CCNA Network Services and Security Practice Test 33 — 15 Questions

Question 1

You are connected to R1, a branch router. Configure an extended ACL named BRANCH_IN that permits only HTTP (TCP port 80) traffic from the internal network 192.168.1.0/24 to the web server at 203.0.113.10, and permits ICMP echo-reply from any source to any destination. Apply the ACL inbound on the interface facing the internal network. Then verify that only the specified traffic is allowed.

Accepted Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in. It creates an extended ACL that permits TCP port 80 from the internal 192.168.1.0/24 to the web server 203.0.113.10 and permits only ICMP echo-reply, then applies it inbound on the internal interface G0/0, matching the requirement. Option B is wrong because the ACL is applied outbound on G0/0, but traffic from internal hosts to the web server exits via the WAN interface (G0/1), not G0/0. Option C is wrong because it permits all ICMP (any any) instead of only echo-reply, allowing unnecessary ICMP traffic. Option D is wrong because it applies the ACL inbound on both G0/0 and G0/1; applying it on G0/1 would incorrectly filter inbound traffic from the ISP, potentially blocking the web server's responses.

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN out

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in
!
interface GigabitEthernet0/1
 ip access-group BRANCH_IN in

Question 2

You are connected to R1. The network uses 192.168.1.0/24 for internal hosts and 203.0.113.0/29 for the public IP pool (203.0.113.2 is the outside interface). Configure PAT so that inside hosts can reach the Internet using the pool address 203.0.113.2. Also configure static NAT to map internal server 192.168.1.10 to 203.0.113.3. The initial config has errors; identify and fix them.

Accepted Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255 and ensure the NAT pool and PAT are correctly configured.. The ACL 10 permits 10.0.0.0/8, but inside hosts are on 192.168.1.0/24 — this ACL does not match the inside subnet, so PAT fails. The static NAT is correct. To fix: change ACL 10 to permit 192.168.1.0 0.0.0.255. Also ensure the PAT references the correct ACL; currently it uses list 10, so after fixing the ACL, PAT will work. No other changes needed.

Answer

Change the NAT pool to use a different public IP address and update the static NAT mapping.

Answer

Remove the static NAT and use PAT for the server as well.

Answer

Change the inside interface IP address to match the ACL.

Question 3

You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.

Accepted Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.. Three issues exist: (1) GigabitEthernet0/1 is the outside interface but is configured as 'ip nat inside' — it should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword, so it does one-to-one translation instead of port address translation. (3) ACL 1 permits 192.168.2.0/24, but the inside LAN is 192.168.1.0/24 — the ACL must match the correct subnet. Correcting these allows PAT for the LAN and static NAT for the web server.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Question 4

You are connected to R1. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 inside network can reach the Internet through the outside interface GigabitEthernet0/1 using the IP address 203.0.113.1. Additionally, configure static NAT to map internal server 192.168.1.10 to public IP 203.0.113.5. The current configuration has several errors. Identify and correct them.

Accepted Answer

Correct the NAT interface directions: G0/0 as inside, G0/1 as outside. Add 'overload' to the PAT command. Change ACL 100 to permit 192.168.1.0 0.0.0.255.. The configuration had three issues: (1) Inside and outside interfaces were swapped — G0/0 (inside) was marked 'ip nat outside' and G0/1 (outside) was 'ip nat inside'. (2) The PAT command was missing the 'overload' keyword. (3) ACL 100 matched the wrong subnet (192.168.2.0 instead of 192.168.1.0). To fix: correct interface NAT directions, add 'overload', and update ACL to permit 192.168.1.0/24.

Answer

Change the NAT interface directions: G0/0 as outside, G0/1 as inside. Add 'overload' to the PAT command. Change ACL 100 to permit 192.168.1.0 0.0.0.255.

Answer

Correct the NAT interface directions: G0/0 as inside, G0/1 as outside. Add 'overload' to the PAT command. Keep ACL 100 as is because it already permits the correct subnet.

Answer

Change the NAT interface directions: G0/0 as outside, G0/1 as inside. Add 'overload' to the PAT command. Change ACL 100 to permit 192.168.1.0 0.0.0.255.

