350-401 Practice Test 23 — 15 Questions

Question 1

A network engineer runs the following command on Router R2:

R2# debug ip dhcp server events
*Mar  1 00:05:23.123: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 on interface GigabitEthernet0/1
*Mar  1 00:05:23.124: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)
*Mar  1 00:05:23.125: DHCPD: DHCPREQUEST received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30
*Mar  1 00:05:23.126: DHCPD: Sending DHCPACK to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)

Based on this debug output, what can be concluded?

Accepted Answer

The DHCP server successfully assigned IP address 10.0.0.2 to the client.. The debug shows a successful DHCP four-message exchange (DISCOVER, OFFER, REQUEST, ACK) with the client receiving IP address 10.0.0.2. The client ID is a long hex string derived from the client's MAC address.

Answer

The DHCP server failed to allocate an IP address to the client.

Answer

The client is using DHCPv6 because of the long client ID.

Answer

The DHCP server is configured with a pool that excludes 10.0.0.2.

Question 2

A network engineer runs the following command on Router R6:

R6# show ip dhcp conflict
IP address       Detection method     Detection time         VRF
10.0.0.10        Ping                 Mar 01 2025 10:00 AM   default
10.0.0.15        Gratuitous ARP       Mar 01 2025 10:05 AM   default

Based on this output, what can be concluded?

Accepted Answer

The addresses 10.0.0.10 and 10.0.0.15 are unavailable for DHCP assignment.. The output shows two IP address conflicts detected by the DHCP server. One was detected via ping, the other via gratuitous ARP. These addresses are marked as conflicted and will not be assigned until resolved.

Answer

The DHCP server has successfully assigned these addresses to clients.

Answer

The DHCP server uses only ping to detect conflicts.

Answer

The conflicts were caused by the DHCP server itself.

Question 3

Examine this DHCP configuration:
```
ip dhcp pool POOL1
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 8.8.8.8
 lease 0 12
!
ip dhcp excluded-address 10.10.10.1 10.10.10.10
```
Which statement is true?

Accepted Answer

DHCP clients will receive a lease for 12 hours.. The configuration defines a DHCP pool with a lease of 12 hours (0 days, 12 hours) and excludes the first 10 addresses.

Answer

The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.

Answer

The default lease is used because the lease command is incomplete.

Answer

The DNS server is set to 8.8.8.8, but clients will ignore it.

Question 4

Examine this DHCP configuration:
```
service dhcp
ip dhcp pool POOL2
 network 10.20.20.0 255.255.255.0
 default-router 10.20.20.1
 lease infinite
```
What is the effect of the 'lease infinite' command?

Accepted Answer

Clients will receive an infinite lease and never need to renew.. The lease infinite command sets the DHCP lease time to never expire.

Answer

The lease time is set to the default value of 1 day.

Answer

Clients will be unable to obtain an IP address because infinite is invalid.

Answer

The router will ignore the lease command and use the default.

Question 5

Drag and drop the steps of DHCP snooping operation on a Cisco switch into the correct order, from first to last.

Accepted Answer

Enable DHCP snooping globally. DHCP snooping begins by enabling the feature globally with 'ip dhcp snooping'. Then, the feature is enabled on specific VLANs. Trusted interfaces (typically uplinks to DHCP servers) are configured with 'ip dhcp snooping trust'. The switch then intercepts DHCP messages, building the DHCP snooping binding database from valid server responses. Finally, any DHCP server messages received on untrusted interfaces are dropped to prevent rogue server attacks.

Question 6

A network engineer runs the following command on Router R3:

R3# show ip nat statistics
Total active translations: 5 (0 static, 5 dynamic; 5 extended)
Outside interfaces: GigabitEthernet0/0
Inside interfaces: GigabitEthernet0/1
Hits: 1234  Misses: 5
CEF Translated packets: 1200, CEF Punted packets: 34
Expired translations: 10
Dynamic mappings:
-- Inside Source
[Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240
   refcount 5

Based on this output, what can be concluded?

Accepted Answer

The router is performing Port Address Translation (PAT).. The statistics show 5 active dynamic translations, all extended (PAT). The pool POOL1 has 10 addresses, but only 5 are currently used. The misses indicate packets that triggered new translations.

Answer

The NAT pool has exhausted all available addresses.

Answer

The NAT translations are all static.

Answer

The inside interface is GigabitEthernet0/0.

Question 7

A network engineer runs the following command on Router R7:

R7# show ip nat translations verbose
Pro Inside global      Inside local       Outside local      Outside global
--- 192.0.2.10         10.0.0.10          ---                ---
  create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00
  timeout: never, flags: static
--- 192.0.2.11         10.0.0.11          ---                ---
  create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00
  timeout: never, flags: static

Based on this output, what can be concluded?

Accepted Answer

The translations are static and will remain until manually removed.. The verbose output shows static NAT entries with 'timeout: never' and 'flags: static'. These translations will not time out and are manually configured.

Answer

These translations will expire after a configurable timeout.

Answer

The translations are dynamic and will be removed after idle timeout.

Answer

The router is performing PAT for these addresses.

