CCNA Network Services and Security Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A network engineer is troubleshooting a DHCP issue where DHCP clients on the LAN subnet are sending DHCPDISCOVER messages but the DHCP server does not receive them. The output of the show ip dhcp binding command on R1 is shown. What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ip helper-address command is configured on the WAN interface instead of the LAN interface facing the DHCP clients.. The DHCP clients on the LAN subnet are sending DHCPDISCOVER messages, but the DHCP server does not receive them because the ip helper-address command is misconfigured on the WAN interface instead of the LAN interface facing the clients. The ip helper-address command must be applied on the ingress interface (the LAN interface) that receives the broadcast DHCPDISCOVER messages, so that the router can convert the broadcast into a unicast directed to the DHCP server. When placed on the WAN interface, it does not intercept the broadcasts from the LAN clients, and the DHCP server never receives the relayed request.

Answer

DHCP service is disabled on R1.

Answer

The DHCP pool is configured with a network address that does not match the client subnet.

Answer

The default-router option is missing from the DHCP pool configuration.

Question 2

A client PC is receiving an APIPA address (169.254.x.x) instead of a valid IP from the DHCP server. The DHCP server is on the same subnet as the client. The technician runs the command 'show ip dhcp binding' and confirms that the correct scope is configured. The command 'show ip dhcp pool' shows that there are plenty of addresses remaining in the pool. The client's NIC status shows 'connected'. What should the technician do next?

Accepted Answer

Check for a rogue DHCP server on the network.. The client is receiving an APIPA address (169.254.x.x) despite the DHCP server having available addresses and being on the same subnet. This indicates that the client's DHCP discover broadcast is not reaching the legitimate DHCP server, or the server's offer is not reaching the client. Since the DHCP server is local and the scope is correctly configured, the most likely cause is a rogue DHCP server responding faster than the legitimate server, or a device (like a home router) acting as a DHCP server and handing out APIPA-like addresses or conflicting leases. Option D directly addresses this by suggesting to check for a rogue DHCP server, which can interfere with the DHCP process and cause the client to fail to obtain a valid IP.

Answer

Check the DHCP snooping configuration on the access switch.

Answer

Verify that no firewall is blocking UDP ports 67 and 68 on the local network.

Answer

Run the ipconfig /release and /renew commands on the client.

Question 3

A network engineer notices that clients in the 192.168.10.0/24 subnet are receiving the IP address 192.168.10.1 from the DHCP server, causing a duplicate IP conflict with the router’s own interface. What is the most likely cause?

Accepted Answer

The DHCP pool does not exclude the router’s own interface IP address.. The most likely cause is that the DHCP pool configuration does not exclude the router's own interface IP address (192.168.10.1) from the range of addresses that the DHCP server can assign. By default, a Cisco router acting as a DHCP server will lease any address within the configured network statement unless an explicit ip dhcp excluded-address command is applied. Since the router's interface already uses 192.168.10.1, leasing that same address to a client creates a duplicate IP conflict.

Answer

The DHCP conflict logging feature is disabled on the router.

Answer

The DHCP lease time is set too low, causing frequent re-issuing of addresses.

Answer

The DHCP pool’s default-router address is misconfigured, so the client uses the router’s IP as its own.

Question 4

A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?

Accepted Answer

Check if the web server is running HTTPS service on port 443.. The symptom (port 80 works, port 443 fails) with a static NAT that maps the entire IP address (not just specific ports) indicates the issue is likely at the server itself, not the NAT configuration. Static NAT translates all traffic for the inside local IP to the inside global IP, so if one TCP port works and another does not, the NAT is functioning correctly. The most appropriate next step is to verify that the web server is actually listening on TCP port 443 (HTTPS), as the server may not have the HTTPS service running or configured.

Answer

Verify that the ACL applied to the outside interface explicitly permits TCP port 443.

Answer

Examine the NAT translation table for any conflicting dynamic entries.

Answer

Confirm the inside global IP address mapped to the server is correct.

Question 5

Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?

Accepted Answer

The order of the ACL entries causes the deny statement to match first.. The ACL is processed top-down, and the first matching entry determines the action. In this scenario, the deny statement for 192.168.10.0/24 to 192.168.20.0/24 appears before any permit statement for that traffic, so packets from the 192.168.10.0/24 network to the 192.168.20.0/24 network are denied immediately, even if a later permit statement would have allowed them. This explains why hosts can reach other networks (including the Internet) but not the 192.168.20.0/24 servers.

