CCNA Network Services and Security Practice Test 36 — 15 Questions

Question 1

A client PC is receiving an APIPA address (169.254.x.x) instead of a valid IP from the DHCP server. The DHCP server is on the same subnet as the client. The technician runs the command 'show ip dhcp binding' and confirms that the correct scope is configured. The command 'show ip dhcp pool' shows that there are plenty of addresses remaining in the pool. The client's NIC status shows 'connected'. What should the technician do next?

Accepted Answer

Check for a rogue DHCP server on the network.. When a client on the same subnet as the DHCP server still receives an APIPA address, the problem is often that the client's DHCP Discover broadcasts are not reaching the legitimate DHCP server or the server's offers are not reaching the client. Since the technician has already verified the DHCP server configuration (scope exists, addresses available) and the client's physical connectivity (NIC connected), the most logical next step is to check for a rogue DHCP server. A rogue server can intercept DHCP Discover messages and respond with invalid or malicious offers, causing the client to disregard legitimate offers, or it might respond with offers that conflict and confuse the client. This addresses the DHCP application layer (Layer 7) and ensures that only the authorized server is responding. Identifying a rogue server can be done via packet capture or by inspecting DHCP lease database inconsistencies.

Answer

Check the DHCP snooping configuration on the access switch.

Answer

Verify that no firewall is blocking UDP ports 67 and 68 on the local network.

Answer

Run the ipconfig /release and /renew commands on the client.

Question 2

A network engineer notices that clients in the 192.168.10.0/24 subnet are receiving the IP address 192.168.10.1 from the DHCP server, causing a duplicate IP conflict with the router’s own interface. What is the most likely cause?

Accepted Answer

The DHCP pool does not exclude the router’s own interface IP address.. The DHCP server is handing out 192.168.10.1, which is the router’s interface IP, because the pool includes the entire subnet without excluding that address. The correct fix is to configure 'ip dhcp excluded-address 192.168.10.1'. The other options describe features that do not control whether the server offers a specific address: conflict logging, lease time, and default-router settings do not prevent assignment of a duplicate address.

Answer

The DHCP conflict logging feature is disabled on the router.

Answer

The DHCP lease time is set too low, causing frequent re-issuing of addresses.

Answer

The DHCP pool’s default-router address is misconfigured, so the client uses the router’s IP as its own.

Question 3

A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?

Accepted Answer

Check if the web server is running HTTPS service on port 443.. Since the ACL already permits all IP traffic and the static NAT translation works for port 80, the problem is not at Layer 3/4 filtering or NAT. The most likely cause is an application-layer issue: the web server is not listening on port 443. Checking the server's HTTPS service directly addresses that.

Answer

Verify that the ACL applied to the outside interface explicitly permits TCP port 443.

Answer

Examine the NAT translation table for any conflicting dynamic entries.

Answer

Confirm the inside global IP address mapped to the server is correct.

Question 4

Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?

Accepted Answer

The order of the ACL entries causes the deny statement to match first.. The exhibit shows Extended IP access list 110 with a deny statement for traffic from 192.168.10.0/24 to 192.168.20.0/24 (entry 10) placed before a permit ip any statement (entry 20). Because ACLs are processed in sequential order, the first matching entry is used. Traffic from 192.168.10.0/24 to 192.168.20.0/24 matches the deny statement and is dropped, even though a subsequent permit entry would allow it. The counters (145 matches for deny, 95 matches for permit) confirm that the deny is being hit first.

Answer

The ACL is applied in the wrong direction on the interface.

Answer

The ACL is missing a permit statement for the 192.168.20.0/24 destination.

Answer

The implicit deny at the end is blocking the traffic to 192.168.20.0/24.

Question 5

After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?

Accepted Answer

The port Gi0/24 has not been configured as a trusted port for DHCP snooping.. DHCP snooping classifies all ports as untrusted by default, and an untrusted port drops DHCP server messages (OFFER/ACK) to prevent rogue servers. Because the uplink Gi0/24 was not explicitly configured as a trusted port with ip dhcp snooping trust, the legitimate DHCP offers from the server are being discarded, so clients never receive addresses. The other options are not the cause: an ip helper-address would still be needed if the server were remote and was working before snooping (so it is already in place); the DHCP snooping database is not required for traffic forwarding; and the binding table does not need to contain the server’s MAC to permit server traffic.

Answer

The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.

Answer

The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.

Answer

The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.

