CCNA Network Services and Security Practice Test 29 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Accepted Answer

Enter global configuration mode, enable DHCP relay on the required interface, create the DHCP pool, configure the network and default gateway, exclude addresses, and verify.. The correct order is to first exclude addresses to prevent the DHCP server from leasing reserved or gateway IPs, then create and configure the DHCP pool (network, default gateway), next enable DHCP relay on the required interface, and finally verify. Option D follows this Cisco best practice. Option A risks assigning excluded addresses because the pool is created before exclusions. Options B and C place relay setup before the pool is fully configured, which is incorrect.

Answer

Enter global configuration mode, create the DHCP pool, configure the network and default gateway, exclude addresses, enable DHCP relay on the required interface, and verify.

Question 2

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Accepted Answer

1. Exclude addresses from the pool. 2. Configure the DHCP pool for VLAN 10 with network, default-router, and DNS. 3. Enable DHCP relay on the VLAN 20 interface. 4. Verify DHCP operations.. The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Answer

1. Enable DHCP relay on the VLAN 20 interface. 2. Configure the DHCP pool for VLAN 10. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Answer

1. Exclude addresses from the pool. 2. Enable DHCP relay on the VLAN 20 interface. 3. Configure the DHCP pool for VLAN 10. 4. Verify DHCP operations.

Answer

1. Configure the DHCP pool for VLAN 10. 2. Enable DHCP relay on the VLAN 20 interface. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Question 3

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a different subnet.

Accepted Answer

Configure the 'ip helper-address' command on the interface facing the client subnet.. First configure the ip helper-address on the client-facing interface (A). Then enable 'debug ip dhcp relay' (D) so forwarded packets are captured. Next trigger the DORA process by releasing/renewing the client IP address (C). Finally verify with passive show commands (B). Debug must be active before the DORA exchange; enabling it afterward misses the output.

Question 4

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a local subnet and enable a DHCP relay agent on a different interface to forward client requests to that server.

Accepted Answer

Configure the DHCP server on the local subnet, then configure the DHCP relay agent on the remote interface, and finally verify both server and relay functionality.. The DHCP server must be configured first on the local subnet, then the relay agent on the remote interface to forward requests; verification ensures both server and relay function correctly.

Answer

Configure the DHCP relay agent on the remote interface, then configure the DHCP server on the local subnet, and finally verify both server and relay functionality.

Answer

Configure the DHCP server on the local subnet, then verify functionality, and finally configure the DHCP relay agent on the remote interface.

Answer

Configure the DHCP relay agent on the remote interface, then verify functionality, and finally configure the DHCP server on the local subnet.

Question 5

Drag and drop the following steps into the correct order to configure a DHCP server on a Cisco IOS-XE router and enable DHCP relay on a remote subnet, following Cisco's recommended configuration sequence.

Accepted Answer

1. Create DHCP pool with network and default-router. 2. Exclude addresses. 3. Enable DHCP relay on the remote interface.. The recommended order is to first create the DHCP pool with network and default-router, then exclude addresses, and finally enable DHCP relay on the remote interface. While the 'ip dhcp excluded-address' command can technically be issued before or after the pool definition, Cisco documentation typically shows the pool created first. The critical requirement is that DHCP relay is configured last, after the DHCP server is fully configured. Options B and D place relay first, which is incorrect.

Question 6

Which TWO statements correctly describe the operation of the ip helper-address command in a DHCP relay agent configuration?

Accepted Answer

It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.. Option A is correct because the `ip helper-address` command is configured on the router interface facing the client, and it converts the client's DHCPDISCOVER broadcast into a unicast directed to the specified DHCP server, allowing the client to obtain an IP address from a server on a different subnet. Option D is also correct because the relay agent sets the giaddr (gateway IP address) field in the DHCP packet to its own interface IP address. This is how the DHCP server knows which subnet the client is on and can assign an appropriate IP address and return the reply. Option B is incorrect because the command is configured on the interface facing the DHCP clients, not on the server-facing interface. Option C is incorrect because `ip helper-address` does not forward all UDP broadcasts; it only forwards broadcasts for specific UDP ports (DHCP, DNS, TFTP, etc.) by default, and this list can be modified. Option E is incorrect because the command does not perform any MAC address validation or spoofing protection; it simply relays DHCP messages.

