CCNA Network Services and Security Practice Test 34 — 15 Questions

Question 1

You are connected to R1 via console. R1 connects two networks: GigabitEthernet0/0 (10.0.0.1/30) to the ISP, and GigabitEthernet0/1 (172.16.1.1/24) to an internal network. The internal hosts (172.16.1.0/24) need to communicate with a server at 10.0.0.2 (ISP side) using a static NAT mapping. Configure static NAT so that internal host 172.16.1.100 is mapped to public IP 10.0.0.3 (which is not assigned to any interface; assume ISP routes 10.0.0.3 to R1). Also configure a static route to reach 10.0.0.3 via the ISP router (next-hop 10.0.0.2).

Accepted Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2. Static NAT provides a one-to-one mapping between a private and public IP. The inside/outside interface designations are critical for NAT to function. The static route ensures that return traffic to 10.0.0.3 is routed via the ISP.

Answer

ip nat inside source static 10.0.0.3 172.16.1.100
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat outside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Question 2

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to ISP router, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal network uses 192.168.1.0/24 and needs to access the internet. Configure NAT overload on R1 so that internal hosts are translated to the IP address of GigabitEthernet0/0 when accessing the internet.

Accepted Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside. NAT overload (PAT) allows multiple internal hosts to share a single public IP by using different source ports. The ACL identifies the internal network, and the interfaces are marked as inside/outside. The 'overload' keyword enables port address translation. Option B fails because it translates to the wrong interface (GigabitEthernet0/1) instead of the public-facing interface (GigabitEthernet0/0). Option C is missing the required 'overload' keyword, so it performs dynamic NAT without PAT, which is insufficient for multiple hosts. Option D uses an overly broad ACL ('permit any') that does not match only the internal network (192.168.1.0/24) as required by the stem.

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit any
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Question 3

You are connected to R1 via the console. R1 is a router that needs to provide DHCP services for hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The DHCP server is located on VLAN 10 at 192.168.10.100, but hosts on VLAN 20 cannot reach it directly. Configure R1 to forward DHCP broadcasts from VLAN 20 to the DHCP server.

Accepted Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip helper-address 192.168.10.100. The ip helper-address command enables the router to forward UDP broadcasts (including DHCP) to a specific server. Placing it on the VLAN 20 subinterface ensures that DHCP requests from VLAN 20 are unicast to the server on VLAN 10.

Answer

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip helper-address 192.168.10.100

Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip dhcp relay information option

Answer

ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1

Question 4

You are connected to R1 via the console. R1's GigabitEthernet0/0 (192.168.1.1/24) connects to the management network, and GigabitEthernet0/1 (10.0.0.1/30) connects to the core. You need to restrict SSH access to R1 from only the management subnet 192.168.1.0/24. Additionally, SSH should be configured with a domain name 'example.com' and a modulus of 2048 bits. The username 'admin' with password 'Cisco123' should be created for SSH login.

Accepted Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048. SSH requires RSA keys for encryption. The access-class applies an ACL to incoming VTY connections, allowing only the management subnet. Setting 'transport input ssh' disables less secure protocols like Telnet.

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT out
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input telnet ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin password Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Question 5

You are connected to R1 via the console. R1 is configured as an NTP client that should synchronize with the NTP server at 203.0.113.1. You need to verify that R1 is synchronizing correctly and also ensure that the system clock is updated. Additionally, configure R1 to act as an NTP server for downstream devices on the internal network 192.168.1.0/24.

Accepted Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.. The correct verification command is 'show ntp status' because it displays the synchronization state and stratum level. 'show ntp associations' shows configured peers but not the sync state. After NTP sync is established, the system clock is automatically updated; 'clock set' is not typically required but remains a valid command to manually adjust the clock. 'clock update' is not a valid IOS command. To make R1 an NTP server for downstream devices, use the global command 'ntp master 4', not 'ntp server' (which makes the router a client). Then, on the interface facing 192.168.1.0/24 (G0/0), apply 'ntp broadcast' to send NTP broadcasts so clients can synchronize without polling. Option A correctly combines these steps while other options mix incorrect commands or verification methods.