Question 6

Refer to the exhibit. A network administrator notices that newly connected devices on the 192.168.1.0/24 subnet are failing to obtain IP addresses via DHCP and are instead assigning themselves APIPA addresses. The administrator issues the show ip dhcp pool command on the router and receives the output shown. What is the most likely cause of this issue?

Accepted Answer

The lease time is set to 7 days, causing old devices to hold IP addresses long after disconnecting.. The exhibit shows 'Current bindings: 253' out of 'Total addresses: 254', meaning only one free IP remains. 'Lease expiration' is 7 days, indicating that devices that have disconnected still hold their bindings for up to a week, preventing new clients from obtaining addresses. This explains the APIPA fallback.

Answer

DHCP snooping is blocking DHCP Offer messages on the VLAN.

Answer

The DHCP pool has an address conflict, causing all addresses to be marked as ineligible.

Answer

The pool's subnet mask is incorrectly configured as /24 instead of /25, limiting available addresses.

Question 7

A network technician applies an extended ACL outbound on the WAN interface Gi0/0 to block traffic from the 10.0.0.0/8 network to internet hosts. After applying the ACL, internal users report they cannot access any web pages because return traffic from internet hosts is being dropped. The technician verifies the ACL entries and finds only statements controlling outbound traffic. What is the most appropriate next action?

Accepted Answer

Add the established keyword to the ACL to permit return traffic for existing sessions.. Extended ACLs are stateless; they inspect each packet individually without tracking session state. When an outbound ACL permits outbound traffic from the inside network to the internet, the return traffic is not automatically allowed. The established keyword in a TCP access-list entry matches packets that have the ACK or RST bits set, indicating they belong to an established session. Adding this keyword to a permit statement for return traffic allows the router to dynamically permit responses to internally initiated connections without opening the network to all inbound traffic. This addresses the transport layer (Layer 4) state required for bidirectional communication.

Answer

Add a new access-list entry permitting all traffic from internet hosts to the 10.0.0.0/8 network.

Answer

Remove the outbound ACL and apply a new inbound ACL on the same interface.

Answer

Replace the ACL with a stateful firewall rule set.

Question 8

A network technician is troubleshooting a router that cannot be accessed via SSH. The router responds to Telnet but SSH attempts return 'connection refused'. The technician confirmed that 'ip ssh version 2' is configured and 'show ip ssh' indicates SSH is enabled. The output of 'show line vty 0 4' shows 'transport input telnet'. What should the technician do next?

Accepted Answer

Add the 'transport input ssh' command to the VTY lines.. The VTY lines are configured with 'transport input telnet', which explicitly allows only Telnet sessions. SSH is enabled globally, but because it is not listed in the VTY transport input, the router rejects SSH connection attempts. Adding 'transport input ssh' (or 'transport input all') under the VTY lines permits SSH connections without disrupting Telnet, solving the mismatch at the application layer.

Answer

Generate a new RSA key pair and restart the SSH service.

Answer

Configure 'ip ssh version 1' to enable backward compatibility.

Answer

Configure AAA authentication on the VTY lines.

Question 9

A network technician is troubleshooting a DHCP relay issue. The router at the branch office is supposed to forward DHCP requests from local clients to a central DHCP server. Clients connected to Gi0/1 are not receiving IP addresses. The technician verifies that the DHCP server is reachable from the router, that no ACLs are blocking DHCP traffic, and that the DHCP scope on the server has available leases. Upon checking the running configuration, the technician notices that the ip helper-address command is applied to interface Gi0/0 (the WAN link toward the server) instead of Gi0/1. What should the technician do next?

Accepted Answer

Move the ip helper-address command from interface Gi0/0 to interface Gi0/1.. The ip helper-address command must be configured on the interface that receives DHCP broadcasts from clients—in this case, Gi0/1, the LAN-facing interface. Placing it on the WAN interface (Gi0/0) means the router never sees the client broadcasts and therefore never relays them. Moving the command to Gi0/1 enables the router to intercept DHCP discoveries and forward them as unicast packets to the DHCP server. This action directly addresses a common DHCP relay misconfiguration at the network services layer.

Answer

Check the DHCP server logs for any error or warning messages related to the clients' requests.

Answer

Issue the show ip interface brief command to ensure that interface Gi0/1 is in an up/up state.

Answer

Remove the ip helper-address from Gi0/0 and then reapply it to the same interface to ensure the command is active.

Question 10

After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?

