CCNA Network Services Security Questions — Page 2 of 5

MCQmedium

Users receive addresses from the correct subnet and can reach destinations by IP address, but they cannot browse by hostname.

A.Default-router option

B.DNS server option

C.Lease time option

D.TFTP server option

AnswerB

The DHCP DNS-server option (option 6) provides clients with the IP address of a resolver to use for hostname-to-IP translation. When users receive a valid IP/prefix but no correct DNS server, name resolution fails even though all local network settings appear normal. Without a reachable DNS server, clients cannot resolve domain names, causing web and application connectivity failures while direct IP-based access still works.

Why this answer

If clients get an IP address and default gateway but cannot resolve names, the usual problem is the DNS server information handed out by DHCP. Without that, hostname lookups fail even though IP connectivity may still exist.

Exam trap

Don't confuse general network connectivity options with DNS-specific configurations. Focus on what each DHCP option actually configures.

Why the other options are wrong

The default-router option (option 3) provides the gateway for off-subnet traffic. While a missing gateway would prevent access to external networks, the scenario states users receive correct subnet addresses and can likely reach local resources. The inability to browse by hostname points to a DNS issue, not a routing problem.

The lease time option (option 51) determines how long a client can use an assigned IP address before renewing. It does not affect DNS resolution or hostname browsing. A missing or incorrect lease time would cause IP address expiration issues, not name resolution failures.

The TFTP server option (option 66) is used for booting devices like IP phones or diskless workstations to download configuration files or operating systems. It is not involved in hostname resolution. A missing TFTP server would not affect DNS lookups.

Practice this question →

MCQmedium

An engineer successfully authenticates to a controller and receives a token. What is the usual reason for including that token in later API requests?

A.To identify and authorize the client without resending full login credentials each time

B.To convert HTTP requests into SNMP traps

C.To elect the active controller in the cluster

D.To compress JSON payloads before transport

AnswerA

Token-based API authentication allows the client to authenticate once to obtain a token (often a JWT) that serves as a proof of identity for subsequent requests, so the client does not need to resend username/password or other primary credentials on every call. The controller validates the token's signature and claims, and can authorize access based on scopes or roles embedded in the token, thereby providing both identity and authorization in a stateless, efficient manner.

Why this answer

The token proves the client has already authenticated and is authorized to continue interacting with the API for the lifetime of that token or session. It is commonly sent in an HTTP header such as Authorization. It does not replace the need for IP routing or DNS resolution.

Exam trap

Remember that tokens are specific to API authentication and should not be confused with other network security or configuration mechanisms.

Why the other options are wrong

Tokens are used for authentication and authorization in API requests, not for converting HTTP requests into SNMP traps. SNMP traps are asynchronous notifications sent by network devices, and token-based APIs operate at a different layer and protocol.

Token-based authentication is unrelated to controller cluster election. Cluster election typically uses protocols like VRRP, HSRP, or proprietary mechanisms to determine an active controller, not API tokens.

Token inclusion in API requests serves authentication and authorization, not data compression. JSON payload compression is typically handled by content-encoding headers (e.g., gzip) and is independent of token usage.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.

Exam trap

Watch out for the order of ACL statements: deny must come before permit. Also, remember that ACLs must be created before they can be applied to an interface. Do not forget the implicit deny at the end of every ACL.

Practice this question →

Multi-Selectmedium

Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?

Select 2 answers

A.Standard ACLs filter traffic based on source IP address only.

B.Standard ACLs should be placed as close to the source as possible.

C.Standard ACLs can filter traffic based on destination IP address.

D.Standard ACLs should be placed as close to the destination as possible.

E.Standard ACLs can filter traffic based on TCP or UDP port numbers.

AnswersA, D

Standard ACLs are the simplest type of IP access list: they match a packet solely by its source IPv4 address (using an optional wildcard mask) and permit or deny it, ignoring all other header fields. The ACL does not inspect the destination address, protocol number, or TCP/UDP ports, which is why they are less flexible than extended ACLs. This behavior makes them suitable for filtering based on the origin of traffic and for basic source‑based policy, but they cannot enforce granular application‑level controls.

Why this answer

Standard ACLs filter traffic based solely on the source IP address, using numbers 1–99 or 1300–1999 in classic Cisco IOS. They do not consider destination IP, protocol, or port numbers. Because they lack granularity, placing them close to the destination (option D) prevents them from inadvertently blocking traffic that should be permitted, as they cannot distinguish between traffic destined for different services on the same destination host.

