CCNA Network Services and Security Practice Test 28 — 15 Questions

Question 1

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Accepted Answer

Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.. First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Answer

Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.

Answer

Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.

Answer

Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.

Question 2

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Accepted Answer

Extended ACLs are typically placed closest to the source of the traffic.. Option B is correct because extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source. Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.

Answer

Standard ACLs are typically placed closest to the source of the traffic.

Answer

A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.

Answer

Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.

Question 3

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router for outbound traffic from a private network to the Internet.

Accepted Answer

Enter global configuration mode, define an ACL to match private traffic, specify the outside interface, and apply ip nat inside source list ACL interface outside overload.. PAT configuration requires first entering global config, defining the traffic with an ACL, specifying the outside interface, then applying the NAT overload command referencing the ACL and outside interface.

Question 4

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router and describe the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create a pool of global addresses, then enable PAT with overload.. First, enter config mode. Then mark the inside and outside interfaces. Create a pool of global addresses. Finally, enable PAT with overload to allow multiple inside hosts to share the pool addresses.

Answer

Enter global configuration mode, enable PAT with overload, create a pool of global addresses, then mark inside and outside interfaces.

Question 5

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router for outbound traffic, including ACL creation, NAT statement, interface marking, and the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create an ACL to match internal traffic, apply NAT with overload using the outside interface.. The correct sequence is: enter global configuration mode, mark the inside and outside interfaces with 'ip nat inside' and 'ip nat outside', then create an ACL to match internal traffic, and finally apply the NAT overload statement using the outside interface. This order ensures the NAT process knows which interfaces are designated as inside/outside before matching and translating traffic. Option B follows this standard recommended order.

Answer

Enter global configuration mode, create an ACL to match internal traffic, apply NAT with overload using the outside interface, mark inside and outside interfaces.

Question 6

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router.

Accepted Answer

Enter global configuration mode, define inside and outside interfaces, create a NAT pool with the public IP address range, and enable overload on the pool.. The correct sequence is: enter global configuration mode, designate inside and outside interfaces, create the NAT pool, and then enable overload on the pool. Interfaces must be designated first so that NAT translation can identify which interfaces are inside/outside. The pool must exist before you apply overload to it; otherwise the overload command will refer to an undefined pool. The other options incorrectly place the pool creation or overload instruction before interface designation or in an impossible order.

Question 7

Drag and drop the following steps into the correct order to configure PAT (NAT overload) on a Cisco IOS-XE router so that internal hosts can share a single public IP when accessing the internet. Note: The NAT overload command is applied globally, not on the interface.

Accepted Answer

Enter global configuration mode, configure inside and outside interfaces, create an ACL to match internal traffic, configure NAT overload with the ACL and outside interface.. First, enter global configuration mode. Then configure the inside and outside interfaces with 'ip nat inside' and 'ip nat outside'. Next, create an ACL to identify internal traffic that should be translated. Finally, apply the NAT overload configuration globally using 'ip nat inside source list interface overload'. The correct order is global config, interfaces, ACL, then global NAT command.

Question 8

Drag and drop the configuration steps into the correct order to configure Port Address Translation (PAT) on a Cisco router.

Accepted Answer

Define interesting traffic using an access list to identify the internal source addresses to be translated.. The correct sequence is: first define the addresses to translate with an access list; next mark the inside interface with 'ip nat inside'; then mark the outside interface with 'ip nat outside'; finally, enable PAT globally with the 'ip nat inside source list ... overload' command. The overload command is not applied to an interface—it references the outside interface to translate source addresses to that interface’s IP.

Question 9

Drag and drop the following steps into the correct order to configure PAT (overload) on a Cisco router using a single public IP address on the outside interface.

Accepted Answer

Enter global configuration mode. The correct sequence is: first enter global configuration mode, then define the access list that matches inside traffic. Next, mark the inside and outside interfaces with `ip nat inside` and `ip nat outside` respectively. Finally, enable PAT with overload using `ip nat inside source list interface overload`. This order ensures the router knows which interfaces are internal and external, which traffic to translate, and how to perform the translation.

Question 10

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Accepted Answer

To configure static NAT, use the command 'ip nat inside source static

'.. Option A is correct because the 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.

Answer

The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.

Answer

To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.

Question 11

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, including the use of nslookup and dig for diagnosis.

Accepted Answer

Client sends DNS query to configured recursive resolver (e.g., ISP or public DNS). DNS resolution starts with the client query, then recursive server lookups, authoritative response, caching and reply, and finally diagnostic tools like nslookup or dig to verify.

Question 12

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the diagnostic workflow using nslookup and dig to identify a missing or incorrect A-record.

Accepted Answer

Client sends DNS query to configured DNS server → DNS server checks cache and forwards query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses nslookup to verify → Client uses dig +trace for detailed path analysis. The standard DNS resolution sequence ends with the client receiving the A-record. Troubleshooting uses nslookup first for basic checks, then dig +trace for detailed path analysis.

Answer

Client sends DNS query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses dig +trace → Client uses nslookup to verify

Answer

Client sends DNS query to configured DNS server → DNS server checks cache and forwards query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses dig +trace → Client uses nslookup to verify

Answer

Client sends DNS query to configured DNS server → DNS server checks cache and returns A-record from cache → If not cached, server forwards query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses nslookup → Client uses dig +trace

Question 13

Drag and drop the following steps into the correct order to trace the DNS resolution process from a client query to receiving an A-record response.

Accepted Answer

Client sends DNS query to recursive resolver. The client first sends its query to a recursive resolver (often provided by the ISP or a public DNS service). The resolver then queries a root name server to find the TLD server for the domain's top-level domain (e.g., .com). Next, the resolver queries the TLD server to learn the authoritative name server for the specific domain. Finally, the resolver queries that authoritative server, which responds with the A record containing the IP address. Each step depends on the previous one because higher-level servers only delegate to lower levels, not store final records. The resolver then caches the response and returns it to the client, completing the process. Nslookup and dig are diagnostic tools used after this resolution if records are missing or incorrect, but they are not part of the resolution steps themselves.

Question 14

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the nslookup and dig diagnostic workflow for troubleshooting missing or wrong DNS records.

Accepted Answer

Client sends DNS query to local resolver; server responds with A-record; client uses IP address; then nslookup for basic query; then dig for detailed diagnostics.. The DNS resolution process starts with the client query, server response, and client use. Troubleshooting follows with nslookup for basic queries and dig for detailed diagnostics.

Answer

Client sends DNS query to local resolver; server responds with A-record; client uses IP address; then dig for detailed diagnostics; then nslookup for basic query.

Answer

Client sends DNS query to local resolver; client uses IP address; server responds with A-record; then nslookup for basic query; then dig for detailed diagnostics.

Answer

Client sends DNS query to local resolver; server responds with A-record; then nslookup for basic query; then dig for detailed diagnostics; then client uses IP address.

Question 15

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet.

Accepted Answer

Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay.. The relay agent must be configured first by setting the ip helper-address on the client-facing interface, then verifying connectivity to the DHCP server. The DORA process should be observed using a relay-specific debug command such as debug ip dhcp relay; the originally listed debug ip dhcp server packet would show no output on a pure relay agent, making it incorrect for verification.