Question 5

You are connected to R1. The internal network 192.168.1.0/24 must be able to access the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.1. Additionally, a web server at 192.168.1.100 must be reachable from the Internet via static NAT to the same outside interface. The current configuration has errors. Correct the NAT configuration so that inside hosts can browse the web and the server is reachable from outside.

Accepted Answer

Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255. The configuration had three issues: (1) Interface G0/1 was incorrectly configured as 'ip nat inside' instead of 'ip nat outside' — this prevents translation as both interfaces are inside. (2) The NAT overload keyword was missing on the dynamic PAT rule — without 'overload', only one-to-one translation occurs. (3) ACL 100 was matching 192.168.2.0/24 instead of the actual inside subnet 192.168.1.0/24, so traffic from the correct subnet was not translated. Correcting these allows inside hosts to PAT to the outside IP and the static NAT to function properly.

Answer

Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and change ACL 100 to permit 192.168.2.0 0.0.0.255

Answer

Change interface G0/1 to 'ip nat outside', remove the 'overload' keyword from the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255

Answer

Change interface G0/1 to 'ip nat inside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255

Question 6

You are connected to R1. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the outside interface GigabitEthernet 0/1 with IP 203.0.113.2/29. The current configuration has an incorrect inside/outside interface assignment and a missing overload keyword. Fix all issues.

Accepted Answer

Configure 'ip nat inside' on GigabitEthernet0/0, 'ip nat outside' on GigabitEthernet0/1, correct ACL 10 to permit 192.168.1.0 0.0.0.255, and add 'overload' to the PAT command.. Three issues exist: (1) The inside and outside interfaces are swapped — GigabitEthernet0/0 (LAN) should be 'ip nat inside' and GigabitEthernet0/1 (WAN) should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword. (3) ACL 10 permits 10.0.0.0/8 but the inside subnet is 192.168.1.0/24; ACL must be corrected. Fix with 'interface GigabitEthernet0/0', 'ip nat inside', 'interface GigabitEthernet0/1', 'ip nat outside', 'ip nat inside source list 10 interface GigabitEthernet0/1 overload', and 'access-list 10 permit 192.168.1.0 0.0.0.255'.

Answer

Configure 'ip nat outside' on GigabitEthernet0/0, 'ip nat inside' on GigabitEthernet0/1, keep ACL 10 as is, and add 'overload' to the PAT command.

Answer

Configure 'ip nat inside' on GigabitEthernet0/1, 'ip nat outside' on GigabitEthernet0/0, correct ACL 10 to permit 192.168.1.0 0.0.0.255, and add 'overload' to the PAT command.

Answer

Configure 'ip nat inside' on GigabitEthernet0/0, 'ip nat outside' on GigabitEthernet0/1, correct ACL 10 to permit 192.168.1.0 0.0.0.255, but do not add 'overload' to the PAT command.

Question 7

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

Accepted Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.. The configuration has two issues: (1) ACL 100 permits 192.168.2.0/24 instead of 192.168.1.0/24, so the inside traffic is not matched for PAT. (2) The 'ip nat inside source list' command lacks the 'overload' keyword, preventing port address translation. The static NAT entry for the web server is correctly configured and does not depend on the ACL; it will work once the ACL is fixed. To resolve: change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.

Answer

Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.

Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.

Question 8

You are connected to R1. The network uses private IP 10.10.10.0/24 on the inside and must reach the Internet via the outside interface G0/1 with public IP 203.0.113.1/29. Configure PAT (NAT overload) so that inside hosts can access the Internet, and also configure a static NAT for the internal server 10.10.10.100 to public IP 203.0.113.2. The current configuration has errors: the inside and outside interfaces are swapped, the ACL is incorrectly defined, and the overload keyword is missing. Fix all issues.

Accepted Answer

On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload. The configuration had three faults: (1) The inside interface (G0/0 with private IP) was marked 'ip nat outside', and the outside interface (G0/1 with public IP) was marked 'ip nat inside' — these must be swapped. (2) The ACL 10 permitted 192.168.1.0/24 instead of the actual inside subnet 10.10.10.0/24. (3) The NAT command 'ip nat inside source list 10 interface GigabitEthernet0/1' was missing the 'overload' keyword, which is required for PAT. The static NAT was correctly defined. After fixing all three, inside hosts will be able to access the Internet using PAT.