Exam trap

Cisco often tests the misconception that standard ACLs should be placed close to the source (like extended ACLs), when in fact standard ACLs lack the granularity to do so safely and must be placed near the destination.

Why the other options are wrong

Standard ACLs filter only on source IP, so placing them close to the source can block traffic destined to other networks that should be allowed. The correct placement is close to the destination to minimize unintended filtering.

Standard ACLs do not examine destination IP addresses; they only match on source IP addresses. Filtering by destination requires an extended ACL.

Standard ACLs operate at Layer 3 and cannot examine Layer 4 information such as TCP or UDP port numbers. Port-based filtering requires an extended ACL.

Practice this question →

MCQhard

A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?

A.Check if the web server is running HTTPS service on port 443.

B.Verify that the ACL applied to the outside interface explicitly permits TCP port 443.

C.Examine the NAT translation table for any conflicting dynamic entries.

D.Confirm the inside global IP address mapped to the server is correct.

AnswerA

Because the existing ACL permits all IP traffic and the static NAT rule already translates port 80 successfully, the network and translation layers are validated for HTTP. Since HTTPS uses a different application-layer service and TCP port 443, the most likely failure point is the web server not listening for HTTPS connections. Checking whether the server is running HTTPS on port 443 isolates the issue to the application layer, which is the correct next step.

Why this answer

The symptom (port 80 works, port 443 fails) with a static NAT that maps the entire IP address (not just specific ports) indicates the issue is likely at the server itself, not the NAT configuration. Static NAT translates all traffic for the inside local IP to the inside global IP, so if one TCP port works and another does not, the NAT is functioning correctly. The most appropriate next step is to verify that the web server is actually listening on TCP port 443 (HTTPS), as the server may not have the HTTPS service running or configured.

Exam trap

Cisco often tests the misconception that a static NAT or ACL must be explicitly configured for each port, when in fact static NAT translates all ports, and the ACL in this scenario already permits all traffic, so the issue must be at the application layer.

Why the other options are wrong

The already-configured ACL permits all IP traffic, so explicitly allowing port 443 would not resolve a server not listening on that port. This step wastes time on a verified configuration.

Static NAT does not use dynamic overload entries. There are no conflicting entries because NAT overload is not configured, making this check irrelevant.

The fact that port 80 works shows the inside global IP is correct. Re-verifying it would not explain the port-specific failure, as the issue is not with the translation.

Practice this question →

PBQhard

You are connected to R1. The internal network 192.168.1.0/24 must be able to access the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.1. Additionally, a web server at 192.168.1.100 must be reachable from the Internet via static NAT to the same outside interface. The current configuration has errors. Correct the NAT configuration so that inside hosts can browse the web and the server is reachable from outside.

Hints

•Check which interfaces are marked as inside and outside — both were inside.
•The dynamic NAT rule is missing a keyword to enable port address translation.
•Verify the ACL used in the NAT rule matches the correct inside subnet.

A.Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255

B.Change interface G0/1 to 'ip nat outside', add 'overload' to the dynamic NAT rule, and change ACL 100 to permit 192.168.2.0 0.0.0.255

C.Change interface G0/1 to 'ip nat outside', remove the 'overload' keyword from the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255

D.Change interface G0/1 to 'ip nat inside', add 'overload' to the dynamic NAT rule, and correct ACL 100 to permit 192.168.1.0 0.0.0.255

AnswerA

solution

! R1
interface GigabitEthernet0/1
no ip nat inside
ip nat outside
exit
ip nat inside source list 100 interface GigabitEthernet0/1 overload
no access-list 100
access-list 100 permit ip 192.168.1.0 0.0.0.255 any

Why this answer

The configuration had three issues: (1) Interface G0/1 was incorrectly configured as 'ip nat inside' instead of 'ip nat outside' — this prevents translation as both interfaces are inside. (2) The NAT overload keyword was missing on the dynamic PAT rule — without 'overload', only one-to-one translation occurs. (3) ACL 100 was matching 192.168.2.0/24 instead of the actual inside subnet 192.168.1.0/24, so traffic from the correct subnet was not translated. Correcting these allows inside hosts to PAT to the outside IP and the static NAT to function properly.

Exam trap

Watch for three common mistakes in NAT configuration: (1) misplacing the 'inside' and 'outside' interface designations, (2) forgetting the 'overload' keyword for PAT, and (3) using an incorrect ACL that does not match the actual inside network. Always verify the ACL matches the source subnet of traffic needing translation.