Answer

Use 'show ntp associations' to verify synchronization, 'clock update' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp associations' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Question 6

You are connected to R1 via the console. R1 is a router that connects to the internet via GigabitEthernet0/0 (198.51.100.1/30) and to the internal network via GigabitEthernet0/1 (10.1.1.1/24). You need to implement a security policy that permits HTTP traffic (port 80) from the internal network to a web server at 10.1.1.100, and denies all other traffic from internal hosts to the internet. The ACL should be named 'INTERNET-FILTER' and applied inbound on GigabitEthernet0/1.

Accepted Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip 10.1.1.0 0.0.0.255 any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in. The named extended ACL filters traffic based on source, destination, and protocol. The permit allows HTTP from internal to the web server. The deny blocks all other internal-to-internet traffic. Applying it inbound on the internal interface filters traffic as it enters the router.

Answer

ip access-list standard INTERNET-FILTER
 permit 10.1.1.0 0.0.0.255
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp host 10.1.1.100 10.1.1.0 0.0.0.255 eq 80
 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group INTERNET-FILTER in

Question 7

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The security policy requires that only SSH traffic (TCP port 22) from the internal network (192.168.1.0/24) be permitted to reach the router itself, and all other inbound traffic to the router from internal hosts should be blocked. Additionally, the router must be hardened for SSH access: generate RSA keys of 2048 bits, set SSH version 2, enable SSH on vty lines, and disable Telnet. Currently, there is no security configuration. Configure R1 to meet these requirements.

Accepted Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2. The extended ACL VTY_ACL permits SSH from the internal subnet and denies all other IP traffic. The access-class command applies it inbound to VTY lines. SSH hardening includes generating 2048-bit RSA keys, setting SSH version 2, and disabling Telnet by specifying transport input ssh. A local username is required for SSH authentication. Note that a domain name (e.g., ip domain-name example.com) must be configured before generating RSA keys; without it, the crypto key generation fails or requires interactive input.

Answer

ip access-list standard VTY_ACL
 permit 192.168.1.0 0.0.0.255
 deny any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp any any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL in
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Answer

ip access-list extended VTY_ACL
 permit tcp 192.168.1.0 0.0.0.255 any eq 22
 deny ip any any
!
line vty 0 4
 access-class VTY_ACL out
 transport input ssh
 login local
!
username admin secret cisco
crypto key generate rsa modulus 2048
ip ssh version 2

Question 8

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network has an NTP server at 192.168.1.200. R1 must be configured as an NTP client to synchronize its time with the server. Additionally, R1 should serve as an NTP server for internal devices on the LAN with a stratum of 5 to maintain proper hierarchy. The time zone is UTC. No NTP configuration exists. Configure NTP on R1 as specified.

Accepted Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0. Ly configures R1 as an NTP client pointing to the NTP server at 192.168.1.200, enables R1 to serve time to LAN devices using `ntp master 5` which sets the required stratum to 5, and sets the accurate UTC time zone. Option B fails because `ntp master` without a stratum number defaults to stratum 8, which does not satisfy the explicit stratum 5 requirement. Option C uses an incorrect time zone (EST) instead of the required UTC. Option D points to an IP (10.0.0.2) that is not the NTP server—the correct server is at 192.168.1.200.

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master
R1(config)# clock timezone UTC 0

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone EST 5

Answer

R1(config)# ntp server 10.0.0.2
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0

Question 9

Which three of the following are characteristics of DHCP snooping on a Cisco switch? (Choose three.)

Accepted Answer

It differentiates trusted and untrusted ports to filter DHCP messages.. DHCP snooping is a security feature that filters untrusted DHCP messages by differentiating trusted and untrusted ports. It builds and maintains a DHCP snooping binding database to track valid IP-to-MAC address assignments. Additionally, it prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, typically using the 'ip dhcp snooping limit rate' command.

Answer

It requires all DHCP servers to be connected to untrusted ports.

Answer

It replaces the DHCP server's IP address with a static route.

Answer

It encrypts DHCP traffic between the client and the server.

Question 10

Which three options are true regarding the operation of Dynamic ARP Inspection (DAI) on a Cisco switch? (Choose three.)

Accepted Answer

DAI validates ARP packets based on the DHCP snooping binding database.. Dynamic ARP Inspection (DAI) validates ARP packets by intercepting them on untrusted ports and checking the MAC-to-IP address binding against the DHCP snooping binding database. If the binding is invalid or missing, DAI drops the packet, preventing ARP spoofing attacks. This is why all three statements are correct: DAI relies on the DHCP snooping database, drops invalid bindings, and is enabled on untrusted ports facing end hosts.

