CCNA Network Services and Security Questions — Page 3 of 5

151

MCQmedium

Why is centralized logging especially useful when combined with NTP?

A.Because synchronized clocks make centralized log timelines easier to analyze accurately.

B.Because NTP assigns the Syslog server its IP address.

C.Because Syslog replaces authentication when NTP is present.

D.Because centralized logging blocks unauthorized traffic automatically.

AnswerA

Synchronised clocks via NTP ensure that log timestamps across all network devices share a common time reference, eliminating drift that would otherwise scatter events from the same incident across different points in a centralised log timeline. This temporal alignment satisfies the constraint of accurate forensic reconstruction, as analysts can correlate events from routers, switches, and servers without manual offset correction.

Why this answer

Centralized logging is much more useful when device clocks are synchronized because the timestamps can be correlated properly. In practical terms, collecting messages in one place is valuable, but if one router thinks it is 9:00 and another thinks it is 9:17, the event sequence becomes confusing. NTP solves that time-alignment problem.

This is a common operations best practice. Syslog provides the central visibility, and NTP makes the timeline trustworthy.

Exam trap

A common exam trap is to mistakenly believe that NTP provides IP addressing or security functions such as blocking unauthorized traffic. Some may also incorrectly assume that syslog replaces authentication mechanisms when NTP is present. These misconceptions arise because candidates confuse the distinct roles of NTP and syslog.

NTP strictly synchronizes time, while syslog collects logs. Neither assigns IP addresses nor enforces access control. Understanding this separation is crucial to avoid selecting incorrect answers that attribute unrelated functions to NTP or centralized logging.

Why the other options are wrong

Option B is incorrect because NTP does not assign IP addresses to syslog servers or any devices. IP addressing is handled by DHCP or manual configuration, not by NTP.

Option C is incorrect because syslog does not replace authentication mechanisms. NTP and syslog are unrelated to access control or authentication processes in Cisco networks.

Option D is incorrect because centralized logging improves visibility into network events but does not block unauthorized traffic. Traffic enforcement is managed by firewalls, ACLs, or other security features.

Practice this question →

152

Multi-Selectmedium

Which three of the following are characteristics of DHCP snooping on a Cisco switch? (Choose three.)

Select 3 answers

.It differentiates trusted and untrusted ports to filter DHCP messages.

.It builds and maintains a DHCP snooping binding database.

.It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports.

.It encrypts DHCP traffic between the client and the server.

.It replaces the DHCP server's IP address with a static route.

.It requires all DHCP servers to be connected to untrusted ports.

Why this answer

DHCP snooping is a security feature that filters untrusted DHCP messages by differentiating trusted and untrusted ports. It builds and maintains a DHCP snooping binding database to track valid IP-to-MAC address assignments. Additionally, it prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, typically using the 'ip dhcp snooping limit rate' command.

Exam trap

Cisco often tests that DHCP snooping's rate-limiting feature specifically targets DHCP starvation attacks, not rogue server attacks, and that the binding database is used for both IP source guard and dynamic ARP inspection integration.

Practice this question →

153

PBQhard

You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.

Network Topology

Hints

•Check which interfaces are marked as inside and outside — the public IP interface should be outside.
•The ACL used for PAT must match the inside local network, not a different subnet.
•The PAT command must include the keyword 'overload' to enable port address translation.

A.Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.

B.Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.

C.Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.

D.Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.

AnswerA

solution

! R1
configure terminal
no ip nat inside source list 10 interface GigabitEthernet0/1
ip nat inside source list 10 interface GigabitEthernet0/1 overload
no access-list 10
access-list 10 permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
no ip nat inside
ip nat outside
end

Why this answer

The configuration had three issues: 1) ACL 10 permitted 10.0.0.0/8 instead of the actual inside subnet 192.168.1.0/24, so no traffic matched PAT. 2) The PAT command was missing the 'overload' keyword, which is required for Port Address Translation; without it, the device attempts one-to-one dynamic NAT. 3) The interface facing the public network (G0/1) was incorrectly configured as 'ip nat inside' instead of 'ip nat outside'. The fix is to correct the ACL to permit 192.168.1.0 0.0.0.255, ensure the PAT command includes 'overload', and change G0/1 to 'ip nat outside'.

Exam trap

A common trap is confusing inside and outside interface designations. Remember: the interface facing the private network is 'ip nat inside', and the interface facing the public network is 'ip nat outside'. Also, PAT requires the 'overload' keyword; without it, you get dynamic NAT (one-to-one).

Why the other options are wrong

The specific factual error is that the interface with the public IP (203.0.113.1) must be configured as 'ip nat outside', not 'ip nat inside'. Marking it as inside would cause asymmetric NAT behavior and break translation.

The specific factual error is that PAT requires the 'overload' keyword. Without it, the router performs dynamic NAT (one-to-one translation), which would not support multiple hosts sharing a single public IP.

The specific factual errors are: (1) the interface with the public IP must be 'ip nat outside', and (2) PAT requires the 'overload' keyword. Both are violated here.

Practice this question →

154

Multi-Selectmedium

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

Select 2 answers

A.A record

B.AAAA record

C.CNAME record

D.PTR record

E.MX record

AnswersB, D

An AAAA record is the forward-DNS record that maps a hostname to a 128-bit IPv6 address, analogous to an A record for IPv4. It is commonly used for hostname-to-address resolution, not for address-to-hostname resolution. Since the question requires reverse mapping from an IPv6 address back to a name, an AAAA record does not fulfill that purpose.

Why this answer

The AAAA record (Quad-A record) maps a domain name to an IPv6 address, making it the standard type for forward IPv6 lookups. The PTR record performs the reverse mapping—from an IPv6 address back to a domain name. Administrators routinely check both records with tools like nslookup or dig to ensure forward and reverse DNS consistency, which is critical for services such as email and security logging.

The other options (A, CNAME, MX) do not directly provide a domain-to-IPv6 mapping or its reverse verification.

Exam trap

Cisco often tests the misconception that an A record can be used for IPv6 addresses, but the A record is strictly for IPv4 (RFC 1035), while the AAAA record is the correct type for IPv6 (RFC 3596).

Why the other options are wrong

An A record maps a hostname to an IPv4 address, not an IPv6 address. Since the question specifically asks about IPv6, this record type is incorrect.

A CNAME record creates an alias from one domain name to another, not a direct mapping to an IP address. It does not provide the IP address itself, so it cannot verify the mapping to an IPv6 address.

MX records specify mail exchange servers for a domain and are used for email routing, not for mapping domain names to IP addresses. They do not provide IPv6 address mappings.

Practice this question →

155

Drag & Dropmedium

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the diagnostic workflow using nslookup and dig to identify a missing or incorrect A-record.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The standard DNS resolution sequence ends with the client receiving the A-record. Troubleshooting uses nslookup first for basic checks, then dig +trace for detailed path analysis.

Exam trap

Do not confuse the client's initial query destination (configured DNS server, not root) and remember the troubleshooting order: nslookup before dig +trace. Also, avoid inserting extra steps like explicit cache returns.

Practice this question →

156

MCQhard

A router is performing PAT for inside users. Which detail allows multiple inside sessions to share one public IPv4 address at the same time?

A.Use of transport-layer port numbers to distinguish sessions

B.Replacement of all MAC addresses with broadcast addresses

C.Automatic conversion of every subnet into a /32

D.Requirement that every inside host use the same private IP address

AnswerA

PAT (Port Address Translation) relies on the TCP or UDP port numbers to differentiate multiple simultaneous sessions from different inside hosts that all share the same public IP address. When a host sends a packet, the router assigns a unique source port, stores the mapping in its NAT table, and later uses that port to reverse the translation and deliver the response to the correct private host.

Why this answer

PAT works because it uses transport-layer port numbers to keep different conversations distinct even when they share the same public IP address. In plain language, the router rewrites and tracks port information so that return traffic can be matched back to the correct inside host and application session. That is what makes one public address usable for many simultaneous internal users.

This is a key difference between PAT and simple static NAT. Static NAT creates a fixed one-to-one relationship, while PAT creates many simultaneous translations differentiated by port values. The correct answer is the one that identifies port-based tracking as the reason the design scales beyond a single host.

Exam trap

Remember, PAT uses port numbers to differentiate sessions, not MAC addresses, IP addresses, or VLAN IDs.

Why the other options are wrong

PAT does not replace MAC addresses with broadcast addresses; MAC addresses are used for local network segment communication and are not involved in NAT/PAT operations. Broadcast addresses are used for sending packets to all hosts on a subnet, which would not help in distinguishing individual sessions.

PAT does not convert subnets into /32 addresses; it translates private IP addresses and port numbers to a single public IP address with different port numbers. Changing subnet masks to /32 would imply host-specific routing, which is not how PAT functions.

PAT does not require all inside hosts to use the same private IP address; in fact, each host typically has a unique private IP address. PAT translates these unique private addresses to the same public IP but with different port numbers to maintain session uniqueness.

Practice this question →

157

PBQhard

You are connected to the multilayer switch MLS1 in a branch network. The DHCP server on router R1 is supposed to serve the 192.168.20.0/24 VLAN 20, but clients in VLAN 20 are not receiving IP addresses. Additionally, a rogue DHCP server has been detected on VLAN 20. Configure MLS1 to enable DHCP snooping on VLAN 20, set the trust state on the uplink port to R1, and limit the rate of DHCP packets on access ports. Then, on R1, correct the DHCP configuration so that the pool for VLAN 20 uses the correct default-router (192.168.20.1) and DNS server (8.8.8.8), and ensure that the excluded-address range is not too large (exclude only the first 10 addresses). Verify the solution.

Network Topology

Hints

•On MLS1, DHCP snooping must be globally enabled and then applied to VLAN 20.
•The uplink to R1 must be trusted; access ports should have rate limiting to prevent DHCP starvation.
•On R1, the excluded-address range was too broad; only exclude the first 10 addresses. The default-router and DNS server were incorrect.

A.On MLS1: ip dhcp snooping, ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

B.On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.254, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

C.On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.10.1 dns-server 4.4.4.4

D.On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8, but no ip dhcp snooping enabled globally on MLS1

AnswerA

solution

! R1
configure terminal
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN20_POOL
default-router 192.168.20.1
dns-server 8.8.8.8
end

! MLS1
ip dhcp snooping
ip dhcp snooping vlan 20
interface GigabitEthernet0/0
ip dhcp snooping trust
exit
interface GigabitEthernet0/1
ip dhcp snooping limit rate 10
end

Why this answer

The problem had three faults: First, the DHCP pool on R1 had a wrong default-router (192.168.10.1 instead of 192.168.20.1) and an incorrect DNS server (4.4.4.4 instead of 8.8.8.8). Second, the excluded-address range was too large (excluding all addresses from .1 to .254 effectively blocked all dynamic assignments; corrected to exclude only .1 through .10). Third, DHCP snooping was disabled on MLS1, allowing a rogue DHCP server.

To enable DHCP snooping, both the global `ip dhcp snooping` command and the VLAN-specific `ip dhcp snooping vlan 20` command are required. With snooping enabled, the uplink port Gig0/0 was set as trusted and the access port Gig0/1 was configured with rate limiting to prevent DHCP starvation attacks.

Exam trap

Watch for three separate issues: DHCP pool misconfiguration (default-router, DNS, excluded range), DHCP snooping not enabled globally, and the need to set trust on the uplink. Candidates often forget the global 'ip dhcp snooping' command or misconfigure the excluded range.

Why the other options are wrong

The excluded-address range is too large; it should only exclude the first 10 addresses (1-10) to allow dynamic allocation from .11 onward.

The default-router must be the gateway for VLAN 20 (192.168.20.1), and the DNS server should be 8.8.8.8 as specified.

The global 'ip dhcp snooping' command is required to activate the feature; omitting it leaves DHCP snooping disabled entirely.

Practice this question →

158

MCQhard

An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?

A.It is permitted because the destination matches

B.It is denied by the implicit deny

C.It is permitted because the packet matches the source network stated in the ACE.

D.It is permitted only if the source port is 443

AnswerB

An ACL ends with an implicit deny all rule, so any packet not explicitly permitted by a preceding ACE is dropped. An ICMP packet is not TCP and therefore does not match the permit tcp statement, regardless of its source or destination. Thus, it falls through to the implicit deny and is denied.

Why this answer

ACLs end with an implicit deny. Since the only explicit permit is for HTTPS traffic, the ICMP packet is denied.

Exam trap

Remember that ACLs have an implicit deny all rule. Just because a source or destination is specified doesn't mean all traffic types are allowed.

Why the other options are wrong

The ACL only permits TCP traffic from 10.10.10.0/24 to host 192.0.2.10 on port 443. ICMP is not TCP, so even though the destination matches, the protocol does not match, and the packet is not permitted.

Although the source IP matches the ACE's source network, the ACE only permits TCP traffic; ICMP is a different protocol, so the packet is denied by the implicit deny.

ICMP does not use TCP ports; it uses ICMP type and code. The ACL entry specifies TCP port 443, which is irrelevant for ICMP traffic. Even if the source port were 443, ICMP packets do not have TCP ports.

Practice this question →

159

Multi-Selectmedium

Which three of the following statements about Network Address Translation (NAT) are correct? (Choose three.)

Select 3 answers

.Static NAT provides a one-to-one mapping between a private IP and a public IP.

.Dynamic NAT uses a pool of public IP addresses assigned on a first-come, first-served basis.

.PAT (Port Address Translation) allows multiple internal hosts to share a single public IP address.

.NAT eliminates the need for any routing in a network.

.Dynamic NAT always assigns the same public IP to a given internal host.

.PAT requires a unique public IP for every concurrent session.

Why this answer

Static NAT provides a one-to-one mapping between a private IP and a public IP, ensuring that a specific internal host always uses the same public address. Dynamic NAT uses a pool of public IP addresses assigned on a first-come, first-served basis, so internal hosts compete for available addresses. PAT (Port Address Translation) allows multiple internal hosts to share a single public IP by differentiating sessions via unique port numbers, which is the most common form of NAT used in home and small office routers.

Exam trap

Cisco often tests the misconception that dynamic NAT provides a fixed mapping like static NAT, or that PAT requires multiple public IPs, when in fact PAT is designed to share a single public IP among many hosts.

Practice this question →

160

MCQmedium

Why is NTP especially useful when devices send logs to a centralized Syslog server?

A.It helps align device clocks so centralized log timestamps can be correlated more accurately.

B.It assigns the Syslog server an IP address.

C.It replaces the need for a Syslog server.

D.It encrypts every Syslog message automatically.

AnswerA

Network Time Protocol synchronizes the system clocks of routers, switches, and servers, so each device reports the same timestamp for concurrent events. When centralized log correlation combines Syslog outputs from multiple devices, consistent time references enable security analysts to reconstruct the exact sequence of actions and pinpoint root causes. Without NTP alignment, clock drift would cause misleading log ordering and obscure real threats.

Why this answer

NTP is especially useful because synchronized clocks make the log timestamps more meaningful and easier to correlate. In plain language, if each device thinks the current time is different, the sequence of events in the centralized log becomes confusing. NTP helps align time across devices so the logs tell a more accurate story.

This is an operational best practice. Syslog collects the messages, and NTP makes their timing consistent. The correct answer is the one focused on timestamp correlation.

Exam trap

Avoid confusing NTP's function with security or data optimization features; focus on its role in time synchronization.

