CCNP Practice Test 22 — 15 Questions

Question 1

interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload

What is the effect of this configuration?

Accepted Answer

All traffic from 192.168.1.0/24 will be translated to the IP address of GigabitEthernet0/0 using PAT.. This is a standard NAT overload (PAT) configuration. The inside network 192.168.1.0/24 is translated to the IP address of the outside interface (GigabitEthernet0/0) using port address translation. All inside hosts share the outside interface IP address.

Answer

Only one host from 192.168.1.0/24 can access the internet at a time.

Answer

Traffic from the outside interface will be translated to 192.168.1.0/24.

Answer

The configuration will fail because the access list must be applied to an interface.

Question 2

Which BGP attribute is used as the first tie-breaker when multiple paths are available and the weight is equal?

Accepted Answer

Local preference. BGP uses a multi-step path selection process. After comparing weight (highest wins), the next attribute is local preference (highest wins).

Answer

AS path length

Answer

Origin code

Answer

MED

Question 3

Drag and drop the steps of PPPoE session establishment into the correct order, from first to last.

Accepted Answer

Client sends PADI broadcast. PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

Question 4

Drag and drop the steps of DMVPN phase 2 spoke-to-spoke tunnel establishment into the correct order, from first to last.

Accepted Answer

Spoke registers with hub via NHRP. In DMVPN phase 2, each spoke first registers with the hub via mGRE and NHRP. When a spoke wants to reach another spoke, it sends an NHRP Resolution Request to the hub. The hub forwards the request to the destination spoke, which replies with its real (non-NBMA) address. The source spoke then initiates a direct mGRE tunnel to the destination spoke, and finally the spokes exchange routing information over the direct tunnel.

Question 5

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

Accepted Answer

The engineer forgot to add the ip nat inside source static command for the web server.. The scenario requires both dynamic NAT (for outbound traffic) and static NAT (for inbound access to the web server). Using only a dynamic NAT configuration with an access list will not provide a permanent mapping for the web server.

Answer

The access list used for NAT does not permit the web server's IP address.

Answer

The ip nat inside and ip nat outside commands are applied on the wrong interfaces.

Answer

The global configuration mode is missing the ip nat pool command.

Question 6

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

Accepted Answer

The router is performing NAT only for the source IP, but the return traffic is taking a different path that does not go through the NAT router.. For a successful NAT session, both the outbound and inbound translations must be present. If only the outbound translation exists, the return traffic is not being translated back correctly, possibly due to asymmetric routing or a missing route.

Answer

The SSH server is blocking connections from the public IP address.

Answer

The NAT overload is causing port conflicts for SSH.

Answer

The access list used for NAT is denying the SSH traffic.

Question 7

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

Accepted Answer

The DHCP pool is not associated with the correct VLAN interface using the network command.. The DHCP server configuration appears correct, but the clients are not receiving the DNS server address. This often happens when the DHCP server is not the default gateway and DHCP relay is involved, or when the DHCP pool is not bound to the correct interface.

Answer

The DNS server is unreachable from the DHCP server.

Answer

The ip dhcp excluded-address command is blocking the DNS server IP.

Answer

The DHCP client is configured with a static DNS server address.

Question 8

A network engineer is configuring a Cisco router to act as a DHCP server for a branch office. The engineer creates a DHCP pool for the 192.168.1.0/24 subnet and configures the default-router, dns-server, and domain-name options. However, clients are able to obtain IP addresses but cannot ping the default gateway. The engineer verifies that the router's interface IP is 192.168.1.1. What is the most likely cause?

Accepted Answer

The router's interface is not configured with an IP address in the 192.168.1.0/24 subnet.. The DHCP server assigns the default gateway, but if the router's interface is not in the same subnet as the pool or if the interface is down, clients cannot reach it.

Answer

The DHCP pool is missing the lease command.

Answer

The router's interface is administratively down.

Answer

The ip dhcp excluded-address command is blocking the default gateway IP.

