CCNA Network Services and Security Practice Test 26 — 15 Questions

Question 1

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The interfaces are marked with inside and outside in the wrong places. NAT overload works only when the inside and outside interfaces are identified correctly. Here the roles are reversed, so translations are not built in the right direction.

Answer

The ACL should deny 192.168.20.0/24 instead of permit it

Answer

PAT cannot be used with a /30 WAN link

Answer

NAT overload requires a route-map instead of an ACL

Question 2

A client receives an IP address but cannot reach remote networks. Which DHCP option is most likely missing or incorrect?

Accepted Answer

Default gateway option. The client can obtain an IP address but cannot reach remote networks, which indicates that the DHCP server is not providing the default gateway (option 3). Without a default gateway, the client has no route to destinations outside its local subnet, so traffic to remote networks is dropped. The DHCP server must be configured to supply the router's IP address as the default gateway for clients to forward inter-network traffic.

Answer

DNS server option

Answer

Lease time option

Answer

TFTP server option

Question 3

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

Accepted Answer

The ACL should match the source port 80 on returning traffic, not the destination port 80. An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.

Answer

HTTP traffic can never be filtered with a standard ACL

Answer

The ACL must be applied outbound on the inside interface only

Answer

NAT automatically bypasses interface ACLs

Question 4

Match each network service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. Each network service has a distinct primary function: DNS translates names to IPs, DHCP automates IP assignment, NTP synchronizes time, SNMP manages devices, FTP transfers files, and HTTP serves web content.

Answer

DNS: Assigns IP addresses dynamically to devices on a network

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Manages and monitors network devices

Question 5

Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?

Accepted Answer

The NAT statement is missing the overload keyword. Without overload, dynamic NAT uses one public address per internal session mapping. PAT with overload is what lets many inside hosts share a single outside interface address at the same time.

Answer

The access list should deny the inside subnet

Answer

The inside and outside interface roles are reversed in the exhibit

Answer

NAT cannot be used with RFC1918 addresses

Question 6

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

Accepted Answer

ip helper-address 10.99.99.10. DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Answer

ip default-gateway 10.20.20.1

Answer

switchport trunk allowed vlan 20

Answer

spanning-tree portfast default

Question 7

On a router performing NAT, where should ip nat inside be applied?

Accepted Answer

On the interface facing the internal private network. The inside designation belongs on the interface facing the private internal network. The outside designation belongs on the interface facing the public or external network.

Answer

On the interface facing the ISP only

Answer

On every routed interface on the router

Answer

Only on loopback interfaces

Question 8

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Accepted Answer

The NTP server is unsynchronized or unreachable. NTP requires IP reachability to the time source. If the NTP server is unreachable due to routing or ACL issues, the switch falls back to its local clock, causing drift. Option A is correct. Option B is wrong because Syslog has no effect on NTP synchronization. Option C is incorrect because NTP does not require a trunk port; it can operate over any VLAN with IP connectivity. Option D is false because DNS is only needed if the NTP server is specified by hostname; the server can be reached by IP address without DNS.

Answer

The device must run Syslog before NTP can sync

Answer

NTP requires a trunk port on the management VLAN

Answer

The clock can sync only if DNS is configured

Question 9

Exhibit: An engineer wants a device to send only warning messages and more critical events to a syslog server. Which logging level should be configured?

Accepted Answer

logging trap warnings. Syslog severity levels include lower numbers for more severe events. Warning is level 4, so setting logging trap warnings sends level 4, 3, 2, 1, and 0 messages.

Answer

logging trap debugging

Answer

logging trap notifications

Answer

logging trap informational

Question 10

Exhibit: A user can ping 8.8.8.8 successfully but cannot browse to www.example.com by name. Which service is the most likely failing component?

Accepted Answer

DNS. If connectivity to an IP address works but name-based access fails, the path is up and the problem is usually name resolution. DNS is the service that translates hostnames into IP addresses.

Answer

NTP

Answer

Syslog

Answer

CDP

Question 11

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

Accepted Answer

PAT overload. When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.

Answer

Static NAT

Answer

Policy-based routing

Answer

Port security

Question 12

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Accepted Answer

logging host 10.10.10.50. One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Answer

ip helper-address 10.10.10.50

Answer

snmp-server host 10.10.10.60

Answer

service timestamps log localtime

Question 13

A DHCP client on VLAN 30 is not receiving an IP address from a DHCP server (10.99.99.20) on another subnet. The SVI for VLAN 30 is configured with an IP address and is up, but the DHCP relay command is missing. Which command should be added to the SVI configuration?

Accepted Answer

ip helper-address 10.99.99.20. DHCP Discover messages are broadcasts and do not cross routers by default. On an SVI or routed interface facing the clients, an ip helper-address relays those broadcasts to the DHCP server on another subnet.

Answer

ip directed-broadcast

Answer

service dhcp-server 10.99.99.20

Answer

default-router 10.99.99.20

Question 14

A branch router should automatically learn the IP address of a time source so logs from all devices show matching timestamps. Which service provides that function?

Accepted Answer

NTP. NTP synchronizes clocks across network devices. When timestamps line up, syslog messages and troubleshooting output become much more useful.

Answer

DNS

Answer

TFTP

Answer

NetFlow

Question 15

A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?

Accepted Answer

permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443. To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.

Answer

permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443

Answer

deny tcp any 10.1.50.0 0.0.0.255 eq 23

Answer

permit ip any any