Answer

DAI relies on the MAC address table to validate ARP requests.

Answer

DAI encrypts ARP replies to prevent eavesdropping.

Answer

DAI prevents rogue DHCP server attacks by inspecting DHCP offers.

Question 11

Which three of the following statements about Network Address Translation (NAT) are correct? (Choose three.)

Accepted Answer

Static NAT provides a one-to-one mapping between a private IP and a public IP.. Static NAT provides a one-to-one mapping between a private IP and a public IP, ensuring that a specific internal host always uses the same public address. Dynamic NAT uses a pool of public IP addresses assigned on a first-come, first-served basis, so internal hosts compete for available addresses. PAT (Port Address Translation) allows multiple internal hosts to share a single public IP by differentiating sessions via unique port numbers, which is the most common form of NAT used in home and small office routers.

Answer

Dynamic NAT always assigns the same public IP to a given internal host.

Answer

NAT eliminates the need for any routing in a network.

Answer

PAT requires a unique public IP for every concurrent session.

Question 12

Which four of the following are true statements regarding the operation of DHCP snooping on a Cisco switch? (Choose all that apply. There are four correct answers.)

Accepted Answer

DHCP snooping builds and maintains a DHCP snooping binding database (also called a binding table).. The four correct statements are true because DHCP snooping is a security feature that operates by classifying switch ports as trusted or untrusted. By default, all ports are untrusted, meaning they cannot send DHCP server messages (OFFER, ACK, NAK) unless explicitly configured as trusted. Rate-limiting DHCP messages on untrusted ports mitigates DHCP starvation attacks, and the binding database (MAC-to-IP mapping) is built from DHCP ACK messages to prevent IP spoofing. The incorrect statement "DHCP snooping requires an external DHCP server to be configured on the switch" is false because DHCP snooping itself does not require the switch to act as a DHCP server; it simply relies on DHCP messages from a legitimate server reachable through a trusted port.

Answer

DHCP snooping prevents rogue DHCP servers by allowing only authorized servers on any port.

Answer

DHCP snooping requires an external DHCP server to be configured on the switch.

Question 13

Which three of the following are characteristics of DHCP snooping? (Choose three.)

Accepted Answer

It builds and maintains a DHCP snooping binding database.. DHCP snooping is a security feature that filters untrusted DHCP messages and builds a DHCP snooping binding database to track valid IP-to-MAC address assignments. It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, and it validates DHCP client MAC addresses against the source MAC in the Ethernet frame to prevent MAC spoofing. These three functions directly correspond to the correct answer options.

Answer

It automatically enables IP source guard when configured globally.

Answer

It allows DHCP server messages from untrusted ports if the source MAC matches.

Answer

It filters untrusted DHCP messages on trusted ports.

Question 14

Which three of the following are security best practices for implementing AAA on a Cisco router? (Choose three.)

Accepted Answer

Use a local username database as a fallback method if the AAA server is unreachable.. Using a local username database as a fallback method ensures that if the AAA server becomes unreachable, administrators can still authenticate via the router's local accounts. This is a standard best practice to prevent lockout. Enabling 'aaa new-model' is mandatory before any AAA configuration, as it activates the AAA subsystem on the router. TACACS+ is the preferred protocol for command authorization and accounting because it encrypts the entire packet and supports per-command authorization, unlike RADIUS which only encrypts the password.

Answer

Disable the enable secret password when using AAA servers.

Answer

Set the authentication login method to 'none' for console access.

Answer

Use RADIUS for command-level authorization.

Question 15

Which four of the following are characteristics or functions of a stateless firewall, such as an extended access control list (ACL) on a Cisco router? (Choose four.)

Accepted Answer

It uses an ordered list of permit or deny rules, processing packets in sequence until a match is found.. A stateless firewall, such as a Cisco extended ACL, processes each packet independently without tracking the state of a connection. It makes filtering decisions solely based on static fields in the packet header, such as source/destination IP addresses and port numbers, and applies rules in a sequential order until a match is found. This is why options about per-packet inspection, IP/port filtering, and sequential rule processing are correct.

Answer

It automatically allows return traffic for established connections.

Answer

It can inspect the application-layer payload to detect malicious content.