CCNA Network Services and Security Practice Test 32 — 15 Questions

Question 1

You are connected to R1, a multilayer switch acting as a DNS forwarder for two VLANs. Users on VLAN 10 report that they cannot resolve 'files.example.com' while VLAN 20 works fine. The DNS server 198.51.100.53 is reachable but returns SERVFAIL for queries from subnet 192.168.10.0/24, while server 203.0.113.53 responds correctly for both VLANs. Diagnose and fix the DNS resolution issue using nslookup and dig, then adjust the IOS-XE configuration to ensure proper name resolution. Choose the best fix that permanently resolves the problem.

Accepted Answer

Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.. The faulty DNS server 198.51.100.53 returns SERVFAIL for the A record query, indicating a misconfiguration or missing record on that server. Although reordering (Option C) would allow resolution to work by querying the functional server first, it is not the optimal fix because the broken server remains in the list and could still be used if the primary times out or for future queries. The best practice is to completely remove the faulty server using 'no ip name-server 198.51.100.53'. Option B adds a static entry that only helps one domain and does not address the root cause. Option D would make the router use only the broken server, worsening the problem.

Answer

Add a static DNS entry for 'files.example.com' using 'ip host files.example.com 10.0.0.1' on R1.

Answer

Change the DNS server order so that the working server is primary using 'ip name-server 203.0.113.53 198.51.100.53'.

Answer

Configure the router to use only the faulty server by removing the working server with 'no ip name-server 203.0.113.53'.

Question 2

You are troubleshooting DNS resolution issues from R1. Using nslookup and dig commands, diagnose why the router cannot resolve the hostname 'fileserver.courseiva.com' to an IP address, and why reverse lookup for IP address 198.51.100.10 fails. Determine the appropriate fix to ensure successful forward and reverse DNS resolution.

Accepted Answer

Add an A record for 'fileserver.courseiva.com' pointing to 198.51.100.10 and a PTR record for 198.51.100.10 pointing to 'fileserver.courseiva.com' on the DNS server.. The DNS resolution failures are due to two issues: the A record for 'fileserver.courseiva.com' does not exist on the DNS server (NXDOMAIN response), and the PTR record for reverse lookup of 198.51.100.10 is missing. To resolve the forward lookup, you must add an A record mapping the hostname to an IP address on the DNS server (e.g., 198.51.100.10). For the reverse lookup, you need to add a PTR record mapping the IP address 198.51.100.10 to the hostname. On R1, the DNS configuration is correct (ip domain-lookup enabled, name-server 203.0.113.1), but the DNS server lacks the necessary records. The solution involves configuring the DNS server (not R1) to add the missing records. On R1, ensure that the DNS server is reachable and that the domain lookup is enabled; no additional CLI changes are required on the router.

Answer

Configure the 'ip host' command on R1 to statically map 'fileserver.courseiva.com' to 198.51.100.10.

Answer

Enable 'ip domain-lookup' and configure the correct DNS server IP on R1 using 'ip name-server 203.0.113.1'.

Answer

Add only an A record for 'fileserver.courseiva.com' on the DNS server.

Question 3

You are connected to R1, a multilayer switch acting as a DNS client for internal name resolution. The network uses a private DNS server at 192.168.1.100. Users report that resolving the hostname 'server01.courseiva.local' fails intermittently. Diagnose and fix the DNS resolution issue by examining the current configuration and using appropriate show commands to verify.

Accepted Answer

Re-enter the 'ip name-server 192.168.1.100' command and verify with 'show ip dns'.. The 'ip name-server' command was missing from the configuration, causing the switch to use broadcast DNS queries (to 255.255.255.255) instead of a specific server. Broadcast queries may occasionally succeed if a DNS server on the network answers them, producing the reported intermittent failures. Re-entering the 'ip name-server 192.168.1.100' command forces directed queries, ensuring reliable resolution. After configuration, a 'ping server01.courseiva.local' will trigger DNS and confirm success if the server is reachable.

Answer

Configure 'ip domain lookup' to enable DNS resolution on the switch.

Answer

Change the 'ip domain name' to 'courseiva.local' to match the hostname being resolved.