Why the other options are wrong

The ACL must match the source subnet of the inside hosts that need translation; using 192.168.2.0/24 does not match 192.168.1.0/24.

The 'overload' keyword is essential for PAT; omitting it means only one inside host can use the outside IP at a time.

NAT requires one interface to be 'inside' and the other 'outside'; having both as 'inside' prevents translation of outbound traffic.

Practice this question →

Multi-Selectmedium

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Select 2 answers

A.Standard ACLs are typically placed closest to the source of the traffic.

B.Extended ACLs are typically placed closest to the source of the traffic.

C.A wildcard mask of 0.0.0.0 in an ACL matches all bits of the IP address.

D.A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.

E.Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.

AnswersB, C

Extended ACLs are placed closest to the source of traffic because they can filter on multiple fields such as source and destination IP, Layer 4 ports, and protocols. Filtering early at the source prevents unwanted traffic from wasting bandwidth and router CPU resources across the entire network path. This placement also ensures that the more specific extended criteria are applied as soon as traffic enters the network, making the filtering efficient and effective.

Why this answer

Extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source.

Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.

Exam trap

Cisco often tests the misconception that standard ACLs should be placed close to the source, when in fact extended ACLs are placed close to the source and standard ACLs close to the destination.

Why the other options are wrong

Standard ACLs filter only on source IP address, so placing them close to the source can block traffic that should be allowed to other destinations, causing unnecessary denial of service.

A wildcard mask of 255.255.255.255 means 'ignore all bits,' so it matches any IP address, equivalent to the 'any' keyword. It does not match all bits.

Extended ACLs are more effective when placed near the source to filter unwanted traffic early, not near the destination. Placing them near the destination allows unwanted traffic to traverse the network unnecessarily.

Practice this question →

Multi-Selectmedium

Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?

Select 2 answers

A.Configure NTP on the network devices

B.Verify timezone and timestamp settings

C.Increase the syslog severity threshold to debugging

D.Disable console logging

E.Clear the logging buffer on all devices

AnswersA, B

NTP synchronises each router's clock to a common time source, so log timestamps across devices align. Without a shared reference, routers drift independently, producing the mismatched timestamps users reported; configuring NTP directly resolves that clock-skew constraint.

Why this answer

Option A is correct because configuring NTP on the routers synchronizes their clocks to a common, authoritative time source, which is the fundamental fix for timestamps that do not align across devices. Option B is correct because even with NTP running, mismatched timezone or timestamp service settings (for example, 'service timestamps log datetime localtime' versus UTC, or an incorrect clock timezone offset) will make log entries appear inconsistent, so these settings must be verified. Option C is wrong because raising the syslog severity threshold to debugging only increases the volume and detail of logged messages; it does nothing to correct clock skew.

Option D is wrong because disabling console logging merely stops messages from being displayed on the console and does not affect timestamp accuracy. Option E is wrong because clearing the logging buffer only discards stored log entries and has no effect on the time synchronization or timestamp formatting of future messages.

Exam trap

Don't confuse log display settings or buffer configurations with time synchronization settings.

Why the other options are wrong

Increasing the syslog severity threshold to debugging generates more log messages but does not address the root cause of time discrepancies. It can overwhelm storage and analysis without fixing the time synchronization issue.

Disabling console logging does not address timestamp synchronization; it only stops log messages from appearing on the console, which does not align timestamps across devices.

Clearing the logging buffer removes existing log entries but does not prevent future timestamps from being incorrect. The time drift persists, so new logs will still have mismatched timestamps.

Practice this question →

MCQmedium

Which traffic type is typically most sensitive to delay and jitter and is commonly prioritized with QoS?

A.Voice traffic

B.Bulk backup traffic

C.Email attachments

D.Operating system updates

AnswerA

Voice (VoIP) is the archetypal real-time traffic because human conversation requires an interactive exchange where end-to-end delay above 150 ms or excessive jitter causes perceptible degradation like echo and talker overlap. Cisco recommends Express Forwarding with priority queuing for voice to keep delay and packet loss below strict thresholds, as retransmission is useless for live audio. This makes voice the most delay-sensitive traffic type among the listed options, because any queuing delay directly compromises call quality.

Why this answer

Voice traffic is highly sensitive to delay, jitter, and packet loss, so it is commonly prioritized in QoS policies.

