CCNA Network Services and Security Practice Test 31 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a local subnet and enable a DHCP relay agent on a different interface to forward client requests to that server.

Accepted Answer

Configure the DHCP server on the local subnet, then configure the DHCP relay agent on the remote interface, and finally verify both server and relay functionality.. The DHCP server must be configured first on the local subnet, then the relay agent on the remote interface to forward requests; verification ensures both server and relay function correctly.

Answer

Configure the DHCP relay agent on the remote interface, then configure the DHCP server on the local subnet, and finally verify both server and relay functionality.

Answer

Configure the DHCP server on the local subnet, then verify functionality, and finally configure the DHCP relay agent on the remote interface.

Answer

Configure the DHCP relay agent on the remote interface, then verify functionality, and finally configure the DHCP server on the local subnet.

Question 2

Which TWO statements correctly describe the operation of the ip helper-address command in a DHCP relay agent configuration?

Accepted Answer

It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.. The `ip helper-address` command is configured on the router interface facing the client, and it converts the client's DHCPDISCOVER broadcast into a unicast directed to the specified DHCP server, allowing the client to obtain an IP address from a server on a different subnet. Option D is also correct because the relay agent sets the giaddr (gateway IP address) field in the DHCP packet to its own interface IP address. This is how the DHCP server knows which subnet the client is on and can assign an appropriate IP address and return the reply. Option B is incorrect because the command is configured on the interface facing the DHCP clients, not on the server-facing interface. Option C is incorrect because `ip helper-address` does not forward all UDP broadcasts; it only forwards broadcasts for specific UDP ports (DHCP, DNS, TFTP, etc.) by default, and this list can be modified. Option E is incorrect because the command does not perform any MAC address validation or spoofing protection; it simply relays DHCP messages.

Answer

It is configured on the DHCP server interface to allow replies to reach clients on remote subnets.

Answer

It automatically forwards all UDP broadcasts by default.

Answer

It prevents DHCP spoofing by validating the source MAC address of DHCP packets.

Question 3

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.

Accepted Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.. The 802.1X port is stuck in UNAUTHORIZED because AAA authentication for dot1x is set to 'local' but there is no local user database configured. Additionally, the RADIUS server is configured but not used for dot1x or login. The fix is to change 'aaa authentication dot1x default' to use group radius, and 'aaa authentication login default' to group radius local for fallback. Also ensure the RADIUS server is reachable and the key matches the server.

Answer

Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.

Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.

Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.

Question 4

You are connected to R1. Configure AAA with RADIUS authentication so that SSH users are authenticated first against the RADIUS server (198.51.100.10) and fall back to the local user database if the server is unreachable. Additionally, troubleshoot why an 802.1X-enabled interface (GigabitEthernet0/1) remains in the unauthorized state. The RADIUS server shares a key of 'cisco123' and uses UDP port 1812. The local user 'admin' with secret 'adminpass' must be available as a fallback.

Accepted Answer

[CORRECT] The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.. The RADIUS server is unreachable (not reachable), but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. When the server cannot be reached (e.g., timeout), no fallback exists, so the port stays unauthorized. The fix is to modify the dot1x authentication list to include 'local' as a fallback method. Adding local fallback allows the switch to authenticate the supplicant using the local database when the RADIUS server is unreachable.

Answer

The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.

Answer

The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.

Answer

The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.

Question 5

You are connected to R1. The network has two routers (R1 and R2) connected via a serial link (S0/0/0). R1's GigabitEthernet0/0 connects to the 192.168.1.0/24 LAN. An extended ACL must be configured on R1 to permit only HTTPS traffic (TCP port 443) from host 192.168.1.10 to server 203.0.113.5 (reachable via R2), and deny all other traffic from the LAN to the server. Currently, the ACL is applied inbound on G0/0 but valid HTTPS traffic is being blocked. Troubleshoot and fix the configuration.