Answer

It is configured on the DHCP server interface to allow replies to reach clients on remote subnets.

Answer

It automatically forwards all UDP broadcasts by default.

Answer

It prevents DHCP spoofing by validating the source MAC address of DHCP packets.

Question 7

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.

Accepted Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.. The 802.1X port is stuck in UNAUTHORIZED because AAA authentication for dot1x is set to 'local' but there is no local user database configured. Additionally, the RADIUS server is configured but not used for dot1x or login. The fix is to change 'aaa authentication dot1x default' to use group radius, and 'aaa authentication login default' to group radius local for fallback. Also ensure the RADIUS server is reachable and the key matches the server.

Answer

Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.

Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.

Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.

Question 8

You are connected to R1. Configure AAA with RADIUS authentication on R1 so that SSH login attempts first contact the RADIUS server at 192.0.2.10 (key 'cisco123'), and if the server is unreachable, fall back to the local database. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on a connected switch remains in the 'unauthorized' state despite RADIUS being functional; identify and fix the misconfiguration on the switch (SW1).

Accepted Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.. The correct answer is Option A. For R1, the 'aaa authentication login default group radius local' command ensures that SSH login attempts first contact the RADIUS server at 192.0.2.10 and fall back to the local database if the server is unreachable. Options that omit the 'local' keyword (C) lack this fallback, making them incorrect. Option B incorrectly uses 'aaa authentication login' on the switch for 802.1X; the correct command is 'aaa authentication dot1x'. On SW1, all wrong options (B, C, D) are missing the 'dot1x pae authenticator' command under the interface, which is required for the switch to explicitly act as an 802.1X authenticator (though some IOS versions auto-assume it, Cisco CCNA expects explicit configuration). Option D also lacks 'dot1x pae authenticator', leaving the port in unauthorized state. Only Option A includes all necessary commands: correct RADIUS server definitions, proper AAA authentication lists for both login and dot1x, global 'dot1x system-auth-control', and the interface-level commands 'authentication port-control auto' and 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto', 'dot1x pae authenticator'.

Answer

R1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication login default group radius local', 'line vty 0 4', 'login authentication default'. SW1: 'aaa new-model', 'radius server RADIUS', 'address ipv4 192.0.2.10 key cisco123', 'aaa authentication dot1x default group radius', 'dot1x system-auth-control', 'interface GigabitEthernet0/1', 'authentication port-control auto'.

Question 9

You are connected to R1. Configure AAA with RADIUS authentication so that SSH users are authenticated first against the RADIUS server (198.51.100.10) and fall back to the local user database if the server is unreachable. Additionally, troubleshoot why an 802.1X-enabled interface (GigabitEthernet0/1) remains in the unauthorized state. The RADIUS server shares a key of 'cisco123' and uses UDP port 1812. The local user 'admin' with secret 'adminpass' must be available as a fallback.

Accepted Answer

[CORRECT] The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.. The RADIUS server is unreachable (not reachable), but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. When the server cannot be reached (e.g., timeout), no fallback exists, so the port stays unauthorized. The fix is to modify the dot1x authentication list to include 'local' as a fallback method. Adding local fallback allows the switch to authenticate the supplicant using the local database when the RADIUS server is unreachable.

Answer

The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.

Answer

The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.

Answer

The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.

Question 10

You are connected to R1. Configure AAA with RADIUS authentication for all login methods. The RADIUS server is at 203.0.113.10 with key 'CiscoKey123'. Then troubleshoot why the 802.1X port on interface GigabitEthernet0/1 remains in unauthorized state. The port is configured for dot1x port-control auto, but authentication fails. Ensure that the AAA authentication default method uses RADIUS first, then local fallback, and that the RADIUS server is correctly reachable and configured for authentication.

