CCNA Network Services and Security Practice Test 30 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.1, with the ACL applied inbound on the router's GigabitEthernet0/0 interface, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.. First, enter config mode. Create the ACL permitting HTTP from the source network to the destination host. Apply it inbound on the correct interface. Then exit and verify.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it outbound on GigabitEthernet0/0 with 'ip access-group 100 out', then exit and verify with 'show access-lists'.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then verify with 'show running-config' without exiting configuration mode.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show ip interface brief'.

Question 2

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.100, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the interface facing the 192.168.1.0/24 network, save the configuration, and verify with show access-lists.. First, enter config mode. Then create the ACL allowing HTTP from the source network to the destination host. Apply it inbound on the appropriate interface. Save and verify the configuration.

Answer

Enter global configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it outbound on the interface facing the server, save the configuration, and verify with show ip interface.

Answer

Enter interface configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the same interface, save the configuration, and verify with show running-config.

Answer

Enter global configuration mode, create the ACL with a deny statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the interface facing the server, save the configuration, and verify with show access-lists.

Question 3

Which of the following is the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the router's G0/0 interface?

Accepted Answer

Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group in. The correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from 192.168.1.0/24 to 10.0.0.0/24, applied inbound on G0/0, is: first enter global configuration mode, create the ACL with a deny statement for the specific source and destination, then add a permit ip any any statement, then enter interface G0/0, and apply the ACL inbound with ip access-group in. Option B is incorrect because the ACL must be created before entering the interface. Option C is incorrect because the order of ACEs within the ACL must have the specific deny before the broad permit. Option D is incorrect because ip access-group must be applied on an interface, not globally.

Answer

Enter interface G0/0, apply ip access-group <acl-number> in, then create ACL with deny tcp any any eq telnet, permit ip any any

Answer

Enter global configuration mode, create ACL with permit ip any any, deny tcp any any eq telnet, then enter interface G0/0, apply ip access-group <acl-number> in

Answer

Enter global configuration mode, create ACL with deny tcp any any eq telnet, permit ip any any, then apply ip access-group <acl-number> in without entering interface

Question 4

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Accepted Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Apply the ACL inbound on GigabitEthernet0/1. Step 3: Verify the ACL configuration.. ACL configuration requires defining permit/deny statements first, then applying to the interface inbound, and finally verification.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Define the ACL with permit and deny statements. Step 3: Verify the ACL configuration.

Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Verify the ACL configuration. Step 3: Apply the ACL inbound on GigabitEthernet0/1.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Verify the ACL configuration. Step 3: Define the ACL with permit and deny statements.

Question 5

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server 10.0.0.10, applied inbound on interface GigabitEthernet0/1.

Accepted Answer

1. Enter global configuration mode
2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
3. Enter interface configuration mode for GigabitEthernet0/1
4. Apply the ACL inbound with ip access-group ACL_NAME in
5. Exit configuration mode and verify with show access-lists. After entering config mode, create the ACL to allow HTTP from the specified network to the server. Apply it inbound on the correct interface. Then exit and verify.

Answer

1. Enter interface configuration mode for GigabitEthernet0/1
2. Apply the ACL inbound with ip access-group ACL_NAME in
3. Enter global configuration mode
4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
5. Exit configuration mode and verify with show access-lists

Answer

1. Enter global configuration mode
2. Enter interface configuration mode for GigabitEthernet0/1
3. Apply the ACL inbound with ip access-group ACL_NAME in
4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
5. Exit configuration mode and verify with show access-lists

Answer

1. Enter global configuration mode
2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
3. Exit configuration mode and verify with show access-lists
4. Enter interface configuration mode for GigabitEthernet0/1
5. Apply the ACL inbound with ip access-group ACL_NAME in

Question 6

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.

Accepted Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.. First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.

Answer

Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.

Answer

Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.

Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.

Question 7

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Accepted Answer

Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.. First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Answer

Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.

Answer

Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.

Answer

Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.

Question 8

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Accepted Answer

Extended ACLs are typically placed closest to the source of the traffic.. Extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source. Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.

Answer

Standard ACLs are typically placed closest to the source of the traffic.

Answer

A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.

Answer

Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.

Question 9

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router and describe the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create a pool of global addresses, then enable PAT with overload.. For PAT configuration on a Cisco IOS-XE router, the correct order is: first enter global configuration mode (configure terminal), then define inside and outside interfaces (ip nat inside / ip nat outside under interface configuration), then create the global address pool (ip nat pool), and finally enable PAT with overload (ip nat inside source list ... pool ... overload). This sequence matches only option A. Option B is incorrect because creating the pool must be done after entering global configuration mode, not before. Option C is incorrect because marking interfaces must be done from global configuration mode, and enabling PAT requires a pool to exist. Option D is incorrect because enabling PAT without a pool will fail, and marking interfaces must be done before enabling PAT.