Answer

Use 'debug ip dns' to monitor DNS queries and identify the problem.

Question 4

You are connected to R1. Configure R1 as a DHCP server for the 192.168.100.0/24 subnet, reserving the first 10 addresses and the address 192.168.100.254 for static assignments, with default gateway 192.168.100.1 and DNS server 8.8.8.8. Then, on the same router, enable DHCP relay for the 10.1.1.0/24 subnet by configuring the helper address pointing to the DHCP server at 192.168.100.1. Finally, verify that the DHCP pool is correctly configured and that the helper address is set.

Accepted Answer

The default-router is incorrectly set to 192.168.100.254 instead of 192.168.100.1, and the ip helper-address on G0/1 points to 192.168.100.254 instead of 192.168.100.1.. The configuration has two critical errors. First, the default-router in the DHCP pool is incorrectly set to 192.168.100.254, which is an excluded address meant for static assignment, not the actual gateway (192.168.100.1). Second, the ip helper-address on G0/1 points to 192.168.100.254 (the wrong address) instead of the DHCP server's own interface IP 192.168.100.1. To fix, change the default-router to 192.168.100.1 and update the helper-address to 192.168.100.1.

Answer

The default-router is correctly set to 192.168.100.1, but the ip helper-address on G0/1 points to 192.168.100.254 instead of 192.168.100.1.

Answer

The default-router is incorrectly set to 192.168.100.254 instead of 192.168.100.1, but the ip helper-address on G0/1 correctly points to 192.168.100.1.

Answer

Both the default-router and the ip helper-address are correctly configured as 192.168.100.1.

Question 5

You are connected to R1 via the console. R1 is the DHCP server for the 192.168.50.0/24 LAN. Configure DHCP on R1 to assign addresses from 192.168.50.10 to 192.168.50.200, with default gateway 192.168.50.1 and DNS server 8.8.8.8. Also, configure R1 to act as a DHCP relay agent for the 10.0.0.0/30 link to reach a remote DHCP server at 203.0.113.10. Then, troubleshoot and fix a misconfiguration that causes clients on VLAN 50 to not receive IP addresses.

Accepted Answer

[CORRECT] The DHCP pool is misconfigured: the excluded-address range covers most of the pool (192.168.50.1 through 192.168.50.200), but leaves 192.168.50.201-254 assignable, violating the requirement. The correct configuration should exclude 192.168.50.1-9 (gateway) and 192.168.50.201-254 (upper end). The 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1.. The DHCP pool is misconfigured: the excluded-address range of 192.168.50.1 through 192.168.50.200 covers most of the pool, but leaves addresses 192.168.50.201 to 192.168.50.254 assignable, which violates the requirement to assign addresses only from 192.168.50.10 to 192.168.50.200. To meet the requirement, you must exclude both the lower range (192.168.50.1 to 192.168.50.9, reserving the gateway) and the upper range (192.168.50.201 to 192.168.50.254). Additionally, the 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1 so that broadcasts from the 10.0.0.0/30 subnet are forwarded.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9, but the helper-address on GigabitEthernet0/0 is correct because it forwards DHCP requests to the remote server. The relay agent configuration is missing on GigabitEthernet0/1.

Answer

The DHCP pool is correctly configured with excluded-address 192.168.50.1 192.168.50.9. The issue is that the 'ip helper-address' on GigabitEthernet0/1 is missing; it should be added to forward requests to the remote server. Additionally, the 'ip helper-address' on GigabitEthernet0/0 is correct because it forwards requests from VLAN 50 to the remote server.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9. The 'ip helper-address' on GigabitEthernet0/0 should be removed. The relay agent configuration is correct because 'ip helper-address 203.0.113.10' is already configured on GigabitEthernet0/1.

Question 6

You are connected to R1 (a router acting as DHCP server) via the console. Configure R1 to provide DHCP addresses for VLAN 10 (192.168.10.0/24) on the switch SW1, which is connected via R1's G0/0. Exclude the first 10 addresses (192.168.10.1-10) and the last address (192.168.10.254). Set the default gateway to 192.168.10.1 and DNS server to 203.0.113.10. On SW1, enable DHCP snooping globally and for VLAN 10, configure G0/1 as trusted toward R1, and ensure the ip helper-address on the switch's VLAN 10 SVI points to R1's G0/0 IP. The current config has a wrong helper-address and an oversized excluded range; identify and fix all issues.