Accepted Answer

The ACL is missing an explicit permit statement for HTTPS traffic from host 192.168.1.10 to server 203.0.113.5, and the current permit ip any any allows all traffic, including HTTP, which violates the requirement to deny HTTP.. Valid HTTPS is blocked because the current ACL does not have an effective ACE permitting TCP/443 from 192.168.1.10 to 203.0.113.5; the implicit deny at the end drops that traffic. A reachable `permit ip any any` would allow HTTPS, so if such an ACE appears in the configuration it is not the effective match for this flow. The correct fix adds an explicit permit for TCP 443 from the host to the server, denies HTTP and all other IP traffic from the LAN to the server, and then permits all other IP traffic.

Answer

The ACL is applied inbound on G0/0, but it should be applied outbound on G0/0 to filter traffic leaving the LAN.

Answer

The ACL should be applied to the serial interface S0/0/0 instead of G0/0 to filter traffic going to R2.

Answer

The ACL is missing a deny statement for all other traffic from the LAN to the server, and the permit ip any any allows everything, including unwanted traffic.

Question 6

You are connected to R1. The network has two routers (R1, R2) and a switch (SW1) in between. R1's G0/0 connects to SW1 (192.168.1.1/24), SW1 connects to R2's G0/0 (192.168.1.2/24). R2 has a loopback (Lo0: 203.0.113.1/32) used as a management address. Configure an extended ACL on R1 so that only SSH (TCP/22) traffic from the 10.0.0.0/24 network is permitted to reach R2's loopback; all other traffic to that loopback must be denied. Then apply the ACL in the correct direction on the correct interface.

Accepted Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any host 203.0.113.1
interface GigabitEthernet0/1
 ip access-group 100 in. The current configuration has no ACL restricting traffic to R2's loopback. The candidate must create an extended ACL that permits TCP from 10.0.0.0/24 to host 203.0.113.1 eq 22, then deny all other IP traffic to that host. The ACL must be applied inbound on R1's G0/1 (facing the 10.0.0.0/24 network) to filter traffic before it enters R1. Applying outbound on G0/0 would also work, but inbound on G0/1 is more efficient and typical. The implicit deny at the end of the ACL blocks all other traffic to the loopback.

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any host 203.0.113.1
interface GigabitEthernet0/0
 ip access-group 100 out

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
interface GigabitEthernet0/1
 ip access-group 100 in

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any any
interface GigabitEthernet0/1
 ip access-group 100 in

Question 7

You are connected to R1. The network currently permits all HTTP traffic from hosts on the 192.168.1.0/24 LAN to reach the web server at 203.0.113.10, but SSH traffic (TCP port 22) from the same LAN is being blocked. Additionally, you must ensure that no other traffic from the LAN reaches the server. Configure an extended ACL on R1 to allow only HTTP and SSH from the LAN to the server, and apply it inbound on the correct interface. Verify your solution.

Accepted Answer

Remove the existing ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/0.. The existing ACL BLOCK_SSH is applied inbound on GigabitEthernet0/0 and explicitly denies SSH from the LAN to the server, but permits all other IP traffic (including HTTP). The requirement is to allow only HTTP and SSH, blocking everything else. The solution is to remove the current ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from the LAN to the server for ports 80 (HTTP) and 22 (SSH), and implicitly deny all other traffic, then reapply it inbound on GigabitEthernet0/0.

Answer

Modify the existing ACL BLOCK_SSH by adding a permit statement for HTTP and changing the deny SSH to permit SSH, then reapply it inbound on GigabitEthernet0/0.

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/1 (the WAN interface).

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it outbound on GigabitEthernet0/0.

Question 8

You are connected to R1 via the console. An extended ACL named BLOCK_SMTP has been applied inbound on interface GigabitEthernet0/1, but users on the 192.168.10.0/24 network cannot send email to the SMTP server at 203.0.113.10. Additionally, the ACL is blocking all other traffic that should be permitted. Examine the running configuration and fix the ACL so that SMTP traffic (TCP port 25) from the 192.168.10.0/24 network to the SMTP server is permitted, and all other IP traffic is allowed.

Accepted Answer

permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
deny tcp any any eq 25
permit ip any any. It permits SMTP from 192.168.10.0/24 to the SMTP server, then denies all other SMTP traffic, and finally permits all other IP traffic. Option B is wrong because it places a general permit for any SMTP before the specific deny, meaning all SMTP is permitted regardless of source/destination. Option C is wrong because it denies all SMTP first, so the subsequent specific permit for the user network is never reached. Option D is wrong because the order permits the specific SMTP, then permits all IP traffic (including other SMTP), then denies SMTP—the permit ip any any before the deny makes the deny unreachable for all traffic, allowing all SMTP.

