CCNA Network Services and Security Practice Test 38 — 15 Questions

Question 1

Refer to the exhibit. A network engineer is troubleshooting DHCP issues on a branch office network. Several users report that new devices are unable to obtain IP addresses, even though the DHCP pool configured on R1 appears to have sufficient free addresses. The engineer executes the show ip dhcp conflict command and observes the output. Based on the output, what is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Several hosts on the network are using static IP addresses from the DHCP pool range, causing the DHCP server to mark those addresses as conflicts and depleting the available pool.. The output of 'show ip dhcp conflict' lists IP addresses that the DHCP server detected as already in use via ping or gratuitous ARP. When hosts use static IP addresses from the DHCP pool range, the server marks those addresses as conflicts and removes them from the available pool, effectively depleting the pool even though the scope shows free addresses. This matches the scenario where new devices cannot obtain IP addresses despite the pool appearing to have sufficient free addresses.

Answer

The DHCP scope is misconfigured with an exclusion range that includes 192.168.1.50 to 192.168.1.59.

Answer

The ping timeout on the DHCP server is set too low, causing it to falsely detect conflicts.

Answer

The DHCP server is not properly releasing expired leases, causing the conflict table to fill up.

Question 2

Refer to the exhibit. An administrator is trying to access a web server in the DMZ at 192.168.1.10 using HTTPS, but the connection times out. The web server is confirmed to be running and listening on both port 80 and port 443. The administrator examines the access list configuration on the perimeter router. Based on the output of the show access-lists command, what is the most likely cause of the failure?

Accepted Answer

The access list does not include a permit statement for TCP port 443.. The access list shown in the exhibit permits TCP port 80 (HTTP) but does not include a permit statement for TCP port 443 (HTTPS). Since the administrator is trying to access the web server using HTTPS, which uses port 443, the traffic is implicitly denied by the final 'deny ip any any log' statement. This causes the connection to time out because the packets are dropped before reaching the server.

Answer

The access list is applied in the wrong direction on the interface.

Answer

The web server is not actually listening on TCP port 443, despite the configuration.

Answer

The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.

Question 3

A network engineer notices that hosts in the 192.168.2.0/24 network connected to router R1's GigabitEthernet0/1 interface cannot reach the Internet. R1 has a standard ACL 10 configured as 'access-list 10 permit 192.168.1.0 0.0.0.255' and applied inbound on interface GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. What is the most likely cause?

Accepted Answer

The ACL is filtering return traffic from the Internet that enters G0/0, because it is applied inbound on that interface instead of outbound.. ACL 10 is applied inbound on GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. When traffic from the Internet returns to hosts in the 192.168.2.0/24 network, it enters G0/0 inbound and is evaluated against ACL 10, which only permits source addresses from 192.168.1.0/24. The implicit deny at the end of the ACL then blocks all return traffic destined for 192.168.2.0/24, preventing those hosts from reaching the Internet.

Answer

The implicit deny at the end of ACL 10 is blocking all outbound traffic from the 192.168.2.0/24 network.

Answer

The router is not performing inter-VLAN routing between the 192.168.1.0 and 192.168.2.0 networks.

Answer

The ACL is missing a permit statement for the 192.168.2.0/24 network to allow traffic from that subnet.

Question 4

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

Accepted Answer

The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.. The `show ntp status` output would show the clock as unsynchronized if R1 cannot communicate with the NTP server at 10.1.1.100. NTP uses UDP port 123, and a routing issue or an access list blocking this port would prevent the exchange of NTP packets, leaving the clock unsynchronized. The `ntp server` command configures R1 as a client to request synchronization, but it does not guarantee reachability.

Answer

The NTP authentication key configured on R1 does not match the one on the server.

Answer

The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.

Answer

The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.

Question 5

Refer to the exhibit. A network administrator is reviewing the NAT translations on router R1 and notices that the internal host 192.168.1.10 appears in both a static NAT entry (for ports 80 and 443) using global address 203.0.113.10, and a dynamic PAT entry (port 49152) using global address 203.0.113.1. The administrator is concerned this might indicate a misconfiguration. Based on the output, which statement is correct?

Accepted Answer

The translations are functioning correctly; the static entries allow inbound web traffic to the host, while the dynamic PAT entry supports an outbound client connection.. Static NAT and dynamic PAT can coexist for the same inside host because they serve different purposes. The static NAT entries for ports 80 and 443 allow inbound web traffic from the internet to reach the internal server at 192.168.1.10 using global address 203.0.113.10. The dynamic PAT entry (port 49152) using global address 203.0.113.1 is a separate translation for an outbound connection initiated by the same host, which is normal behavior as the router maintains distinct translation entries based on direction and port.

