CCNA Network Services and Security Practice Test 30 — 15 Questions

Question 1

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

Accepted Answer

Devices can send log messages to a remote syslog server for central storage. Syslog provides centralized event reporting by allowing devices to send log messages to a remote server (option A is correct). Severity levels enable filtering based on event seriousness (option B is correct). Option C is incorrect because syslog does not assign IP addresses dynamically—that is the role of DHCP. Option D is incorrect because syslog logs events and does not replace SNMP counters, which remain the primary method for collecting interface statistics.

Answer

Syslog is used to assign IP addresses dynamically to endpoints

Answer

Syslog entries replace SNMP counters for interface statistics

Question 2

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.. The switch port is in the 'authorized' state, indicating that 802.1X authentication succeeded and the RADIUS server sent an Access-Accept. However, the workstation cannot ping the default gateway, pointing to a connectivity issue after authentication. The most likely cause is that the RADIUS server returned a VLAN assignment (via the Tunnel-Private-Group-ID attribute) that placed the port in a VLAN that is not the intended one, such as a management VLAN without a gateway, or a VLAN missing a routed SVI, leaving the workstation isolated despite successful authentication.

Answer

The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.

Answer

The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.

Answer

The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.

Question 3

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch port connected to a single PC. The port is in the 'authorized' state, but the PC cannot reach any network resources beyond its directly connected switch. The switch is configured to use RADIUS for authentication. What is the most likely cause of this issue?

Accepted Answer

The RADIUS server is not returning a VLAN assignment, so the port remains in the default VLAN, but the PC needs to be in a different VLAN to reach resources.. The RADIUS server can return a VLAN assignment as part of the Access-Accept message (via RADIUS attribute 64 or 81). If the server does not send a VLAN, the port remains in the configured access VLAN (often VLAN 1). If the PC needs to be in a different VLAN to reach network resources, it will be isolated even though 802.1X authentication succeeded and the port is authorized.

Answer

The switchport is in access mode and not trunking, so the PC cannot reach other VLANs.

Answer

The switch is not configured with 'aaa new-model' and therefore AAA is not enabled.

Answer

The PC is not configured for 802.1X supplicant, so it cannot authenticate properly.

Question 4

Which TWO statements correctly describe the configuration and verification of AAA with RADIUS/TACACS+ and 802.1X port-based authentication on IOS-XE?

Accepted Answer

The switch port must be configured as an access port and the command 'authentication port-control auto' must be applied.. 802.1X requires the switch port to be an access port (not trunk or dynamic) and the 'authentication port-control auto' command enables EAPoL-based authentication. Option D is correct because RADIUS is the recommended protocol for 802.1X; it natively supports EAP extensions and is widely used for network access control, whereas TACACS+ does not support EAP and is more suited for device administration. Option B is false because AAA authentication for 802.1X should use RADIUS, not TACACS+. Option C is false because 'aaa new-model' only activates the AAA framework; 802.1X requires additional global commands like 'dot1x system-auth-control' and per-interface configuration. Option E is false because 802.1X is typically configured on access ports and cannot be used on trunk ports to authenticate multiple VLANs; the port must be in access mode.

Answer

AAA authentication for 802.1X must be configured using TACACS+ as the protocol of choice.

Answer

The global command 'aaa new-model' is sufficient to enable 802.1X on all interfaces.

Answer

802.1X can be configured on a trunk port to authenticate multiple VLANs simultaneously.

Question 5

Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?

Accepted Answer

Standard ACLs filter traffic based on source IP address only.. Standard ACLs filter traffic based solely on the source IP address, using numbers 1–99 or 1300–1999 in classic Cisco IOS. They do not consider destination IP, protocol, or port numbers. Because they lack granularity, placing them close to the destination (option D) prevents them from inadvertently blocking traffic that should be permitted, as they cannot distinguish between traffic destined for different services on the same destination host.

Answer

Standard ACLs should be placed as close to the source as possible.

Answer

Standard ACLs can filter traffic based on destination IP address.

Answer

Standard ACLs can filter traffic based on TCP or UDP port numbers.

Question 6

Which TWO statements correctly describe the behavior of standard ACLs when applied to an interface?

Accepted Answer

Standard ACLs should be placed as close to the destination as possible.. Standard ACLs filter traffic based solely on the source IP address, not the destination. Because they do not consider destination addresses, placing them as close to the destination as possible prevents them from inadvertently blocking traffic that should reach other parts of the network. This placement ensures that only the intended traffic is filtered at the final hop before the destination.

Answer

Standard ACLs filter traffic based on source and destination IP addresses.

Answer

Standard ACLs can filter traffic based on protocol type (TCP, UDP, ICMP).

Answer

Standard ACLs are applied to interfaces in the inbound direction only.

Question 7

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

Accepted Answer

The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.. The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.

Answer

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Answer

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Answer

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.

Question 8

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

Accepted Answer

The router is configured for dynamic NAT without overload (PAT), so it assigns one public IP per inside host and does not allow inbound connections without a static mapping.. Dynamic NAT without overload maps each inside host to a unique public IP from the pool, but it does not allow external hosts to initiate connections because there is no static mapping or port forwarding to direct inbound traffic. The described behavior—internal hosts reaching the Internet while external hosts cannot initiate connections—is typical of dynamic NAT without PAT. With PAT (overload), many internal hosts share a single public IP and inbound connections would still require explicit port forwarding; without overload, the router simply does not know how to translate incoming requests back to the correct inside host.