Exam trap

A common exam trap is assuming that all traffic types require equal QoS prioritization. Candidates might incorrectly select bulk backup traffic or email attachments because they involve large data transfers, but these are not sensitive to delay or jitter. The trap lies in confusing throughput sensitivity with latency sensitivity.

Voice traffic demands low latency and minimal jitter to maintain call quality, which is why it is prioritized. Misunderstanding this distinction can lead to choosing incorrect answers that focus on volume rather than real-time sensitivity.

Why the other options are wrong

Bulk backup traffic is throughput-sensitive but not delay-sensitive. It can tolerate delays and jitter without impacting the backup process, so it is not typically prioritized by QoS in Cisco networks.

Email attachments are not time-sensitive and can tolerate delays and jitter. They do not require prioritization in QoS policies, making this option incorrect for delay-sensitive traffic.

Operating system updates involve large data transfers that are throughput-sensitive but not sensitive to delay or jitter. They are usually scheduled during off-peak times and are not prioritized by QoS.

Practice this question →

MCQeasy

A company wants wireless guest users to authenticate with a username and password stored on a central server, without deploying client certificates. The wireless LAN controller must forward authentication requests to the server. Which protocol should be used between the WLC and the authentication server?

A.Kerberos

B.LDAP

C.RADIUS

D.TACACS+

AnswerC

RADIUS is the standard protocol for centralized authentication of wireless users, including 802.1X/EAP exchanges. The WLC acts as a RADIUS client, forwarding credentials to the authentication server. It supports username and password methods such as PEAP-MSCHAPv2 without requiring client certificates on the supplicant.

Why this answer

Wireless LAN controllers use RADIUS to communicate with authentication servers for 802.1X and other centralized authentication methods. RADIUS supports username and password credentials through EAP methods like PEAP, so guest or employee users can authenticate without client certificates while the WLC forwards requests to the server.

Exam trap

The trap here is conflating device administration protocols like TACACS+ with wireless user authentication, which relies on RADIUS in Cisco WLAN deployments.

Practice this question →

Drag & Drophard

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Exam trap

Do not confuse the order of enabling AAA and creating authentication lists. AAA must be enabled globally before you can create authentication lists. Also, remember that the RADIUS server configuration comes first, as AAA needs to know which server to use.

Practice this question →

MCQhard

An ACL is intended to block Telnet from 10.1.1.0/24 to router VTY access while still allowing SSH from the same subnet. Which statement best explains why an extended ACL is appropriate here?

A.Because the ACL must distinguish traffic by protocol or destination port, not just by source address.

B.Because standard ACLs can match destination TCP ports just as well.

C.Because extended ACLs are required for every router login policy regardless of criteria.

D.Because SSH and Telnet always use the same port number.

AnswerA

This is correct because Telnet and SSH are both TCP-based and may originate from the same source network. A standard ACL can only filter based on source IP, so it cannot differentiate between Telnet (port 23) and SSH (port 22). An extended ACL must match the TCP destination port 23 along with source and destination addresses to block Telnet from 10.1.1.0/24 without impacting other traffic. Without this granularity, the ACL would either block all IP traffic from the source or fail to block Telnet specifically.

Why this answer

An extended ACL is appropriate because the requirement is based not only on source address but also on the specific protocol and application port involved. In practical terms, the policy must distinguish Telnet from SSH even though both originate from the same source subnet. A standard ACL would be too limited because it mainly matches only on source address.

This is the kind of requirement that shows why extended ACLs exist. They allow more granular traffic control by matching protocol and destination details, not just who sent the packet.

Exam trap

Do not confuse the ability to filter by protocol and port with filtering by IP address alone; extended ACLs are required for the former.

Why the other options are wrong

Standard ACLs can only filter based on source IP address, not destination ports or protocols. They lack the granularity to distinguish between Telnet and SSH traffic.

Extended ACLs are not required for every router login policy; they are only needed when filtering must consider protocol or port information. Simple source-based filtering can use standard ACLs.

SSH uses TCP port 22, while Telnet uses TCP port 23. They are distinct ports, so an ACL can differentiate them based on destination port.

Practice this question →

Matchingmedium

Match each security concept to its most accurate purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Verifies identity before access is granted

Determines permitted actions after identity is verified

Records activity or session information

Protects information from unauthorized disclosure

Why these pairings

These pairings correctly define core security concepts (CIA triad plus authentication and authorization).