Answer

The static NAT rule is being overridden by the dynamic PAT rule, causing inbound web traffic to the server to fail.

Answer

The dynamic PAT entry indicates a duplicate session that will cause asymmetric routing and packet drops.

Answer

The router is incorrectly performing both static and dynamic NAT for the same inside address, which violates the configured NAT order.

Question 6

Refer to the exhibit. A network administrator configures NAT overload on R1 to allow internal hosts in the 10.1.1.0/24 subnet to access the Internet. After the configuration, the administrator runs the show ip nat translations verbose command and notices that several internal sessions all appear to use the same inside global port 1024. The administrator is concerned that port conflicts will occur. Based on the output, which statement is correct?

Accepted Answer

The translations are extended entries, so the combination of inside global IP, outside global IP, and port ensures each session is unique, even though the inside global port is the same.. NAT overload (PAT) creates extended entries that uniquely identify each session by the combination of inside global IP, outside global IP, and port. Even though multiple sessions share the same inside global port 1024, the different outside global IP addresses and ports ensure that each translation entry is unique, preventing port conflicts.

Answer

The NAT configuration is missing the overload keyword, causing all internal hosts to share a single source port.

Answer

The static NAT entry mapping 203.0.113.5 to the entire 10.1.1.0/24 subnet forces all subordinate translations to use the same port 1024.

Answer

The dynamic NAT pool is exhausted, forcing the router to reuse port 1024 for all new sessions.

Question 7

A small office has an internal server at 192.168.1.50 that must be reachable from the internet on TCP port 443 using the public address 203.0.113.10. The edge router already performs NAT overload for outbound client traffic on its outside interface. Which configuration correctly adds inbound reachability without breaking existing outbound translation?

Accepted Answer

ip nat inside source static tcp 192.168.1.50 443 203.0.113.10 443. Static NAT with port forwarding binds the inside server's private address and port to a specific public address and port, producing a permanent one-to-one mapping that outside hosts can initiate connections to. Because it is a static entry, it does not conflict with the existing overload configuration used for outbound client traffic, so both behaviors can run on the same router.

Answer

ip nat outside source static tcp 192.168.1.50 443 203.0.113.10 443

Answer

ip nat pool WEB 203.0.113.10 203.0.113.10 netmask 255.255.255.0

Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload

Question 8

A junior administrator is configuring a Cisco router that must forward DHCP requests from the 10.20.30.0/24 LAN to a DHCP server at 192.168.100.50. The LAN interface is Gi0/0 with IP 10.20.30.1. Which single command is required on Gi0/0 so the router relays these broadcasts?

Accepted Answer

ip helper-address 192.168.100.50. The router must act as a DHCP relay agent because clients broadcast on the local segment while the server sits on a different subnet. Configuring the LAN interface with ip helper-address pointing to the server converts those broadcasts into unicasts toward 192.168.100.50, enabling address assignment without placing a DHCP server on every LAN.

Answer

ip forward-protocol udp 192.168.100.50

Answer

ip dhcp relay 192.168.100.50

Answer

ip dhcp pool LAN

Question 9

You are configuring a Cisco switch port in a lobby area where only one device should ever connect. You want the port to learn the first MAC address it sees, and if a different MAC address appears later, you want the port to drop frames from the new address while still allowing the original device to communicate. Which port-security violation mode meets this requirement?

Accepted Answer

protect. Port security protect mode silently discards frames from any MAC address beyond the configured maximum and never logs or disables the port. This preserves connectivity for the first learned, authorized device while blocking the unexpected address, which is exactly the lobby scenario where only one device should be permitted.

Answer

shutdown

Answer

restrict

Answer

err-disable

Question 10

A network administrator at a small branch office needs to allow a wireless guest user to reach an internal web server at 10.5.5.20 using a browser, while preventing that guest from reaching any other internal subnet. The guest is connected to VLAN 50 and the web server is in VLAN 10. Which type of ACL should be applied on the router between VLANs to meet this requirement?

Accepted Answer

Extended numbered ACL 100 applied inbound on the VLAN 50 interface. An extended ACL is required because the requirement involves matching both source and destination addresses, and the protocol/port for HTTP. Applying it inbound on the guest VLAN interface filters traffic as it enters the router, before it can reach other internal subnets. A standard ACL cannot match destination addresses, and the other placements either use the wrong ACL type or the wrong direction.

Answer

Standard numbered ACL 10 applied inbound on the VLAN 50 interface

Answer

Standard named ACL GUEST_IN applied outbound on the VLAN 10 interface

Answer

Extended named ACL GUEST_OUT applied outbound on the VLAN 50 interface

Question 11

A network engineer is configuring a Cisco switch port for a conference room wall jack. The port must allow only one MAC address at a time, and if a different device is connected, the port should drop packets from the new device but still send a syslog message and increment the violation counter. Which port security violation mode meets these requirements?