Accepted Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10 and ip dhcp excluded-address 192.168.10.254; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 10.0.0.1.. The DHCP server R1 had an excluded range that covered the entire subnet (192.168.10.1 through 192.168.10.254), preventing any addresses from being assigned. This was corrected by first removing that oversized exclusion, then setting the excluded range to 192.168.10.1 192.168.10.10 and adding 192.168.10.254 as a separate excluded address. On SW1, the ip helper-address pointed to 192.168.20.1 (wrong), which should be R1's G0/0 IP 10.0.0.1. Also, DHCP snooping was enabled globally and for VLAN 10, but G0/1 (link to R1) was not trusted; it was set to trusted. These changes allow DHCP requests from VLAN 10 to be relayed to R1 and trusted from the correct interface. Option A is technically incomplete because it fails to include the removal of the original oversized exclusion.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 192.168.10.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.10; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface Vlan10: ip helper-address 10.0.0.1.

Answer

On R1: ip dhcp excluded-address 192.168.10.1 192.168.10.254; ip dhcp pool VLAN10: network 192.168.10.0 255.255.255.0, default-router 192.168.10.1, dns-server 203.0.113.10. On SW1: ip dhcp snooping, ip dhcp snooping vlan 10, interface G0/1: ip dhcp snooping trust, interface Vlan10: ip helper-address 10.0.0.1.

Question 7

You are connected to R1. Configure R1 as a DHCP server for VLAN 20 clients (192.168.20.0/24) with DNS server 203.0.113.10 and default gateway 192.168.20.1. On switch SW1, enable DHCP snooping globally and on VLAN 20, configure the uplink to R1 as trusted, and ensure that the DHCP server is reachable via ip helper-address on the VLAN 20 SVI. Currently, clients are not receiving IP addresses because of misconfigurations: the excluded-address range on R1 is too large (excluding the entire subnet), the helper-address on SW1 points to a wrong IP (192.0.2.99), and a rogue DHCP server is connected to port Fa0/3 on SW1. Fix all issues so that clients can get addresses securely.

Accepted Answer

On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.. The DHCP server had an excluded-address range covering the entire subnet (192.168.20.0–255), which prevented any IP from being assigned. Fix: change the excluded range to only include the gateway (192.168.20.1) and optionally other reserved addresses. The helper-address on SW1 pointed to 192.0.2.99 (nonexistent) instead of the DHCP server at 10.0.0.1; correct it. DHCP snooping was disabled; enable it globally and on VLAN 20, then configure the uplink to R1 (port connecting to R1) as trusted and the port connecting the rogue server (Fa0/3) as untrusted (or simply leave it untrusted by default, but the rogue server will be blocked).

Answer

On R1, remove the excluded-address range entirely; on SW1, configure ip helper-address 192.168.20.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

Answer

On R1, change the excluded-address range to 192.168.20.1 192.168.20.254; on SW1, configure ip helper-address 192.0.2.99 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

Answer

On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, but do not configure any trusted ports.

Question 8

You are connected to R1. Configure DHCP services so that hosts on VLAN 10 (192.168.10.0/24) can obtain IP addresses from R1. Additionally, configure the switch SW1 to prevent rogue DHCP server attacks on that VLAN. The current configuration has a misconfigured helper-address and an excluded-address range that is too broad.

Accepted Answer

On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as trusted.. The helper-address on R1's subinterface points to 10.0.0.2 instead of the DHCP server's IP (R1 itself, which is the server). The excluded-address range excludes all addresses in the subnet, preventing any host from getting an IP. The fix: change helper-address to 192.168.10.1 (loopback or interface IP of R1), and narrow the excluded range to the first 10 addresses (or just the gateway). On SW1, enable DHCP snooping globally and for VLAN 10, and mark the port facing R1 (G0/1) as trusted; other ports should be untrusted to block rogue servers.

Answer

On R1, change the helper-address to 192.168.10.255 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set all ports as trusted.