Accepted Answer

Configure RADIUS server with IP 203.0.113.10 and key 'CiscoKey123', then configure AAA authentication login default group radius local.. The issue is twofold: First, AAA is not fully configured — 'aaa new-model' is present but no RADIUS server or authentication method list is defined. Second, the RADIUS server configuration is missing. To fix, configure the RADIUS server with IP and key using the 'radius server' block, then create an AAA authentication login default list that uses RADIUS first then local fallback (e.g., 'aaa authentication login default group radius local'). The port configuration is correct for 802.1X, but without AAA and RADIUS, authentication cannot proceed; the switch will not contact the RADIUS server, causing the port to remain unauthorized. Option D is incorrect because while 'aaa new-model' and RADIUS server configuration are necessary steps, they alone do not create an authentication method list; without 'aaa authentication login default group radius local', the RADIUS server is never referenced for login authentication.

Answer

Change the interface port-control to 'force-authorized' to bypass authentication and bring the port up.

Answer

Configure AAA authentication login default local radius to use local authentication first, then RADIUS.

Answer

Add the command 'aaa new-model' and configure the RADIUS server with IP 203.0.113.10 and key 'CiscoKey123'.

Question 11

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2/30 (key 'cisco123') so that console and VTY login use RADIUS first, then local authentication. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on R1 is stuck in the unauthorized state. The RADIUS server is reachable but authentication fails. Verify using 'show aaa servers' and 'show dot1x interface GigabitEthernet0/1 details'.

Accepted Answer

Configure 'aaa authentication login default group RADIUS local' and correct the RADIUS server key to match the actual server key.. The RADIUS server is reachable but AAA and 802.1X authentication fail because the pre-shared key on R1 does not match the server's actual key. The correct repair is to first apply 'aaa authentication login default group RADIUS local' to correctly reference the RADIUS server by its name, then set the matching key under 'radius server RADIUS'. Once the key matches, the switch port will transition to authorized state.

Answer

Configure 'aaa authentication login default group radius local' and verify the RADIUS server IP address is correct.

Answer

Configure 'aaa authentication login default group radius local' and enable 802.1X globally with 'dot1x system-auth-control'.

Answer

Configure 'aaa authentication login default local' and remove the RADIUS server configuration.

Question 12

You are connected to R1, a router acting as a network access server for 802.1X authentication on interface GigabitEthernet0/1. Configure AAA with a RADIUS server at 192.0.2.10 (key 'cisco123') so that the default login authentication uses RADIUS first, then local fallback. Additionally, troubleshoot why a connected supplicant on G0/1 remains in the unauthorized state even though RADIUS is reachable and the supplicant credentials are correct.

Accepted Answer

Enable AAA with 'aaa new-model', configure RADIUS server 'RADIUS_SERVER' with key 'cisco123', and apply 'aaa authentication login default group radius local'.. The problem is that AAA is not enabled (no aaa new-model) and no RADIUS server is configured; thus the 802.1X authentication fails because the router does not know how to communicate with the RADIUS server. The fix requires enabling AAA with 'aaa new-model', configuring the RADIUS server with 'radius server RADIUS_SERVER' and its key, then applying a default authentication list that uses RADIUS with local fallback via 'aaa authentication login default group radius local'. After these commands, the port should transition to authorized state for valid credentials.

Answer

Configure 'aaa authentication login default local' and add the RADIUS server with 'radius-server host 192.0.2.10 key cisco123'.

Answer

Enable AAA with 'aaa new-model' and configure 'aaa authentication login default group radius' without local fallback.

Answer

Configure 'aaa new-model', then apply 'dot1x system-auth-control' and 'aaa authentication dot1x default group radius'.

Question 13

You are connected to R1. Configure AAA with RADIUS server at 192.0.2.10 (key = Cisco123) so that console login uses local authentication as fallback. Then troubleshoot why a host connected to R1's GigabitEthernet0/1 (802.1X enabled) remains in unauthorized state. The RADIUS server is reachable. Fix the issue so the port authorizes successfully.

Accepted Answer

The RADIUS server is not defined in a AAA group; create 'aaa group server radius RAD_GROUP' and 'server name RADIUS_SERVER', then update the login default to reference the group.. The RADIUS server is reachable but not properly referenced in a AAA group. The 'aaa authentication login default group radius local' command uses the default group 'radius', which must be explicitly defined with 'aaa group server radius' and associated with the RADIUS server. Without this group, the router cannot send authentication requests to the server, keeping the port unauthorized. The fix is to create a AAA group for RADIUS, add the server to it, and update the login default to reference that group.