Exam trap

Be careful not to confuse the terms within the CIA triad or between CIA and AAA. Remember: Confidentiality = privacy, Integrity = no unauthorized changes, Availability = uptime/access. AAA: Authentication = who you are, Authorization = what you can do, Accounting = what you did.

Practice this question →

PBQhard

You are connected to R1. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the outside interface GigabitEthernet 0/1 with IP 203.0.113.2/29. The current configuration has an incorrect inside/outside interface assignment and a missing overload keyword. Fix all issues.

Network Topology

Hints

•Check which interfaces are marked 'inside' and 'outside'.
•The PAT command must include the 'overload' keyword.
•The ACL must match the correct source subnet (192.168.1.0/24).

A.Configure 'ip nat inside' on GigabitEthernet0/0, 'ip nat outside' on GigabitEthernet0/1, correct ACL 10 to permit 192.168.1.0 0.0.0.255, and add 'overload' to the PAT command.

B.Configure 'ip nat outside' on GigabitEthernet0/0, 'ip nat inside' on GigabitEthernet0/1, keep ACL 10 as is, and add 'overload' to the PAT command.

C.Configure 'ip nat inside' on GigabitEthernet0/1, 'ip nat outside' on GigabitEthernet0/0, correct ACL 10 to permit 192.168.1.0 0.0.0.255, and add 'overload' to the PAT command.

D.Configure 'ip nat inside' on GigabitEthernet0/0, 'ip nat outside' on GigabitEthernet0/1, correct ACL 10 to permit 192.168.1.0 0.0.0.255, but do not add 'overload' to the PAT command.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip nat inside source list 10 interface GigabitEthernet0/1 overload
access-list 10 permit 192.168.1.0 0.0.0.255

Why this answer

Three issues exist: (1) The inside and outside interfaces are swapped — GigabitEthernet0/0 (LAN) should be 'ip nat inside' and GigabitEthernet0/1 (WAN) should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword. (3) ACL 10 permits 10.0.0.0/8 but the inside subnet is 192.168.1.0/24; ACL must be corrected. Fix with 'interface GigabitEthernet0/0', 'ip nat inside', 'interface GigabitEthernet0/1', 'ip nat outside', 'ip nat inside source list 10 interface GigabitEthernet0/1 overload', and 'access-list 10 permit 192.168.1.0 0.0.0.255'.

Exam trap

A common trap is confusing which interface should be inside and which should be outside. Remember: inside is the private LAN side, outside is the public WAN side. Also, do not forget the 'overload' keyword for PAT, and ensure the ACL matches the correct source subnet.

Why the other options are wrong

The specific factual error: The inside/outside interface assignment is reversed; ACL 10 permits 10.0.0.0/8 instead of 192.168.1.0/24.

The specific factual error: The inside/outside interface assignment is reversed; the WAN interface should be outside, not inside.

The specific factual error: The 'overload' keyword is missing, which is required for PAT to enable many-to-one translation.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe why least privilege and source restriction work well together for administrative access?

Select 2 answers

A.Least privilege reduces the scope of actions an authenticated user can perform.

B.Source restriction reduces the network locations from which administrative access is permitted.

C.Either one by itself removes the need for logging.

D.Both exist only for wireless guest access policies.

E.They require all administrative traffic to use PPP encapsulation.

AnswersA, B

Least privilege ensures that an authenticated administrator can only execute the specific commands and configuration changes required for their job role. By limiting authorization to a minimal set of actions, it reduces the potential impact of mistakes, compromised credentials, or insider misuse, and enforces separation of duties. This is a core principle of Role-Based Access Control (RBAC).

Why this answer

Least privilege and source restriction work well together because they reduce risk in different ways. In practical terms, least privilege limits what a user can do after access is granted, while source restriction reduces where an administrative session is even allowed to originate. Together they reduce both exposure and potential impact.

This is a layered management-security concept and a strong exam-style reasoning item.

Exam trap

A common exam trap is believing that either least privilege or source restriction alone fully secures administrative access. Candidates may incorrectly think that limiting user permissions removes the need to restrict source IPs, or vice versa. This mistake overlooks that least privilege controls what actions a user can perform after access, but does not prevent unauthorized access attempts from untrusted locations.

Similarly, source restriction limits where access can originate but does not limit what an authenticated user can do. The exam tests understanding that both controls are necessary and complementary for robust administrative security.

