CCNA Network Services and Security Practice Test 29 — 15 Questions

Question 1

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The router is configured for dynamic NAT without overload (PAT), so it assigns one public IP per inside host and does not allow inbound connections without a static mapping.. Dynamic NAT without overload maps each inside host to a unique public IP from the pool, but it does not allow external hosts to initiate connections because there is no static mapping or port forwarding to direct inbound traffic. The described behavior—internal hosts reaching the Internet while external hosts cannot initiate connections—is typical of dynamic NAT without PAT. With PAT (overload), many internal hosts share a single public IP and inbound connections would still require explicit port forwarding; without overload, the router simply does not know how to translate incoming requests back to the correct inside host.

Answer

The NAT pool is exhausted because it contains only 21 addresses, and more than 21 internal hosts are trying to access the Internet simultaneously.

Answer

The inside local addresses are not in the same subnet as the inside interface, causing asymmetric routing.

Answer

The outside global addresses are not routable on the Internet, so external hosts cannot send return traffic.

Question 2

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Accepted Answer

The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.. When the NAT pool is exhausted, no new translations can be created, so only hosts that already have established translations can continue to communicate, causing intermittent connectivity. A full NAT table means the pool of public IP addresses is completely allocated, preventing new sessions. Implementing PAT allows multiple inside hosts to share a single public IP by multiplexing port numbers, resolving the pool exhaustion.

Answer

The inside local addresses are not properly defined in the access list.

Answer

The outside interface is not configured with the ip nat outside command.

Answer

The inside interface is not configured with the ip nat inside command.

Question 3

Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?

Accepted Answer

PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.. PAT (Port Address Translation) translates multiple internal private IP addresses to a single public IP address by assigning unique source port numbers to each session, allowing many internal hosts to share one public IP. This is correctly described in option A. Option D is also correct because PAT uniquely identifies each translation by both the IP address and the port number, enabling the router to demultiplex return traffic. Option B is wrong because PAT uses many-to-one mapping, not 1:1; a 1:1 mapping is characteristic of static NAT. Option C is incorrect because PAT can operate with a single public IP address (often the outside interface address) rather than requiring a pool. Option E is false because PAT translations are dynamically created and time out after a period of inactivity; they are not static.

Answer

PAT requires a 1:1 mapping of internal to external IP addresses.

Answer

PAT can only be configured with a pool of public IP addresses.

Answer

PAT translations are always static and never time out.

Question 4

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

Accepted Answer

Configure PAT (overload) for internal hosts and static NAT for the web server.. PAT (Port Address Translation), also known as NAT overload, allows multiple internal hosts to share a single public IP address by mapping each session to a unique port number, satisfying the requirement for internet access. Static NAT is then used to create a one-to-one mapping from the public IP (on a specific port) to the private IP of the internal web server, making it reachable from the internet. This combination meets both outbound connectivity for all hosts and inbound access to the web server without needing additional public IPs.

Answer

Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

Answer

Configure only PAT (overload) for all internal hosts including the web server.

Answer

Configure static NAT for the web server and use only the public IP for internal hosts.

Question 5

A user reports that they cannot access the company's internal web server at 'intranet.company.local' from their workstation. The workstation can ping the web server's IP address 192.168.10.50 successfully, and other internal services like email (mail.company.local) are reachable. Which DNS record issue is most likely causing this problem?

Accepted Answer

Add an A record mapping 'intranet.company.local' to IP address 192.168.10.50. The workstation can ping the web server's IP address (192.168.10.50), confirming network connectivity and that the server is online. However, the user cannot access the server by its hostname 'intranet.company.local', which indicates a DNS resolution failure. Since other internal services like email are reachable, the DNS zone is functioning, but there is no A record that maps the hostname 'intranet' to its IP address. Adding an A record for 'intranet.company.local' pointing to 192.168.10.50 will resolve the issue.

Answer

Add a CNAME record that aliases 'intranet.company.local' to 'webserver.company.local'

Answer

Verify the PTR record for 192.168.10.50 points to 'intranet.company.local'

Answer

Check the NS records for the 'company.local' zone to ensure proper delegation

Question 6

A network administrator is troubleshooting an issue where internal hosts can ping the company's web server by IP address (192.0.2.10) but cannot access it using the fully qualified domain name www.example.com. The DNS server (192.0.2.5) is reachable and responds to queries. The administrator runs nslookup www.example.com from a host and receives the following output:

C:\> nslookup www.example.com
Server:  UnKnown
Address:  192.0.2.5

Name:    www.example.com
Address:  192.0.2.20

Based on the output, what is the most likely cause of the problem?

