CCNA Network Services and Security Practice Test 36 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure NTP with authentication on a Cisco router.

Accepted Answer

Define an NTP authentication key using the ntp authentication-key command.. First, define the NTP authentication key using the ntp authentication-key command to create the key that will be used. Second, enable NTP authentication globally with ntp authenticate so that the router requires keys for NTP associations. Third, specify which keys are trusted with ntp trusted-key so the router accepts those keys. Fourth, associate the NTP server with the key using the ntp server command with the key option, linking the server to the trusted key. Finally, verify the authenticated association using show ntp associations to confirm the configuration is working. This order is required because the key must exist before it can be trusted, authentication must be enabled before keys are checked, and the server must be configured with the key only after it is trusted.

Question 2

Drag and drop the following steps into the correct order to implement DHCP services for clients in VLAN 10 using a centralized DHCP server in VLAN 20 and to protect the network with DHCP snooping.

Accepted Answer

Configure the DHCP server with an IP address pool for the 192.168.10.0/24 subnet and ensure connectivity to VLAN 20.. The correct order requires the DHCP server to be configured first so it can respond to requests. Then the IP helper-address is configured on the default gateway interface for VLAN 10 to forward client broadcasts to the server. Next, DHCP snooping is enabled globally, followed by identifying the trusted port to the server (to allow DHCP replies), and then snooping is enabled on the client VLAN. Finally, a client connection triggers a DHCP transaction that you can verify with the snooping binding table.

Question 3

Drag and drop the following steps into the correct order to configure a Layer 3 switch to perform DHCP relay agent and DHCP snooping for a remote DHCP server.

Accepted Answer

On the DHCP server, create a DHCP pool for the client subnet with the correct network, default gateway, and lease parameters.. Correct order: 1) Create DHCP pool on the server to have valid lease parameters; 2) Assign IP address to the SVI so it can act as the gateway and relay agent for the subnet; 3) Globally enable DHCP snooping to activate the feature; 4) Enable snooping on the client VLAN so that only that VLAN’s DHCP traffic is filtered; 5) Set the interface facing the server as trusted to allow DHCP replies; 6) Configure ip helper-address on the SVI to forward client DHCP broadcasts to the server. Each step depends on the previous: the server must be ready; the SVI needs an IP before the helper can be applied; snooping must be globally on before per-VLAN settings; trusted port must be defined before relayed replies are accepted; finally, the helper address enables the actual relay.

Question 4

Which TWO statements accurately describe Network Address Translation (NAT) types?

Accepted Answer

Static NAT creates a fixed one-to-one mapping between a local and global address and is typically used to allow external connectivity to internal servers.. Option A is correct because static NAT (also called one-to-one NAT) permanently maps a single private (local) address to a single public (global) address, which is exactly the configuration used to publish internal servers such as web or mail hosts to the Internet. Option B is correct because dynamic NAT draws a public address from a configured pool and creates a temporary one-to-one binding for the duration of the session, and since it operates strictly at Layer 3 it does not rewrite TCP/UDP port numbers (that is the job of PAT/overloading). Option C is wrong because PAT translates both TCP and UDP (and ICMP query IDs), since it multiplexes on any Layer 4 identifier, not TCP alone. Option D is wrong because static NAT mappings are manually configured and persist until an administrator removes them; they are not aged out by inactivity timers. Option E is wrong because PAT specifically allows many private hosts to share a single public IP by translating source ports, so exhaustion of a public pool is not the failure mode described.

Answer

PAT only translates TCP packets because it uses port numbers, leaving UDP translation unsupported.

Answer

Static NAT entries are automatically removed after periods of inactivity to free up public addresses.

Answer

With PAT, if the public IP address pool is exhausted, new translations fail because PAT requires unique public IPs for each private host.

Question 5

Which TWO statements about IPv4 and IPv6 ACLs are true?

Accepted Answer

Extended IPv4 ACLs should be placed as close to the source as possible to minimize unnecessary traffic on the network.. Extended IPv4 ACLs filter on source and destination IP addresses, ports, and protocols, so placing them as close to the source as possible prevents unwanted traffic from traversing the network, reducing bandwidth waste and security risks. This is a best practice for extended ACLs, unlike standard ACLs which should be placed close to the destination.

Answer

Standard IPv4 ACLs use numbers in the range 100-199.

Answer

Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

Answer

Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

Question 6

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

Accepted Answer

The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.. DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Answer

The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

Answer

DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

Answer

The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

Question 7

A network administrator notices that syslog messages from a core router are arriving at the syslog server with timestamps that are hours behind other devices. The router’s NetFlow exports also show incorrect start and end times for flows, making traffic analysis unreliable. The administrator verifies that all router interfaces are up and that the SNMP community strings on the router match the NMS.

Accepted Answer

The router’s NTP client is configured with an incorrect authentication key.. The router's timestamps are incorrect for both syslog messages and NetFlow exports, which points to a system-wide time synchronization issue. NTP (Network Time Protocol) is responsible for maintaining accurate time on network devices, and if the NTP client is configured with an incorrect authentication key, it will fail to synchronize with the NTP server, causing the router's clock to drift. This explains why all time-stamped data (syslog and NetFlow) is consistently behind.

Answer

The logging trap level is set to informational, so only high-severity messages are sent with correct timestamps.

Answer

The SNMP v3 user’s privacy password is incorrect, causing the NMS to reject syslog traps.

Answer

The IP flow cache timeout is set too low, causing NetFlow timestamps to appear skewed.

Question 8

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

Accepted Answer

The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.. The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database. DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Answer

The SSH ACL is misconfigured and denies port 22 from the management subnet.