Answer

The ACL is applied in the wrong direction on the interface.

Answer

The ACL is missing a permit statement for the 192.168.20.0/24 destination.

Answer

The implicit deny at the end is blocking the traffic to 192.168.20.0/24.

Question 6

After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?

Accepted Answer

The port Gi0/24 has not been configured as a trusted port for DHCP snooping.. When DHCP snooping is enabled, all ports are untrusted by default. Untrusted ports will drop DHCP server messages (OFFER, ACK, etc.) unless the port is explicitly configured as trusted. Since the DHCP server is connected to Gi0/24 and the technician did not configure it as a trusted port, the switch discards the server's responses, preventing clients from obtaining IP addresses.

Answer

The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.

Answer

The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.

Answer

The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.

Question 7

Refer to the exhibit. A network administrator notices that newly connected devices on the 192.168.1.0/24 subnet are failing to obtain IP addresses via DHCP and are instead assigning themselves APIPA addresses. The administrator issues the show ip dhcp pool command on the router and receives the output shown. What is the most likely cause of this issue?

Accepted Answer

The lease time is set to 7 days, causing old devices to hold IP addresses long after disconnecting.. A 7-day lease time means that IP addresses assigned to devices are held for a full week, even after those devices disconnect from the network. If the subnet is small (e.g., 192.168.1.0/24 provides 254 usable addresses) and many devices have come and gone, the DHCP pool can become exhausted, leaving no available addresses for new devices. When DHCP fails, clients fall back to APIPA (169.254.x.x) addresses per RFC 3927.

Answer

DHCP snooping is blocking DHCP Offer messages on the VLAN.

Answer

The DHCP pool has an address conflict, causing all addresses to be marked as ineligible.

Answer

The pool's subnet mask is incorrectly configured as /24 instead of /25, limiting available addresses.

Question 8

A network technician is troubleshooting a router that cannot be accessed via SSH. The router responds to Telnet but SSH attempts return 'connection refused'. The technician confirmed that 'ip ssh version 2' is configured and 'show ip ssh' indicates SSH is enabled. The output of 'show line vty 0 4' shows 'transport input telnet'. What should the technician do next?

Accepted Answer

Add the 'transport input ssh' command to the VTY lines.. The VTY lines are configured with 'transport input telnet', which explicitly allows only Telnet sessions. SSH is enabled globally, but because it is not listed in the VTY transport input, the router rejects SSH connection attempts. Adding 'transport input ssh' (or 'transport input all') under the VTY lines permits SSH connections without disrupting Telnet, solving the mismatch at the application layer.

Answer

Generate a new RSA key pair and restart the SSH service.

Answer

Configure 'ip ssh version 1' to enable backward compatibility.

Answer

Configure AAA authentication on the VTY lines.

Question 9

A network technician is troubleshooting a DHCP relay issue. The router at the branch office is supposed to forward DHCP requests from local clients to a central DHCP server. Clients connected to Gi0/1 are not receiving IP addresses. The technician verifies that the DHCP server is reachable from the router, that no ACLs are blocking DHCP traffic, and that the DHCP scope on the server has available leases. Upon checking the running configuration, the technician notices that the ip helper-address command is applied to interface Gi0/0 (the WAN link toward the server) instead of Gi0/1. What should the technician do next?

Accepted Answer

Move the ip helper-address command from interface Gi0/0 to interface Gi0/1.. The ip helper-address command must be applied to the interface that receives the DHCP broadcast from clients, which is Gi0/1 in this scenario. It converts the broadcast into a unicast directed to the DHCP server. Applying it to Gi0/0 (the WAN interface) is ineffective because broadcasts are not forwarded across routers by default, and the helper address must be on the ingress interface of the client subnet.

Answer

Check the DHCP server logs for any error or warning messages related to the clients' requests.

Answer

Issue the show ip interface brief command to ensure that interface Gi0/1 is in an up/up state.

Answer

Remove the ip helper-address from Gi0/0 and then reapply it to the same interface to ensure the command is active.

Question 10

After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?

Accepted Answer

DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.. Dynamic ARP Inspection (DAI) relies on the DHCP snooping binding table to validate ARP packets. When a host uses a static IP address, it does not have an entry in that table, so DAI treats its ARP packets as invalid and drops them. This prevents the static host from resolving the default gateway's MAC address, breaking connectivity even though the IP and MAC are correct.