Why the other options are wrong

NTP is a protocol for clock synchronization, not for IP address assignment. IP addresses are assigned via DHCP or static configuration, and NTP operates at the application layer to synchronize time over the network. Therefore, NTP does not assign IP addresses to any device, including Syslog servers.

NTP and Syslog serve entirely different purposes. NTP synchronizes clocks, while Syslog is a protocol for sending log messages to a centralized server. NTP cannot replace Syslog because it does not collect, store, or forward log messages.

Both are often used together but are independent services.

NTP does not provide encryption for Syslog messages or any other data. NTP is solely responsible for time synchronization and does not include security features like encryption. Syslog messages are typically sent in clear text unless additional security measures like TLS or SSH are implemented.

Practice this question →

161

Multi-Selectmedium

Which two actions are reasonable examples of basic device-hardening practice?

Select 2 answers

A.Disable unused services or interfaces where practical

B.Use SSH instead of Telnet for remote management

C.Allow anonymous administrative login for convenience

D.Place all traffic in VLAN 1 so it is easier to remember

E.Remove authentication from VTY lines

AnswersA, B

Unused services like the HTTP server, CDP, or unused physical interfaces remain active by default and can be exploited as attack vectors or leak sensitive network information. Disabling these services and shutting down unused ports reduces the device's attack surface and prevents unauthorized lateral movement. This is a basic hardening step that every network administrator should implement.

Why this answer

Basic hardening is about reducing unnecessary exposure and making administrative access safer. In plain language, this usually means disabling services or interfaces that are not needed and preferring secure management protocols such as SSH. These choices shrink the attack surface and improve the security of routine device administration without requiring advanced security products.

The wrong answers in hardening questions often suggest convenience at the expense of security, such as leaving insecure access methods enabled or removing authentication. CCNA-level security expects you to recognize that strong fundamentals often come from disciplined configuration choices rather than from complex tools alone.

Exam trap

Avoid choosing convenience over security; protocols like Telnet and HTTP are easy but insecure for management.

Why the other options are wrong

Allowing anonymous administrative login means no authentication is required, which completely bypasses access control. This violates the principle of least privilege and exposes the device to unauthorized configuration changes.

VLAN 1 is the default VLAN and is often targeted in VLAN hopping attacks. Using VLAN 1 for all traffic violates the security best practice of segregating traffic and using dedicated VLANs for management, user data, and voice.

Removing authentication from VTY lines means anyone can connect to the device via Telnet or SSH without a password. This is a critical security flaw that allows unauthorized remote access.

Practice this question →

162

MCQmedium

Which service would a client most directly rely on to convert `server.example.com` into an IP address?

A.DNS

B.ARP

C.NTP

D.CDP

AnswerA

The Domain Name System is the service that directly performs hostname-to-IP address resolution. When a client types a URL like www.cisco.com, it sends a DNS query to a resolver, which returns the corresponding IPv4 or IPv6 address. This is the fundamental name resolution service on which applications rely before establishing TCP connections. Without DNS, users would need to memorize numeric IP addresses.

Why this answer

The client relies on DNS for name resolution. In plain language, DNS is the service that lets devices and users use readable names instead of memorizing numeric IP addresses. When the client needs to reach `server.example.com`, DNS helps translate that hostname into the IP-related information needed for actual communication.

This is different from DHCP, which supplies address configuration, and from NTP, which synchronizes time. It is also different from ARP, which resolves local IPv4 addresses to MAC addresses. The correct answer is the one associated specifically with hostname resolution.

Exam trap

A frequent exam trap is mistaking ARP for DNS because both involve address resolution. However, ARP only resolves IPv4 addresses to MAC addresses within the same local network segment and does not translate hostnames to IP addresses. Candidates might also confuse NTP or CDP as name resolution services, but NTP is for time synchronization, and CDP discovers directly connected Cisco devices.

Misunderstanding these roles leads to selecting incorrect answers, especially since the question specifically asks about converting a hostname to an IP address, which only DNS performs.

Why the other options are wrong

ARP is incorrect because it only resolves IPv4 addresses to MAC addresses on the local network segment and does not translate hostnames to IP addresses.

NTP is incorrect since it is used for synchronizing time between devices and does not perform any form of hostname or IP address resolution.

CDP is incorrect because it is a Cisco proprietary protocol used for discovering directly connected Cisco devices, not for resolving hostnames to IP addresses.

Practice this question →

163

MCQhard

A controller-based WLAN uses 5 GHz in an open office. Clients keep disconnecting when users roam between APs, but signal strength remains strong. Based on the exhibit, what is the most likely problem?

A.A transmit power mismatch is creating asymmetric coverage around AP-3.

B.The SSID must use 2.4 GHz only for roaming to work.

C.WPA2 cannot support roaming between APs.

D.The WLAN needs a different DHCP scope on each AP.

AnswerA

A transmit power mismatch on AP-3 creates an oversized basic service area, making its BSSID audible at distances where neighboring AP-3 signals are faint. Clients near the edge of that cell hear AP-3 strongly but transmit at lower client power, so the AP cannot hear them reliably, causing uplink failures and delayed roaming. The asymmetry leads to sticky clients who remain associated to AP-3 even when another AP offers a stronger uplink, degrading throughput and VoIP quality.

Why this answer

The APs are transmitting at much higher power than the clients, creating a coverage imbalance. Clients may hear the AP well enough to stay associated too long, while the AP cannot reliably hear the weaker client at the same cell edge. That leads to sticky-client and roaming issues even when RSSI looks strong.

Exam trap

A common exam trap is assuming that roaming issues are caused by encryption protocols like WPA2 or by requiring 2.4 GHz operation only. Candidates may also mistakenly believe that DHCP scopes must be unique per AP to support roaming. These misconceptions distract from the real issue: transmit power mismatch causing asymmetric coverage.

The APs transmitting at much higher power than clients cause sticky client problems, where clients do not roam properly despite strong signal strength. Understanding this subtle power imbalance is critical to avoid selecting incorrect answers related to encryption or DHCP.

Why the other options are wrong

Incorrect because roaming works on 5 GHz and is often preferred there; restricting SSID to 2.4 GHz is unnecessary and unrelated to the problem.

Incorrect because WPA2 supports roaming; encryption type does not cause clients to disconnect when roaming between APs.

Incorrect because DHCP scopes are shared in controller-based WLANs; separate DHCP scopes per AP are not required for roaming functionality.

Practice this question →

164

MCQhard

An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?

A.Configure the VTY lines to accept SSH and not Telnet.

B.Enable PortFast on the VTY lines.

C.Use DHCP snooping to protect the VTY lines.

D.Increase the OSPF hello interval.

AnswerA

This is correct because it directly restricts the management protocol accepted on the router.

Why this answer

The most direct change is to configure the VTY lines to accept only SSH, which removes Telnet as an accepted protocol. Option B (PortFast) is a spanning-tree feature that speeds up port transition on access ports and has nothing to do with VTY access. Option C (DHCP snooping) is a Layer 2 security feature to prevent rogue DHCP servers; it does not affect VTY line protocols.

Option D (OSPF hello interval) is an OSPF timer adjustment, unrelated to remote access security. Therefore, only option A directly achieves the goal.

Exam trap

Avoid assuming that ACLs or global commands can replace specific VTY line configurations for protocol restriction.

Why the other options are wrong

PortFast is a spanning-tree feature for switch ports, not related to VTY line protocols.

DHCP snooping is a Layer 2 security feature against rogue DHCP servers, irrelevant to Telnet/SSH access.

Increasing the OSPF hello interval affects OSPF neighbor discovery, not remote access to the router.

Practice this question →

165

Matchingmedium

Match each service to the kind of problem it most directly helps solve.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hostname works incorrectly or cannot be resolved into IP information

Clients need automatic IP configuration

Device timestamps do not line up consistently

Administrators need centralized event and log collection

Why these pairings

DNS solves the problem of remembering IP addresses. DHCP eliminates manual IP configuration. FTP enables file transfers.

SSH provides encrypted remote access. RADIUS and TACACS+ are AAA protocols, with RADIUS commonly used for network access and TACACS+ for device administration.

Exam trap

A common trap is confusing the roles of RADIUS and TACACS+, or thinking that services like DNS or DHCP have overlapping functions. Remember that DNS resolves names, DHCP assigns IPs, FTP transfers files, SSH secures remote access, RADIUS handles network access, and TACACS+ handles device administration.

Practice this question →

166

MCQhard

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

A.Because secure transport alone does not remove the need for source restriction and accountability controls.

B.Because SSH is less secure than Telnet and must be compensated for.

C.Because logs automatically enforce ACL policy.

D.Because source IP restriction replaces the need for authentication.

AnswerA

Secure transport such as SSH safeguards confidentiality and integrity of the management session, but it does not filter which administrative source addresses are permitted or log which user performed specific configuration changes. Without an SSH access-class or management ACL, any reachable source can attempt a login, and without audit logs or AAA accounting, there is no accountability after the fact. Defense-in-depth therefore requires source restriction and accounting in addition to encryption.

Why this answer

The decision reflects defense in depth. SSH encrypts the session and authenticates users, but it does not limit which source IPs can connect or provide audit trails. Source IP restriction reduces the attack surface by allowing only trusted hosts, and logging provides accountability and forensic evidence.

Option B is incorrect because SSH is more secure than Telnet, not less. Option C is incorrect because logs record events but do not enforce ACLs. Option D is incorrect because source IP restriction complements authentication rather than replacing it.

Exam trap

A frequent exam trap is to believe that using SSH alone fully secures remote device access, leading to the mistaken idea that source IP restrictions and logging are redundant. This overlooks that SSH only encrypts the session and authenticates users but does not limit which hosts can connect or provide audit trails. Ignoring source IP filtering increases exposure to brute-force or credential compromise attacks from unauthorized IPs.

Similarly, neglecting logging removes visibility into who accessed the device and when, hindering incident response. The trap is confusing transport security with comprehensive access control and accountability.

Why the other options are wrong

SSH is more secure than Telnet, so this option incorrectly suggests it is less secure and requires compensation.

Logs record activity but do not automatically enforce ACL policy; enforcement is a separate function.

Source IP restriction limits allowed hosts but does not replace the need for user authentication.

Practice this question →

167

PBQhard

You are connected to R1 via the console. R1 is configured as an NTP client that should synchronize with the NTP server at 203.0.113.1. You need to verify that R1 is synchronizing correctly and also ensure that the system clock is updated. Additionally, configure R1 to act as an NTP server for downstream devices on the internal network 192.168.1.0/24.

Network Topology

Hints

•Check if the NTP server is reachable and the clock is synchronized.
•The 'master' command sets the stratum level for downstream clients.
•Use broadcast on the internal interface to distribute time.

A.Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

B.Use 'show ntp associations' to verify synchronization, 'clock update' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

C.Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

D.Use 'show ntp associations' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

AnswerA

solution

! R1
ntp server 203.0.113.1
ntp master 4
interface GigabitEthernet0/0
ntp broadcast

Why this answer

The correct verification command is 'show ntp status' because it displays the synchronization state and stratum level. 'show ntp associations' shows configured peers but not the sync state. After NTP sync is established, the system clock is automatically updated; 'clock set' is not typically required but remains a valid command to manually adjust the clock. 'clock update' is not a valid IOS command. To make R1 an NTP server for downstream devices, use the global command 'ntp master 4', not 'ntp server' (which makes the router a client).

Then, on the interface facing 192.168.1.0/24 (G0/0), apply 'ntp broadcast' to send NTP broadcasts so clients can synchronize without polling. Option A correctly combines these steps while other options mix incorrect commands or verification methods.

Exam trap

Be careful to distinguish 'show ntp status' (synchronization state) from 'show ntp associations' (peer list); also remember that 'ntp master' is a global command, while 'ntp broadcast' is applied per interface.

Why the other options are wrong

Uses invalid 'clock update' command and incorrectly uses 'ntp server' instead of 'ntp master' to make R1 an NTP server for downstream.

Uses 'ntp server' instead of 'ntp master' to make R1 an NTP server; 'ntp server' configures R1 as a client, not a server.

Uses 'show ntp associations' which does not show synchronization status; 'show ntp status' is needed for that.

168

Multi-Selectmedium

Which two statements accurately describe DNS and DHCP?

Select 2 answers

A.DNS resolves names to IP information, while DHCP dynamically assigns addressing information to clients.

B.DHCP is used primarily to translate private addresses into public addresses.

C.DNS can help users reach services by hostname instead of remembering numeric IP addresses.

D.DHCP replaces the need for subnet masks and default gateways.

E.DNS and DHCP are both Layer 1 technologies.

AnswersA, C

DNS is an application-layer protocol that translates human-friendly domain names into the numeric IP addresses used for routing and identifying hosts. DHCP, on the other hand, is a network management protocol that dynamically allocates IP addresses and other network parameters such as subnet mask, default gateway, and DNS server addresses to clients when they join a network. Thus, DNS resolves names to IPs, while DHCP automates the assignment of addressing information, fulfilling two distinct but complementary roles in network connectivity.

Why this answer

DNS and DHCP solve very different problems, even though both are common infrastructure services. DNS helps devices and users find systems by name. In simple terms, it means people can type a hostname rather than memorizing numeric IP addresses. DHCP automatically gives clients important IP settings such as an address, subnet mask, default gateway, and often DNS server information.

The trick in comparison questions is not to blend their roles together. DHCP does not perform NAT, and it does not eliminate the need for addressing details; it actually supplies them.

Exam trap

A frequent exam trap is confusing DHCP with NAT or assuming DHCP replaces the need for subnet masks and default gateways. Some candidates mistakenly believe DHCP translates private IP addresses to public ones, but this is the role of NAT, not DHCP. Additionally, DHCP does not remove the need for subnet masks or default gateways; instead, it provides these parameters automatically to clients.

Misunderstanding these distinctions can lead to incorrect answers, especially when questions ask about the functions of IP services. Carefully distinguishing DHCP’s role in dynamic addressing from NAT’s role in address translation is essential to avoid this trap.

Why the other options are wrong

DHCP does not translate private addresses to public; that is the function of NAT.

DHCP does not replace the need for subnet masks and default gateways; it actually provides them automatically.

DNS and DHCP operate at the Application Layer (Layer 7), not Layer 1.

Practice this question →

169

MCQhard

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

A.ip helper-address 10.99.99.20 under interface Vlan30

B.switchport mode trunk under interface Vlan30

C.ip default-gateway 10.99.99.20 under interface Vlan30

D.spanning-tree portfast under interface Vlan30

AnswerA

The VLAN 30 SVI is the Layer 3 gateway for that subnet, so DHCP client broadcasts must be relayed as unicast to the server at 10.99.99.20. The ip helper-address command enables this relay function and is correctly placed on the SVI that receives the clients' requests. Without it, the broadcast would be dropped by the router.

Why this answer

The correct fix is to add an IP helper address pointing to the remote DHCP server on the Layer 3 interface for VLAN 30. In practical terms, the clients are sending DHCP discovery as a broadcast, and the server is on another subnet. The SVI for VLAN 30 is the local gateway that must relay those requests toward the server.

This is one of the most exam-realistic campus troubleshooting scenarios because it tests both subnet boundaries and the role of the local gateway interface.

Exam trap

A common exam trap is confusing the ip helper-address command with ip default-gateway or Layer 2 commands like switchport mode trunk. Candidates might incorrectly apply switchport commands to an SVI, which is a Layer 3 interface, or think setting ip default-gateway will relay DHCP requests. These mistakes cause DHCP broadcasts to fail reaching the remote server, leading to no IP address assignment for clients.

