CCNA Network Services and Security Practice Test 33 — 15 Questions

Question 1

You are connected to R1 via console. R1 has two interfaces: GigabitEthernet0/0 (10.0.0.1/30, connected to ISP) and GigabitEthernet0/1 (192.168.1.1/24, connected to internal LAN). The LAN hosts (192.168.1.0/24) need to access the internet. Configure dynamic NAT with PAT (overload) on R1 using a NAT pool so that internal hosts share the public IP 10.0.0.1 when accessing the internet. Assume the ISP router is already configured and reachable.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 10.0.0.1 10.0.0.1 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC overload
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside. Option A is correct because it creates an ACL matching only the internal subnet (192.168.1.0/24), defines a NAT pool containing only the single public IP 10.0.0.1, enables PAT with the 'overload' keyword, and correctly assigns inside/outside interfaces. Option B is wrong because the pool includes 10.0.0.2, which is the ISP's IP and would cause conflicts, plus it lacks the 'overload' keyword so PAT is not activated. Option C is wrong because the ACL uses 'any', potentially matching unintended traffic, and the interface roles are reversed (G0/0 as inside, G0/1 as outside), breaking the NAT translation direction. Option D is incorrect because while it implements PAT correctly, it uses interface overload rather than a NAT pool, which does not meet the explicit requirement to use a pool.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 10.0.0.1 10.0.0.2 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside

Answer

access-list 1 permit any
ip nat pool PUBLIC 10.0.0.1 10.0.0.1 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC overload
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside

Question 2

You are connected to R1 via console. R1 is a router that needs to provide DHCP services to hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The router has two subinterfaces on GigabitEthernet0/0: G0/0.10 (192.168.10.1/24) and G0/0.20 (192.168.20.1/24) with 802.1Q encapsulation. Configure R1 as a DHCP server for both VLANs, excluding addresses 192.168.10.1-10 and 192.168.20.1-10, with a lease of 1 day. Ensure DNS server 8.8.8.8 is provided.

Accepted Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 1
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 1. Option A correctly uses `lease 1` for a 1-day lease, dotted decimal subnet masks, and proper DHCP pool settings. Option B incorrectly uses CIDR notation `/24` in the network command, which IOS does not accept. Option C uses `lease 24`, which is interpreted as 24 days, not 1 day. Option D also incorrectly uses `lease 24`, resulting in a 24-day lease instead of the required 1-day lease.

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 /24
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 1 0 0
ip dhcp pool VLAN20
 network 192.168.20.0 /24
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 1 0 0

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 24
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 24

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 24
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 24

Question 3

You are connected to R1 via console. R1 is a router that should restrict SSH access to only the management station at 192.168.1.100. Currently, SSH is enabled but any IP can connect. Configure a standard named ACL called 'SSH_ACL' to permit only the management station, and apply it to the VTY lines to filter incoming SSH connections. Ensure the VTY lines use SSH only (no Telnet). The SSH version should be set to 2.

Accepted Answer

R1(config)# ip access-list standard SSH_ACL
R1(config-std-nacl)# permit host 192.168.1.100
R1(config-std-nacl)# deny any
R1(config-std-nacl)# exit
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL in
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2. The standard ACL restricts inbound connections to the VTY lines. Applying it with 'ip access-class in' filters incoming Telnet/SSH sessions. Setting 'transport input ssh' disables Telnet, and 'ip ssh version 2' ensures secure SSH version 2.

Answer

R1(config)# access-list SSH_ACL permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# access-group SSH_ACL in
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2

Answer

R1(config)# ip access-list standard SSH_ACL
R1(config-std-nacl)# permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL out
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2

Answer

R1(config)# access-list SSH_ACL permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL in
R1(config-line)# transport input all
R1(config)# ip ssh version 2

Question 4

You are connected to R1 via console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network administrator needs to monitor R1's system messages. Configure R1 to send syslog messages with severity level 5 (notifications) and above to the syslog server at 10.0.0.2. Also, ensure that logging is enabled and that messages include the timestamp and source interface.

Accepted Answer

logging on
logging trap notifications
logging source-interface GigabitEthernet0/0
logging host 10.0.0.2
service timestamps log datetime. The logging commands enable syslog output. 'logging trap notifications' sets severity to 5 (notifications). 'logging source-interface' ensures syslog messages originate from a consistent IP. 'service timestamps' adds time information to log entries for easier troubleshooting.