Answer

The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.

Answer

IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.

Answer

The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.

Question 11

A network engineer notices that an NMS at 10.1.1.200 cannot poll a router that has SNMPv2c configured with community string 'public'. What is causing this issue?

Accepted Answer

The SNMP community 'public' has an access list that only permits host 10.1.1.100.. SNMPv2c community strings can be restricted by an access control list (ACL) that specifies which source IP addresses are allowed to poll the router. If the ACL only permits host 10.1.1.100, then the NMS at 10.1.1.200 will be denied access even though the community string 'public' is correct. This is a common configuration for security, but it prevents polling from unauthorized hosts.

Answer

SNMPv2c is not enabled on the router.

Answer

The NMS is using the wrong community string.

Answer

The router's SNMP agent is not listening on the interface facing 10.1.1.200.

Question 12

Refer to the exhibit. A network engineer is troubleshooting a DHCP issue where DHCP clients on the LAN subnet are sending DHCPDISCOVER messages but the DHCP server does not receive them. The output of the show ip dhcp binding command on R1 is shown. What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The trap logging level is set to errors (severity 3), filtering out informational and debug messages.. The exhibit shows that the logging trap level is configured to 'errors' (severity 3). This means only syslog messages with a severity of 0 (emergencies) through 3 (errors) are sent to the syslog server. Informational (severity 6) and debugging (severity 7) messages are filtered out because they are below the configured trap threshold. This directly explains why those messages are not reaching the server, even though they are generated locally.

Answer

The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

Answer

The syslog server IP address 192.168.100.50 is unreachable from the router.

Answer

Console logging is disabled, so only severity 3 and lower messages appear.

Question 13

Refer to the exhibit. A network engineer is troubleshooting a DHCP issue where DHCP clients on the LAN subnet are sending DHCPDISCOVER messages but the DHCP server does not receive them. The output of the show ip dhcp binding command on R1 is shown. What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ACL 110 is not applied to any interface.. If an ACL is not applied to any interface, it will never process traffic, and the 'show access-lists' command will show zero matches for all ACEs. The engineer confirmed that traffic matching the ACL entries is traversing the network, but the ACL counters remain at zero, which directly indicates that the ACL is not being invoked by any interface configuration. Applying an ACL to an interface with the 'ip access-group' command is required for it to filter traffic.

Answer

The ACL is applied to the interface in the wrong direction (inbound instead of outbound).

Answer

The access-list 110 syntax has incorrect subnet masks causing no matches.

Answer

The interface GigabitEthernet0/0 is administratively down, preventing ACL processing.

Question 14

After securing a switch by running 'ip ssh version 2' and generating RSA keys with 'crypto key generate rsa modulus 1024', remote SSH connections fail with a 'key exchange error'. A check of the SSH client’s documentation reveals it requires a minimum 2048-bit RSA key for SSH version 2. What should the technician do next?

Accepted Answer

Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.. The error is caused by the SSH client requiring a minimum 2048-bit RSA key for SSH version 2, but the switch was configured with a 1024-bit key. The correct solution is to regenerate the RSA key pair with a 2048-bit modulus using 'crypto key generate rsa modulus 2048', which satisfies the client's security requirement and allows SSH version 2 to establish a secure connection.

Answer

Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.

Answer

Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.

Answer

Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.

Question 15

A network engineer notices that after removing a standard ACL that was applied inbound on the internet-facing interface, the router is now receiving IP packets from the internet with source IP addresses in the 10.0.0.0/8 range, which were previously blocked. What is the most likely cause?

Accepted Answer

Removing the ACL from the interface eliminates the implicit deny at the end and restores the default permit all behavior, allowing all incoming traffic.. When a standard ACL is removed from an interface using the 'no ip access-group' command, the implicit deny any at the end of the ACL is also removed. By default, Cisco routers permit all IP traffic on an interface unless an ACL is applied to filter it. Therefore, after removal, the router reverts to its default permit-all behavior, allowing previously blocked traffic like source IPs in the 10.0.0.0/8 range.

Answer

The original standard ACL only had a permit statement, so after removal the permit still takes effect because the ACL remains in the running configuration.

Answer

The ip access-group command on the interface remains but is missing the referenced ACL, causing the router to default to denying all ingress traffic except the previously permitted 10.0.0.0/8.

Answer

The ACL was reapplied in the outbound direction instead of inbound, so it now blocks traffic leaving the interface but not entering it.