CCNA Network Services and Security Practice Test 37 — 15 Questions

Question 1

A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the web server is running HTTPS service on port 443.. The symptom (port 80 works, port 443 fails) with a static NAT that maps the entire IP address (not just specific ports) indicates the issue is likely at the server itself, not the NAT configuration. Static NAT translates all traffic for the inside local IP to the inside global IP, so if one TCP port works and another does not, the NAT is functioning correctly. The most appropriate next step is to verify that the web server is actually listening on TCP port 443 (HTTPS), as the server may not have the HTTPS service running or configured.

Answer

Verify that the ACL applied to the outside interface explicitly permits TCP port 443.

Answer

Examine the NAT translation table for any conflicting dynamic entries.

Answer

Confirm the inside global IP address mapped to the server is correct.

Question 2

Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?

Accepted Answer

The order of the ACL entries causes the deny statement to match first.. The ACL is processed top-down, and the first matching entry determines the action. In this scenario, the deny statement for 192.168.10.0/24 to 192.168.20.0/24 appears before any permit statement for that traffic, so packets from the 192.168.10.0/24 network to the 192.168.20.0/24 network are denied immediately, even if a later permit statement would have allowed them. This explains why hosts can reach other networks (including the Internet) but not the 192.168.20.0/24 servers.

Answer

The ACL is applied in the wrong direction on the interface.

Answer

The ACL is missing a permit statement for the 192.168.20.0/24 destination.

Answer

The implicit deny at the end is blocking the traffic to 192.168.20.0/24.

Question 3

After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?

Accepted Answer

The port Gi0/24 has not been configured as a trusted port for DHCP snooping.. When DHCP snooping is enabled, all ports are untrusted by default. Untrusted ports will drop DHCP server messages (OFFER, ACK, etc.) unless the port is explicitly configured as trusted. Since the DHCP server is connected to Gi0/24 and the technician did not configure it as a trusted port, the switch discards the server's responses, preventing clients from obtaining IP addresses.

Answer

The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.

Answer

The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.

Answer

The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.

Question 4

Refer to the exhibit. A network administrator notices that newly connected devices on the 192.168.1.0/24 subnet are failing to obtain IP addresses via DHCP and are instead assigning themselves APIPA addresses. The administrator issues the show ip dhcp pool command on the router and receives the output shown. What is the most likely cause of this issue?

Accepted Answer

The lease time is set to 7 days, causing old devices to hold IP addresses long after disconnecting.. A 7-day lease time means that IP addresses assigned to devices are held for a full week, even after those devices disconnect from the network. If the subnet is small (e.g., 192.168.1.0/24 provides 254 usable addresses) and many devices have come and gone, the DHCP pool can become exhausted, leaving no available addresses for new devices. When DHCP fails, clients fall back to APIPA (169.254.x.x) addresses per RFC 3927.

Answer

DHCP snooping is blocking DHCP Offer messages on the VLAN.

Answer

The DHCP pool has an address conflict, causing all addresses to be marked as ineligible.

Answer

The pool's subnet mask is incorrectly configured as /24 instead of /25, limiting available addresses.

Question 5

A network technician is troubleshooting a router that cannot be accessed via SSH. The router responds to Telnet but SSH attempts return 'connection refused'. The technician confirmed that 'ip ssh version 2' is configured and 'show ip ssh' indicates SSH is enabled. The output of 'show line vty 0 4' shows 'transport input telnet'. What should the technician do next?

Accepted Answer

Add the 'transport input ssh' command to the VTY lines.. The VTY lines are configured with 'transport input telnet', which explicitly allows only Telnet sessions. SSH is enabled globally, but because it is not listed in the VTY transport input, the router rejects SSH connection attempts. Adding 'transport input ssh' (or 'transport input all') under the VTY lines permits SSH connections without disrupting Telnet, solving the mismatch at the application layer.

Answer

Generate a new RSA key pair and restart the SSH service.

Answer

Configure 'ip ssh version 1' to enable backward compatibility.

Answer

Configure AAA authentication on the VTY lines.

Question 6

A network technician is troubleshooting a DHCP relay issue. The router at the branch office is supposed to forward DHCP requests from local clients to a central DHCP server. Clients connected to Gi0/1 are not receiving IP addresses. The technician verifies that the DHCP server is reachable from the router, that no ACLs are blocking DHCP traffic, and that the DHCP scope on the server has available leases. Upon checking the running configuration, the technician notices that the ip helper-address command is applied to interface Gi0/0 (the WAN link toward the server) instead of Gi0/1. What should the technician do next?