Understanding that ip helper-address is the DHCP relay mechanism on Layer 3 interfaces is critical to avoid this trap.

Why the other options are wrong

Incorrect. The command switchport mode trunk is a Layer 2 switchport configuration and cannot be applied to an SVI, which is a Layer 3 interface. This does not affect DHCP relay.

Incorrect. The ip default-gateway command sets the default gateway for management traffic on a Layer 2 device and does not relay DHCP broadcasts. It does not restore DHCP service for clients.

Incorrect. The spanning-tree portfast command is used on physical Layer 2 switchports to speed up port transitions and has no effect on DHCP relay or SVIs.

Practice this question →

170

Multi-Selectmedium

Which two statements accurately describe the value of named administrative accounts?

Select 2 answers

A.They improve accountability by tying actions to specific individuals.

B.They improve traceability during audits or incident reviews.

C.They replace the need for authorization controls.

D.They can be used only with Telnet and not SSH.

E.They exist only for wireless guest administration.

AnswersA, B

Named accounts (like AAA with local or RADIUS/TACACS+) bind authenticated users to a unique identity, so every command or configuration change can be logged with the responsible person's username. This is the basis for accountability: when multiple admins share a generic credential, you cannot determine who executed a specific action, but named accounts unambiguously assign responsibility. This deterrence and forensic attribution is a core driver for using AAA rather than shared passwords.

Why this answer

Named administrative accounts are valuable because they tie actions to individual identities and make access review more meaningful. In practical terms, when multiple people share one generic admin account, accountability becomes weaker. Named identities improve traceability and support auditing, investigations, and operational review.

This is a core secure-administration concept and a good reasoning item rather than just a memorization exercise.

Exam trap

Beware of confusing named accounts with other security measures like password policies or role-based access control.

Why the other options are wrong

Named accounts provide identification and authentication, but authorization (what actions an account can perform) is a separate control typically enforced via privilege levels, role-based access control (RBAC), or command authorization (e.g., using TACACS+). Replacing authorization with identity alone would violate the principle of least privilege.

Named accounts are protocol-agnostic and work with any management protocol, including SSH, HTTPS, and SNMPv3. Telnet is insecure and rarely used in modern networks; named accounts are actually more important with secure protocols to maintain accountability without compromising security.

Named administrative accounts are used across all network device administration, including routers, switches, firewalls, and wireless controllers. Wireless guest administration typically uses separate guest accounts or captive portal authentication, not administrative accounts.

Practice this question →

171

Multi-Selectmedium

Which two statements accurately describe why NetFlow is useful for operations teams?

Select 2 answers

A.It helps identify which conversations or applications contribute to link utilization.

B.It can provide more detail than simple interface counters alone.

C.It replaces the need for all routing protocols.

D.It is the main wireless encryption protocol for guest access.

E.It eliminates the usefulness of Syslog.

AnswersA, B

NetFlow samples or captures packet metadata into flow records that identify source/destination IP, ports, and protocol, allowing engineers to rank traffic by conversation or application. This visibility pinpoints which specific flows (e.g., a video-streaming host or an application server) are responsible for congestion, transforming raw link utilization into actionable per-flow intelligence.

Why this answer

NetFlow is useful because it helps teams move beyond simple interface utilization and see which traffic conversations are responsible for usage. In practical terms, it can reveal which hosts, protocols, or applications are contributing to the traffic profile, making it valuable for troubleshooting, capacity planning, and security investigations. Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog; Syslog provides device event logging while NetFlow provides traffic flow data, and both tools complement each other in network operations.

Exam trap

A frequent exam trap is mistaking NetFlow for a routing protocol, a security mechanism, or a replacement for Syslog.

Why the other options are wrong

Option C is incorrect because NetFlow does not replace routing protocols; it is a monitoring technology that provides visibility into traffic flows but does not perform routing functions or influence path selection.

Option D is incorrect as NetFlow is unrelated to wireless encryption protocols. Wireless encryption standards like WPA2 or WPA3 handle security, whereas NetFlow focuses on traffic flow monitoring.

Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog. Syslog provides event logging and system messages, which complement NetFlow’s traffic flow data for comprehensive network monitoring.

Practice this question →

172

MCQhard

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

A.NetFlow

B.Another DHCP scope

C.A new STP priority

D.A larger OSPF metric

AnswerA

NetFlow (and similar flow export technologies) captures metadata for each IP conversation traversing the interface, including source/destination addresses, L4 ports, and byte counts. This allows the administrator to aggregate by host, application, or TCP/UDP port and immediately identify the top talkers driving the interface to high utilization. Unlike SNMP counters that show only aggregate usage, NetFlow correlates the utilization to specific flows.

Why this answer

NetFlow provides conversation-level visibility into which hosts and applications are consuming bandwidth, closing the gap left by SNMP's interface totals. A new DHCP scope assigns IP addresses but offers no traffic insight. An STP priority manages loop-free topology and does not affect monitoring.

A larger OSPF metric influences routing path selection, not traffic analysis.

Exam trap

Avoid assuming all network monitoring tools provide the same level of detail. Understand the specific capabilities of each tool.

Why the other options are wrong

A DHCP scope handles address assignment and has no role in traffic conversation visibility.

An STP priority manages spanning-tree topology and does not provide bandwidth usage details.

A larger OSPF metric affects routing path selection but does not reveal which conversations are using bandwidth.

Practice this question →

173

MCQeasy

Users can reach a server by IP address but not by hostname. Which service should be checked first?

A.NTP

B.DNS

C.QoS

D.HSRP

AnswerB

Users can reach a server by IP address but not by hostname. This is the classic symptom of a DNS resolution failure: the client cannot translate the fully qualified domain name (FQDN) into an IP address, so the connection attempt fails at the name lookup stage. The fact that the IP path itself works proves Layer 3 routing and the server's services are reachable, isolating the problem to name resolution.

Why this answer

If the server is reachable by IP but not by name, the likely issue is name resolution, which points to DNS.

Exam trap

A common exam trap is selecting NTP, QoS, or HSRP as the cause when users cannot reach a server by hostname. NTP synchronizes time and does not affect name resolution. QoS prioritizes traffic but does not translate hostnames to IP addresses.

HSRP provides gateway redundancy and does not influence DNS functionality. Choosing any of these distractors wastes time and leads to incorrect troubleshooting. The key is to recognize that hostname resolution depends solely on DNS, so DNS must be the first service checked when IP connectivity exists but hostname access fails.

Why the other options are wrong

NTP (Network Time Protocol) is responsible for synchronizing clocks across devices but does not handle hostname resolution or IP address translation, so it cannot cause hostname access failures.

QoS (Quality of Service) manages traffic prioritization and bandwidth allocation but does not perform any function related to hostname resolution or IP address translation.

HSRP (Hot Standby Router Protocol) provides gateway redundancy and failover but does not influence DNS or the ability to resolve hostnames to IP addresses.

Practice this question →

174

Multi-Selectmedium

Which two actions help protect access-layer switch ports from rogue DHCP servers?

Select 2 answers

A.Enable DHCP snooping globally and for the needed VLANs

B.Trust the uplink toward the legitimate DHCP server path

C.Enable PortFast on all trunks to block rogue servers

D.Disable ARP on access ports

E.Set every access port as trusted

AnswersA, B

DHCP snooping is the foundational security feature that validates DHCP messages and constructs the binding table. Enabling it globally activates the feature, but you must also enable it on specific VLANs to apply filtering to access layer ports. Without this step, the switch will not inspect DHCP traffic, leaving client ports vulnerable to rogue DHCP replies. This configuration is mandatory for any DHCP snooping protection to take effect in the VLAN.

Why this answer

DHCP snooping marks trusted and untrusted interfaces and filters server-type DHCP messages on untrusted ports. Uplink ports toward the real DHCP server or relay are typically trusted, while user-facing ports stay untrusted. Option C is incorrect because PortFast does not filter DHCP messages; it only speeds up spanning tree convergence.

Option D is incorrect because disabling ARP breaks normal communication and does not block DHCP. Option E is incorrect because marking all access ports as trusted would permit rogue DHCP servers on those ports.

Exam trap

Do not confuse port security with DHCP snooping; they address different security concerns.

Why the other options are wrong

PortFast is used to speed up spanning tree convergence on access ports, not to block rogue DHCP servers. Enabling PortFast on trunks does not prevent rogue DHCP attacks and could cause loops if misconfigured.

Disabling ARP on access ports would break normal IP communication, as ARP is essential for resolving IP addresses to MAC addresses. It does not prevent rogue DHCP servers from responding to DHCP requests.

Setting every access port as trusted would allow rogue DHCP servers connected to any access port to respond to DHCP requests, defeating the purpose of DHCP snooping.

Practice this question →

175

MCQhard

A network engineer notices that clients in the 192.168.10.0/24 subnet are receiving the IP address 192.168.10.1 from the DHCP server, causing a duplicate IP conflict with the router’s own interface. What is the most likely cause?

A.The DHCP pool does not exclude the router’s own interface IP address.

B.The DHCP conflict logging feature is disabled on the router.

C.The DHCP lease time is set too low, causing frequent re-issuing of addresses.

D.The DHCP pool’s default-router address is misconfigured, so the client uses the router’s IP as its own.

AnswerA

When no excluded-address is configured for the router’s IP, the DHCP server treats it as available from the pool and can offer it to clients, creating a conflict. Adding 'ip dhcp excluded-address 192.168.10.1' prevents the server from offering that address.

Why this answer

The most likely cause is that the DHCP pool configuration does not exclude the router's own interface IP address (192.168.10.1) from the range of addresses that the DHCP server can assign. By default, a Cisco router acting as a DHCP server will lease any address within the configured network statement unless an explicit ip dhcp excluded-address command is applied. Since the router's interface already uses 192.168.10.1, leasing that same address to a client creates a duplicate IP conflict.

Exam trap

Cisco often tests the distinction between the DHCP pool's network statement (which defines the range of assignable addresses) and the need to explicitly exclude addresses that are already in use, leading candidates to overlook the ip dhcp excluded-address command and instead focus on unrelated features like conflict logging or lease timers.

Why the other options are wrong

Many candidates confuse conflict detection with a preventive mechanism, thinking that enabling it would stop the assignment of an already-used address.

Candidates may associate short leases with instability, but the root cause is the missing exclusion, not the lease timer.

Beginners often conflate the default gateway with the assigned IP address, believing a mistake in the default-router setting could cause an address conflict.

Practice this question →

176

MCQhard

A network administrator is troubleshooting an issue where internal hosts can ping the company's web server by IP address (192.0.2.10) but cannot access it using the fully qualified domain name www.example.com. The DNS server (192.0.2.5) is reachable and responds to queries. The administrator runs nslookup www.example.com from a host and receives the following output: C:\> nslookup www.example.com Server: UnKnown Address: 192.0.2.5 Name: www.example.com Address: 192.0.2.20 Based on the output, what is the most likely cause of the problem?

A.The host's DNS cache is corrupted; flush it using ipconfig /flushdns.

B.The DNS A record for www.example.com is incorrect; update it to point to 192.0.2.10.

C.The web server's firewall is blocking traffic from the host; add an allow rule.

D.The DNS server is not authoritative for the example.com zone; delegate the zone to a different server.

AnswerB

Correct. The nslookup output shows that www.example.com resolves to 192.0.2.20, but the actual web server is at 192.0.2.10. This indicates the DNS A record is incorrect and must be updated to point to the correct IP address.

Why this answer

The nslookup output shows that www.example.com resolves to 192.0.2.20, but the web server is at 192.0.2.10. This indicates the DNS A record is incorrect and must be updated to point to the correct IP. Pinging by IP works because it bypasses DNS, confirming network connectivity.

The host's DNS cache is not the issue because nslookup queries the server directly and still returns the wrong address. The firewall is not involved since pinging by IP succeeds, and the DNS server is authoritative (the response is received).

Exam trap

The trap here is that candidates may assume a DNS server that responds to queries is functioning correctly, overlooking that the response itself can contain an incorrect A record, which is the actual cause of the resolution failure.

Why the other options are wrong

The nslookup output shows the DNS server is returning an incorrect IP address (198.51.100.1) for www.example.com, not a local cache issue. Flushing the DNS cache would not resolve the problem because the host is querying the DNS server and receiving the wrong answer.

The host can successfully ping the web server at 192.0.2.10, which indicates that ICMP traffic is not blocked by the firewall. The problem is that the host is trying to reach the wrong IP address (198.51.100.1) due to DNS resolution, not that the correct IP is being blocked.

The nslookup response includes the server name 'dns.example.com', which indicates that the DNS server is authoritative for the example.com zone. If it were not authoritative, the response would typically show a non-authoritative answer or refer to another server. Delegation is not needed because the server is already authoritative.

Practice this question →

177

MCQhard

Based on the exhibit, what is the most likely reason PAT is not working correctly?

A.The inside and outside NAT interface roles are reversed.

B.PAT requires OSPF to be enabled on the WAN link.

C.The ACL must be numbered 100 instead of 1.

D.The router must use GRE before PAT can overload.

AnswerA

For PAT (overload) to translate private addresses to a public IP, the interface facing the internal LAN must be configured as `ip nat inside` and the interface facing the ISP/WAN as `ip nat outside`. If these are reversed, the router attempts to translate traffic entering the public interface and exiting the private interface, so the source addresses of internal users are never translated, breaking PAT. This is the most likely cause given the exhibit shows mismatched interface roles.

Why this answer

PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction.

This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.

Exam trap

A common exam trap is confusing the NAT inside and outside interface roles. Candidates might overlook that reversing these roles causes PAT to fail silently, as translation direction depends on correct interface designation. Misunderstanding this can lead to incorrect troubleshooting steps, such as focusing on routing protocols or ACL numbering, which do not impact PAT functionality directly.

Why the other options are wrong

Incorrect because PAT does not depend on OSPF or any routing protocol to function; enabling OSPF on the WAN link is unrelated.

Incorrect because the ACL number does not have to be 100; standard ACLs like 1 are valid for NAT configurations.

Incorrect because GRE tunneling is not required for PAT; PAT operates independently of GRE.

Practice this question →

178

Multi-Selectmedium

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Select 3 answers

A.RADIUS encrypts the entire packet payload, including all attributes.

B.TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.

C.TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

D.TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each.

E.RADIUS combines authentication and authorization into a single process, meaning an access-accept packet includes both authentication success and authorization attributes.

F.When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.

AnswersB, D, E

TACACS+ encrypts the entire payload (body) of the packet—including the authentication, authorization, and accounting attributes and fields—while the TCP header remains in clear text for transport. This provides complete confidentiality of the AAA data, including usernames, passwords, and authorization decisions. The encryption uses a shared secret key to compute an MD5-based hash to obfuscate the body, whereas RADIUS only encrypts the password attribute.

Why this answer

TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes.

Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Exam trap

Cisco often tests the confusion between RADIUS and TACACS+ encryption scope and transport protocols, where candidates mistakenly think RADIUS encrypts the entire payload or that TACACS+ uses UDP, when in fact RADIUS only encrypts the password and uses UDP, while TACACS+ encrypts the full body and uses TCP.

Why the other options are wrong

RADIUS only encrypts the password attribute in the access-request packet; the rest of the packet, including other attributes like username and authorization data, is sent in clear text. This is a key security limitation of RADIUS compared to TACACS+.

