutdown, Status: Secure-shutdown. Which action will restore connectivity while keeping port security enabled?

Accepted Answer

Enter shutdown then no shutdown on the interface.. A port in secure-shutdown state due to a port security violation is placed in err-disabled mode. The standard recovery is to administratively shut down and then re-enable the interface with shutdown followed by no shutdown. This clears the violation and restores the port while leaving the port security configuration intact. Removing port security or configuring errdisable recovery does not provide the immediate, security-preserving fix.

Answer

Enter no switchport port-security on the interface.

Answer

Enter errdisable recovery cause psecure-violation in global configuration mode.

Answer

Enter clear port-security violation on the interface.

Question 7

An engineer is troubleshooting a site-to-site IPsec VPN between two Cisco routers. Phase 1 negotiations are failing, and the engineer suspects a mismatch in the ISAKMP policy parameters. Which two parameters must match on both peers for the ISAKMP phase 1 policy to succeed? (Choose two.)

Accepted Answer

Hash algorithm, such as SHA-256. ISAKMP phase 1 policies are compared attribute by attribute, and both peers must share at least one matching combination of encryption, hash, authentication, Diffie-Hellman group, and lifetime. The encryption and hash algorithms are core transform attributes that must be identical for a common policy to be selected. Transform set names, crypto ACL sequence numbers, and the pre-shared key are either local labels or separate authentication credentials rather than negotiated phase 1 policy parameters.

Answer

Crypto ACL sequence numbers

Answer

Transform set name string

Answer

Pre-shared key value

Question 8

A network engineer is configuring a Cisco switch port for port security. The port is connected to a single user's workstation. The engineer wants to ensure that if a different MAC address is seen on the port, the port will be shut down and an SNMP trap will be sent. Which command set achieves this requirement?

Accepted Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown. Port security with a maximum of 1 MAC address and violation mode shutdown will disable the port if a second MAC address is detected. The shutdown mode also generates an SNMP trap and syslog message. The restrict mode only drops packets and sends notifications but keeps the port up, while protect mode drops silently. Therefore, the shutdown mode is required to meet both conditions.

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation protect

Answer

switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown

Answer

switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict

Question 9

A security administrator is reviewing a Cisco IOS zone-based firewall configuration on an edge router. The design requires that traffic initiated from the untrusted zone toward the trusted zone be blocked, while return traffic for sessions initiated from the trusted zone be permitted. A zone pair has been created with the trusted zone as source and the untrusted zone as destination. Which action should be applied to that zone pair to meet the requirement?

Accepted Answer

Apply an inspect policy to the zone pair. Zone-based firewall policy uses inspect to create stateful sessions for traffic moving between zones. When inspect is applied to the trusted-to-untrusted pair, outbound sessions are tracked and their return packets are permitted automatically. Because no policy permits sessions originating in the untrusted zone, inbound-initiated traffic is dropped, satisfying the design. Pass, drop, and deny actions either lack state tracking or block the required outbound traffic.

Answer

Apply a pass policy to the zone pair

Answer

Apply a drop policy to the zone pair

Answer

Apply a deny policy to the zone pair

Question 10

A network engineer is configuring a site-to-site IPsec VPN between two Cisco routers. The engineer wants to ensure that only traffic from the 10.1.1.0/24 subnet to the 10.2.2.0/24 subnet is encrypted, while all other traffic is sent unencrypted. The engineer creates an extended ACL named VPN_TRAFFIC and applies it as a crypto map match address. However, after applying the configuration, all traffic between the sites is being dropped, including traffic that should be encrypted. Which action should the engineer take to resolve the issue?

Accepted Answer

Change the ACL to permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 and ensure the crypto map is applied to the correct interface.. The ACL referenced by a crypto map must permit the exact traffic that should be encrypted. If the ACL is incorrect or the crypto map is not applied to the correct interface, traffic may be dropped or not encrypted. Verifying the ACL permits the source and destination subnets and that the crypto map is applied to the outgoing interface ensures only the intended traffic is encrypted. Other traffic should not match the ACL and will be sent unencrypted, as required.