Answer

Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

Answer

RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

Question 9

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

Accepted Answer

The switch port connecting to the router is not configured as a trusted port for DHCP snooping.. DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Answer

The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

Answer

The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

Answer

DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

Question 10

A network administrator configures PAT on a router to allow internal hosts in the 10.10.10.0/24 subnet to access the Internet. Afterward, users report that they can ping public IP addresses but cannot access any websites. The administrator verifies that the access list for NAT matches the correct subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command is applied. What is the most likely cause of this issue?

Accepted Answer

The router's DNS proxy is misconfigured, preventing resolution of website names.. The ability to ping public IP addresses confirms that IP routing and PAT are working for ICMP traffic. However, the failure to access websites by name while ping works indicates a DNS resolution problem. If the PAT translation table were full, new ICMP echo requests would also be dropped because they require new NAT translations. Therefore, the most likely cause is a misconfigured DNS proxy or DNS server, preventing name resolution for HTTP/HTTPS sessions.

Answer

The PAT translation table is full, causing new TCP connection requests to be dropped.

Answer

The 'overload' keyword was omitted, causing the router to use dynamic NAT with a single-address pool.

Answer

A static NAT entry for a web server is using the same public IP address as the PAT overload.

Question 11

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Accepted Answer

Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.. First, the DHCP server must be properly configured on the router. Next, DHCP snooping is enabled globally on the switch to protect against rogue servers. Then, the specific client VLANs must be added to the snooping database. After that, the uplink interface to the DHCP server must be trusted to allow legitimate server responses. Finally, the ip helper-address command is placed on the client's SVI to forward DHCP broadcasts to the remote server.

Question 12

Which TWO actions does DHCP snooping perform by default on a Cisco switch?

Accepted Answer

It blocks DHCP server messages received on untrusted ports.. DHCP snooping is a security feature that, by default, filters DHCP server messages (such as DHCPOFFER, DHCPACK, and DHCPNAK) received on untrusted ports. This prevents rogue DHCP servers from offering malicious IP configurations to clients. The switch also automatically builds and maintains a DHCP snooping binding table, which maps client MAC addresses to leased IP addresses, VLANs, and port information, to validate DHCP traffic.

Answer

It generates a Cisco Discovery Protocol packet for each DHCP request.

Answer

It relays DHCP requests across VLANs.

Answer

It converts DHCP broadcasts into unicasts.

Question 13

Refer to the exhibit. A network engineer is troubleshooting a DHCP issue where DHCP clients on the LAN subnet are sending DHCPDISCOVER messages but the DHCP server does not receive them. The output of the show ip dhcp binding command on R1 is shown. What is the most likely cause of the problem?

Accepted Answer

The ip helper-address command is configured on the WAN interface instead of the LAN interface facing the DHCP clients.. The DHCP clients on the LAN subnet are sending DHCPDISCOVER messages, but the DHCP server does not receive them because the ip helper-address command is misconfigured on the WAN interface instead of the LAN interface facing the clients. The ip helper-address command must be applied on the ingress interface (the LAN interface) that receives the broadcast DHCPDISCOVER messages, so that the router can convert the broadcast into a unicast directed to the DHCP server. When placed on the WAN interface, it does not intercept the broadcasts from the LAN clients, and the DHCP server never receives the relayed request.

Answer

DHCP service is disabled on R1.

Answer

The DHCP pool is configured with a network address that does not match the client subnet.

Answer

The default-router option is missing from the DHCP pool configuration.

Question 14

A client PC is receiving an APIPA address (169.254.x.x) instead of a valid IP from the DHCP server. The DHCP server is on the same subnet as the client. The technician runs the command 'show ip dhcp binding' and confirms that the correct scope is configured. The command 'show ip dhcp pool' shows that there are plenty of addresses remaining in the pool. The client's NIC status shows 'connected'. What should the technician do next?

Accepted Answer

Check for a rogue DHCP server on the network.. The client is receiving an APIPA address (169.254.x.x) despite the DHCP server having available addresses and being on the same subnet. This indicates that the client's DHCP discover broadcast is not reaching the legitimate DHCP server, or the server's offer is not reaching the client. Since the DHCP server is local and the scope is correctly configured, the most likely cause is a rogue DHCP server responding faster than the legitimate server, or a device (like a home router) acting as a DHCP server and handing out APIPA-like addresses or conflicting leases. Option D directly addresses this by suggesting to check for a rogue DHCP server, which can interfere with the DHCP process and cause the client to fail to obtain a valid IP.

Answer

Check the DHCP snooping configuration on the access switch.

Answer

Verify that no firewall is blocking UDP ports 67 and 68 on the local network.

Answer

Run the ipconfig /release and /renew commands on the client.

Question 15

A network engineer notices that clients in the 192.168.10.0/24 subnet are receiving the IP address 192.168.10.1 from the DHCP server, causing a duplicate IP conflict with the router’s own interface. What is the most likely cause?

Accepted Answer

The DHCP pool does not exclude the router’s own interface IP address.. The most likely cause is that the DHCP pool configuration does not exclude the router's own interface IP address (192.168.10.1) from the range of addresses that the DHCP server can assign. By default, a Cisco router acting as a DHCP server will lease any address within the configured network statement unless an explicit ip dhcp excluded-address command is applied. Since the router's interface already uses 192.168.10.1, leasing that same address to a client creates a duplicate IP conflict.

Answer

The DHCP conflict logging feature is disabled on the router.

Answer

The DHCP lease time is set too low, causing frequent re-issuing of addresses.

Answer

The DHCP pool’s default-router address is misconfigured, so the client uses the router’s IP as its own.