Answer

permit tcp any any eq 25
deny tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
permit ip any any

Answer

deny tcp any any eq 25
permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
permit ip any any

Answer

permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
permit ip any any
deny tcp any any eq 25

Question 9

You are connected to R1. The network uses a single router with two subnets: 192.168.1.0/24 (connected to GigabitEthernet0/0) and 10.0.0.0/30 (connected to GigabitEthernet0/1). Configure an extended named ACL called 'FILTER_HTTP' that permits HTTP traffic (TCP port 80) from the 192.168.1.0/24 subnet to any destination, and includes an explicit deny statement to deny all other IP traffic. Apply the ACL inbound on GigabitEthernet0/0. Then verify that HTTP traffic is allowed and all other traffic is blocked.

Accepted Answer

ip access-list extended FILTER_HTTP
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 deny ip any any
interface GigabitEthernet0/0
 ip access-group FILTER_HTTP in. The task requires creating an extended named ACL 'FILTER_HTTP' that permits TCP port 80 from source 192.168.1.0/24 to any destination, and then denies all other IP traffic (the implicit deny will block everything else, but you must explicitly add a deny ip any any statement to make the intent clear). The ACL must be applied inbound on GigabitEthernet0/0. The solution uses the commands: ip access-list extended FILTER_HTTP, permit tcp 192.168.1.0 0.0.0.255 any eq 80, deny ip any any, and interface GigabitEthernet0/0, ip access-group FILTER_HTTP in. Verification with show access-lists and show ip interface GigabitEthernet0/0 confirms the ACL and its application.

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 access-list 100 deny ip any any
interface GigabitEthernet0/0
 ip access-group 100 in

Answer

ip access-list extended FILTER_HTTP
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
interface GigabitEthernet0/0
 ip access-group FILTER_HTTP in

Answer

ip access-list extended FILTER_HTTP
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 deny ip any any
interface GigabitEthernet0/1
 ip access-group FILTER_HTTP in

Question 10

You are connected to R1 via console. R1 is a router that connects two internal subnets (192.168.1.0/24 and 192.168.2.0/24) to the internet via a serial link to ISP. Currently, no ACL is applied. Your task is to configure an extended named ACL on R1 that permits only HTTP (TCP/80) and HTTPS (TCP/443) traffic from the 192.168.1.0/24 subnet to the internet, and denies all other traffic from that subnet. Traffic from 192.168.2.0/24 must be permitted without restriction. Apply the ACL inbound on the interface facing the internal subnets. Additionally, verify that the implicit deny is not blocking necessary traffic by ensuring that the ACL correctly handles the traffic.

Accepted Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/0
 ip access-group FILTER in. The task required an extended ACL to permit HTTP/HTTPS from 192.168.1.0/24 and all traffic from 192.168.2.0/24. The candidate must create a named ACL (e.g., FILTER), add two permit statements for TCP/80 and TCP/443 from 192.168.1.0 0.0.0.255 to any, then a permit ip from 192.168.2.0 0.0.0.255 to any. The ACL is applied inbound on G0/0 (the interface facing 192.168.1.0/24) because traffic from that subnet enters R1 through G0/0. Applying it outbound on G0/0 would be incorrect, as it would only filter traffic leaving that subnet, not entering. Also, the ACL must be applied on the correct interface to avoid blocking traffic from 192.168.2.0/24, which enters via G0/1.

Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/0
 ip access-group FILTER out

Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/1
 ip access-group FILTER in

Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/0
 ip access-group FILTER in
 interface g0/1
 ip access-group FILTER in

Question 11

You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.

Accepted Answer

Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.. The ACL BLOCK_IN currently has a single deny ip any any entry, which blocks all traffic inbound on G0/1. The correct solution is to first remove the existing ACL, then create a new extended ACL that permits TCP 443 from source network 192.0.2.0/24 to destination network 203.0.113.0/24, and apply it inbound on G0/1. The implicit deny at the end of the ACL will then block all other traffic, achieving the desired policy.

