CCNA Network Services and Security Practice Test 31 — 15 Questions

Question 1

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Accepted Answer

Trusted. DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.

Answer

Secure

Answer

Authorized

Answer

Relay

Question 2

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode, define the RADIUS server, configure AAA authentication, enable 802.1X globally, apply per-interface 802.1X settings.. First enter global config, then define the RADIUS server, then configure AAA authentication, then enable 802.1X globally, and finally apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, define the RADIUS server, configure AAA authentication, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, configure AAA authentication, define the RADIUS server, enable 802.1X globally, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, define the RADIUS server, enable 802.1X globally, configure AAA authentication, apply per-interface 802.1X settings.

Question 3

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interface. First enter global config, then define RADIUS server, then configure AAA authentication, then enable 802.1X globally, then apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interface

Answer

Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interface

Answer

Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interface

Question 4

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Accepted Answer

aaa new-model. AAA configuration must precede 802.1X. The correct order is: first enable AAA globally with 'aaa new-model', then define the RADIUS server with 'radius server RADIUS-SERVER', then globally enable 802.1X with 'dot1x system-auth-control', and finally on the interface set authentication port-control with 'authentication port-control auto'.

Question 5

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode and enable AAA globally using the 'aaa new-model' command.. Start by entering global configuration mode and enabling AAA with 'aaa new-model'. Next, create an authentication method list using 'aaa authentication dot1x default group radius' to define the method for 802.1X. Then, configure the RADIUS server parameters using 'radius-server host' and 'radius-server key' so the switch knows where to send authentication requests; note that the method list can reference the 'radius' group even before the server is specified. Finally, enable 802.1X system-wide with the global command 'dot1x system-auth-control' to activate 802.1X globally. This order ensures each prerequisite is met before the next step.

Question 6

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Configure RADIUS server, enable AAA globally, create an authentication list for 802.1X, apply 802.1X to the port. First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Answer

Enable AAA globally, configure RADIUS server, apply 802.1X to the port, create an authentication list for 802.1X

Answer

Configure RADIUS server, create an authentication list for 802.1X, enable AAA globally, apply 802.1X to the port

Answer

Apply 802.1X to the port, configure RADIUS server, enable AAA globally, create an authentication list for 802.1X

Question 7

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Accepted Answer

TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.. TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes. Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Answer

RADIUS encrypts the entire packet payload, including all attributes.

Answer

TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

Answer

When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.

Question 8

Drag and drop the following steps into the correct order to configure and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.1, with the ACL applied inbound on the router's GigabitEthernet0/0 interface, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.. First, enter config mode. Create the ACL permitting HTTP from the source network to the destination host. Apply it inbound on the correct interface. Then exit and verify.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it outbound on GigabitEthernet0/0 with 'ip access-group 100 out', then exit and verify with 'show access-lists'.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then verify with 'show running-config' without exiting configuration mode.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show ip interface brief'.

Question 9

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.100, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the interface facing the 192.168.1.0/24 network, save the configuration, and verify with show access-lists.. First, enter config mode. Then create the ACL allowing HTTP from the source network to the destination host. Apply it inbound on the appropriate interface. Save and verify the configuration.

Answer

Enter global configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it outbound on the interface facing the server, save the configuration, and verify with show ip interface.

Answer

Enter interface configuration mode, create the ACL with a permit statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the same interface, save the configuration, and verify with show running-config.

Answer

Enter global configuration mode, create the ACL with a deny statement for HTTP from 192.168.1.0/24 to 10.0.0.100, apply it inbound on the interface facing the server, save the configuration, and verify with show access-lists.

Question 10

Which of the following is the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the router's G0/0 interface?

Accepted Answer

Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group in. The correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from 192.168.1.0/24 to 10.0.0.0/24, applied inbound on G0/0, is: first enter global configuration mode, create the ACL with a deny statement for the specific source and destination, then add a permit ip any any statement, then enter interface G0/0, and apply the ACL inbound with ip access-group in. Option B is incorrect because the ACL must be created before entering the interface. Option C is incorrect because the order of ACEs within the ACL must have the specific deny before the broad permit. Option D is incorrect because ip access-group must be applied on an interface, not globally.

Answer

Enter interface G0/0, apply ip access-group <acl-number> in, then create ACL with deny tcp any any eq telnet, permit ip any any

Answer

Enter global configuration mode, create ACL with permit ip any any, deny tcp any any eq telnet, then enter interface G0/0, apply ip access-group <acl-number> in

Answer

Enter global configuration mode, create ACL with deny tcp any any eq telnet, permit ip any any, then apply ip access-group <acl-number> in without entering interface

Question 11

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Accepted Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Apply the ACL inbound on GigabitEthernet0/1. Step 3: Verify the ACL configuration.. ACL configuration requires defining permit/deny statements first, then applying to the interface inbound, and finally verification.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Define the ACL with permit and deny statements. Step 3: Verify the ACL configuration.

Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Verify the ACL configuration. Step 3: Apply the ACL inbound on GigabitEthernet0/1.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Verify the ACL configuration. Step 3: Define the ACL with permit and deny statements.

Question 12

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server 10.0.0.10, applied inbound on interface GigabitEthernet0/1.

Accepted Answer

1. Enter global configuration mode
2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
3. Enter interface configuration mode for GigabitEthernet0/1
4. Apply the ACL inbound with ip access-group ACL_NAME in
5. Exit configuration mode and verify with show access-lists. After entering config mode, create the ACL to allow HTTP from the specified network to the server. Apply it inbound on the correct interface. Then exit and verify.

Answer

1. Enter interface configuration mode for GigabitEthernet0/1
2. Apply the ACL inbound with ip access-group ACL_NAME in
3. Enter global configuration mode
4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
5. Exit configuration mode and verify with show access-lists

Answer

1. Enter global configuration mode
2. Enter interface configuration mode for GigabitEthernet0/1
3. Apply the ACL inbound with ip access-group ACL_NAME in
4. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
5. Exit configuration mode and verify with show access-lists

Answer

1. Enter global configuration mode
2. Create the ACL with permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.10 eq www
3. Exit configuration mode and verify with show access-lists
4. Enter interface configuration mode for GigabitEthernet0/1
5. Apply the ACL inbound with ip access-group ACL_NAME in

Question 13

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.

Accepted Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.. First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.

Answer

Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.

Answer

Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.

Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.

Question 14

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Accepted Answer

Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.. First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Answer

Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.

Answer

Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.

Answer

Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.

Question 15

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Accepted Answer

Extended ACLs are typically placed closest to the source of the traffic.. Extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source. Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.

Answer

Standard ACLs are typically placed closest to the source of the traffic.

Answer

A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.

Answer

Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.