TACACS+ uses TCP (port 49) as its transport protocol, while RADIUS uses UDP (ports 1812/1813). This is a fundamental difference: TCP provides reliable, connection-oriented delivery, whereas UDP is connectionless and faster but less reliable.

In 802.1X, the switch acts as an authenticator (passing EAP messages between the client and the authentication server), not as the authentication server itself. The authentication server is typically a RADIUS server that validates client credentials.

Practice this question →

179

PBQhard

You are connected to R1 via the console. The network has a DNS server at 203.0.113.10 that should resolve www.example.com to 203.0.113.100. However, when you ping www.example.com, it fails. Diagnose and resolve the DNS resolution issue. The DNS server is reachable via ping, but nslookup from R1 returns a server failure. Configure R1 so that it can successfully resolve www.example.com. Additionally, verify that the DNS server is correctly configured for forward and reverse lookups.

Network Topology

Hints

•Check the configured name-server IP address in the running-config.
•The DNS server is reachable, but the router is querying the wrong server.
•After fixing the name-server, ensure the DNS server has the correct A record for the domain.

A.Configure 'ip name-server 203.0.113.10' under global configuration and ensure the DNS server has an A record for www.example.com pointing to 203.0.113.100.

B.Configure 'ip domain-lookup' and 'ip name-server 10.0.0.2' under global configuration, then verify with ping www.example.com.

C.Configure 'ip domain-lookup' and 'ip host www.example.com 203.0.113.100' under global configuration, then verify with ping www.example.com.

D.Configure 'ip dns server' under global configuration to make R1 act as a DNS server, then add an A record for www.example.com.

AnswerA

solution

! R1
configure terminal
no ip name-server 10.0.0.2
ip name-server 203.0.113.10
end
write memory

Why this answer

The issue is that the DNS server IP address configured under 'ip name-server' is incorrect (10.0.0.2) instead of the actual DNS server (203.0.113.10). Additionally, the DNS server itself is not configured with the proper A record for www.example.com. The fix involves correcting the name-server address and ensuring the DNS server has the correct forward mapping.

After correcting the name-server, nslookup and dig should return the IP address 203.0.113.100. For reverse lookup, a PTR record for 203.0.113.100 pointing to www.example.com must exist on the DNS server.

Exam trap

The exam trap is that candidates may confuse the 'ip name-server' command with 'ip host' or 'ip dns server'. They might also overlook the need to verify the DNS server's records. Always check the configured name-server IP first when DNS resolution fails.

Why the other options are wrong

The specific factual error: The name-server address must match the actual DNS server; using 10.0.0.2 will not resolve the hostname.

The specific factual error: The 'ip host' command creates a static mapping, not a DNS resolution. The question requires DNS resolution to work, not a static override.

The specific factual error: The 'ip dns server' command enables DNS server services on the router, but the router is not meant to be a DNS server in this scenario. The fix is to point to the existing DNS server.

Practice this question →

180

MCQhard

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

A.deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

B.deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

C.deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

D.permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

AnswerA

This is correct because it blocks only TCP port 80 traffic from the source subnet to the web server.

Why this answer

The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`.

This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.

Exam trap

A common exam trap is selecting a deny statement that blocks all IP traffic (option B) instead of just HTTP traffic. This overblocking disrupts legitimate services beyond HTTP, violating the requirement to allow all other traffic. Another trap is denying UDP port 80 (option C), which is ineffective because HTTP uses TCP, not UDP.

Additionally, mistakenly permitting TCP port 80 traffic (option D) contradicts the goal of blocking HTTP access. Understanding the difference between protocol types and the impact of broad versus specific ACL entries is essential to avoid these pitfalls.

Why the other options are wrong

Option B denies all IP traffic from the source subnet to the destination host, which is too broad and blocks all services, not just HTTP, violating the requirement to allow other traffic.

Option C denies UDP traffic on port 80, but HTTP uses TCP, so this entry would not block HTTP traffic and fails to meet the requirement.

Option D permits TCP traffic on port 80, which contradicts the requirement to block HTTP traffic from the source subnet to the web server.

Practice this question →

181

MCQhard

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

A.The clients are missing valid DNS server information.

B.The default gateway must be removed from the DHCP scope.

C.The clients must use PPP before DNS works.

D.The VLAN must be converted to the native VLAN on all trunks.

AnswerA

The DHCP scope assigns IP configuration but does not include Option 6 (DNS server), so clients receive no resolver address. When a user pings a hostname, the client cannot query a DNS server, causing resolution failure; direct IP access works because no DNS is required. This exactly matches the exhibited symptom of IP connectivity succeeding while hostname-based access fails.

Why this answer

The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Exam trap

A frequent exam trap is to mistake the inability to resolve hostnames as a routing or VLAN trunking problem. Candidates might incorrectly believe that removing the default gateway or converting the VLAN to the native VLAN on trunks will resolve the issue. However, these options do not address DNS resolution, which is an application-layer service independent of Layer 3 forwarding.

The trap arises because clients can reach remote IP addresses, misleading candidates to focus on routing or VLAN configuration rather than missing DNS server information in the DHCP scope.

Why the other options are wrong

Removing the default gateway from the DHCP scope is incorrect because the default gateway is essential for routing traffic outside the local VLAN. Its presence does not cause hostname resolution failures.

The suggestion that clients must use PPP before DNS works is incorrect because PPP is unrelated to DNS resolution in a typical VLAN and DHCP environment. DNS operates independently of PPP.

Converting the VLAN to the native VLAN on all trunks does not affect DNS resolution. This option addresses Layer 2 trunking issues, which are unrelated to the hostname resolution problem described.

Practice this question →

182

Matchingmedium

Match each service or visibility technology to the most appropriate use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Collecting device events and messages centrally

Reading interface status and counters from devices

Finding which hosts are using the most bandwidth

Keeping event timelines consistent across systems

Why these pairings

Syslog collects device events and messages centrally, providing a centralized log repository. SNMP reads interface status and counters from devices, offering real-time device monitoring. NetFlow analyzes network traffic to identify bandwidth usage by host, making it ideal for finding top talkers.

NTP synchronizes clocks across systems to maintain consistent event timelines. Each technology is matched to its primary use case.

Exam trap

The trap here is that many technologies have overlapping capabilities (e.g., SNMP can also monitor interface traffic, but it is not a traffic analysis tool like NetFlow). Candidates must focus on the primary, most specific use case for each technology as defined in Cisco documentation.

Practice this question →

183

MCQhard

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

A.Static NAT

B.PAT overload

C.No NAT

D.DHCP relay

AnswerA

Static NAT creates a one-to-one fixed mapping between an inside private IP and an inside global public IP. This ensures the server's public address never changes, so inbound connections from the Internet to that address are always translated to the same internal server. It also allows the server to initiate outbound traffic with a consistent source address. This is required for an internal server to be reachable from outside.

Why this answer

A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably.

PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.

Exam trap

A common exam trap is selecting PAT overload instead of static NAT for a server that must be reachable from outside using the same public IP. PAT overload is designed for many internal hosts sharing a single public IP for outbound connections, not for providing a fixed public IP for inbound access. This misunderstanding leads to incorrect assumptions about how inbound traffic is handled.

The exam tests your ability to distinguish between dynamic port-based translation and static one-to-one mappings, so confusing these concepts can cause you to choose the wrong NAT approach.

Why the other options are wrong

PAT overload is incorrect because it allows multiple internal hosts to share a single public IP for outbound traffic but does not provide a stable public IP for inbound connections to a specific server.

No NAT is incorrect because private IP addresses are not routable on the Internet, so the internal server would not be reachable from outside without address translation.

DHCP relay is unrelated to NAT or external reachability; it only forwards DHCP requests between clients and servers across subnets and does not affect how the server is accessed externally.

Practice this question →

184

MCQhard

A host receives a correct IP address and subnet mask from DHCP but still cannot reach remote networks. Local subnet communication works. Which missing DHCP option is the strongest suspect?

A.Default gateway information

B.An STP root bridge ID

C.A voice VLAN value

D.A router ID

AnswerA

Without a default gateway, a host can determine that a destination is off-subnet via its own IP and mask, but it has no next-hop IP address to which to forward the packets. DHCP typically delivers the default gateway via option 3, and its absence means local-link traffic works while remote traffic remains unanswered. Therefore, this is the missing required information for off-subnet connectivity.

Why this answer

The strongest suspect is the default gateway option. In practical terms, the host can already identify local destinations because the subnet mask is present. That is why local communication still works. What it does not have is the next hop needed for off-subnet traffic. Without a default gateway, remote communication usually fails.

This is a very common host-troubleshooting scenario. It separates basic local addressing from the additional information required for off-subnet reachability.

Exam trap

A common exam trap is selecting options like STP root bridge ID or voice VLAN as the cause of remote connectivity failure. These options relate to Layer 2 switching or voice VLAN segmentation and do not affect IP routing or host reachability to remote networks. Candidates might confuse DHCP options that influence Layer 2 behavior with those critical for Layer 3 routing.

The key mistake is overlooking the default gateway option, which is essential for off-subnet traffic forwarding. This trap tests the candidate’s understanding of DHCP’s role in providing routing information, not just IP addressing.

Why the other options are wrong

An STP root bridge ID is irrelevant to host IP reachability because it pertains to Layer 2 spanning tree topology and does not affect IP routing or DHCP configuration for hosts.

A voice VLAN value is specific to voice traffic segmentation on switches and does not influence a host’s ability to route IP packets to remote networks, making it unrelated to the connectivity issue.

A router ID is a concept used in routing protocols like OSPF and does not apply to DHCP or host IP configuration, so it cannot cause the described connectivity problem.

Practice this question →

185

MCQmedium

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

A.DNS

B.NTP

C.SNMP

D.CDP

AnswerB

NTP is the correct choice because it synchronizes the system clocks of routers and switches across the network, ensuring consistent timestamps for logging, troubleshooting, and event correlation. Without NTP, device clocks drift independently, making it impossible to accurately sequence or compare events from different devices, which is critical for network monitoring and security forensics.

Why this answer

Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Exam trap

Don't confuse protocols with similar acronyms or those related to network management. Focus on the specific function of time synchronization.

Why the other options are wrong

DNS (Domain Name System) resolves hostnames to IP addresses and has no role in time synchronization. DNS does not provide timestamp information or clock setting capabilities. Verifying DNS would not help ensure consistent timestamps in logs.

SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices, not for time synchronization. While SNMP can retrieve device uptime or timestamps from MIBs, it does not set or synchronize clocks. Relying on SNMP for time consistency would not correct clock drift.

CDP (Cisco Discovery Protocol) is a Layer 2 protocol used to discover neighboring Cisco devices and their capabilities. It does not provide time synchronization or affect timestamps in logs. CDP is irrelevant for ensuring consistent timestamps.

Practice this question →

186

MCQhard

A router is configured with a static NAT mapping for an internal server. What is the main operational advantage of this design for outside clients?

A.The server is represented by a fixed public address that outside clients can reach predictably

B.The server automatically shares its public address with all inside users through overload

C.The server no longer needs an IP address on the internal network

D.The mapping removes the need for routing to the server

AnswerA

Static NAT creates a permanent, explicit one-to-one binding between the server's private inside local address and a designated public inside global address. This fixed mapping remains constant and is not dynamically reassigned, which allows outside clients to reach the server using the same predictable public address each time. Since the mapping is preconfigured, inbound connections are consistently forwarded to that internal server without requiring any port translation or dynamic address selection.

Why this answer

The main operational advantage is predictability. In plain language, outside clients always know which public IP address represents the internal server. That stable one-to-one mapping makes the server easier to reach consistently from external networks. This is exactly why static NAT is commonly used for inside services that need outside reachability.

This differs from PAT, which is optimized for many outbound user sessions sharing fewer public addresses. Static NAT is valuable when a specific device or service must have a stable external identity.

Exam trap

A frequent exam trap is confusing static NAT with PAT (Port Address Translation). While PAT allows many internal devices to share one public IP by using different port numbers, static NAT assigns a fixed public IP to a single internal device. Selecting an answer that suggests the server shares its public address with all inside users (like option B) is incorrect because static NAT does not perform address overload.

Another trap is assuming static NAT removes the need for routing; however, routing is still required to forward packets to the internal server. Misunderstanding these differences can lead to incorrect answers about NAT behavior and design advantages.

Why the other options are wrong

This option is incorrect because it describes PAT behavior, where multiple inside users share a public IP via port overload. Static NAT does not share the public address among users.

This option is incorrect because the internal server still requires a valid IP address on the internal network for routing and communication; static NAT does not remove this requirement.

This option is incorrect because NAT translates addresses but does not eliminate the need for routing. Proper routing is still necessary to deliver packets to the internal server.

Practice this question →

187

MCQhard

Refer to the exhibit. A network engineer is troubleshooting DHCP issues on a branch office network. Several users report that new devices are unable to obtain IP addresses, even though the DHCP pool configured on R1 appears to have sufficient free addresses. The engineer executes the show ip dhcp conflict command and observes the output. Based on the output, what is the most likely cause of the problem?

A.The DHCP scope is misconfigured with an exclusion range that includes 192.168.1.50 to 192.168.1.59.

B.The ping timeout on the DHCP server is set too low, causing it to falsely detect conflicts.

C.Several hosts on the network are using static IP addresses from the DHCP pool range, causing the DHCP server to mark those addresses as conflicts and depleting the available pool.

D.The DHCP server is not properly releasing expired leases, causing the conflict table to fill up.

AnswerC

Each conflict entry with detection method 'Ping' indicates the server attempted to verify the address and received a reply, meaning a device is already using that IP statically or from another source. The server then marks it as a conflict and withdraws it from the pool, shrinking the pool until no addresses remain free.

Why this answer

The output of 'show ip dhcp conflict' lists IP addresses that the DHCP server detected as already in use via ping or gratuitous ARP. When hosts use static IP addresses from the DHCP pool range, the server marks those addresses as conflicts and removes them from the available pool, effectively depleting the pool even though the scope shows free addresses. This matches the scenario where new devices cannot obtain IP addresses despite the pool appearing to have sufficient free addresses.

Exam trap

Cisco often tests the distinction between a DHCP exclusion range (which prevents addresses from being offered) and a DHCP conflict (which occurs after an address is offered but found to be in use), tempting candidates to confuse the two concepts.

Why the other options are wrong

Candidates may confuse administratively excluded addresses with dynamically detected conflicts.

The misconception is that aggressive ping settings create false conflicts, when in fact a conflict entry proves a reply was received.

Candidates might think that conflicts represent stale entries, but a conflict is a permanent record of a detected collision, not a lease state.

Practice this question →

188

MCQhard

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

A.SW2 is the root bridge for VLAN 10.

B.Gi0/1 on SW2 is the root port.

C.All SW2 ports in VLAN 10 must be designated ports.

D.STP is disabled because the priorities are equal.

AnswerB

Gi0/1 is the root port because STP selects the port with the lowest root path cost to reach the root bridge, and the received BPDU lists the root as reachable through Port 1. On SW2, Port 1 maps to Gi0/1, so that interface assumes the root port role. A root port is the non-root switch's closest path to the root, and it remains in forwarding state.