Answer

Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.

Answer

Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.

Answer

Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.

Question 12

You are connected to R1, a branch router. Configure an extended ACL named BRANCH_IN that permits only HTTP (TCP port 80) traffic from the internal network 192.168.1.0/24 to the web server at 203.0.113.10, and permits ICMP echo-reply from any source to any destination. Apply the ACL inbound on the interface facing the internal network. Then verify that only the specified traffic is allowed.

Accepted Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in. It creates an extended ACL that permits TCP port 80 from the internal 192.168.1.0/24 to the web server 203.0.113.10 and permits only ICMP echo-reply, then applies it inbound on the internal interface G0/0, matching the requirement. Option B is wrong because the ACL is applied outbound on G0/0, but traffic from internal hosts to the web server exits via the WAN interface (G0/1), not G0/0. Option C is wrong because it permits all ICMP (any any) instead of only echo-reply, allowing unnecessary ICMP traffic. Option D is wrong because it applies the ACL inbound on both G0/0 and G0/1; applying it on G0/1 would incorrectly filter inbound traffic from the ISP, potentially blocking the web server's responses.

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN out

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in
!
interface GigabitEthernet0/1
 ip access-group BRANCH_IN in

Question 13

You are connected to R1. The network uses 192.168.1.0/24 for internal hosts and 203.0.113.0/29 for the public IP pool (203.0.113.2 is the outside interface). Configure PAT so that inside hosts can reach the Internet using the pool address 203.0.113.2. Also configure static NAT to map internal server 192.168.1.10 to 203.0.113.3. The initial config has errors; identify and fix them.

Accepted Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255 and ensure the NAT pool and PAT are correctly configured.. The ACL 10 permits 10.0.0.0/8, but inside hosts are on 192.168.1.0/24 — this ACL does not match the inside subnet, so PAT fails. The static NAT is correct. To fix: change ACL 10 to permit 192.168.1.0 0.0.0.255. Also ensure the PAT references the correct ACL; currently it uses list 10, so after fixing the ACL, PAT will work. No other changes needed.

Answer

Change the NAT pool to use a different public IP address and update the static NAT mapping.

Answer

Remove the static NAT and use PAT for the server as well.

Answer

Change the inside interface IP address to match the ACL.

Question 14

You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.

Accepted Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.. Three issues exist: (1) GigabitEthernet0/1 is the outside interface but is configured as 'ip nat inside' — it should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword, so it does one-to-one translation instead of port address translation. (3) ACL 1 permits 192.168.2.0/24, but the inside LAN is 192.168.1.0/24 — the ACL must match the correct subnet. Correcting these allows PAT for the LAN and static NAT for the web server.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Question 15

You are connected to R1. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 inside network can reach the Internet through the outside interface GigabitEthernet0/1 using the IP address 203.0.113.1. Additionally, configure static NAT to map internal server 192.168.1.10 to public IP 203.0.113.5. The current configuration has several errors. Identify and correct them.

Accepted Answer

Correct the NAT interface directions: G0/0 as inside, G0/1 as outside. Add 'overload' to the PAT command. Change ACL 100 to permit 192.168.1.0 0.0.0.255.. The configuration had three issues: (1) Inside and outside interfaces were swapped — G0/0 (inside) was marked 'ip nat outside' and G0/1 (outside) was 'ip nat inside'. (2) The PAT command was missing the 'overload' keyword. (3) ACL 100 matched the wrong subnet (192.168.2.0 instead of 192.168.1.0). To fix: correct interface NAT directions, add 'overload', and update ACL to permit 192.168.1.0/24.

Answer

Change the NAT interface directions: G0/0 as outside, G0/1 as inside. Add 'overload' to the PAT command. Change ACL 100 to permit 192.168.1.0 0.0.0.255.

Answer

Correct the NAT interface directions: G0/0 as inside, G0/1 as outside. Add 'overload' to the PAT command. Keep ACL 100 as is because it already permits the correct subnet.

Answer

Change the NAT interface directions: G0/0 as outside, G0/1 as inside. Add 'overload' to the PAT command. Change ACL 100 to permit 192.168.1.0 0.0.0.255.