CCNA Network Services and Security Practice Test 26 — 15 Questions

Question 1

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

Accepted Answer

The router is configured for dynamic NAT without overload (PAT), so it assigns one public IP per inside host and does not allow inbound connections without a static mapping.. Option B is correct because dynamic NAT without overload maps each inside host to a unique public IP from the pool, but it does not allow external hosts to initiate connections because there is no static mapping or port forwarding to direct inbound traffic. The described behavior—internal hosts reaching the Internet while external hosts cannot initiate connections—is typical of dynamic NAT without PAT. With PAT (overload), many internal hosts share a single public IP and inbound connections would still require explicit port forwarding; without overload, the router simply does not know how to translate incoming requests back to the correct inside host.

Answer

The NAT pool is exhausted because it contains only 21 addresses, and more than 21 internal hosts are trying to access the Internet simultaneously.

Answer

The inside local addresses are not in the same subnet as the inside interface, causing asymmetric routing.

Answer

The outside global addresses are not routable on the Internet, so external hosts cannot send return traffic.

Question 2

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Accepted Answer

The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.. When the NAT pool is exhausted, no new translations can be created, so only hosts that already have established translations can continue to communicate, causing intermittent connectivity. A full NAT table means the pool of public IP addresses is completely allocated, preventing new sessions. Implementing PAT allows multiple inside hosts to share a single public IP by multiplexing port numbers, resolving the pool exhaustion.

Answer

The inside local addresses are not properly defined in the access list.

Answer

The outside interface is not configured with the ip nat outside command.

Answer

The inside interface is not configured with the ip nat inside command.

Question 3

Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?

Accepted Answer

PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.. PAT (Port Address Translation) translates multiple internal private IP addresses to a single public IP address by assigning unique source port numbers to each session, allowing many internal hosts to share one public IP. This is correctly described in option A. Option D is also correct because PAT uniquely identifies each translation by both the IP address and the port number, enabling the router to demultiplex return traffic. Option B is wrong because PAT uses many-to-one mapping, not 1:1; a 1:1 mapping is characteristic of static NAT. Option C is incorrect because PAT can operate with a single public IP address (often the outside interface address) rather than requiring a pool. Option E is false because PAT translations are dynamically created and time out after a period of inactivity; they are not static.

Answer

PAT requires a 1:1 mapping of internal to external IP addresses.

Answer

PAT can only be configured with a pool of public IP addresses.

Answer

PAT translations are always static and never time out.

Question 4

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

Accepted Answer

Configure PAT (overload) for internal hosts and static NAT for the web server.. Option B is correct because PAT (Port Address Translation), also known as NAT overload, allows multiple internal hosts to share a single public IP address by mapping each session to a unique port number, satisfying the requirement for internet access. Static NAT is then used to create a one-to-one mapping from the public IP (on a specific port) to the private IP of the internal web server, making it reachable from the internet. This combination meets both outbound connectivity for all hosts and inbound access to the web server without needing additional public IPs.

Answer

Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

Answer

Configure only PAT (overload) for all internal hosts including the web server.

Answer

Configure static NAT for the web server and use only the public IP for internal hosts.

Question 5

A user reports that they cannot access the company's internal web server at 'intranet.company.local' from their workstation. The workstation can ping the web server's IP address 192.168.10.50 successfully, and other internal services like email (mail.company.local) are reachable. Which DNS record issue is most likely causing this problem?

Accepted Answer

Add an A record mapping 'intranet.company.local' to IP address 192.168.10.50. The workstation can ping the web server's IP address (192.168.10.50), confirming network connectivity and that the server is online. However, the user cannot access the server by its hostname 'intranet.company.local', which indicates a DNS resolution failure. Since other internal services like email are reachable, the DNS zone is functioning, but there is no A record that maps the hostname 'intranet' to its IP address. Adding an A record for 'intranet.company.local' pointing to 192.168.10.50 will resolve the issue.

Answer

Add a CNAME record that aliases 'intranet.company.local' to 'webserver.company.local'

Answer

Verify the PTR record for 192.168.10.50 points to 'intranet.company.local'

Answer

Check the NS records for the 'company.local' zone to ensure proper delegation

Question 6

A network administrator is troubleshooting an issue where internal hosts can ping the company's web server by IP address (192.0.2.10) but cannot access it using the fully qualified domain name www.example.com. The DNS server (192.0.2.5) is reachable and responds to queries. The administrator runs nslookup www.example.com from a host and receives the following output:

C:\> nslookup www.example.com
Server:  UnKnown
Address:  192.0.2.5

Name:    www.example.com
Address:  192.0.2.20

Based on the output, what is the most likely cause of the problem?

Accepted Answer

The DNS A record for www.example.com is incorrect; update it to point to 192.0.2.10.. The nslookup output shows that www.example.com resolves to 192.0.2.20, but the web server is at 192.0.2.10. This indicates the DNS A record is incorrect and must be updated to point to the correct IP. Pinging by IP works because it bypasses DNS, confirming network connectivity. The host's DNS cache is not the issue because nslookup queries the server directly and still returns the wrong address. The firewall is not involved since pinging by IP succeeds, and the DNS server is authoritative (the response is received).

Answer

The host's DNS cache is corrupted; flush it using ipconfig /flushdns.

Answer

The web server's firewall is blocking traffic from the host; add an allow rule.