Why the other options are wrong

This option is incorrect because neither least privilege nor source restriction eliminates the need for logging; visibility and accountability remain critical for security auditing.

This option is incorrect because least privilege and source restriction are broad security principles applicable to all administrative access, not limited to wireless guest access policies.

This option is incorrect because PPP encapsulation is unrelated to administrative access controls like least privilege and source restriction; it does not affect management access security.

Practice this question →

MCQmedium

Why might voice traffic be placed in a priority queue on a WAN link?

A.To increase the TTL value of voice packets

B.To reduce delay and jitter for time-sensitive traffic

C.To change RTP into TCP for reliability

D.To avoid assigning IP addresses to phones

AnswerB

Voice traffic consists of real-time RTP/UDP packets that are extremely sensitive to network latency and jitter. A priority queue on a WAN ensures that these voice packets are forwarded before packets in lower-priority queues, minimizing queuing delay and smoothing inter-packet timing. This is essential because excessive delay makes conversations unintelligible, and jitter causes choppy audio that the playout buffer cannot fully compensate for.

Why this answer

Voice traffic is delay-sensitive. Prioritization helps reduce queuing delay and jitter so real-time audio remains intelligible.

Exam trap

A common exam trap is selecting answers that confuse QoS prioritization with unrelated network functions such as increasing the TTL value of voice packets or converting RTP traffic into TCP. These options are incorrect because QoS focuses on managing packet scheduling and queuing rather than altering packet headers or transport protocols. Another trap is thinking that IP address assignment relates to QoS, which it does not.

Recognizing that priority queuing specifically targets delay-sensitive traffic like voice helps avoid these misleading options.

Why the other options are wrong

Increasing the TTL value of voice packets is unrelated to QoS or priority queuing. TTL controls packet lifetime and does not affect delay or jitter, so this option is incorrect.

QoS does not convert RTP (used for voice) into TCP. RTP is typically carried over UDP for real-time performance, so this option is incorrect.

Assigning IP addresses to phones is handled by DHCP or static configuration, not by QoS or priority queuing. This option is unrelated to voice traffic prioritization.

Practice this question →

Multi-Selectmedium

Which TWO actions does DHCP snooping perform by default on a Cisco switch?

Select 2 answers

A.It blocks DHCP server messages received on untrusted ports.

B.It generates a Cisco Discovery Protocol packet for each DHCP request.

C.It builds a DHCP binding table.

D.It relays DHCP requests across VLANs.

E.It converts DHCP broadcasts into unicasts.

AnswersA, C

DHCP snooping marks each switch port as either trusted or untrusted. Ports connected to legitimate DHCP servers are configured as trusted, while all other ports are untrusted. When a DHCP server message such as DHCPOFFER, DHCPACK, or DHCPNAK arrives on an untrusted port, the switch drops it, preventing a rogue device from issuing fraudulent IP configuration to clients. This enforcement is the core security function of DHCP snooping.

Why this answer

DHCP snooping is a security feature that, by default, filters DHCP server messages (such as DHCPOFFER, DHCPACK, and DHCPNAK) received on untrusted ports. This prevents rogue DHCP servers from offering malicious IP configurations to clients. The switch also automatically builds and maintains a DHCP snooping binding table, which maps client MAC addresses to leased IP addresses, VLANs, and port information, to validate DHCP traffic.

Exam trap

Cisco often tests the distinction between DHCP snooping's default actions (filtering on untrusted ports and building the binding table) and optional features like DHCP relay or broadcast-to-unicast conversion, which are not part of DHCP snooping itself.

Why the other options are wrong

This statement incorrectly associates two separate features; DHCP snooping operates at Layer 2 for DHCP security, not for CDP.

This function belongs to the relay agent, not to DHCP snooping, which operates within a single VLAN to enforce security policies.

This is a relay agent feature; DHCP snooping does not alter the broadcast nature of DHCP packets, it only filters them.

Practice this question →

PBQhard

You are troubleshooting PAT and static NAT on R1. The inside network 192.168.10.0/24 must be translated to the public IP 203.0.113.1 (interface G0/1) using port address translation. Additionally, the server at 192.168.10.100 must be reachable from the outside via static NAT to 203.0.113.5. The current configuration is not working. Identify and correct the errors in the running config on R1.

Hints

•Check which subnet the ACL is matching — it might not be your inside network.
•Look at the PAT command: is there an 'overload' keyword? Without it, only one translation is allowed.
•Verify the static NAT mapping: the inside server IP should match the actual server.