Accepted Answer

Move the ip helper-address command from interface Gi0/0 to interface Gi0/1.. The ip helper-address command must be applied to the interface that receives the DHCP broadcast from clients, which is Gi0/1 in this scenario. It converts the broadcast into a unicast directed to the DHCP server. Applying it to Gi0/0 (the WAN interface) is ineffective because broadcasts are not forwarded across routers by default, and the helper address must be on the ingress interface of the client subnet.

Answer

Check the DHCP server logs for any error or warning messages related to the clients' requests.

Answer

Issue the show ip interface brief command to ensure that interface Gi0/1 is in an up/up state.

Answer

Remove the ip helper-address from Gi0/0 and then reapply it to the same interface to ensure the command is active.

Question 7

After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?

Accepted Answer

DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.. Dynamic ARP Inspection (DAI) relies on the DHCP snooping binding table to validate ARP packets. When a host uses a static IP address, it does not have an entry in that table, so DAI treats its ARP packets as invalid and drops them. This prevents the static host from resolving the default gateway's MAC address, breaking connectivity even though the IP and MAC are correct.

Answer

The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.

Answer

IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.

Answer

The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.

Question 8

A network engineer notices that an NMS at 10.1.1.200 cannot poll a router that has SNMPv2c configured with community string 'public'. What is causing this issue?

Accepted Answer

The SNMP community 'public' has an access list that only permits host 10.1.1.100.. SNMPv2c community strings can be restricted by an access control list (ACL) that specifies which source IP addresses are allowed to poll the router. If the ACL only permits host 10.1.1.100, then the NMS at 10.1.1.200 will be denied access even though the community string 'public' is correct. This is a common configuration for security, but it prevents polling from unauthorized hosts.

Answer

SNMPv2c is not enabled on the router.

Answer

The NMS is using the wrong community string.

Answer

The router's SNMP agent is not listening on the interface facing 10.1.1.200.

Question 9

Refer to the exhibit. A network engineer is troubleshooting an issue where syslog messages at severity 6 (informational) and severity 7 (debugging) are not being sent to the syslog server at 192.168.100.50, even though the device appears to generate these messages locally. Based on the exhibit, what is the most likely cause?

Accepted Answer

The trap logging level is set to errors (severity 3), filtering out informational and debug messages.. The exhibit shows that the logging trap level is configured to 'errors' (severity 3). This means only syslog messages with a severity of 0 (emergencies) through 3 (errors) are sent to the syslog server. Informational (severity 6) and debugging (severity 7) messages are filtered out because they are below the configured trap threshold. This directly explains why those messages are not reaching the server, even though they are generated locally.

Answer

The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

Answer

The syslog server IP address 192.168.100.50 is unreachable from the router.

Answer

Console logging is disabled, so only severity 3 and lower messages appear.

Question 10

Refer to the exhibit. A network engineer is troubleshooting an ACL that is not filtering traffic as expected. The engineer runs the show access-lists 110 command and notices that all access control entries (ACEs) show zero matches, even though traffic that should match the permit or deny statements is traversing the network. The engineer then checks the interface configuration. What is the most likely cause?

Accepted Answer

The ACL 110 is not applied to any interface.. If an ACL is not applied to any interface, it will never process traffic, and the 'show access-lists' command will show zero matches for all ACEs. The engineer confirmed that traffic matching the ACL entries is traversing the network, but the ACL counters remain at zero, which directly indicates that the ACL is not being invoked by any interface configuration. Applying an ACL to an interface with the 'ip access-group' command is required for it to filter traffic.

Answer

The ACL is applied to the interface in the wrong direction (inbound instead of outbound).

Answer

The access-list 110 syntax has incorrect subnet masks causing no matches.

Answer

The interface GigabitEthernet0/0 is administratively down, preventing ACL processing.

Question 11

After securing a switch by running 'ip ssh version 2' and generating RSA keys with 'crypto key generate rsa modulus 1024', remote SSH connections fail with a 'key exchange error'. A check of the SSH client’s documentation reveals it requires a minimum 2048-bit RSA key for SSH version 2. What should the technician do next?