Answer

logging on
logging trap informational
logging source-interface GigabitEthernet0/1
logging host 10.0.0.2
service timestamps log datetime

Answer

logging on
logging trap 5
logging source-interface GigabitEthernet0/0
logging 10.0.0.2
service timestamps

Answer

logging on
logging trap notifications
logging source-interface GigabitEthernet0/1
logging host 10.0.0.2
service timestamps debug datetime

Question 5

You are connected to R1 via console. R1 connects two networks: GigabitEthernet0/0 (10.0.0.1/30) to the ISP, and GigabitEthernet0/1 (172.16.1.1/24) to an internal network. The internal hosts (172.16.1.0/24) need to communicate with a server at 10.0.0.2 (ISP side) using a static NAT mapping. Configure static NAT so that internal host 172.16.1.100 is mapped to public IP 10.0.0.3 (which is not assigned to any interface; assume ISP routes 10.0.0.3 to R1). Also configure a static route to reach 10.0.0.3 via the ISP router (next-hop 10.0.0.2).

Accepted Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2. Static NAT provides a one-to-one mapping between a private and public IP. The inside/outside interface designations are critical for NAT to function. The static route ensures that return traffic to 10.0.0.3 is routed via the ISP.

Answer

ip nat inside source static 10.0.0.3 172.16.1.100
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat outside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Question 6

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to ISP router, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal network uses 192.168.1.0/24 and needs to access the internet. Configure NAT overload on R1 so that internal hosts are translated to the IP address of GigabitEthernet0/0 when accessing the internet.

Accepted Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside. NAT overload (PAT) allows multiple internal hosts to share a single public IP by using different source ports. The ACL identifies the internal network, and the interfaces are marked as inside/outside. The 'overload' keyword enables port address translation. Option B fails because it translates to the wrong interface (GigabitEthernet0/1) instead of the public-facing interface (GigabitEthernet0/0). Option C is missing the required 'overload' keyword, so it performs dynamic NAT without PAT, which is insufficient for multiple hosts. Option D uses an overly broad ACL ('permit any') that does not match only the internal network (192.168.1.0/24) as required by the stem.

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit any
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Question 7

You are connected to R1 via the console. R1 is a router that needs to provide DHCP services for hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The DHCP server is located on VLAN 10 at 192.168.10.100, but hosts on VLAN 20 cannot reach it directly. Configure R1 to forward DHCP broadcasts from VLAN 20 to the DHCP server.

Accepted Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip helper-address 192.168.10.100. The ip helper-address command enables the router to forward UDP broadcasts (including DHCP) to a specific server. Placing it on the VLAN 20 subinterface ensures that DHCP requests from VLAN 20 are unicast to the server on VLAN 10.

Answer

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip helper-address 192.168.10.100

Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip dhcp relay information option

Answer

ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1

Question 8

You are connected to R1 via the console. R1's GigabitEthernet0/0 (192.168.1.1/24) connects to the management network, and GigabitEthernet0/1 (10.0.0.1/30) connects to the core. You need to restrict SSH access to R1 from only the management subnet 192.168.1.0/24. Additionally, SSH should be configured with a domain name 'example.com' and a modulus of 2048 bits. The username 'admin' with password 'Cisco123' should be created for SSH login.

Accepted Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048. SSH requires RSA keys for encryption. The access-class applies an ACL to incoming VTY connections, allowing only the management subnet. Setting 'transport input ssh' disables less secure protocols like Telnet.

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT out
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input telnet ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin password Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Question 9

You are connected to R1 via the console. R1 is configured as an NTP client that should synchronize with the NTP server at 203.0.113.1. You need to verify that R1 is synchronizing correctly and also ensure that the system clock is updated. Additionally, configure R1 to act as an NTP server for downstream devices on the internal network 192.168.1.0/24.

Accepted Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.. The correct verification command is 'show ntp status' because it displays the synchronization state and stratum level. 'show ntp associations' shows configured peers but not the sync state. After NTP sync is established, the system clock is automatically updated; 'clock set' is not typically required but remains a valid command to manually adjust the clock. 'clock update' is not a valid IOS command. To make R1 an NTP server for downstream devices, use the global command 'ntp master 4', not 'ntp server' (which makes the router a client). Then, on the interface facing 192.168.1.0/24 (G0/0), apply 'ntp broadcast' to send NTP broadcasts so clients can synchronize without polling. Option A correctly combines these steps while other options mix incorrect commands or verification methods.

Answer

Use 'show ntp associations' to verify synchronization, 'clock update' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp associations' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Question 10

You are connected to R1 via the console. R1 is a router that connects to the internet via GigabitEthernet0/0 (198.51.100.1/30) and to the internal network via GigabitEthernet0/1 (10.1.1.1/24). You need to implement a security policy that permits HTTP traffic (port 80) from the internal network to a web server at 10.1.1.100, and denies all other traffic from internal hosts to the internet. The ACL should be named 'INTERNET-FILTER' and applied inbound on GigabitEthernet0/1.

Accepted Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip 10.1.1.0 0.0.0.255 any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in. The named extended ACL filters traffic based on source, destination, and protocol. The permit allows HTTP from internal to the web server. The deny blocks all other internal-to-internet traffic. Applying it inbound on the internal interface filters traffic as it enters the router.