Answer

Remove the ACL from the crypto map and rely on the default encryption behavior.

Answer

Add a permit ip any any statement at the end of the ACL.

Answer

Apply the ACL as an inbound filter on the inside interface to classify traffic before encryption.

Question 11

A network technician is configuring port security on a Cisco switch interface FastEthernet0/1. The technician wants to allow only the first learned MAC address and have the interface shut down if a different MAC address is seen. The technician enters the following commands:

interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown

After connecting a PC, the interface goes into the error-disabled state. Which action will restore the interface while maintaining port security?

Accepted Answer

Enter the shutdown command followed by the no shutdown command on the interface.. When a port security violation occurs in shutdown mode, the interface is placed into the error-disabled state. The only way to recover is to manually shut down the interface and then bring it back up using the shutdown and no shutdown commands. This action clears the error condition and allows the interface to learn the MAC address again, while port security remains configured and active.

Answer

Remove port security and reapply the configuration.

Answer

Change the violation mode to restrict.

Answer

Enter the clear port-security violation command on the interface.

Question 12

A network engineer is configuring a Cisco IOS router to support NAT overload (PAT) for a small office. The inside network is 192.168.1.0/24, and the outside interface is GigabitEthernet0/1 with IP address 203.0.113.5. The engineer enters the following commands:

ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
interface GigabitEthernet0/1
 ip address 203.0.113.5 255.255.255.0
 ip nat outside

After applying the configuration, hosts on the inside network cannot access the Internet. Which command is missing to allow return traffic?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.1. NAT overload translates inside local addresses to the outside interface address, but the router still needs a route to reach external networks. A default route pointing to the next-hop router ensures that translated packets are forwarded correctly. Without this route, the router drops packets destined for the Internet, and return traffic never reaches inside hosts. The access list and NAT configuration are correct; the missing piece is the default route.

Answer

access-list 1 permit any

Answer

ip nat inside source static 192.168.1.1 203.0.113.5

Answer

ip nat pool PUBLIC 203.0.113.5 203.0.113.5 netmask 255.255.255.0

Question 13

A router interface applies this ACL inbound:

10 deny tcp any any eq 80
20 permit ip any any

A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?

Accepted Answer

The ACL blocks HTTP but allows ICMP. ACLs are processed top down. Line 10 denies TCP destination port 80, which blocks HTTP. Line 20 then permits all remaining IP traffic, including ICMP echo packets used by ping.

Answer

The ACL blocks all traffic because the first entry is a deny

Answer

The ACL permits HTTP because line 20 overrides line 10

Answer

The ACL blocks ping because ICMP is not explicitly permitted

Question 14

A switch has DHCP snooping enabled, but users still experience IP-to-MAC spoofing attacks. Which additional feature should be considered to help address that specific problem?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets against trusted binding information learned through DHCP snooping, directly preventing IP-to-MAC spoofing. PortFast is used to speed up STP convergence and does not provide ARP security. EtherChannel aggregates multiple links for bandwidth and redundancy but does not inspect ARP traffic. NetFlow is a traffic accounting and monitoring tool, not a security control for ARP spoofing. Therefore, DAI is the correct additional feature to address IP-to-MAC spoofing.

Answer

PortFast

Answer

EtherChannel

Answer

NetFlow

Question 15

What is a key difference between SNMPv3 and earlier SNMP versions?

Accepted Answer

SNMPv3 adds authentication and encryption features. SNMPv3 improves security by adding authentication, message integrity, and privacy features. Earlier versions, especially SNMPv1 and v2c, rely on community strings and provide much weaker protection.

Answer

SNMPv3 supports IPv4 only

Answer

SNMPv3 cannot be used for monitoring interface counters

Answer

SNMPv3 replaces syslog completely