A.The ACL in the NAT configuration incorrectly permits network 192.168.20.0/24 instead of 192.168.10.0/24, and the PAT command is missing the 'overload' keyword.

B.The static NAT entry uses the wrong inside address; it should be 192.168.10.100 but is configured with 192.168.10.1.

C.The PAT command is missing the 'overload' keyword, and the static NAT entry maps to the wrong public IP; it should use 203.0.113.1 instead of 203.0.113.5.

D.The static NAT entry maps the server to the wrong public IP, 203.0.113.1 instead of 203.0.113.5, and the ACL incorrectly permits network 192.168.20.0/24.

AnswerA

solution

! R1
configure terminal
no access-list 100
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
ip nat inside source list 100 interface GigabitEthernet0/1 overload
end
write memory

Why this answer

The running configuration has two errors. First, access-list 100 incorrectly permits the 192.168.20.0/24 network instead of the inside network 192.168.10.0/24, so PAT will not translate any internal hosts. Second, the PAT command is missing the 'overload' keyword, which means only a single translation is possible, breaking connectivity for multiple devices.

The static NAT entry for the server is correctly mapping 192.168.10.100 to 203.0.113.5 and does not need correction.

Exam trap

Watch out for ACLs that match the wrong subnet in NAT configurations. Also, remember that PAT requires the 'overload' keyword; without it, only one translation is allowed. Static NAT often uses a different public IP than the PAT pool to avoid conflicts.

Why the other options are wrong

The static NAT entry is correct; the inside address 192.168.10.100 is properly mapped to 203.0.113.5.

Static NAT requires a separate public IP to avoid overlapping with PAT translations. The public IP 203.0.113.5 is appropriate.

The static NAT entry is correctly configured with 192.168.10.100 and 203.0.113.5; the error is solely in the ACL and missing overload keyword.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe DNS in everyday network use?

Select 2 answers

A.DNS helps resolve hostnames into IP-related information.

B.DNS makes services easier to use by allowing names instead of raw IP addresses.

C.DNS automatically assigns IP addresses to hosts.

D.DNS replaces the need for subnet masks.

E.DNS elects the STP root bridge.

AnswersA, B

DNS translates human-readable hostnames into IP-related records, including A, AAAA and CNAME entries, so clients can locate services without memorising addresses. This satisfies the stem's requirement that the statement reflect everyday resolution behaviour, where forward lookups from name to address underpin nearly all routine network communication.

Why this answer

Option A is correct because DNS is fundamentally a name-resolution service: a resolver queries name servers for records such as A (IPv4 address), AAAA (IPv6 address), CNAME (alias), and PTR (reverse lookup), returning IP-related information for a hostname. Option B is correct because this resolution lets users and applications reference friendly names like www.example.com instead of remembering raw IP addresses, which is the core usability benefit of DNS in everyday networking. The remaining options do not belong: IP address assignment is handled by DHCP (or static configuration), not DNS; subnet masks are part of IP addressing and routing and are unaffected by DNS; and STP root bridge election is a Layer 2 switching function determined by bridge ID (priority plus MAC address), entirely unrelated to DNS.

Exam trap

A frequent exam trap is mistaking DNS for DHCP or other network functions. Some candidates incorrectly believe DNS assigns IP addresses to hosts, but that role belongs to DHCP. Others confuse DNS with protocols like STP, which manages network topology but is unrelated to name resolution.

This confusion arises because both DNS and DHCP are IP services, but they serve distinct purposes. Misunderstanding these roles can lead to incorrect answers and misconfiguration in real networks. Remember, DNS only resolves hostnames into IP-related information and does not handle IP address assignment or network path selection.

Why the other options are wrong

Option C is incorrect because DNS does not assign IP addresses; that task belongs to DHCP, which dynamically provides IP configuration to hosts on a network.

Option D is incorrect because DNS does not replace subnet masks; subnet masks are used to define network and host portions of an IP address and control routing and addressing scope.

Option E is incorrect because DNS has no role in Spanning Tree Protocol (STP) operations, such as electing the root bridge; these functions are unrelated to DNS.

Practice this question →

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a DHCP issue where DHCP clients on the LAN subnet are sending DHCPDISCOVER messages but the DHCP server does not receive them. The output of the show ip dhcp binding command on R1 is shown. What is the most likely cause of the problem?