Accepted Answer

restrict. Port security violation modes determine what happens when an unauthorized MAC address appears. Restrict mode drops the offending frames, increments the violation counter, and generates a syslog message, while keeping the port up for the authorized device. Protect mode drops silently without logging. Shutdown mode err-disables the port, which is too disruptive here.

Answer

shutdown

Answer

protect

Answer

disable

Question 12

A network administrator is troubleshooting a switch that is receiving DHCPDISCOVER messages from a client on VLAN 20, but the DHCP server on a different subnet never sees those requests. The interface VLAN 20 has the address 10.20.0.1/24, and the DHCP server address is 10.99.0.10. Which command should be applied to enable the switch to forward these requests to the server?

Accepted Answer

ip helper-address 10.99.0.10. DHCP relay is configured with the ip helper-address command on the interface facing the clients, which unicasts their DHCP broadcasts to the specified server and sets the gateway address so the server can match the correct scope. Without it, the broadcast stays on the local subnet and the remote server never receives the request.

Answer

ip dhcp pool VLAN20

Answer

ip forward-protocol udp 67

Answer

ip dhcp relay information option

Question 13

A network engineer is configuring a Cisco IOS router that connects a small branch office to the Internet. The router's outside interface is GigabitEthernet0/0 with IP address 203.0.113.5/30, and the inside interface is GigabitEthernet0/1 with IP address 192.168.10.1/24. The branch has 50 internal hosts that need simultaneous outbound Internet access, but the ISP assigned only the single public address 203.0.113.5. The engineer wants to conserve public addresses and ensure that internal addresses are hidden. Which configuration should be applied on the router?

Accepted Answer

ip nat inside source list 1 interface GigabitEthernet0/0 overload, with an access list permitting 192.168.10.0/24. The router must translate many inside private addresses to the single public address provided by the ISP. NAT overload, also called PAT, allows this by tracking source port numbers to distinguish sessions. Configuring ip nat inside source list with the outside interface and the overload keyword, plus an access list matching 192.168.10.0/24, meets the requirement and hides internal addressing.

Answer

ip nat outside source list 1 interface GigabitEthernet0/1 overload, translating outside sources to the inside interface address

Answer

ip nat inside source list 1 pool PUBLIC_POOL, with a pool containing 203.0.113.5 and a matching access list

Answer

ip nat inside source static 192.168.10.1 203.0.113.5, mapping the inside interface to the public address

Question 14

A network administrator is configuring DHCP snooping on a Cisco Catalyst switch. The switch has a trunk port Gi1/0/24 connecting to another switch, and several access ports connecting to end-user PCs. The administrator issues the commands 'ip dhcp snooping', 'ip dhcp snooping vlan 10', and then configures interface Gi1/0/24 with 'ip dhcp snooping trust'. A PC connected to Gi1/0/5 (an untrusted port) sends a DHCPDISCOVER. What will the switch do with this DHCPDISCOVER message?

Accepted Answer

Forward the DHCPDISCOVER to trusted ports only, and drop any DHCPOFFER received on untrusted ports.. When DHCP snooping is enabled on a VLAN, switch ports are untrusted by default. Client DHCP messages such as DHCPDISCOVER are allowed from untrusted ports and forwarded toward trusted ports. Server messages such as DHCPOFFER, DHCPACK, and DHCPNAK are dropped if received on untrusted ports. Trusting the uplink port allows legitimate server replies to enter the switch while blocking rogue DHCP servers on access ports.

Answer

Drop the DHCPDISCOVER because only trusted ports can send DHCP messages.

Answer

Forward the DHCPDISCOVER to all ports in VLAN 10, including untrusted access ports.

Answer

Convert the untrusted port to a trusted port automatically after receiving the first DHCPDISCOVER.

Question 15

An engineer applies an extended named ACL to a router interface with the ip access-group command but notices that it is filtering traffic in the wrong direction relative to the requirement. The ACL is named EDGE_FILTER and is intended to control packets arriving from the internet. Which command correctly applies the ACL to the outside interface to meet this requirement?

Accepted Answer

ip access-group EDGE_FILTER in. Extended named ACLs are applied to interfaces with the ip access-group command, and the in keyword evaluates packets as they enter the router from the outside network. This matches the goal of controlling traffic arriving from the internet, whereas the out direction would only filter traffic leaving toward the internet.

Answer

ip access-group EDGE_FILTER out

Answer

access-group EDGE_FILTER in

Answer

ip access-class EDGE_FILTER in