Why this answer

The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Exam trap

A common exam trap is to incorrectly conclude that STP is disabled when bridge priorities are equal. Candidates may mistakenly believe that equal priorities cause STP to fail or not elect a root bridge. However, STP always elects a root bridge by comparing the MAC addresses as a tiebreaker when priorities match.

Another trap is assuming all ports on a non-root switch must be designated ports, ignoring the existence of a root port that leads toward the root bridge. Misreading the root port can lead to incorrect answers about port roles and network topology.

Why the other options are wrong

This option is incorrect because the root bridge ID shown in the STP details differs from SW2's local bridge ID, indicating SW2 is not the root bridge for VLAN 10.

This option is wrong since a non-root switch does not have all ports as designated ports; it must have one root port and may have other ports as designated or blocked.

This is incorrect because equal priorities do not disable STP; the protocol uses the MAC address portion of the bridge ID to break ties and continue operation.

Practice this question →

189

Multi-Selectmedium

Which two statements accurately describe why NTP and Syslog are often configured together?

Select 2 answers

A.Syslog provides event visibility, while NTP helps keep timestamps consistent across devices.

B.Consistent time improves the usefulness of centralized logs and event correlation.

C.NTP replaces the need for any event logging.

D.Syslog automatically assigns the NTP server address to all devices.

E.Both services can be used only on routers, not switches.

AnswersA, B

Syslog is a client/server protocol that forwards network device log messages to a central collector, giving administrators event visibility. NTP synchronizes device clocks so every logged event has a consistent, reliable timestamp. They work together because syslog provides the audit trail while NTP makes the timestamps in that trail trustworthy.

Why this answer

NTP and Syslog are often configured together because logs become much more useful when the device clocks are aligned. In practical terms, Syslog provides the event messages, while NTP helps ensure that the timestamps on those messages are consistent across the environment. That makes troubleshooting and incident analysis more reliable.

This is a very practical operations concept and comes up often in real troubleshooting workflows.

Exam trap

A common exam trap is selecting the option that NTP replaces the need for event logging or that Syslog automatically configures NTP server addresses. Candidates might confuse time synchronization with logging functionality, but NTP only provides accurate time, not event data. Similarly, Syslog collects logs but does not manage NTP settings.

Misunderstanding these roles can lead to incorrect answers, as the two services complement each other but serve distinct purposes in network management.

Why the other options are wrong

This option is incorrect because NTP only synchronizes time and does not replace the need for event logging, which is handled by Syslog or other logging mechanisms.

This option is incorrect because Syslog does not configure NTP server addresses or manage time synchronization; these are separate configuration tasks.

This option is incorrect because both NTP and Syslog are widely used on various network devices, including routers and switches, not limited to routers alone.

Practice this question →

190

MCQmedium

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

A.ip default-gateway 10.20.20.1

B.ip helper-address 10.99.99.10

C.switchport trunk allowed vlan 20

D.spanning-tree portfast default

AnswerB

DHCP relies on broadcast discovery, and broadcasts do not cross Layer 3 boundaries. The PCs in VLAN 20 cannot reach the DHCP server on a different subnet unless the VLAN 20 SVI has ip helper-address 10.99.99.10 configured. That command converts the client broadcast into a unicast relayed to the server, while also inserting the SVI IP as the giaddr so the server can scope an appropriate address. Therefore, this is the missing configuration.

Why this answer

DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Exam trap

A frequent exam trap is selecting the ip default-gateway command as the solution for DHCP relay issues. This command only applies to Layer 2 switches for their own management traffic and does not forward DHCP broadcasts across routed interfaces. Candidates may also mistakenly focus on VLAN trunking or spanning-tree settings, which do not affect DHCP relay functionality.

The key is to recognize that DHCP broadcasts must be explicitly forwarded by the router or Layer 3 switch interface using ip helper-address to reach a DHCP server in another subnet.

Why the other options are wrong

The ip default-gateway command configures the default gateway for a Layer 2 switch’s management interface and does not forward DHCP broadcasts. Since the question involves DHCP relay across routed VLANs, this command is irrelevant.

The switchport trunk allowed vlan 20 command controls VLAN traffic allowed on a trunk link but does not influence DHCP relay or routing between VLANs. The issue is DHCP relay, not VLAN trunk configuration.

The spanning-tree portfast default command enables PortFast on switch ports to speed up STP convergence and does not affect DHCP relay or routing. It is unrelated to the problem of clients not receiving DHCP addresses.

Practice this question →

191

MCQhard

Refer to the exhibit. An administrator is trying to access a web server in the DMZ at 192.168.1.10 using HTTPS, but the connection times out. The web server is confirmed to be running and listening on both port 80 and port 443. The administrator examines the access list configuration on the perimeter router. Based on the output of the show access-lists command, what is the most likely cause of the failure?

A.The access list does not include a permit statement for TCP port 443.

B.The access list is applied in the wrong direction on the interface.

C.The web server is not actually listening on TCP port 443, despite the configuration.

D.The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.

AnswerA

The access list only has a single permit statement for the 192.168.1.0/24 network, and it matches 'eq www', which is TCP port 80. Because HTTPS uses TCP port 443, no forwarded traffic to that port is explicitly permitted, so it is dropped by the implicit deny-all rule at the end of the ACL. Even if the server is listening, the router's ACL prevents the packets from ever reaching it.

Why this answer

The access list shown in the exhibit permits TCP port 80 (HTTP) but does not include a permit statement for TCP port 443 (HTTPS). Since the administrator is trying to access the web server using HTTPS, which uses port 443, the traffic is implicitly denied by the final 'deny ip any any log' statement. This causes the connection to time out because the packets are dropped before reaching the server.

Exam trap

Cisco often tests the distinction between HTTP (port 80) and HTTPS (port 443) in ACLs, trapping candidates who assume that allowing HTTP automatically allows HTTPS or that the implicit deny only applies to non-TCP traffic.

Why the other options are wrong

Candidates may assume the ACL is not applied correctly, but without interface details this conclusion cannot be drawn from the given output.

Candidates might blame the server configuration rather than the network ACL, but the question stem provides the server state to rule this out.

This is a common misconception: the explicit deny is not the root cause; the missing permit is the real issue. Removing the deny without adding a permit for HTTPS would still result in the traffic being blocked by the implicit deny.

Practice this question →

192

MCQhard

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

A.Use the narrowest possible match so only the intended traffic is denied.

B.Always deny all IP traffic to the destination subnet first.

C.Use a standard ACL because destination details never matter.

D.Place the ACL only where no routing exists.

AnswerA

Using the narrowest possible match—such as a specific extended ACL entry with the exact destination IP, protocol, and port—ensures that only packets destined for that one web server are denied, leaving all other traffic untouched. This precision prevents accidental blocking of other services or hosts sharing the same subnet, which is the core principle of least-privilege ACL design.

Why this answer

The most important principle is to write the ACL as narrowly as possible so it matches only the unwanted traffic and does not overblock unrelated traffic. In practical terms, the rule should target the specific destination and service being denied rather than using a broader deny that unintentionally blocks other communication.

This is a precision-and-scope question. Good ACL design is as much about what you avoid blocking as what you intend to block.

Exam trap

Avoid using broad deny statements that block more than necessary. Focus on precision by targeting both IP and port.

Why the other options are wrong

This option is wrong because denying all IP traffic to the destination subnet would block all traffic to that subnet, not just the specific web server, which contradicts the requirement to allow access to other web destinations.

Using a standard ACL ignores the importance of destination details, which are crucial for selectively denying access to one specific web server while allowing others. This approach would lead to broader access restrictions than intended.

Placing the ACL only where no routing exists is incorrect because it does not address the requirement of selectively blocking traffic to a specific web server while allowing access to others. ACLs must be strategically placed to control traffic flow effectively based on routing paths.

Practice this question →

193

Multi-Selecthard

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Select 2 answers

A.logging host 10.10.10.50

B.ntp server 10.10.10.60

C.ip helper-address 10.10.10.50

D.snmp-server host 10.10.10.60

E.service timestamps log localtime

AnswersA, B

The logging host 10.10.10.50 command designates a remote syslog server to receive all generated log messages. This is the primary mechanism for sending logs to a collector, as the device will forward syslog messages at the configured severity levels. Without this statement, logs are only stored locally, so this command directly fulfills the requirement to send logs to 10.10.10.50.

Why this answer

One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Exam trap

A common exam trap is selecting commands related to SNMP or DHCP relay, such as 'snmp-server host' or 'ip helper-address', mistakenly believing they configure logging or time synchronization. Candidates may also choose 'service timestamps log localtime' expecting it to standardize timestamps, but without NTP synchronization, timestamps remain inconsistent across devices. The trap lies in confusing the purpose of these commands with syslog and NTP functions.

The question specifically requires centralized logging and consistent timestamps, which only 'logging host' and 'ntp server' commands fulfill together.

Why the other options are wrong

'ip helper-address 10.10.10.50' is incorrect because it is used to relay broadcast traffic like DHCP requests, not for syslog or time synchronization.

'snmp-server host 10.10.10.60' is incorrect because SNMP manages network monitoring and traps, but does not synchronize device time or configure syslog destinations.

'service timestamps local' is insufficient alone because it adds timestamps but does not synchronize time across devices, so timestamps may remain inconsistent without NTP.

Practice this question →

194

MCQhard

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

A.Authentication succeeded, but authorization limits the user's command access.

B.The device lost all routing information after login.

C.The subnet mask on the user workstation is incorrect.

D.Syslog is blocking the commands for security reasons.

AnswerA

In AAA architecture, authentication verifies the user's identity, while authorization independently determines which commands the authenticated user may execute. Since login succeeded but command access is restricted, the failure occurs at the authorization stage, not at authentication. TACACS+ or RADIUS attributes, or local privilege levels, enforce these per-command limits.

Why this answer

The situation is best explained by authorization controls. In practical terms, authentication confirms who the user is, but authorization determines what that user can do after login. A successful login followed by restricted command access means the identity is valid but the permission set is limited.

This is one of the most important practical distinctions within AAA.

Exam trap

A common exam trap is assuming that successful authentication means unrestricted access to all device commands. Candidates often confuse authentication with authorization, thinking that if a user can log in, they should have full command privileges. This misunderstanding leads to incorrect answers suggesting routing issues or workstation configuration problems as causes for command denial.

However, Cisco devices distinctly separate authentication (identity verification) from authorization (permission enforcement). Authorization policies can restrict command access even after a successful login, which is the correct explanation in this scenario.

Why the other options are wrong

This option is incorrect because losing routing information after login does not selectively deny commands. Routing issues affect packet forwarding, not user command permissions, so it does not explain the selective command denial.

This option is invalid because an incorrect subnet mask on the user's workstation would affect network connectivity, not command access on the device after successful login. It does not relate to authorization or command restrictions.

This option is wrong since Syslog is a logging mechanism that records events but does not block or restrict user commands. It provides visibility but does not enforce command authorization or deny access.

Practice this question →

195

MCQhard

A network administrator wants to receive an immediate notification from a device when a significant event occurs, rather than polling the device repeatedly. Which SNMP feature is most associated with that requirement?

A.SNMP traps

B.Syslog severity 7

C.DHCP relay

D.NetFlow exporters

AnswerA

An SNMP trap is an unsolicited, event-driven message that a managed device sends directly to a network management station (NMS) to alert it of a fault, status change, or security incident. Unlike SNMP polling, which requires the NMS to request information, traps are pushed immediately when the triggering event occurs, enabling real-time notification without waiting for a poll cycle. This is exactly the behavior described by the requirement to receive an immediate notification from a device.

Why this answer

SNMP traps are the correct answer because they are an SNMP feature that sends unsolicited, event-driven notifications from the device to the management system when a significant event occurs, eliminating the need for polling. Option B (syslog severity 7) is incorrect because syslog is a separate protocol for logging; while syslog messages are also sent unsolicited, the question specifically asks for an SNMP feature. Options C (DHCP relay) and D (NetFlow exporters) are unrelated to immediate event notifications: DHCP relay forwards broadcast requests, and NetFlow exports traffic flow data for analysis.

Exam trap

A frequent exam trap is mistaking syslog messages or NetFlow exporters as the mechanism for immediate event notifications in SNMP. Syslog severity levels, such as severity 7, relate to logging detail but do not trigger unsolicited alerts to management stations. Similarly, NetFlow exporters focus on traffic flow analysis rather than event-driven notifications.

Candidates may also confuse DHCP relay, which is unrelated to SNMP, with notification features. The key is to remember that only SNMP traps send unsolicited, immediate notifications, distinguishing them from polling or other monitoring tools.

Why the other options are wrong

Syslog severity 7 refers to debug-level logging detail but does not trigger unsolicited alerts; syslog messages require polling or log monitoring and are not part of SNMP's event-driven notification.

DHCP relay is a mechanism to forward DHCP requests across networks and has no role in SNMP or event-driven notifications, making it irrelevant to the question.

NetFlow exporters provide detailed traffic flow information for analysis but do not send immediate event notifications; they are unrelated to SNMP traps or polling mechanisms.

Practice this question →

196

MCQhard

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

A.Leave it inbound on the LAN because standard ACLs belong near the source

B.Move it outbound on the WAN-facing interface closer to the destination

C.Convert it to a VTY access-class

D.Apply it inbound on all switch access ports

AnswerB

A standard ACL filters only on source IP address, so it should be applied outbound on the WAN-facing interface, as far from the source as the destination path allows. This placement blocks host 10.10.10.50 from reaching the WAN/remote side with a single rule, avoiding unnecessary processing on internal LAN interfaces. It is the recommended best practice for standard ACLs.

Why this answer

A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Exam trap

A frequent exam trap is believing that standard ACLs should always be applied inbound near the source to block unwanted traffic early. Since standard ACLs filter only by source IP, placing them inbound on a LAN interface can block all traffic from that host, including local communications within the LAN. This leads to unintended network outages and user complaints.

The trap is confusing the ACL placement rule for extended ACLs, which are placed near the source, with the rule for standard ACLs, which should be placed near the destination to avoid over-blocking.

Why the other options are wrong

Leaving the standard ACL inbound on the LAN interface is incorrect because standard ACLs filter only by source IP, which causes all traffic from that host, including local LAN traffic, to be blocked. This disrupts local communications and is not best practice.

Converting the ACL to a VTY access-class is irrelevant to the question because VTY access-classes control remote management access to the router, not general traffic filtering from a host to remote networks.

Applying the ACL inbound on all switch access ports is impractical and inefficient. It would block traffic at multiple points unnecessarily and does not address the specific need to filter traffic from the host to remote networks.

Practice this question →

197

MCQhard

Why is the combination of strong authentication and centralized logging better than either control by itself?

A.Authentication improves prevention, while centralized logging improves visibility and investigation.

B.They are redundant because both perform exactly the same task.

C.Centralized logging makes authentication unnecessary.

D.Strong authentication removes the need for any event records.

AnswerA

Strong authentication (e.g., MFA, certificates) enforces identity verification before access is granted, thereby reducing the likelihood of unauthorized entry—this is a preventive control. Centralized logging, by contrast, aggregates security events from diverse systems into a single repository, enabling real-time monitoring, forensic analysis, and post-incident investigation. Together they form a defense-in-depth strategy: one blocks initial compromise, while the other provides the visibility needed to detect, respond to, and learn from attempted or successful attacks.

Why this answer

The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate what happened across the environment. In practical terms, one control is stronger on prevention, and the other is stronger on visibility and accountability. Together they provide broader protection than either one alone.