Answer

The DNS server is not authoritative for the example.com zone; delegate the zone to a different server.

Question 7

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

Accepted Answer

AAAA record. The AAAA record (Quad-A record) maps a domain name to an IPv6 address, making it the standard type for forward IPv6 lookups. The PTR record performs the reverse mapping—from an IPv6 address back to a domain name. Administrators routinely check both records with tools like nslookup or dig to ensure forward and reverse DNS consistency, which is critical for services such as email and security logging. The other options (A, CNAME, MX) do not directly provide a domain-to-IPv6 mapping or its reverse verification.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 8

Drag and drop the DNS record types on the left to their correct descriptions or purposes on the right.

Accepted Answer

A record: Maps a domain name to an IPv4 address. These pairings correctly match each DNS record type to its function: A maps hostnames to IPv4, AAAA to IPv6, CNAME creates an alias, MX specifies mail servers, NS identifies authoritative name servers, and PTR enables reverse DNS lookup.

Question 9

Drag and drop the DNS record types on the left to the correct descriptions on the right.

Accepted Answer

A record: Maps a domain name to an IPv4 address. These are standard DNS record types as defined in RFCs and tested in networking certifications like CCNA.

Answer

AAAA record: Maps a domain name to an IPv6 address

Answer

CNAME record: Maps an alias domain name to another canonical domain name

Answer

MX record: Maps a domain name to a mail exchange server

Question 10

A network administrator has configured a Cisco switch as a DHCP server for the 192.168.1.0/24 subnet. Hosts in VLAN 10 are unable to obtain IP addresses via DHCP. The switch's SVI for VLAN 10 is up/up. What is the most likely cause of the problem?

Accepted Answer

The DHCP server is including the network and broadcast addresses in the pool, causing conflicts. Use the 'ip dhcp excluded-address' command to exclude them.. Option B is correct. The most likely cause is that the DHCP server pool includes the network (192.168.1.0) and broadcast (192.168.1.255) addresses, which are reserved and cannot be leased. When a host requests an IP, the server may attempt to assign one of these addresses, causing a conflict and preventing successful DHCP lease completion. Using the 'ip dhcp excluded-address' command to exclude these addresses from the pool resolves the issue. Option A is not the best answer because the SVI for VLAN 10 is up/up and must already have an IP address in the 192.168.1.0/24 subnet for the DHCP server to offer addresses to that subnet; if it were missing, DHCP would fail completely, but the symptom would likely be no offers at all, not address conflicts. The problem described is consistent with the pool including reserved addresses, which is a common misconfiguration.

Answer

The VLAN 10 SVI is not configured with an IP address in the 192.168.1.0/24 subnet.

Answer

DHCP snooping is blocking DHCP messages on the switch port connected to the hosts.

Answer

The DHCP pool is not bound to VLAN 10. Use the 'vlan' command under the pool configuration.

Question 11

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

Accepted Answer

DHCP snooping is blocking the relay agent because the relay interface is not trusted.. The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped. Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place. Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.

Answer

The DHCP server is on a different subnet and the relay address is incorrect.

Answer

The DHCP server is unreachable from the router.

Answer

The ip helper-address command is missing from the VLAN 200 interface.

Question 12

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Accepted Answer

Trusted. DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.

Answer

Secure

Answer

Authorized

Answer

Relay

Question 13

A network administrator is troubleshooting a new branch office where hosts in VLAN 20 on switch SW1 cannot obtain IP addresses from the DHCP server located at 192.168.10.5 in the main data center. The router R1 is configured as the default gateway for VLAN 20 with interface GigabitEthernet0/1.20. The administrator verifies that the DHCP server is reachable and has available addresses. What configuration change should the administrator make to resolve the issue?

Accepted Answer

Configure the 'ip helper-address 192.168.10.5' command on the router interface GigabitEthernet0/1.20.. The correct answer is B because the DHCP server is on a different subnet than the hosts in VLAN 20. By default, DHCP broadcasts are not forwarded across routers. The 'ip helper-address 192.168.10.5' command on the router's subinterface GigabitEthernet0/1.20 converts the broadcast DHCP request into a unicast and forwards it to the DHCP server, allowing the hosts to obtain IP addresses.

Answer

Configure a static IP address on the DHCP server to ensure it is always reachable.

Answer

Enable DHCP snooping globally on the switch SW1.

Answer

Increase the DHCP lease time on the server to 30 days.

Question 14

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

1. Enter global configuration mode. 2. Configure RADIUS server host and key. 3. Enable AAA globally. 4. Define an authentication method list for 802.1X. 5. Enter interface configuration mode. 6. Enable 802.1X port authentication. 7. Apply the authentication method list to the interface. 8. Verify configuration.. The correct order begins by entering global configuration mode, then configuring the RADIUS server host and key before enabling AAA globally. Although AAA can be enabled without a RADIUS server, Cisco recommends defining the server before creating the authentication method list that references it to avoid configuration errors. After enabling AAA, define the authentication method list for 802.1X, then enter interface configuration mode, enable 802.1X port authentication, apply the method list to the interface, and finally verify the configuration.

Question 15

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode and enable AAA with the 'aaa new-model' command.. First, enter global config and enable AAA. Then define the RADIUS server, configure AAA authentication to use RADIUS for 802.1X, and finally enable 802.1X on the interface.

CCNA Network Services and Security Practice Test 26 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 26 — 15 Questions

Exhibit