Accepted Answer

The DNS A record for www.example.com is incorrect; update it to point to 192.0.2.10.. The nslookup output shows that www.example.com resolves to 192.0.2.20, but the web server is at 192.0.2.10. This indicates the DNS A record is incorrect and must be updated to point to the correct IP. Pinging by IP works because it bypasses DNS, confirming network connectivity. The host's DNS cache is not the issue because nslookup queries the server directly and still returns the wrong address. The firewall is not involved since pinging by IP succeeds, and the DNS server is authoritative (the response is received).

Answer

The host's DNS cache is corrupted; flush it using ipconfig /flushdns.

Answer

The web server's firewall is blocking traffic from the host; add an allow rule.

Answer

The DNS server is not authoritative for the example.com zone; delegate the zone to a different server.

Question 7

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

Accepted Answer

AAAA record. The AAAA record (Quad-A record) maps a domain name to an IPv6 address, making it the standard type for forward IPv6 lookups. The PTR record performs the reverse mapping—from an IPv6 address back to a domain name. Administrators routinely check both records with tools like nslookup or dig to ensure forward and reverse DNS consistency, which is critical for services such as email and security logging. The other options (A, CNAME, MX) do not directly provide a domain-to-IPv6 mapping or its reverse verification.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 8

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

Accepted Answer

DHCP snooping is blocking the relay agent because the relay interface is not trusted.. The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped. Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place. Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.

Answer

The DHCP server is on a different subnet and the relay address is incorrect.

Answer

The DHCP server is unreachable from the router.

Answer

The ip helper-address command is missing from the VLAN 200 interface.

Question 9

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Accepted Answer

Trusted. DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.

Answer

Secure

Answer

Authorized

Answer

Relay

Question 10

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode, define the RADIUS server, configure AAA authentication, enable 802.1X globally, apply per-interface 802.1X settings.. First enter global config, then define the RADIUS server, then configure AAA authentication, then enable 802.1X globally, and finally apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, define the RADIUS server, configure AAA authentication, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, configure AAA authentication, define the RADIUS server, enable 802.1X globally, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, define the RADIUS server, enable 802.1X globally, configure AAA authentication, apply per-interface 802.1X settings.

Question 11

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interface. First enter global config, then define RADIUS server, then configure AAA authentication, then enable 802.1X globally, then apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interface

Answer

Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interface

Answer

Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interface

Question 12

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Accepted Answer

aaa new-model. AAA configuration must precede 802.1X. The correct order is: first enable AAA globally with 'aaa new-model', then define the RADIUS server with 'radius server RADIUS-SERVER', then globally enable 802.1X with 'dot1x system-auth-control', and finally on the interface set authentication port-control with 'authentication port-control auto'.

Question 13

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode and enable AAA globally using the 'aaa new-model' command.. Start by entering global configuration mode and enabling AAA with 'aaa new-model'. Next, create an authentication method list using 'aaa authentication dot1x default group radius' to define the method for 802.1X. Then, configure the RADIUS server parameters using 'radius-server host' and 'radius-server key' so the switch knows where to send authentication requests; note that the method list can reference the 'radius' group even before the server is specified. Finally, enable 802.1X system-wide with the global command 'dot1x system-auth-control' to activate 802.1X globally. This order ensures each prerequisite is met before the next step.

Question 14

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Configure RADIUS server, enable AAA globally, create an authentication list for 802.1X, apply 802.1X to the port. First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Answer

Enable AAA globally, configure RADIUS server, apply 802.1X to the port, create an authentication list for 802.1X

Answer

Configure RADIUS server, create an authentication list for 802.1X, enable AAA globally, apply 802.1X to the port

Answer

Apply 802.1X to the port, configure RADIUS server, enable AAA globally, create an authentication list for 802.1X

Question 15

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Accepted Answer

TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.. TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes. Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Answer

RADIUS encrypts the entire packet payload, including all attributes.

Answer

TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

Answer

When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.