This reflects a real security principle: mature security depends on layers of control, not one mechanism trying to do every job.

Exam trap

A common exam trap is believing that strong authentication alone is enough to secure a network, leading to the misconception that event logging is unnecessary. Candidates may also incorrectly assume that centralized logging can replace authentication by simply recording events without preventing unauthorized access. This misunderstanding overlooks the complementary roles these controls play: authentication stops unauthorized users upfront, while logging provides the visibility needed to detect and investigate incidents.

Ignoring either control weakens overall security and can cause candidates to select incorrect answers that underestimate the importance of layered defenses.

Why the other options are wrong

This option is incorrect because authentication and logging serve different purposes; authentication controls access, while logging records events. They are not redundant but complementary.

This option is wrong because centralized logging only records events and does not prevent unauthorized access, so it cannot replace strong authentication.

This option is incorrect because even with strong authentication, event records remain essential for auditing, troubleshooting, and investigating security incidents.

Practice this question →

198

Multi-Selecthard

Users can browse websites by IP address but not by hostname. The default gateway is reachable and general internet connectivity works. Which two causes are the most likely?

Select 2 answers

A.The clients are missing a valid DNS server setting

B.DNS queries may be blocked somewhere along the path

C.The routers are missing NTP configuration

D.The switch access ports should be changed to dynamic desirable

AnswersA, B

Without a valid DNS server setting, the client's resolver has no IP address to send hostname queries to, so name resolution returns a 'server not found' or timeout error. Browsing by IP address works because HTTP requests target the IP directly and never invoke the DNS lookup process. This is a classic missing-DNS configuration issue at the client or DHCP scope.

Why this answer

If IP connectivity works but hostnames fail, the problem is usually DNS configuration or DNS reachability, not general routing.

Exam trap

A frequent exam trap is to assume that if users cannot browse websites by hostname, the problem must be with routing or the default gateway. However, the question states the default gateway is reachable and general internet connectivity works, which rules out routing issues. Another trap is to confuse unrelated configurations like NTP or switch port settings as causes for DNS failures.

The key is to focus on DNS-specific causes: missing DNS server settings on clients or DNS traffic being blocked. Misinterpreting these symptoms leads to incorrect answers that do not address the root cause of hostname resolution failure.

Why the other options are wrong

Incorrect. NTP configuration affects time synchronization but does not impact DNS resolution or hostname-based browsing, so it is unrelated to this issue.

Incorrect. Changing switch access ports to dynamic desirable affects VLAN trunk negotiation (DTP) but does not influence DNS resolution or hostname connectivity.

Practice this question →

199

Multi-Selectmedium

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Select 2 answers

A.Users often access services by name, so failed name resolution can feel like total connectivity loss.

B.Testing by IP address versus hostname can help distinguish DNS issues from raw path issues.

C.DNS failure automatically means the default gateway is missing.

D.If DNS fails, DHCP and NTP must also fail immediately.

E.DNS replaces the need for routing between subnets.

AnswersA, B

DNS translates human-friendly domain names into IP addresses, so when name resolution fails, client applications cannot even initiate a session to a server. Because users rarely type raw IP addresses, every attempted connection appears to fail, making a single DNS outage feel identical to a complete network outage. The data path may be fully operational, but the user perceives total connectivity loss.

Why this answer

DNS issues can look like general connectivity problems because many users think in terms of names, not IP addresses. In practical terms, they may report that 'the network is down' when the actual routed path works but hostname resolution does not. That is why testing by IP versus name is such a useful troubleshooting step.

The distinction between transport reachability and naming is critical in user-facing support.

Exam trap

A common exam trap is assuming that DNS failure means the default gateway or other network infrastructure is missing or malfunctioning. Candidates might incorrectly link DNS issues to routing failures or DHCP and NTP outages, which are separate services. This misunderstanding leads to wasted troubleshooting effort on routing tables or gateway configurations when the real problem lies in DNS server availability or client resolver settings.

The exam tests your ability to isolate DNS as an application-layer service distinct from network-layer connectivity.

Why the other options are wrong

Incorrect because DNS failure does not imply the default gateway is missing. Routing and DNS are separate functions, and gateway issues are unrelated to DNS resolution.

Incorrect because DHCP and NTP are independent IP services. DNS failure does not cause these services to fail immediately or automatically.

Incorrect because DNS does not replace routing. DNS resolves names to IP addresses, while routing protocols determine packet forwarding between subnets.

Practice this question →

200

PBQhard

You are connected to R1, a multilayer switch acting as a DNS forwarder for two VLANs. Users on VLAN 10 report that they cannot resolve 'files.example.com' while VLAN 20 works fine. The DNS server 198.51.100.53 is reachable but returns SERVFAIL for queries from subnet 192.168.10.0/24, while server 203.0.113.53 responds correctly for both VLANs. Diagnose and fix the DNS resolution issue using nslookup and dig, then adjust the IOS-XE configuration to ensure proper name resolution. Choose the best fix that permanently resolves the problem.

Network Topology

Hints

•The first DNS server returns SERVFAIL for the A record query.
•The second DNS server resolves the name correctly.
•Use 'no ip name-server <ip>' to remove a faulty server.

A.Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.

B.Add a static DNS entry for 'files.example.com' using 'ip host files.example.com 10.0.0.1' on R1.

C.Change the DNS server order so that the working server is primary using 'ip name-server 203.0.113.53 198.51.100.53'.

D.Configure the router to use only the faulty server by removing the working server with 'no ip name-server 203.0.113.53'.

AnswerA

solution

! R1
configure terminal
no ip name-server 198.51.100.53
end

Why this answer

The faulty DNS server 198.51.100.53 returns SERVFAIL for the A record query, indicating a misconfiguration or missing record on that server. Although reordering (Option C) would allow resolution to work by querying the functional server first, it is not the optimal fix because the broken server remains in the list and could still be used if the primary times out or for future queries. The best practice is to completely remove the faulty server using 'no ip name-server 198.51.100.53'.

Option B adds a static entry that only helps one domain and does not address the root cause. Option D would make the router use only the broken server, worsening the problem.

Exam trap

Do not confuse a reachable DNS server with a functional one. SERVFAIL means the server is responding but cannot resolve the query. The solution is to remove the faulty server, not reorder or add static entries.

Why the other options are wrong

Reordering the name servers works around the issue temporarily but leaves the faulty server in the configuration, which is not a permanent solution and violates best practice of removing misconfigured DNS servers.

Practice this question →

201

MCQeasy

A small office wants branch routers to automatically hand out IP addresses, default gateway values, and DNS servers to clients. Which service should be configured?

A.DNS

B.DHCP

C.NTP

D.TACACS+

AnswerB

DHCP automatically assigns IP addresses, subnet masks, default gateways, DNS servers, and other network parameters from a defined scope. This eliminates the need for manual static configuration, ensuring that each client receives valid, non-conflicting addressing. In a small office, the branch router can act as a DHCP server or BOOTP relay agent to dynamically hand out IPs to hosts.

Why this answer

DHCP is built for this exact job. It centrally provides addressing details so endpoints do not need to be configured by hand.

Exam trap

A common exam trap is confusing DHCP with other network services like DNS, NTP, or TACACS+. DNS only resolves domain names to IP addresses and does not assign IP addresses or default gateways. NTP synchronizes time across devices but does not handle IP addressing.

TACACS+ is an AAA protocol used for authentication and authorization, not for assigning IP addresses or network parameters. Selecting any of these instead of DHCP leads to incorrect answers because they do not fulfill the requirement of automatically handing out IP addresses and related network configuration to clients.

Why the other options are wrong

DNS resolves domain names to IP addresses but does not assign IP addresses, default gateways, or DNS server settings to clients. It is not responsible for automatic IP configuration, so it is incorrect for this question.

NTP synchronizes time across network devices and does not provide IP addressing or network configuration parameters to clients, making it irrelevant for this question.

TACACS+ is an AAA protocol used for authentication, authorization, and accounting. It does not handle IP address assignment or network parameter distribution, so it is not the correct service here.

Practice this question →

202

PBQhard

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

Hints

•Check the ACL for the correct inside network.
•The PAT command is missing a keyword to enable port address translation.
•Ensure the 'overload' keyword is present in the ip nat inside source list command.

A.Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

B.Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.

C.Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.

D.Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.

AnswerA

solution

! R1
conf t
no access-list 100
access-list 100 permit 192.168.1.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
end

Why this answer

The configuration has two issues: (1) ACL 100 permits 192.168.2.0/24 instead of 192.168.1.0/24, so the inside traffic is not matched for PAT. (2) The 'ip nat inside source list' command lacks the 'overload' keyword, preventing port address translation. The static NAT entry for the web server is correctly configured and does not depend on the ACL; it will work once the ACL is fixed. To resolve: change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

Exam trap

Candidates often overlook that the ACL must match the inside network exactly, and that 'overload' is required for PAT. Additionally, they may forget to verify with 'show ip nat translations' to confirm the configuration is working.

Why the other options are wrong

The answer fails to include the verification step, which is a critical part of troubleshooting and ensuring the configuration is applied correctly.

The ACL must match the correct inside network; without fixing it, PAT will not apply to the intended traffic.

The 'overload' keyword is essential for PAT; omitting it means the router will perform dynamic NAT without port translation, which is insufficient for multiple hosts.

Practice this question →

203

MCQhard

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

A.The NTP authentication key configured on R1 does not match the one on the server.

B.The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.

C.The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.

D.The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.

AnswerD

The exhibit clearly shows 'no reference clock' and stratum 16, which indicates that R1 has not received any NTP packets from the configured server. This is a classic symptom of network unreachability—the router’s NTP requests are not making it to the server or responses are not coming back, often caused by a missing route or an ACL filtering UDP 123.

Why this answer

The `show ntp status` output would show the clock as unsynchronized if R1 cannot communicate with the NTP server at 10.1.1.100. NTP uses UDP port 123, and a routing issue or an access list blocking this port would prevent the exchange of NTP packets, leaving the clock unsynchronized. The `ntp server` command configures R1 as a client to request synchronization, but it does not guarantee reachability.

Exam trap

Cisco often tests the misconception that the `ntp server` command alone is insufficient and that an additional 'ntp enable' command is needed, but in reality, the client process is automatically started by the `ntp server` command.

Why the other options are wrong

Candidates often confuse unsynchronized status with authentication issues, but authentication failures do not prevent reception of packets; they just discard them after arrival.

A common myth is that NTP cannot sync if the clocks are too far apart. While extreme offsets may delay sync, they do not prevent the router from hearing the server, so the reference clock field would still show the server’s IP or clock ID.

Some candidates mistakenly believe that a separate 'ntp enable' command is required. In IOS, configuring an ntp server automatically enables NTP, so the service is active.

Practice this question →

204

MCQmedium

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

A.Defense in depth

B.Least privilege

C.Segmentation

D.Availability

AnswerB

Correct. Users receive only the access they need.

Why this answer

Least privilege is the security principle that grants users only the specific permissions necessary to perform their job functions, minimizing potential damage from errors or malicious actions. Defense in depth is a layered security strategy using multiple controls, not a principle of limiting permissions. Segmentation divides a network into isolated segments to contain threats, but does not directly govern individual user permissions.

Availability ensures systems and data are accessible when needed, which is unrelated to restricting access rights.

Exam trap

Don't confuse access control methods like RBAC, DAC, or MAC with the principle of least privilege, which specifically minimizes permissions.

Why the other options are wrong

Defense in depth refers to a layered security approach that employs multiple security measures to protect information. It does not specifically address the principle of granting users only the necessary permissions for their tasks.

Segmentation refers to dividing a network into segments to enhance security and manageability, rather than limiting user permissions. It does not directly address the concept of granting only necessary permissions to users.

Availability refers to ensuring that systems and data are accessible when needed, which does not relate to limiting user permissions for task completion. This option does not address the principle of restricting access based on necessity.

Practice this question →

205

MCQhard

R1 and R2 should form an OSPF adjacency on their shared GigabitEthernet link, but they remain stuck in EXSTART. What is the most likely cause?

A.The routers are using different OSPF areas.

B.The interface MTU values do not match.

C.One side is configured as passive-interface.

D.The subnet mask on the link is incorrect.

AnswerB

A mismatch in interface MTU is the classic cause of OSPF neighbors becoming stuck in EXSTART or EXCHANGE. During the Database Description (DBD) packet exchange, each router includes its MTU in the DBD header; if the receiving router sees a larger MTU than its own, it drops the packet, so the neighbor state never progresses past EXSTART. This correctly explains why the adjacency fails to reach FULL.

Why this answer

The MTU values do not match. OSPF neighbors can discover each other and even move through earlier states, but an MTU mismatch commonly leaves them stuck in EXSTART or EXCHANGE because the routers do not agree on database description packet sizing. Area mismatch, network mismatch, and passive-interface issues usually prevent a much earlier stage of adjacency formation.

Exam trap

A common exam trap is selecting area mismatch or passive-interface as the cause of OSPF adjacency stuck in ExStart. While area mismatch prevents neighbor formation entirely, and passive-interface stops hello packets, these issues cause earlier failures, not ExStart stalls. The ExStart state specifically involves negotiating database description packets, which requires matching MTU values.

Candidates often overlook MTU mismatches because neighbors appear in the topology, misleading them to suspect other configuration errors. Understanding that MTU mismatch allows neighbor discovery but blocks database synchronization is key to avoiding this trap.

Why the other options are wrong

Both routers are configured in area 0, so area mismatch is not the cause. Area mismatches prevent neighbor discovery, which would stop adjacency formation before ExStart.

If one interface is passive, OSPF hello packets are not sent, preventing neighbor formation altogether. This would stop adjacency formation earlier than ExStart.

The subnet mask is consistent on both sides, allowing neighbor discovery. Incorrect subnet masks would prevent neighbors from recognizing each other, blocking adjacency before ExStart.

Practice this question →

206

Multi-Selectmedium

Which two statements about NTP are correct? (Choose two.)

Select 2 answers

A.Accurate time helps correlate log messages across multiple devices.

B.NTP replaces the need for DNS in enterprise networks.

C.NTP synchronizes clocks between network devices and time sources.

D.NTP is used to negotiate EtherChannel parameters.

AnswersA, C

When network devices have synchronized time, their logs can be aligned to a common timeline, allowing an administrator to trace a single event across multiple routers, switches, and firewalls. Without synchronized time, an attacker or a fault can be obscured by skewed timestamps. This correlation is fundamental to efficient incident response and root-cause analysis.

Why this answer

NTP synchronizes time across devices, which is important for logging, certificates, and event correlation.

Exam trap

A common exam trap is mistaking NTP for a service that replaces DNS or manages link aggregation like EtherChannel. Some candidates incorrectly believe NTP handles domain name resolution or negotiates EtherChannel parameters because these are also fundamental network services. However, NTP’s sole purpose is to synchronize time across devices.

Selecting options that confuse NTP with DNS or EtherChannel leads to incorrect answers. Understanding that NTP only manages time synchronization helps avoid this trap and ensures accurate selection of correct options related to time correlation and clock synchronization.

Why the other options are wrong

This option is incorrect because NTP does not replace DNS. DNS resolves domain names to IP addresses, while NTP only synchronizes time across devices.

This option is incorrect because NTP does not negotiate EtherChannel parameters. EtherChannel negotiation is handled by protocols like PAgP or LACP, unrelated to time synchronization.