Answer

On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.254. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

Answer

On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

Question 9

You are connected to SW1, a multilayer switch. Configure DHCP snooping and an IP helper-address so that clients in VLAN 20 receive IP addresses from the DHCP server at 10.0.0.2. The DHCP server is already configured with a pool for 192.168.20.0/24, but clients are not getting addresses. Identify and correct the issues in the current configuration.

Accepted Answer

Enable DHCP snooping globally and on VLAN 20, configure interface G0/0 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.. The DHCP relay helper-address was pointing to 10.0.0.3 instead of the actual server at 10.0.0.2. Also, DHCP snooping was not enabled. After enabling DHCP snooping globally and on VLAN 20, configure the uplink to the DHCP server as a trusted port (G0/0) and the access port (G0/1) as untrusted (default). Finally, correct the helper-address to 10.0.0.2. These steps allow DHCP broadcasts from VLAN 20 to be relayed to the server and prevent rogue DHCP attacks.

Answer

Enable DHCP snooping globally and on VLAN 20, configure interface G0/1 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

Answer

Enable DHCP snooping globally and on VLAN 20, configure interface G0/0 as trusted, and keep the ip helper-address as 10.0.0.3 because that is the correct server address.

Answer

Enable DHCP snooping globally and on VLAN 20, configure both interfaces G0/0 and G0/1 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

Question 10

You are connected to R1. Configure DHCP server on R1 to assign addresses from 192.168.50.0/24 to hosts on VLAN 50, excluding 192.168.50.1-192.168.50.20, with default-router 192.168.50.1 and DNS server 8.8.8.8. On switch SW1, configure DHCP snooping globally and on VLAN 50, and enable trusted ports on the uplink to R1. Then, a host on VLAN 50 reports it received an incorrect IP address; troubleshoot and fix the issue: the wrong helper-address is configured on SW1, the excluded range is too large, and a rogue DHCP server is present on port Fa0/5.

Accepted Answer

Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, correct the excluded range on R1 to 192.168.50.1-192.168.50.20, and change the helper-address on SW1's G0/1 to 192.168.50.1.. The host received a wrong IP because a rogue DHCP server on Fa0/5 was responding. First, enable DHCP snooping globally with 'ip dhcp snooping' and on VLAN 50 with 'ip dhcp snooping vlan 50'. Then, trust the uplink port to R1 (G0/1) with 'ip dhcp snooping trust'. Next, fix the excluded range on R1: change it to exclude only the first 20 addresses (192.168.50.1-192.168.50.20) so that hosts can obtain other addresses. Finally, correct the helper-address on SW1's G0/1: change 'ip helper-address 10.0.0.1' to 'ip helper-address 192.168.50.1' because the DHCP server is on the VLAN 50 SVI, not on the point-to-point link.

Answer

Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 10.0.0.1.

Answer

Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and correct the excluded range on R1 to 192.168.50.1-192.168.50.20.

Answer

Enable DHCP snooping globally and on VLAN 50, trust the uplink port to R1, and change the helper-address on SW1's G0/1 to 192.168.50.1.

Question 11

You are connected to the multilayer switch MLS1 in a branch network. The DHCP server on router R1 is supposed to serve the 192.168.20.0/24 VLAN 20, but clients in VLAN 20 are not receiving IP addresses. Additionally, a rogue DHCP server has been detected on VLAN 20. Configure MLS1 to enable DHCP snooping on VLAN 20, set the trust state on the uplink port to R1, and limit the rate of DHCP packets on access ports. Then, on R1, correct the DHCP configuration so that the pool for VLAN 20 uses the correct default-router (192.168.20.1) and DNS server (8.8.8.8), and ensure that the excluded-address range is not too large (exclude only the first 10 addresses). Verify the solution.

Accepted Answer

On MLS1: ip dhcp snooping, ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8. The problem had three faults: First, the DHCP pool on R1 had a wrong default-router (192.168.10.1 instead of 192.168.20.1) and an incorrect DNS server (4.4.4.4 instead of 8.8.8.8). Second, the excluded-address range was too large (excluding all addresses from .1 to .254 effectively blocked all dynamic assignments; corrected to exclude only .1 through .10). Third, DHCP snooping was disabled on MLS1, allowing a rogue DHCP server. To enable DHCP snooping, both the global `ip dhcp snooping` command and the VLAN-specific `ip dhcp snooping vlan 20` command are required. With snooping enabled, the uplink port Gig0/0 was set as trusted and the access port Gig0/1 was configured with rate limiting to prevent DHCP starvation attacks.