Answer

The RADIUS server key is incorrect; change the key to match the server's configuration.

Answer

The 802.1X port is not enabled; enable 'dot1x port-control auto' on GigabitEthernet0/1.

Answer

The RADIUS server is not reachable; check IP connectivity and firewall rules.

Question 14

You are connected to R1. The network has two routers (R1 and R2) connected via a serial link (S0/0/0). R1's GigabitEthernet0/0 connects to the 192.168.1.0/24 LAN. An extended ACL must be configured on R1 to permit only HTTPS traffic (TCP port 443) from host 192.168.1.10 to server 203.0.113.5 (reachable via R2), and deny all other traffic from the LAN to the server. Currently, the ACL is applied inbound on G0/0 but valid HTTPS traffic is being blocked. Troubleshoot and fix the configuration.

Accepted Answer

The ACL is missing an explicit permit statement for HTTPS traffic from host 192.168.1.10 to server 203.0.113.5, and the current permit ip any any allows all traffic, including HTTP, which violates the requirement to deny HTTP.. The ACL BLOCK_SERVER is intended to block HTTP (port 80) to the server but permit HTTPS (port 443). However, the ACL denies TCP traffic to port 80 from any source, but the permit ip any any statement permits all IP traffic, including HTTPS. The implicit deny at the end would block HTTPS only if the permit were removed. The actual fault is that the ACL is applied inbound on G0/0, but the source address for traffic from the LAN is 192.168.1.10 (not any), and the destination port is 443 (not 80). The current ACL permits all traffic, including HTTPS, so the problem must be that the ACL is too permissive (allowing HTTP) or that the implicit deny is blocking HTTPS due to a misordering. In this case, the ACL is actually permitting everything (including HTTP) because of permit ip any any. To fix, the ACL should explicitly permit HTTPS from host 192.168.1.10, deny HTTP from that host, and deny all other traffic to the server, with a permit ip any any only for other destinations. The correct sequence: permit tcp host 192.168.1.10 host 203.0.113.5 eq 443, deny tcp host 192.168.1.10 host 203.0.113.5 eq 80, permit ip any any.

Answer

The ACL is applied inbound on G0/0, but it should be applied outbound on G0/0 to filter traffic leaving the LAN.

Answer

The ACL should be applied to the serial interface S0/0/0 instead of G0/0 to filter traffic going to R2.

Answer

The ACL is missing a deny statement for all other traffic from the LAN to the server, and the permit ip any any allows everything, including unwanted traffic.

Question 15

You are connected to R1. The network has two routers (R1, R2) and a switch (SW1) in between. R1's G0/0 connects to SW1 (192.168.1.1/24), SW1 connects to R2's G0/0 (192.168.1.2/24). R2 has a loopback (Lo0: 203.0.113.1/32) used as a management address. Configure an extended ACL on R1 so that only SSH (TCP/22) traffic from the 10.0.0.0/24 network is permitted to reach R2's loopback; all other traffic to that loopback must be denied. Then apply the ACL in the correct direction on the correct interface.

Accepted Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any host 203.0.113.1
interface GigabitEthernet0/1
 ip access-group 100 in. The current configuration has no ACL restricting traffic to R2's loopback. The candidate must create an extended ACL that permits TCP from 10.0.0.0/24 to host 203.0.113.1 eq 22, then deny all other IP traffic to that host. The ACL must be applied inbound on R1's G0/1 (facing the 10.0.0.0/24 network) to filter traffic before it enters R1. Applying outbound on G0/0 would also work, but inbound on G0/1 is more efficient and typical. The implicit deny at the end of the ACL blocks all other traffic to the loopback.

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any host 203.0.113.1
interface GigabitEthernet0/0
 ip access-group 100 out

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
interface GigabitEthernet0/1
 ip access-group 100 in

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any any
interface GigabitEthernet0/1
 ip access-group 100 in