Practice this question →

207

Multi-Selectmedium

Which two statements about standard and extended IPv4 ACLs are correct?

Select 2 answers

A.A standard ACL matches only the source IPv4 address.

B.An extended ACL can match protocol information and Layer 4 ports.

C.A standard ACL is normally placed as close to the source as possible.

D.An extended ACL cannot filter ICMP traffic.

E.Both ACL types require named ACL syntax to match traffic.

AnswersA, B

A standard ACL evaluates packets using only the source IPv4 address in the IP header, ignoring destination, protocol, and port information. This coarse filtering means it cannot differentiate between services like HTTP and SSH on the same destination host. As a result, standard ACLs are typically placed near the destination to avoid inadvertently blocking traffic to other networks.

Why this answer

Standard ACLs match only the source IPv4 address, while extended ACLs can match protocol and source and destination details including ports. Because standard ACLs are less granular, they are usually placed closer to the destination. Extended ACLs are usually placed closer to the source.

Exam trap

A frequent exam trap is assuming that standard ACLs can filter traffic based on protocol types or Layer 4 ports, which they cannot. This misconception leads to incorrect placement decisions, such as placing standard ACLs near the source, which risks blocking legitimate traffic from other sources. Another trap is believing extended ACLs cannot filter ICMP traffic, but extended ACLs do support ICMP filtering.

Misunderstanding these facts can cause confusion in both exam scenarios and real-world network design, resulting in incorrect ACL configurations and ineffective traffic control.

Why the other options are wrong

This option is incorrect because standard ACLs are usually placed closer to the destination, not the source, to avoid blocking legitimate traffic from other sources.

This option is incorrect since extended ACLs can filter ICMP traffic by specifying the ICMP protocol in the ACL configuration.

This option is incorrect because both numbered and named ACLs are valid for standard and extended ACLs; named ACL syntax is not required.

Practice this question →

208

Multi-Selectmedium

Which two statements accurately describe why source restriction and logging are often used together for administrative access?

Select 2 answers

A.Source restriction narrows the allowed origin space for administrative sessions.

B.Logging improves visibility and accountability for what happened during administrative access.

C.Logging removes the need for authentication.

D.Source restriction works only when Syslog is disabled.

E.Both controls exist only for guest wireless networks.

AnswersA, B

Source restriction applies network-layer filtering, such as ACLs or management access lists, to administrative protocols (SSH, HTTPS, SNMP) so only traffic from explicitly permitted source IP addresses or subnets reaches the device's management plane. This shrinks the attack surface by blocking unauthorized origins before they can attempt authentication or exploit a service.

Why this answer

Source restriction and logging are often used together because they help answer two different security questions. In practical terms, source restriction limits where administrative sessions may originate, while logging helps show what happened once access was attempted or granted. This combination improves both exposure reduction and post-event visibility.

This is a strong layered-security reasoning item because it focuses on complementary controls rather than one-control thinking.

Exam trap

A frequent exam trap is to believe that logging can replace source restriction or that source restriction only works if logging is disabled. Candidates may incorrectly think that visibility through logs is enough to secure administrative access, ignoring the importance of limiting where management sessions can originate. Another mistake is to assume these controls are only relevant for guest wireless networks, which is false because they apply broadly to all management-plane security.

Understanding that source restriction and logging serve distinct but complementary roles is critical to avoid this trap.

Why the other options are wrong

Logging provides visibility but does not replace authentication; authentication is still required for access.

Source restriction operates independently of Syslog; it does not require Syslog to be disabled or enabled.

Source restriction and logging apply to all administrative access, not just guest wireless networks, which is too narrow of a context.

Practice this question →

209

Drag & Drophard

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet. OPTIONS: A: Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay. [CORRECT] B: Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet. C: Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet. D: Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The relay agent must be configured first by setting the ip helper-address on the client-facing interface, then verifying connectivity to the DHCP server. The DORA process should be observed using a relay-specific debug command such as debug ip dhcp relay; the originally listed debug ip dhcp server packet would show no output on a pure relay agent, making it incorrect for verification. Therefore, only option A is correct.

Exam trap

A common trap is placing the ip helper-address on the wrong interface or using the wrong debug command. Always place the helper address on the client-facing interface, and verify relay operation with debug ip dhcp relay, not debug ip dhcp server packet.

Practice this question →

210

MCQmedium

Which field is modified by each router hop in an IPv4 packet to prevent endless forwarding loops?

A.Source port

B.TTL

C.Sequence number

D.CRC in the Ethernet trailer

AnswerB

In IPv4, the Time-to-Live (TTL) field is set by the source and decremented by exactly one by every router that forwards the packet; when the counter reaches zero, the router drops the packet and sends an ICMP Time Exceeded message to the sender. This decrementing process is the standard hop-limit mechanism that prevents packets from circulating endlessly, and it is the only field in the IP header that each router modifies purely to manage network loop prevention.

Why this answer

The Time to Live field is decremented at each hop.

Exam trap

A frequent exam trap is selecting transport-layer fields like source port or sequence number as the field modified by each router hop. These fields are part of TCP or UDP headers and remain unchanged by routers during forwarding. Another common mistake is confusing the Ethernet frame CRC with the TTL; while the CRC is recalculated on each link to verify frame integrity, it does not control packet lifetime or prevent routing loops.

Misunderstanding these distinctions can lead to incorrect answers about how routers manage packet forwarding and loop prevention.

Why the other options are wrong

Source port is a transport-layer field used by TCP/UDP to identify application endpoints and is not modified by routers during forwarding, so it cannot prevent forwarding loops.

Sequence number is part of the transport layer used for ordering segments in TCP and is not altered by routers, so it does not affect packet forwarding or loop prevention.

CRC in the Ethernet trailer is recalculated on each link to verify frame integrity but does not influence IP packet forwarding decisions or prevent routing loops.

Practice this question →

211

MCQhard

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

A.The ACL should deny 192.168.20.0/24 instead of permit it

B.The interfaces are marked with inside and outside in the wrong places

C.PAT cannot be used with a /30 WAN link

D.NAT overload requires a route-map instead of an ACL

AnswerB

When PAT is configured, Cisco IOS identifies traffic to translate based on the inside and outside interface roles. If those labels are swapped, traffic arriving from the campus LAN appears on the 'outside' interface, so it is not considered an 'inside local' source and the translation rule does not trigger. As a result, packets are forwarded without translation and hosts on VLAN 20 cannot reach the internet through PAT. The fix is to mark the LAN-facing interface as 'inside' and the WAN-facing interface as 'outside' so the NAT process operates in the correct direction.

Why this answer

NAT overload works only when the inside and outside interfaces are identified correctly. Here the roles are reversed, so translations are not built in the right direction.

Exam trap

A frequent exam trap is assuming that the ACL or the subnet mask is the cause of NAT failure when the real issue is reversed inside and outside interface roles. Candidates often overlook the importance of interface designation commands (ip nat inside and ip nat outside), which are crucial for NAT operation. Without correct interface roles, the router cannot translate addresses properly, causing hosts to lose external connectivity even if ACLs and routing are correct.

This trap is tempting because ACLs and subnetting are more familiar concepts, but interface roles are equally critical for NAT to function.

Why the other options are wrong

Option A is incorrect because the ACL used for NAT must permit the inside local subnet (192.168.20.0/24) to allow translation. Denying this subnet would block NAT translation, but the question states the ACL permits it, so this is not the cause.

Option C is incorrect because a /30 WAN link is commonly used in point-to-point connections and does not prevent PAT from functioning. PAT works independently of the WAN subnet size.

Option D is incorrect because NAT overload can be configured using a standard ACL; a route-map is optional and not required. The absence of a route-map does not cause the connectivity issue described.

Practice this question →

212

Drag & Dropmedium

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the nslookup and dig diagnostic workflow for troubleshooting missing or wrong DNS records.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The DNS resolution process starts with the client query, server response, and client use. Troubleshooting follows with nslookup for basic queries and dig for detailed diagnostics.

Exam trap

Do not confuse the order of DNS resolution with the troubleshooting workflow. The client uses the IP address immediately after receiving the response; troubleshooting tools are used only when there is a problem.

Practice this question →

213

MCQhard

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

A.The SSH ACL is misconfigured and denies port 22 from the management subnet.

B.The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.

C.Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

D.RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

AnswerB

Dynamic ARP Inspection (DAI) validates ARP packets against the DHCP snooping binding table, which contains IP-to-MAC mappings learned from DHCP. Because the management workstation uses a static IP address, no DHCP binding is ever recorded, so the switch has no entry for that IP. As a result, DAI classifies the workstation's ARP replies as invalid and drops them, preventing L2 reachability. This matches the symptom precisely: only the statically configured host fails, while DHCP-assigned management hosts continue to work normally.

Why this answer

The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database.

DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Exam trap

Cisco often tests the interaction between security features like DAI and static IP hosts, where candidates overlook that DAI requires explicit static bindings for non-DHCP clients, leading to connectivity failures that appear as timeouts rather than explicit denials.

Why the other options are wrong

Misunderstanding ACL processing—assumes a simple subnet permit ACL would block port 22 by default, but the ACL entry permits all traffic from the subnet, not just specific ports.

Assumes port security is the first cause of connectivity failure when MAC limits are configured, but the symptom does not indicate a port security violation; the port would need to go into err-disabled, which is not mentioned.

AAA failures manifest as authentication errors or prompts that time out after attempting RADIUS, but they typically affect all attempts, not a single source, unless combined with ACLs that permit other hosts but block this one.

Practice this question →

214

Multi-Selectmedium

Which TWO statements correctly describe the differences between RADIUS and TACACS+ when configuring AAA on IOS-XE?

Select 2 answers

A.RADIUS encrypts the entire packet body, while TACACS+ encrypts only the password.

B.TACACS+ uses TCP port 49, while RADIUS uses UDP ports 1812 and 1813.

C.RADIUS supports command-level authorization, whereas TACACS+ does not.

D.TACACS+ separates authentication, authorization, and accounting into distinct processes, while RADIUS combines authentication and authorization.

E.Both RADIUS and TACACS+ can be used for 802.1X port-based authentication on IOS-XE.

AnswersB, D

TACACS+ uses TCP for reliable transport on port 49, while RADIUS uses UDP (port 1812 for authentication/authorization, 1813 for accounting).

Why this answer

Options B and D are correct. TACACS+ uses TCP port 49, while RADIUS uses UDP ports 1812 (authentication) and 1813 (accounting). TACACS+ separates authentication, authorization, and accounting into three distinct processes, whereas RADIUS combines authentication and authorization.

Option A is incorrect because TACACS+ encrypts the entire packet body, while RADIUS encrypts only the password. Option C is incorrect because TACACS+ supports command-level authorization, while RADIUS does not. Option E is incorrect because 802.1X port-based authentication uses RADIUS, not TACACS+.

Exam trap

Cisco often tests the encryption behavior (Option A) as a trap, because candidates confuse which protocol encrypts the entire packet versus just the password, and they also test the authorization granularity (Option C) to see if you know that TACACS+ supports command-level authorization while RADIUS does not.

Why the other options are wrong

TACACS+ encrypts the entire packet, while RADIUS encrypts only the password – the opposite of what this option states.

TACACS+ supports command-level authorization, whereas RADIUS does not – this option reverses the capabilities.

802.1X port-based authentication uses RADIUS, not TACACS+, as specified by the IEEE 802.1X standard.

Practice this question →

215

PBQhard

You are connected to R1. The network has two routers (R1 and R2) connected via a serial link (S0/0/0). R1's GigabitEthernet0/0 connects to the 192.168.1.0/24 LAN. An extended ACL must be configured on R1 to permit only HTTPS traffic (TCP port 443) from host 192.168.1.10 to server 203.0.113.5 (reachable via R2), and deny all other traffic from the LAN to the server. Currently, the ACL is applied inbound on G0/0 but valid HTTPS traffic is being blocked. Troubleshoot and fix the configuration.

Hints

•The current ACL uses 'any' source, but the requirement is to restrict to a specific host.
•The order of ACL entries matters; the first match is applied.
•The implicit deny at the end blocks all traffic that does not match a permit statement.

A.The ACL is missing an explicit permit statement for HTTPS traffic from host 192.168.1.10 to server 203.0.113.5, and the current permit ip any any allows all traffic, including HTTP, which violates the requirement to deny HTTP.

B.The ACL is applied inbound on G0/0, but it should be applied outbound on G0/0 to filter traffic leaving the LAN.

C.The ACL should be applied to the serial interface S0/0/0 instead of G0/0 to filter traffic going to R2.

D.The ACL is missing a deny statement for all other traffic from the LAN to the server, and the permit ip any any allows everything, including unwanted traffic.

AnswerA

solution

! R1
configure terminal
no ip access-list extended BLOCK_SERVER
ip access-list extended BLOCK_SERVER
permit tcp host 192.168.1.10 host 203.0.113.5 eq 443
deny tcp host 192.168.1.10 host 203.0.113.5 eq 80
deny ip any host 203.0.113.5
permit ip any any
end

Why this answer

Valid HTTPS is blocked because the current ACL does not have an effective ACE permitting TCP/443 from 192.168.1.10 to 203.0.113.5; the implicit deny at the end drops that traffic. A reachable `permit ip any any` would allow HTTPS, so if such an ACE appears in the configuration it is not the effective match for this flow. The correct fix adds an explicit permit for TCP 443 from the host to the server, denies HTTP and all other IP traffic from the LAN to the server, and then permits all other IP traffic.

Exam trap

Be careful not to assume that an ACL with a permit ip any any will automatically block specific traffic; it actually permits everything. The implicit deny only applies if there is no matching permit statement. Also, pay attention to the specific requirements: the ACL must deny HTTP but permit HTTPS from the host.

Why the other options are wrong

The direction of ACL application is correct; inbound on the interface where traffic enters the router is standard for filtering traffic from the LAN.

ACLs should be applied as close to the source as possible to deny traffic early. Applying on the serial interface would still work but is less efficient and not the best practice.

The permit ip any any allows all traffic, so HTTPS should be allowed. The problem says HTTPS is blocked, so the issue must be something else, like a missing explicit permit or a misordering.

Practice this question →

216

PBQhard

You are connected to R1. The network uses DNS to resolve hostnames for remote device management. Currently, R1 cannot resolve the hostname 'ServerA' via DNS. Using the nslookup and dig commands, you have gathered the following outputs: nslookup ServerA Server: 203.0.113.1 Address: 203.0.113.1#53 Name: ServerA.example.com Address: 203.0.113.10 dig ServerA ... ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: ... ... The show running-config command shows that 'ip domain-lookup' is enabled, the name-server is 203.0.113.1, and no static host entries are configured. Diagnose and fix the DNS resolution failure. Ensure that R1 can successfully resolve 'ServerA' to its intended IP address 198.51.100.10.

Hints

•Check the output of 'nslookup' and 'dig' carefully; nslookup may show a different IP than expected.
•The DNS server returns a response but with an incorrect record — consider using a static host entry or a different DNS server.
•Verify that the DNS server's A record for ServerA actually points to 198.51.100.10, not 203.0.113.10.