Question 8

Given this NAT configuration:
```
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 ip nat outside
!
ip nat inside source static 10.0.0.5 198.51.100.5
```
What is the purpose of this configuration?

Accepted Answer

It creates a one-to-one mapping between 10.0.0.5 and 198.51.100.5, allowing inbound and outbound traffic.. This configures static NAT, mapping a single inside host to a specific outside address.

Answer

It translates all traffic from 10.0.0.0/24 to 198.51.100.0/24 using PAT.

Answer

It translates only outbound traffic from 10.0.0.5 to 198.51.100.5.

Answer

The configuration is incomplete; it needs an access-list.

Question 9

What is the default lease time for a DHCP pool in Cisco IOS?

Accepted Answer

1 day. The default DHCP lease time on Cisco IOS is 1 day (24 hours).

Answer

12 hours

Answer

2 days

Answer

Infinite

Question 10

A network engineer runs the following command on Router R4:

R4# show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address       Client-ID/              Lease expiration        Type
                 Hardware address/
                 User name
10.0.0.10        0063.6973.636f.2d30.    Mar 01 2025 12:00 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.
                 30
10.0.0.11        0063.6973.636f.2d30.    Mar 01 2025 12:05 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.
                 31

Based on this output, what can be concluded?

Accepted Answer

The DHCP server has two active leases.. The output shows two DHCP bindings with automatic type, meaning they were dynamically assigned. The client-ID is a hex string representing the client identifier. Lease expiration times are shown.

Answer

Both clients have static DHCP reservations.

Answer

The DHCP server is out of addresses.

Answer

The clients are using DHCPv6.

Question 11

A network engineer runs the following command on Router R8:

R8# show ip dhcp server statistics
Memory usage: 12345
Address pools: 2
Database agents: 0
Automatic bindings: 10
Manual bindings: 2
Expired bindings: 1
Malformed messages: 0

Message        Received
BOOTREQUEST    0
DHCPDISCOVER   100
DHCPREQUEST    95
DHCPDECLINE    1
DHCPRELEASE    2
DHCPINFORM     0

Based on this output, what can be concluded?

Accepted Answer

The DHCP server has received more DHCPDISCOVER messages than DHCPREQUEST messages, indicating some clients did not proceed to request.. The statistics show 100 DISCOVERs and 95 REQUESTs, indicating some clients did not complete the process. There is 1 DECLINE, meaning a client detected an address conflict. The server has 10 automatic and 2 manual bindings.

Answer

The DHCP server has 12 active leases.

Answer

The DHCP server rejected 5 DHCPDISCOVER messages.

Answer

The DHCP server has 2 manual bindings that are static reservations.

Question 12

Review the following DHCP relay configuration:
```
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip helper-address 172.16.1.100
```
What is the effect of the 'ip helper-address' command?

Accepted Answer

It forwards DHCP requests from VLAN 10 to the DHCP server at 172.16.1.100.. The command forwards DHCP broadcasts (and other UDP broadcasts by default) to the specified server.

Answer

It configures the router as a DHCP server for VLAN 10.

Answer

It translates the source IP of DHCP requests to 192.168.10.1.

Answer

It blocks DHCP traffic from VLAN 10.

Question 13

Which type of NAT translates multiple inside addresses to a single outside address using different port numbers?

Accepted Answer

Port Address Translation (PAT). PAT (Port Address Translation) allows many inside hosts to share one outside IP by differentiating sessions via port numbers.

Answer

Static NAT

Answer

Dynamic NAT

Answer

Policy NAT

Question 14

Consider the following configuration snippet:
```
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/2
 ip address 203.0.113.1 255.255.255.0
 ip nat outside
!
ip nat inside source list 1 interface GigabitEthernet0/2 overload
access-list 1 permit 192.168.1.0 0.0.0.255
```
What is the effect of this configuration?

Accepted Answer

It translates all traffic from 192.168.1.0/24 to the IP address 203.0.113.1, using port address translation.. The configuration enables dynamic NAT with overload (PAT) for the 192.168.1.0/24 network, translating source addresses to the IP of the outside interface.

Answer

It performs static NAT for each host in 192.168.1.0/24 to a unique IP in the 203.0.113.0/24 network.

Answer

It translates only traffic from 192.168.1.1 to the outside interface IP.

Answer

The configuration is invalid because 'ip nat inside' and 'ip nat outside' are on the wrong interfaces.

Question 15

Analyze this NAT configuration:
```
ip nat pool GLOBAL 203.0.113.10 203.0.113.20 netmask 255.255.255.0
ip nat inside source list 1 pool GLOBAL overload
access-list 1 permit 192.168.1.0 0.0.0.255
```
Which statement is correct?

Accepted Answer

Traffic from 192.168.1.0/24 is translated to addresses in the range 203.0.113.10-20, using PAT.. This is dynamic NAT with overload (PAT) using a pool of addresses.

Answer

Each host in 192.168.1.0/24 gets a unique IP from the pool without port translation.

Answer

The pool must include the outside interface IP address.

Answer

Access-list 1 is used to filter inbound traffic.