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.254, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.10.1 dns-server 4.4.4.4

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8, but no ip dhcp snooping enabled globally on MLS1

Question 12

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP router at 10.0.0.2/30. The internal network has a web server at 192.168.1.10 and a mail server at 192.168.1.20. You need to configure NAT so that internal hosts can access the internet (PAT overload) and external users can reach the web server via public IP 203.0.113.10 and the mail server via public IP 203.0.113.11. The inside interface is GigabitEthernet0/1 (192.168.1.1/24) and the outside interface is GigabitEthernet0/0.

Accepted Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 extendable
ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25 extendable. The named standard ACL PERMIT_INTERNAL permits all internal hosts in 192.168.1.0/24. The 'ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload' command enables PAT, translating internal addresses to the outside interface's IP. Static NAT entries map web and mail servers to public IPs with the 'extendable' keyword to allow both PAT and static NAT. Proper interface NAT direction (inside/outside) is crucial.

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat outside
interface GigabitEthernet0/0
 ip nat inside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80
ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static 192.168.1.10 203.0.113.10
ip nat inside source static 192.168.1.20 203.0.113.11

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat outside source static tcp 203.0.113.10 80 192.168.1.10 80
ip nat outside source static tcp 203.0.113.11 25 192.168.1.20 25

Question 13

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to R2 (10.0.0.2/30). Hosts on the LAN (192.168.1.0/24) need DHCP services. The DHCP server is located at 172.16.1.100 on a different subnet reachable via R2. Configure R1 to forward DHCP broadcasts to the DHCP server.

Accepted Answer

ip helper-address 172.16.1.100. The ip helper-address command on the LAN interface forwards DHCP broadcast requests to the DHCP server at 172.16.1.100, allowing clients to obtain IP addresses across subnets.

Answer

ip dhcp relay information option

Answer

ip forward-protocol udp 67

Answer

ip dhcp-server 172.16.1.100

Question 14

You are connected to R1 via the console. R1 is an NTP client that should synchronize its clock with NTP server 192.168.1.100. The timezone is UTC-5 (Eastern Standard Time). Configure NTP on R1 so that it becomes an NTP client. Additionally, configure the router to log NTP synchronization status messages to the console and buffer logging using the numeric severity level 6 (informational).

Accepted Answer

ntp server 192.168.1.100
logging console 6
logging buffered 6. The correct NTP client command is 'ntp server 192.168.1.100', not 'ntp peer'. The logging commands must use the numeric level 6 to match the requirement. 'logging console 6' and 'logging buffered 6' achieve this; keyword 'informational' is technically valid but does not follow the explicit numeric specification. Mixing numeric and keyword is also incorrect under the given requirement.

Answer

ntp server 192.168.1.100
logging console informational
logging buffered informational

Answer

ntp peer 192.168.1.100
logging console 6
logging buffered 6

Answer

ntp server 192.168.1.100
logging console informational
logging buffered 6

Question 15

You are connected to R1 via the console. R1 connects two networks: GigabitEthernet0/0 (192.168.1.1/24) and GigabitEthernet0/1 (192.168.2.1/24). Create an extended ACL named BLOCK_HTTP that denies HTTP traffic (tcp port 80) from the 192.168.1.0/24 network to the 192.168.2.0/24 network, but permits all other IP traffic. Apply this ACL inbound on GigabitEthernet0/0.

Accepted Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP in. The named extended ACL BLOCK_HTTP denies TCP port 80 from 192.168.1.0/24 to 192.168.2.0/24, then permits all other traffic. Applying it inbound on G0/0 filters traffic from LAN A before routing.

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/1
ip access-group BLOCK_HTTP in

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP out

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP in
interface GigabitEthernet0/1
ip access-group BLOCK_HTTP in

CCNA Network Services and Security Practice Test 32 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 32 — 15 Questions

Exhibit