A.Add a static host entry: 'ip host ServerA 198.51.100.10'

B.Change the DNS server to 8.8.8.8 using 'ip name-server 8.8.8.8'

C.Enable 'ip domain lookup' with 'ip domain-lookup' command

D.Configure the correct domain name using 'ip domain-name example.com'

AnswerA

solution

! R1
! Remove the incorrect static host entry if present (optional, but to force DNS resolution)
no ip host ServerA
! Alternatively, correct the DNS server or add a correct static entry:
ip host ServerA 198.51.100.10
! Or configure a different DNS server that has the correct A record:
ip name-server 198.51.100.1

Why this answer

The nslookup output misleadingly shows a response with IP 203.0.113.10, but the dig output reveals NXDOMAIN, indicating the DNS server has no valid A record for ServerA. The returned address is a default domain record that does not point to the correct device. Since the external DNS server cannot be modified, the quickest and valid fix is to add a static host entry on R1 using 'ip host ServerA 198.51.100.10', which overrides DNS and ensures correct resolution.

Option B is incorrect because changing to 8.8.8.8 would still depend on a remote server having the correct record, which is not guaranteed. Option C is wrong because 'ip domain-lookup' is already enabled, so disabling/enabling it has no effect. Option D is wrong because modifying the domain name only affects how FQDN is built but does not fix the missing A record or wrong IP issue.

Exam trap

Do not assume that a DNS server that responds is correctly configured. Always verify the actual record returned. The nslookup output may show a response, but the IP could be wrong.

Use 'dig' to see the exact answer section. Also, remember that static host entries override DNS and are useful for troubleshooting.

Why the other options are wrong

The DNS server is reachable and responds, but with incorrect data. Simply changing the server may not fix the issue if the new server also lacks the correct record.

The command 'ip domain-lookup' enables DNS resolution, but it is enabled by default. The problem is the incorrect DNS record, not the feature being disabled.

The domain name is already being used in the query (ServerA.example.com). Configuring a different domain name would change the query but not fix the incorrect record for ServerA.

Practice this question →

217

MCQhard

Clients on a network can browse the internet by IP address but fail when using hostnames. What is the most likely problem?

A.The default gateway on the PC is incorrect.

B.The client is using the wrong DNS server address.

C.NAT overload is failing on the edge router.

D.The switchport must be converted to a routed port.

AnswerB

A misconfigured DNS server address causes the client to send name resolution queries to an endpoint that either cannot answer authoritatively or is completely unreachable. Since the client can already reach 8.8.8.8 by IP, the issue is specifically that the DNS resolver is not returning the A/AAAA record needed to translate the hostname. Verify the configured DNS server with ipconfig /all or nslookup, and correct it to a valid internal or public resolver such as 8.8.8.8.

Why this answer

The client can browse by IP address but not by hostname, which indicates that IP connectivity and routing are functional, but name resolution is failing. Since DNS translates hostnames to IP addresses, the most likely fault is that the client is configured with an incorrect DNS server address, preventing it from resolving domain names.

Exam trap

Cisco often tests the distinction between IP connectivity issues and name resolution issues, and the trap here is that candidates may incorrectly blame the default gateway or NAT when the symptom clearly isolates the problem to DNS.

Why the other options are wrong

This option is wrong because if the default gateway on the PC were incorrect, the client would not be able to reach any external IP addresses, not just hostnames. The issue specifically pertains to DNS resolution, not routing.

NAT overload failing on the edge router would typically affect the ability to connect to the internet entirely, not just when using hostnames. Since clients can browse by IP, this indicates NAT is functioning correctly.

This option is wrong because the issue described pertains to DNS resolution, not layer 2 switching or routing. The problem is related to hostname resolution failures, which are not affected by the switchport type.

Practice this question →

218

MCQmedium

On a router performing NAT, where should ip nat inside be applied?

A.On the interface facing the internal private network

B.On the interface facing the ISP only

C.On every routed interface on the router

D.Only on loopback interfaces

AnswerA

The interface facing the internal private network is the inside side of the NAT boundary. By issuing the `ip nat inside` command on it, the router identifies the interface through which privately addressed hosts originate traffic. This designation enables the NAT process to translate source addresses as packets exit and to reverse translations when returning traffic arrives. Without this marking, the router cannot determine which interface is internal, so translation for internal-originated flows fails.

Why this answer

The inside designation belongs on the interface facing the private internal network. The outside designation belongs on the interface facing the public or external network.

Exam trap

A frequent exam trap is misapplying the ip nat inside command to the interface facing the ISP or external network. This mistake reverses the NAT boundary, causing translation to fail because the router expects private addresses on the inside interface only. Another trap is assuming all interfaces require NAT configuration, leading to unnecessary or incorrect commands on unrelated interfaces.

Additionally, some candidates incorrectly think loopback interfaces should be marked inside or outside, but NAT operates on interfaces connected to actual networks. Recognizing that ip nat inside must be on the internal private network interface prevents these common errors.

Why the other options are wrong

Incorrect. The interface facing the ISP is typically marked with ip nat outside, not ip nat inside, because it represents the public or external side of the NAT boundary.

Incorrect. Not every routed interface requires NAT configuration. Only interfaces that participate in NAT translation should be marked as inside or outside to define the translation boundaries.

Incorrect. NAT is not limited to loopback interfaces, and loopbacks are generally not used for NAT inside or outside designation since NAT operates on interfaces connected to real networks.

Practice this question →

219

MCQmedium

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry should appear first in the ACL?

A.permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

B.deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

C.deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

D.deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

AnswerC

This extended ACL entry correctly uses the deny keyword with protocol tcp, source 10.10.10.0 0.0.0.255, destination host 172.16.1.10, and destination port eq 80 to match HTTP traffic. Because web browsing uses TCP port 80, this statement blocks exactly the HTTP requests from the 10.10.10.0/24 users to that specific web server while leaving all other protocols and ports unaffected. The wildcard mask 0.0.0.255 limits the match to the 10.10.10.0/24 subnet, and the explicit host keyword ties the rule to one destination, satisfying the narrow security requirement.

Why this answer

The requirement is specific: block HTTP traffic from one source subnet to one server, but allow everything else. In plain terms, you do not want to shut off all communication to the server or all communication from the users. You only want to stop normal web traffic that uses TCP port 80. That means the ACL should start with a deny statement that matches TCP from 10.10.10.0/24 to host 172.16.1.10 on destination port 80.

Using `deny ip` would block every IP-based protocol to that host, which is broader than the requirement. Using UDP port 80 does not match normal HTTP. And a permit statement would do the opposite of what is needed.

Exam trap

A frequent exam trap is selecting a deny ip statement to block HTTP traffic, which seems simpler but actually blocks all IP traffic from the source subnet to the destination host. This overbroad denial disrupts legitimate communications such as DNS, SSH, or other TCP/UDP services, violating the requirement to allow all other traffic. Another trap is denying UDP port 80, which is incorrect because HTTP uses TCP, not UDP.

Candidates may also mistakenly place a permit statement first, which would allow the HTTP traffic instead of blocking it. Recognizing the correct protocol and port and placing the deny statement first is critical to avoid these pitfalls.

Why the other options are wrong

This option permits TCP traffic from 10.10.10.0/24 to the web server on port 80, which is the exact traffic that must be blocked. Therefore, it contradicts the requirement and is incorrect.

This option denies all IP traffic from the source subnet to the destination host, which is too broad. It blocks all protocols and ports, not just HTTP, violating the requirement to allow other traffic.

This option denies UDP traffic on port 80, but HTTP uses TCP port 80. Denying UDP port 80 does not block HTTP traffic and therefore does not meet the requirement.

Practice this question →

220

PBQhard

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.

Network Topology

Hints

•Check the AAA authentication method for dot1x — it currently uses 'local' but no local users exist.
•The default login authentication also uses 'local' — you need to add RADIUS as primary method.
•Ensure the RADIUS server's IP and key are correct — but the issue is the authentication method list, not connectivity.

A.Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.

B.Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.

C.Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.

D.Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.

AnswerA

solution

! R1
configure terminal
aaa authentication login default group radius local
aaa authentication dot1x default group radius
end
write memory

Why this answer

The 802.1X port is stuck in UNAUTHORIZED because AAA authentication for dot1x is set to 'local' but there is no local user database configured. Additionally, the RADIUS server is configured but not used for dot1x or login. The fix is to change 'aaa authentication dot1x default' to use group radius, and 'aaa authentication login default' to group radius local for fallback.

Also ensure the RADIUS server is reachable and the key matches the server.

Exam trap

Candidates often forget that 802.1X requires a RADIUS server for authentication, not local, and that the login authentication method list must also be configured correctly. They may also overlook the need for the RADIUS key to match exactly.

Why the other options are wrong

The specific factual error is that 802.1X should use RADIUS for authentication, not local, and the login default should have RADIUS as the primary method.

The specific factual error is that the login default should be 'group radius local' to meet the requirement of RADIUS first then local fallback.

The specific factual error is that the key must match exactly; changing it to 'cisco' would break communication with the RADIUS server.

Practice this question →

221

MCQmedium

A host can reach other devices on its local subnet, but it cannot reach remote networks. The host has a valid IP address and subnet mask. Which missing item is the strongest suspect?

A.Default gateway information

B.STP priority information

C.A voice VLAN setting

D.An OSPF process ID

AnswerA

A host reaches its local subnet because it can ARP for those destinations, but for any address outside that subnet, it must forward the packet to a router. Without a default gateway, the host has no next-hop IP address, so it drops or returns an error for all off-subnet traffic. The default gateway is the router interface on the host's subnet, and missing it precisely matches the symptom of local reachability but remote unreachability.

Why this answer

The strongest suspect is a missing default gateway. In practical terms, the host can still identify and reach local addresses because it has its own IP and subnet mask. But without a default gateway, it has no next hop for destinations outside the local subnet. That is why local communication works while remote communication fails.

This is one of the most common host-configuration troubleshooting patterns on the exam and in real networks.

Exam trap

A common exam trap is selecting options related to routing protocols like OSPF or Layer 2 technologies such as STP or VLANs when the issue is actually a missing default gateway. Candidates might incorrectly assume that the host needs an OSPF process ID or STP priority to reach remote networks. However, hosts do not run routing protocols and do not participate in STP decisions.

The real problem is the absence of default gateway information, which prevents the host from forwarding packets beyond its local subnet. Misunderstanding this leads to incorrect answers that focus on advanced protocols rather than basic IP configuration.

Why the other options are wrong

Incorrect because STP priority is a Layer 2 switch parameter that does not affect host IP routing or the ability to reach remote networks. Hosts do not participate in STP decisions.

Incorrect because voice VLAN settings relate to Layer 2 segmentation for voice traffic and do not impact the host’s IP routing or default gateway configuration needed for remote communication.

Incorrect because hosts do not run routing protocols like OSPF and do not require an OSPF process ID. Routing protocols are configured on routers, not end hosts.

Practice this question →

222

MCQhard

After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?

A.The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.

B.IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.

C.DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.

D.The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.

AnswerC

When DAI is enabled, it checks every ARP packet on untrusted ports against the DHCP snooping binding table. Since the static hosts have no DHCP lease, no binding exists, and DAI drops their ARP packets, preventing them from learning the gateway MAC address and causing loss of connectivity.

Why this answer

Dynamic ARP Inspection (DAI) relies on the DHCP snooping binding table to validate ARP packets. When a host uses a static IP address, it does not have an entry in that table, so DAI treats its ARP packets as invalid and drops them. This prevents the static host from resolving the default gateway's MAC address, breaking connectivity even though the IP and MAC are correct.

Exam trap

Cisco often tests the dependency of DAI on DHCP snooping, and the trap here is that candidates assume DAI validates based on the actual IP/MAC correctness rather than requiring a binding table entry.

Why the other options are wrong

Candidates may think that a large number of untrusted hosts could overwhelm the binding table, but static hosts do not interact with DHCP and would not fill the table or be rejected.

Candidates often confuse DAI and IP Source Guard since both use DHCP snooping; however, DAI specifically validates ARP packets, which matches the symptom of connectivity loss due to ARP resolution failure.

Some candidates might associate ARP security features with port shutdown, but standard DAI operation does not disable ports, and the symptom does not indicate interface down events.

Practice this question →

223

PBQmedium

You are connected to R1 via the console. R1 is a router that connects to the internet via GigabitEthernet0/0 (198.51.100.1/30) and to the internal network via GigabitEthernet0/1 (10.1.1.1/24). You need to implement a security policy that permits HTTP traffic (port 80) from the internal network to a web server at 10.1.1.100, and denies all other traffic from internal hosts to the internet. The ACL should be named 'INTERNET-FILTER' and applied inbound on GigabitEthernet0/1.

Network Topology

Hints

•The ACL should be applied to the interface facing the internal network.
•The permit statement must be before the deny statement.
•Use the 'eq' keyword to specify port 80.

A.ip access-list extended INTERNET-FILTER permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80 deny ip 10.1.1.0 0.0.0.255 any ! interface GigabitEthernet0/1 ip access-group INTERNET-FILTER in

B.ip access-list standard INTERNET-FILTER permit 10.1.1.0 0.0.0.255 ! interface GigabitEthernet0/1 ip access-group INTERNET-FILTER in

C.ip access-list extended INTERNET-FILTER permit tcp host 10.1.1.100 10.1.1.0 0.0.0.255 eq 80 deny ip any any ! interface GigabitEthernet0/1 ip access-group INTERNET-FILTER in

D.ip access-list extended INTERNET-FILTER permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80 deny ip any any ! interface GigabitEthernet0/0 ip access-group INTERNET-FILTER in

AnswerA

solution

! R1
ip access-list extended INTERNET-FILTER
permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
deny ip 10.1.1.0 0.0.0.255 any
interface GigabitEthernet0/1
ip access-group INTERNET-FILTER in

Why this answer

The named extended ACL filters traffic based on source, destination, and protocol. The permit allows HTTP from internal to the web server. The deny blocks all other internal-to-internet traffic.

Applying it inbound on the internal interface filters traffic as it enters the router.

Exam trap

Watch out for the direction of the ACL application: inbound on the internal interface filters traffic entering the router from the internal network. Also, remember that extended ACLs are needed when filtering by destination or port.

Why the other options are wrong

Standard ACLs cannot match destination IP addresses or port numbers; they only match source IP addresses.

The ACL entry incorrectly specifies the web server as the source and the internal network as the destination, which is the opposite of the required direction.

Applying the ACL inbound on the external interface filters traffic entering from the internet, not traffic from the internal network. The correct placement is inbound on the internal interface.

224

Drag & Dropmedium

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

ACL configuration requires defining permit/deny statements first, then applying to the interface inbound, and finally verification.

Exam trap

A common trap is to think that you can apply an ACL to an interface before defining it, or that verification should be done before application. Always remember: define, apply, then verify.

Practice this question →

225

Multi-Selectmedium

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Select 2 answers

A.Trusted

B.Untrusted

C.Secure

D.Authorized

E.Relay

AnswersA, B

A trusted port is configured using 'ip dhcp snooping trust' and is allowed to forward all DHCP messages, including server responses. This is typically applied to ports connecting to DHCP servers or upstream relay agents.

Why this answer

DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.

Exam trap

Cisco often tests the exact terminology of DHCP snooping trust states, and the trap here is that candidates confuse 'trusted' and 'untrusted' with other security terms like 'secure' or 'authorized' from different features (e.g., port security or 802.1X).

Why the other options are wrong

This is a distractor term that does not exist in the DHCP snooping configuration. The correct states are trusted and untrusted.

This term is borrowed from other security contexts and is not applicable to DHCP snooping trust states.

This confuses the DHCP relay agent feature with DHCP snooping trust states. They are different mechanisms.

Practice this question →