Question 9

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

Accepted Answer

The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.. PAT uses port numbers to multiplex multiple sessions over a single public IP. If the port range is exhausted or if the NAT translation table is full, new sessions will fail.

Answer

The access list 1 is too permissive and includes the public IP address of the router.

Answer

The router is not configured with ip nat inside on the internal interface.

Answer

The overload keyword is misspelled or not supported on this IOS version.

Question 10

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

Accepted Answer

The access list 100 does not permit the 172.16.0.0/16 network.. The access list used in the NAT command determines which inside local addresses are eligible for translation. If the access list does not include the 172.16.0.0/16 network, those hosts will not be translated and will not be able to reach the internet.

Answer

The router's interface GigabitEthernet0/0 is not configured with ip nat outside.

Answer

The 172.16.0.0/16 hosts have a default gateway pointing to a different router.

Answer

The NAT pool is exhausted for the 172.16.0.0/16 network.

Question 11

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Accepted Answer

The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.. DHCP uses broadcast messages. If the router's interface is not configured to receive broadcasts (e.g., due to a switched network with VLANs), the DHCP server may not see the client's request. However, the most common issue is that the interface is not configured with the ip dhcp server command or the interface is in a different VLAN without a helper address.

Answer

The router's interface is configured with the no ip forward-protocol udp bootps command.

Answer

The DHCP pool is configured with the wrong default-router option.

Answer

The router's DHCP server is disabled globally with the no service dhcp command.

Question 12

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

Accepted Answer

The router does not have NAT hairpinning enabled, so internal traffic to the public IP is not translated.. This is a classic NAT hairpinning issue. When an internal host tries to reach the public IP of the server, the router may not support or be configured for NAT reflection (hairpinning), so the packet is not translated correctly.

Answer

The static NAT entry is missing the extendable keyword.

Answer

The internal hosts have a route to the public IP via the router's outside interface.

Answer

The access list used for NAT is blocking internal traffic.

Question 13

A network engineer runs the following command on Router R1:

R1# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
--- 192.0.2.11         10.0.0.11          ---                ---

Based on this output, what can be concluded?

Accepted Answer

Static NAT is configured for two internal hosts.. The output shows two static NAT translations with no protocol, indicating they are configured as static NAT entries. The inside global addresses are mapped one-to-one to inside local addresses. No dynamic translations are present.

Answer

Dynamic NAT is configured with a pool of addresses.

Answer

PAT is translating multiple internal addresses to a single global address.

Answer

NAT is not operational because no outside local addresses are shown.

Question 14

A network engineer runs the following command on Router R5:

R5# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.20:1234    10.0.0.20:1234     203.0.113.1:53     203.0.113.1:53
tcp 192.0.2.20:5678    10.0.0.20:5678     198.51.100.1:80    198.51.100.1:80

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT) for multiple sessions from the same internal host.. The output shows two translations using the same inside global address (192.0.2.20) but different ports, which is characteristic of PAT. One translation is UDP (DNS) and one is TCP (HTTP).

Answer

The router is configured with static NAT for two internal hosts.

Answer

The router is performing destination NAT.

Answer

The inside local address 10.0.0.20 is using two different global addresses.

Question 15

A network engineer runs the following command on Router R9:

R9# show ip nat translations
Pro Inside global      Inside local       Outside local      Outside global
udp 192.0.2.20:1234    10.0.0.20:1234     203.0.113.1:53     203.0.113.1:53
tcp 192.0.2.20:5678    10.0.0.20:5678     198.51.100.1:80    198.51.100.1:80
--- 192.0.2.21         10.0.0.21          ---                ---

Based on this output, what can be concluded?

Accepted Answer

The router is using both static NAT and PAT simultaneously.. The output shows a mix of dynamic PAT translations (with ports) and a static NAT entry (no protocol/port). The static entry maps 10.0.0.21 to 192.0.2.21, while PAT is used for 10.0.0.20.

Answer

All translations are dynamic.

Answer

The router is configured with a single NAT pool.

Answer

The inside global address 192.0.2.20 is used for both static and dynamic translations.