Accepted Answer

Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.. The error is caused by the SSH client requiring a minimum 2048-bit RSA key for SSH version 2, but the switch was configured with a 1024-bit key. The correct solution is to regenerate the RSA key pair with a 2048-bit modulus using 'crypto key generate rsa modulus 2048', which satisfies the client's security requirement and allows SSH version 2 to establish a secure connection.

Answer

Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.

Answer

Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.

Answer

Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.

Question 12

A network engineer notices that after removing a standard ACL that was applied inbound on the internet-facing interface, the router is now receiving IP packets from the internet with source IP addresses in the 10.0.0.0/8 range, which were previously blocked. What is the most likely cause?

Accepted Answer

Removing the ACL from the interface eliminates the implicit deny at the end and restores the default permit all behavior, allowing all incoming traffic.. When a standard ACL is removed from an interface using the 'no ip access-group' command, the implicit deny any at the end of the ACL is also removed. By default, Cisco routers permit all IP traffic on an interface unless an ACL is applied to filter it. Therefore, after removal, the router reverts to its default permit-all behavior, allowing previously blocked traffic like source IPs in the 10.0.0.0/8 range.

Answer

The original standard ACL only had a permit statement, so after removal the permit still takes effect because the ACL remains in the running configuration.

Answer

The ip access-group command on the interface remains but is missing the referenced ACL, causing the router to default to denying all ingress traffic except the previously permitted 10.0.0.0/8.

Answer

The ACL was reapplied in the outbound direction instead of inbound, so it now blocks traffic leaving the interface but not entering it.

Question 13

A technician is troubleshooting an issue where internal hosts can successfully ping internet addresses but cannot establish HTTP sessions. The router is configured with PAT (overload) and uses an access list to define the inside local addresses. Recently, the internal network was renumbered from 192.168.0.0/24 to 10.0.0.0/24. What is the most likely cause?

Accepted Answer

The NAT access list still permits 192.168.0.0/24 and does not match the new 10.0.0.0/24 addresses.. The NAT access list (used with 'ip nat inside source list') still references the old 192.168.0.0/24 subnet. After renumbering to 10.0.0.0/24, the access list does not match the new inside local addresses, so PAT (overload) translation is not performed for those hosts. ICMP (ping) can still succeed if the router has a route to the internet and the packets are not translated, but HTTP sessions fail because the return traffic cannot be mapped back to the internal hosts without a NAT translation entry.

Answer

The router's HTTP inspection rule is blocking outbound TCP port 80.

Answer

The outside interface access list is blocking TCP packets from the new 10.0.0.0/24 subnet.

Answer

The default route has been changed to point to the wrong next-hop address, causing only HTTP packets to be dropped.

Question 14

Refer to the exhibit. An administrator has configured PAT for internal hosts to access the internet, but users report that they cannot reach external websites. The administrator suspects a NAT issue and runs the show ip nat statistics command. What is the most likely cause of the problem?

Accepted Answer

The NAT overload pool is incorrectly configured with the inside interface Gi0/1 instead of the outside interface Gi0/0.. The show ip nat statistics output likely shows that the NAT overload pool is referencing the inside interface (Gi0/1) instead of the outside interface (Gi0/0). For PAT (overload) to work, the router must translate the source IP of internal traffic to the IP address of the outside interface (Gi0/0) that connects to the internet. If the pool incorrectly uses the inside interface IP, the translated packets will have a source address that is not routable on the external network, causing connectivity failure.

Answer

The access-list 1 used in the NAT statement is not matching any traffic.

Answer

CEF switching is disabled, causing all packets to be punted to the process level and NAT to fail.

Answer

The maximum number of NAT translations has been reached, causing new translations to be denied.

Question 15

Refer to the exhibit. An administrator has configured NAT on router R1 to allow hosts on the 192.168.1.0/24 LAN to access the Internet. However, users report that they cannot reach external websites. The administrator runs the show ip nat translations command. What is the most likely reason for the problem?

Accepted Answer

The ip nat inside command is missing from the LAN-facing interface.. The output of 'show ip nat translations' shows no translations, which indicates that NAT is not being applied to traffic from the LAN. The most common cause is that the 'ip nat inside' command is missing from the LAN-facing interface (e.g., GigabitEthernet0/0). Without this command, the router does not identify the interface as the inside NAT domain, so it never translates the source addresses of packets arriving from the 192.168.1.0/24 subnet.

Answer

The access list used for dynamic NAT does not match the LAN subnet.

Answer

The ip nat outside command is missing from the WAN interface.

Answer

The ip nat inside source static commands have incorrect IP addresses.