Accepted Answer

DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.. Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table to validate ARP packets. Hosts with statically assigned IP addresses have no DHCP binding entry, so DAI considers their ARP packets invalid and drops them, preventing these hosts from resolving MAC addresses and thus causing loss of connectivity.

Answer

The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.

Answer

IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.

Answer

The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.

Question 11

A network engineer notices that an NMS at 10.1.1.200 cannot poll a router that has SNMPv2c configured with community string 'public'. What is causing this issue?

Accepted Answer

The SNMP community 'public' has an access list that only permits host 10.1.1.100.. The SNMP community 'public' has an ACL that permits only host 10.1.1.100, so the NMS at 10.1.1.200 is explicitly denied. No other condition explains the symptom because the community string matches, SNMPv2c is enabled by the configuration, and the agent listens on all interfaces by default.

Answer

SNMPv2c is not enabled on the router.

Answer

The NMS is using the wrong community string.

Answer

The router's SNMP agent is not listening on the interface facing 10.1.1.200.

Question 12

Refer to the exhibit. A network engineer is troubleshooting an issue where syslog messages at severity 6 (informational) and severity 7 (debugging) are not being sent to the syslog server at 192.168.100.50, even though the device appears to generate these messages locally. Based on the exhibit, what is the most likely cause?

Accepted Answer

The trap logging level is set to errors (severity 3), filtering out informational and debug messages.. The exhibit shows 'Trap logging: level errors (3)'. This filter level means only syslog messages with severity 0 (emergency) through 3 (errors) are forwarded to the syslog server. Severity 6 (informational) and 7 (debugging) are above this threshold and are therefore excluded. The log buffer, however, is set to 'debugging' level, so those messages appear locally but are not sent to the server.

Answer

The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

Answer

The syslog server IP address 192.168.100.50 is unreachable from the router.

Answer

Console logging is disabled, so only severity 3 and lower messages appear.

Question 13

Refer to the exhibit. A network engineer is troubleshooting an ACL that is not filtering traffic as expected. The engineer runs the show access-lists 110 command and notices that all access control entries (ACEs) show zero matches, even though traffic that should match the permit or deny statements is traversing the network. The engineer then checks the interface configuration. What is the most likely cause?

Accepted Answer

The ACL 110 is not applied to any interface.. The exhibit shows 'Inbound access list is not set' and 'Outgoing access list is not set' under GigabitEthernet0/0. This confirms that no access list has been applied to this interface, so access list 110, though defined, is not filtering any traffic. Zero matches are observed because the ACL is never consulted.

Answer

The ACL is applied to the interface in the wrong direction (inbound instead of outbound).

Answer

The access-list 110 syntax has incorrect subnet masks causing no matches.

Answer

The interface GigabitEthernet0/0 is administratively down, preventing ACL processing.

Question 14

After securing a switch by running 'ip ssh version 2' and generating RSA keys with 'crypto key generate rsa modulus 1024', remote SSH connections fail with a 'key exchange error'. A check of the SSH client’s documentation reveals it requires a minimum 2048-bit RSA key for SSH version 2. What should the technician do next?

Accepted Answer

Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.. The 'key exchange error' occurs because the 1024-bit RSA key does not meet the client’s 2048-bit minimum requirement for SSH version 2. The immediate corrective step is to regenerate the RSA keys with a 2048-bit modulus using the 'crypto key generate rsa modulus 2048' command, which will produce a larger key pair while preserving the existing SSH version 2 configuration. This addresses the Layer 7 application misconfiguration directly.

Answer

Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.

Answer

Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.

Answer

Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.

Question 15

A network engineer notices that after removing a standard ACL that was applied inbound on the internet-facing interface, the router is now receiving IP packets from the internet with source IP addresses in the 10.0.0.0/8 range, which were previously blocked. What is the most likely cause?

Accepted Answer

Removing the ACL from the interface eliminates the implicit deny at the end and restores the default permit all behavior, allowing all incoming traffic.. When an ACL is removed from an interface using 'no ip access-group', the interface reverts to its default behavior of permitting all traffic. The previous ACL's implicit deny all no longer applies, so spoofed RFC 1918 source addresses that were once blocked are now allowed to enter.

Answer

The original standard ACL only had a permit statement, so after removal the permit still takes effect because the ACL remains in the running configuration.

Answer

The ip access-group command on the interface remains but is missing the referenced ACL, causing the router to default to denying all ingress traffic except the previously permitted 10.0.0.0/8.

Answer

The ACL was reapplied in the outbound direction instead of inbound, so it now blocks traffic leaving the interface but not entering it.