Answer

On G0/0: ip nat outside; on G0/1: ip nat inside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload

Answer

On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 192.168.1.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload

Answer

On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1

Question 9

You are connected to R1. The inside network 192.168.1.0/24 must be translated to the outside interface IP (198.51.100.1) using PAT (NAT overload). Additionally, a static NAT entry must map host 192.168.1.10 to 203.0.113.10. The current configuration is incomplete and contains errors. Correct the configuration so that both translations work properly.

Accepted Answer

interface GigabitEthernet0/1
ip nat outside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.1.10 203.0.113.10. The configuration has three issues: 1) GigabitEthernet0/1 is incorrectly set as 'ip nat inside' instead of 'ip nat outside'. 2) The PAT command is missing the 'overload' keyword. 3) Access-list 1 permits 10.0.0.0/8, not the inside subnet 192.168.1.0/24. The commands fix these: change the interface to 'ip nat outside', add 'overload' to the PAT command, and update the ACL to permit the correct inside network.

Answer

interface GigabitEthernet0/1
ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.1.10 203.0.113.10

Answer

interface GigabitEthernet0/1
ip nat outside
!
access-list 1 permit 10.0.0.0 0.255.255.255
!
ip nat inside source list 1 interface GigabitEthernet0/1
ip nat inside source static 192.168.1.10 203.0.113.10

Answer

interface GigabitEthernet0/1
ip nat outside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80

Question 10

You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.

Accepted Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.. The configuration had three issues: 1) ACL 10 permitted 10.0.0.0/8 instead of the actual inside subnet 192.168.1.0/24, so no traffic matched PAT. 2) The PAT command was missing the 'overload' keyword, which is required for Port Address Translation; without it, the device attempts one-to-one dynamic NAT. 3) The interface facing the public network (G0/1) was incorrectly configured as 'ip nat inside' instead of 'ip nat outside'. The fix is to correct the ACL to permit 192.168.1.0 0.0.0.255, ensure the PAT command includes 'overload', and change G0/1 to 'ip nat outside'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.

Question 11

You are connected to R1. The inside network 192.168.10.0/24 must be able to reach the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.2/30. Additionally, the internal server at 192.168.10.100 must be statically mapped to public IP 203.0.113.10. The current configuration is incomplete and contains errors. Fix the NAT configuration on R1 so that both requirements are met.

Accepted Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside. All options contain a critical error: they use 'ip access-list standard 100', which is invalid because standard ACL numbers must be 1-99 or 1300-1999. Number 100 is reserved for extended ACLs. Additionally, option B's ACL only matches the server host, not the entire subnet; option C lacks the 'overload' keyword; option D configures the outside interface as 'ip nat inside'. Therefore, no option provides a fully correct configuration.

Answer

ip access-list standard 100 permit host 192.168.10.100
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside

Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside

Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat inside

Question 12

You are troubleshooting PAT and static NAT on R1. The inside network 192.168.10.0/24 must be translated to the public IP 203.0.113.1 (interface G0/1) using port address translation. Additionally, the server at 192.168.10.100 must be reachable from the outside via static NAT to 203.0.113.5. The current configuration is not working. Identify and correct the errors in the running config on R1.

Accepted Answer

The ACL in the NAT configuration incorrectly permits network 192.168.20.0/24 instead of 192.168.10.0/24, and the PAT command is missing the 'overload' keyword.. The running configuration has two errors. First, access-list 100 incorrectly permits the 192.168.20.0/24 network instead of the inside network 192.168.10.0/24, so PAT will not translate any internal hosts. Second, the PAT command is missing the 'overload' keyword, which means only a single translation is possible, breaking connectivity for multiple devices. The static NAT entry for the server is correctly mapping 192.168.10.100 to 203.0.113.5 and does not need correction.

Answer

The static NAT entry uses the wrong inside address; it should be 192.168.10.100 but is configured with 192.168.10.1.

Answer

The PAT command is missing the 'overload' keyword, and the static NAT entry maps to the wrong public IP; it should use 203.0.113.1 instead of 203.0.113.5.