Answer

The NAT pool is exhausted because it contains only 21 addresses, and more than 21 internal hosts are trying to access the Internet simultaneously.

Answer

The inside local addresses are not in the same subnet as the inside interface, causing asymmetric routing.

Answer

The outside global addresses are not routable on the Internet, so external hosts cannot send return traffic.

Question 9

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Accepted Answer

The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.. When the NAT pool is exhausted, no new translations can be created, so only hosts that already have established translations can continue to communicate, causing intermittent connectivity. A full NAT table means the pool of public IP addresses is completely allocated, preventing new sessions. Implementing PAT allows multiple inside hosts to share a single public IP by multiplexing port numbers, resolving the pool exhaustion.

Answer

The inside local addresses are not properly defined in the access list.

Answer

The outside interface is not configured with the ip nat outside command.

Answer

The inside interface is not configured with the ip nat inside command.

Question 10

Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?

Accepted Answer

PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.. PAT (Port Address Translation) translates multiple internal private IP addresses to a single public IP address by assigning unique source port numbers to each session, allowing many internal hosts to share one public IP. This is correctly described in option A. Option D is also correct because PAT uniquely identifies each translation by both the IP address and the port number, enabling the router to demultiplex return traffic. Option B is wrong because PAT uses many-to-one mapping, not 1:1; a 1:1 mapping is characteristic of static NAT. Option C is incorrect because PAT can operate with a single public IP address (often the outside interface address) rather than requiring a pool. Option E is false because PAT translations are dynamically created and time out after a period of inactivity; they are not static.

Answer

PAT requires a 1:1 mapping of internal to external IP addresses.

Answer

PAT can only be configured with a pool of public IP addresses.

Answer

PAT translations are always static and never time out.

Question 11

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

Accepted Answer

Configure PAT (overload) for internal hosts and static NAT for the web server.. PAT (Port Address Translation), also known as NAT overload, allows multiple internal hosts to share a single public IP address by mapping each session to a unique port number, satisfying the requirement for internet access. Static NAT is then used to create a one-to-one mapping from the public IP (on a specific port) to the private IP of the internal web server, making it reachable from the internet. This combination meets both outbound connectivity for all hosts and inbound access to the web server without needing additional public IPs.

Answer

Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

Answer

Configure only PAT (overload) for all internal hosts including the web server.

Answer

Configure static NAT for the web server and use only the public IP for internal hosts.

Question 12

A user reports that they cannot access the company's internal web server at 'intranet.company.local' from their workstation. The workstation can ping the web server's IP address 192.168.10.50 successfully, and other internal services like email (mail.company.local) are reachable. Which DNS record issue is most likely causing this problem?

Accepted Answer

Add an A record mapping 'intranet.company.local' to IP address 192.168.10.50. The workstation can ping the web server's IP address (192.168.10.50), confirming network connectivity and that the server is online. However, the user cannot access the server by its hostname 'intranet.company.local', which indicates a DNS resolution failure. Since other internal services like email are reachable, the DNS zone is functioning, but there is no A record that maps the hostname 'intranet' to its IP address. Adding an A record for 'intranet.company.local' pointing to 192.168.10.50 will resolve the issue.

Answer

Add a CNAME record that aliases 'intranet.company.local' to 'webserver.company.local'

Answer

Verify the PTR record for 192.168.10.50 points to 'intranet.company.local'

Answer

Check the NS records for the 'company.local' zone to ensure proper delegation

Question 13

A network administrator is troubleshooting an issue where internal hosts can ping the company's web server by IP address (192.0.2.10) but cannot access it using the fully qualified domain name www.example.com. The DNS server (192.0.2.5) is reachable and responds to queries. The administrator runs nslookup www.example.com from a host and receives the following output:

C:\> nslookup www.example.com
Server:  UnKnown
Address:  192.0.2.5

Name:    www.example.com
Address:  192.0.2.20

Based on the output, what is the most likely cause of the problem?

Accepted Answer

The DNS A record for www.example.com is incorrect; update it to point to 192.0.2.10.. The nslookup output shows that www.example.com resolves to 192.0.2.20, but the web server is at 192.0.2.10. This indicates the DNS A record is incorrect and must be updated to point to the correct IP. Pinging by IP works because it bypasses DNS, confirming network connectivity. The host's DNS cache is not the issue because nslookup queries the server directly and still returns the wrong address. The firewall is not involved since pinging by IP succeeds, and the DNS server is authoritative (the response is received).

Answer

The host's DNS cache is corrupted; flush it using ipconfig /flushdns.

Answer

The web server's firewall is blocking traffic from the host; add an allow rule.

Answer

The DNS server is not authoritative for the example.com zone; delegate the zone to a different server.

Question 14

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

Accepted Answer

AAAA record. The AAAA record (Quad-A record) maps a domain name to an IPv6 address, making it the standard type for forward IPv6 lookups. The PTR record performs the reverse mapping—from an IPv6 address back to a domain name. Administrators routinely check both records with tools like nslookup or dig to ensure forward and reverse DNS consistency, which is critical for services such as email and security logging. The other options (A, CNAME, MX) do not directly provide a domain-to-IPv6 mapping or its reverse verification.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 15

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

Accepted Answer

DHCP snooping is blocking the relay agent because the relay interface is not trusted.. The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped. Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place. Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.

Answer

The DHCP server is on a different subnet and the relay address is incorrect.

Answer

The DHCP server is unreachable from the router.

Answer

The ip helper-address command is missing from the VLAN 200 interface.