Answer

ip access-list standard INTERNET-FILTER
 permit 10.1.1.0 0.0.0.255
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp host 10.1.1.100 10.1.1.0 0.0.0.255 eq 80
 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group INTERNET-FILTER in

Question 11

You are connected to R1 via console. R1's GigabitEthernet0/0 (203.0.113.1/30) connects to the internet, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal LAN hosts need to access the internet using PAT (overload) with the public IP 203.0.113.1 assigned to GigabitEthernet0/0. An internal web server at 192.168.1.100 must be accessible from the internet via static NAT to 203.0.113.5. Your task is to configure NAT/PAT on R1.

Accepted Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside. The access list selects the internal LAN traffic. The NAT pool uses the single public IP for overload. The static NAT translates the internal web server's HTTP traffic to a second public IP. The interface commands mark inside and outside for NAT processing.

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat inside source list NAT_ACL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside

Answer

ip access-list standard NAT_ACL permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.252
ip nat inside source list NAT_ACL pool PUBLIC overload
ip nat inside source static tcp 192.168.1.100 80 203.0.113.5 80 extendable
interface GigabitEthernet0/0
 ip nat inside
interface GigabitEthernet0/1
 ip nat outside

Question 12

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to a WAN link to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN with hosts needing Internet access. The ISP has allocated public IP pool 203.0.113.16/28 (203.0.113.17-203.0.113.30). The internal LAN should use NAT overload (PAT) to translate all internal traffic to the public IP 203.0.113.18. The router currently has no NAT configuration. Configure NAT overload on R1 to allow internal hosts to access the Internet.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 pool ISP_POOL overload
ip nat pool ISP_POOL 203.0.113.18 203.0.113.18 netmask 255.255.255.240
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside. The requirement is to translate all internal traffic to the specific public IP 203.0.113.18, not the physical interface's address. Option C achieves this with a NAT pool containing that IP and the overload keyword, enabling PAT. Option A translates to the interface's IP (10.0.0.1), contradicting the requirement. Option B references the wrong interface in the translation command and lacks overload, while Option D omits the overload keyword entirely, providing only one-to-one NAT.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside

Question 13

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The security policy requires that only SSH traffic (TCP port 22) from the internal network (192.168.1.0/24) be permitted to reach the router itself, and all other inbound traffic to the router from internal hosts should be blocked. Additionally, the router must be hardened for SSH access: generate RSA keys of 2048 bits, set SSH version 2, enable SSH on vty lines, and disable Telnet. Currently, there is no security configuration. Configure R1 to meet these requirements.

Accepted Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2. The extended ACL VTY_ACL permits SSH from the internal subnet and denies all other IP traffic. The access-class command applies it inbound to VTY lines. SSH hardening includes generating 2048-bit RSA keys, setting SSH version 2, and disabling Telnet by specifying transport input ssh. A local username is required for SSH authentication. Note that a domain name (e.g., ip domain-name example.com) must be configured before generating RSA keys; without it, the crypto key generation fails or requires interactive input.

Answer

ip access-list standard VTY_ACL
 permit 192.168.1.0 0.0.0.255
 deny any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp any any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL out
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Question 14

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network has an NTP server at 192.168.1.200. R1 must be configured as an NTP client to synchronize its time with the server. Additionally, R1 should serve as an NTP server for internal devices on the LAN with a stratum of 5 to maintain proper hierarchy. The time zone is UTC. No NTP configuration exists. Configure NTP on R1 as specified.

Accepted Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0. Option A correctly configures R1 as an NTP client pointing to the NTP server at 192.168.1.200, enables R1 to serve time to LAN devices using `ntp master 5` which sets the required stratum to 5, and sets the accurate UTC time zone. Option B fails because `ntp master` without a stratum number defaults to stratum 8, which does not satisfy the explicit stratum 5 requirement. Option C uses an incorrect time zone (EST) instead of the required UTC. Option D points to an IP (10.0.0.2) that is not the NTP server—the correct server is at 192.168.1.200.

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master
R1(config)# clock timezone UTC 0

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone EST 5

Answer

R1(config)# ntp server 10.0.0.2
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0

Question 15

Which three of the following are characteristics of DHCP snooping on a Cisco switch? (Choose three.)

Accepted Answer

It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports.. DHCP snooping is a security feature that filters untrusted DHCP messages by differentiating trusted and untrusted ports. It builds and maintains a DHCP snooping binding database to track valid IP-to-MAC address assignments. Additionally, it prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, typically using the 'ip dhcp snooping limit rate' command.

Answer

It encrypts DHCP traffic between the client and the server.

Answer

It replaces the DHCP server's IP address with a static route.

Answer

It requires all DHCP servers to be connected to untrusted ports.