Answer

The static NAT entry maps the server to the wrong public IP, 203.0.113.1 instead of 203.0.113.5, and the ACL incorrectly permits network 192.168.20.0/24.

Question 13

You are connected to R1. The inside network 192.168.1.0/24 must be able to access the internet using PAT (NAT overload) with the outside interface G0/1 IP 203.0.113.1. Additionally, the internal server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is incomplete and contains errors. Identify and fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Swap ip nat inside/outside on interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.. The configuration had multiple faults: 1) Inside/outside interfaces were swapped – G0/0 (LAN) should be inside, G0/1 (WAN) should be outside. 2) The PAT command was missing the 'overload' keyword. 3) ACL 1 permitted the wrong subnet (192.168.2.0/24 instead of 192.168.1.0/24). 4) The static NAT configuration was correct, but the interface misconfiguration prevented it from working. Fixes: swap ip nat inside/outside on the interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.

Answer

Change the static NAT inside address to 192.168.1.1 and add 'overload' to the dynamic NAT rule.

Answer

Remove the static NAT configuration and rely solely on PAT for the server.

Answer

Add the 'overload' keyword to the dynamic NAT rule and correct ACL 1 to permit 192.168.1.0/24.

Question 14

You are connected to R1 via the console. The network has a DNS server at 203.0.113.10 that should resolve www.example.com to 203.0.113.100. However, when you ping www.example.com, it fails. Diagnose and resolve the DNS resolution issue. The DNS server is reachable via ping, but nslookup from R1 returns a server failure. Configure R1 so that it can successfully resolve www.example.com. Additionally, verify that the DNS server is correctly configured for forward and reverse lookups.

Accepted Answer

Configure 'ip name-server 203.0.113.10' under global configuration and ensure the DNS server has an A record for www.example.com pointing to 203.0.113.100.. The issue is that the DNS server IP address configured under 'ip name-server' is incorrect (10.0.0.2) instead of the actual DNS server (203.0.113.10). Additionally, the DNS server itself is not configured with the proper A record for www.example.com. The fix involves correcting the name-server address and ensuring the DNS server has the correct forward mapping. After correcting the name-server, nslookup and dig should return the IP address 203.0.113.100. For reverse lookup, a PTR record for 203.0.113.100 pointing to www.example.com must exist on the DNS server.

Answer

Configure 'ip domain-lookup' and 'ip name-server 10.0.0.2' under global configuration, then verify with ping www.example.com.

Answer

Configure 'ip domain-lookup' and 'ip host www.example.com 203.0.113.100' under global configuration, then verify with ping www.example.com.

Answer

Configure 'ip dns server' under global configuration to make R1 act as a DNS server, then add an A record for www.example.com.

Question 15

You are connected to R1, a Cisco IOS-XE router acting as the network's DNS client. The network uses a local DNS server at 203.0.113.10 for internal name resolution. Users report that the hostname 'fileserver.courseiva.local' cannot be resolved, while other names work fine. Diagnose and fix the DNS resolution failure so that 'fileserver.courseiva.local' resolves correctly.

Accepted Answer

Add an A record for 'fileserver' on the DNS server.. The DNS server is reachable (ping successful) and resolves other names (e.g., webserver.courseiva.local) correctly. However, 'fileserver.courseiva.local' returns NXDOMAIN, indicating the A record is missing from the DNS zone. Since the router is not the DNS server, the fix must be applied on the DNS server itself — not on R1. The candidate should understand that the problem is a missing DNS record, not a router configuration issue. The solution involves adding an A record for 'fileserver' (with the appropriate IP address) on the DNS server. On R1, verify connectivity to the DNS server and confirm that the domain lookup and name-server settings are correct, which they are. No router CLI changes are needed.

Answer

Configure the 'ip domain-lookup' command on R1 to enable DNS resolution.

Answer

Change the DNS server address on R1 to 8.8.8.8.

Answer

Add a static host entry on R1 using 'ip host fileserver.courseiva.local 192.0.2.10'.

CCNA Network Services and Security Practice Test 33 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 33 — 15 Questions

Exhibit