Answer

Create a pool of global addresses, mark inside and outside interfaces, enter global configuration mode, then enable PAT with overload.

Answer

Mark inside and outside interfaces, enter global configuration mode, enable PAT with overload, then create a pool of global addresses.

Answer

Enter global configuration mode, enable PAT with overload, create a pool of global addresses, then mark inside and outside interfaces.

Question 10

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Accepted Answer

To configure static NAT, use the command 'ip nat inside source static

'.. The 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.

Answer

The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.

Answer

To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.

Question 11

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the diagnostic workflow using nslookup and dig to identify a missing or incorrect A-record.

Accepted Answer

Client sends DNS query to configured DNS server → DNS server checks cache and forwards query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses nslookup to verify → Client uses dig +trace for detailed path analysis. The standard DNS resolution sequence ends with the client receiving the A-record. Troubleshooting uses nslookup first for basic checks, then dig +trace for detailed path analysis.

Answer

Client sends DNS query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses dig +trace → Client uses nslookup to verify

Answer

Client sends DNS query to configured DNS server → DNS server checks cache and forwards query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses dig +trace → Client uses nslookup to verify

Answer

Client sends DNS query to configured DNS server → DNS server checks cache and returns A-record from cache → If not cached, server forwards query to root server → Root server directs to TLD server → TLD server directs to authoritative server → Authoritative server returns A-record to client → Client uses nslookup → Client uses dig +trace

Question 12

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the nslookup and dig diagnostic workflow for troubleshooting missing or wrong DNS records.

Accepted Answer

Client sends DNS query to local resolver; server responds with A-record; client uses IP address; then nslookup for basic query; then dig for detailed diagnostics.. The DNS resolution process starts with the client query, server response, and client use. Troubleshooting follows with nslookup for basic queries and dig for detailed diagnostics.

Answer

Client sends DNS query to local resolver; server responds with A-record; client uses IP address; then dig for detailed diagnostics; then nslookup for basic query.

Answer

Client sends DNS query to local resolver; client uses IP address; server responds with A-record; then nslookup for basic query; then dig for detailed diagnostics.

Answer

Client sends DNS query to local resolver; server responds with A-record; then nslookup for basic query; then dig for detailed diagnostics; then client uses IP address.

Question 13

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet.

OPTIONS:
  A: Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay. [CORRECT]
  B: Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet.
  C: Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet.
  D: Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Accepted Answer

Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay.. The relay agent must be configured first by setting the ip helper-address on the client-facing interface, then verifying connectivity to the DHCP server. The DORA process should be observed using a relay-specific debug command such as debug ip dhcp relay; the originally listed debug ip dhcp server packet would show no output on a pure relay agent, making it incorrect for verification. Therefore, only option A is correct.

Answer

Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet.

Answer

Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet.

Answer

Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Question 14

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Accepted Answer

Enter global configuration mode, exclude addresses, create the DHCP pool, configure the network and default gateway, enable DHCP relay on the required interface, and verify.. The correct order for configuring a Cisco IOS-XE router as a DHCP server and relay agent is: first exclude addresses to prevent the DHCP server from leasing reserved IPs, then create and configure the DHCP pool (network, default gateway), next enable DHCP relay on the required interface, and finally verify. Only Option D follows this sequence exactly. Options A, B, and C are incorrect because they either place exclusion after pool creation (A) or enable relay before the pool is fully configured (B and C), which can lead to address conflicts or forwarding issues.

Answer

Enter global configuration mode, create the DHCP pool, configure the network and default gateway, exclude addresses, enable DHCP relay on the required interface, and verify.

Answer

Enter global configuration mode, enable DHCP relay on the required interface, create the DHCP pool, configure the network and default gateway, exclude addresses, and verify.

Answer

Enter global configuration mode, create the DHCP pool, enable DHCP relay on the required interface, configure the network and default gateway, exclude addresses, and verify.

Question 15

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Accepted Answer

1. Exclude addresses from the pool. 2. Configure the DHCP pool for VLAN 10 with network, default-router, and DNS. 3. Enable DHCP relay on the VLAN 20 interface. 4. Verify DHCP operations.. The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Answer

1. Enable DHCP relay on the VLAN 20 interface. 2. Configure the DHCP pool for VLAN 10. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Answer

1. Exclude addresses from the pool. 2. Enable DHCP relay on the VLAN 20 interface. 3. Configure the DHCP pool for VLAN 10. 4. Verify DHCP operations.

Answer

1. Configure the DHCP pool for VLAN 10. 2. Enable DHCP relay on the VLAN 20 interface. 3. Exclude addresses from the pool. 4. Verify DHCP operations.