A.DHCP service is disabled on R1.

B.The ip helper-address command is configured on the WAN interface instead of the LAN interface facing the DHCP clients.

C.The DHCP pool is configured with a network address that does not match the client subnet.

D.The default-router option is missing from the DHCP pool configuration.

AnswerB

The show ip dhcp binding output shows zero bindings because the router is not relaying DHCP broadcasts. For a DHCP relay agent to work, the ip helper-address must be placed on the interface that receives client broadcasts (the LAN interface). Configuring it on the WAN interface sends relay messages toward the server in the wrong direction, so client DISCOVERs never reach the DHCP server.

Why this answer

The DHCP clients on the LAN subnet are sending DHCPDISCOVER messages, but the DHCP server does not receive them because the ip helper-address command is misconfigured on the WAN interface instead of the LAN interface facing the clients. The ip helper-address command must be applied on the ingress interface (the LAN interface) that receives the broadcast DHCPDISCOVER messages, so that the router can convert the broadcast into a unicast directed to the DHCP server. When placed on the WAN interface, it does not intercept the broadcasts from the LAN clients, and the DHCP server never receives the relayed request.

Exam trap

Cisco often tests the concept that the ip helper-address command must be configured on the interface that receives the DHCP client broadcasts (the LAN interface), not on the interface facing the DHCP server, leading candidates to overlook the direction of traffic flow.

Why the other options are wrong

Candidates may think that an empty binding table means the service is off, but the command itself would fail or show a service status if DHCP were truly disabled.

Candidates often associate 'no addresses assigned' with a pool misconfiguration, but a pool mismatch would not prevent the server from seeing DISCOVER messages and possibly creating failed or erroneous bindings.

Candidates may confuse a missing option with a complete failure of DHCP operation, but IP address leasing is independent of options like default-router.

Practice this question →

MCQmedium

A network administrator is troubleshooting a switch that is receiving DHCPDISCOVER messages from a client on VLAN 20, but the DHCP server on a different subnet never sees those requests. The interface VLAN 20 has the address 10.20.0.1/24, and the DHCP server address is 10.99.0.10. Which command should be applied to enable the switch to forward these requests to the server?

A.ip dhcp pool VLAN20

B.ip forward-protocol udp 67

C.ip dhcp relay information option

D.ip helper-address 10.99.0.10

AnswerD

The ip helper-address command on the client VLAN's SVI converts broadcast DHCPDISCOVER messages into unicast packets destined for the specified server address. It also fills in the gateway address field so the server can select the correct scope for the 10.20.0.0/24 subnet, allowing the reply to be routed back to the client.

Why this answer

DHCP relay is configured with the ip helper-address command on the interface facing the clients, which unicasts their DHCP broadcasts to the specified server and sets the gateway address so the server can match the correct scope. Without it, the broadcast stays on the local subnet and the remote server never receives the request.

Exam trap

The trap here is assuming that enabling option 82 or listing UDP port 67 is enough, when only the ip helper-address statement actually forwards the client request to the server.

Practice this question →

MCQmedium

A junior administrator is configuring a Cisco router that must forward DHCP requests from the 10.20.30.0/24 LAN to a DHCP server at 192.168.100.50. The LAN interface is Gi0/0 with IP 10.20.30.1. Which single command is required on Gi0/0 so the router relays these broadcasts?

A.ip forward-protocol udp 192.168.100.50

B.ip dhcp relay 192.168.100.50

C.ip dhcp pool LAN

D.ip helper-address 192.168.100.50

AnswerD

The ip helper-address command on the LAN interface tells the router to receive UDP broadcasts on that interface and forward them as unicasts to the specified server address. For DHCP, UDP port 67 broadcasts are forwarded automatically, allowing the router to act as a relay agent for clients on 10.20.30.0/24.

Why this answer

The router must act as a DHCP relay agent because clients broadcast on the local segment while the server sits on a different subnet. Configuring the LAN interface with ip helper-address pointing to the server converts those broadcasts into unicasts toward 192.168.100.50, enabling address assignment without placing a DHCP server on every LAN.

Exam trap

The trap here is confusing DHCP relay with DHCP server configuration, since both use DHCP-related keywords but only the helper-address command relays requests to an external server.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe why logs and accounting records both matter in secure operations?

Select 2 answers

A.They improve visibility into events and activity after access occurs.

B.They help with accountability and incident review.

C.They replace the need for authentication entirely.

D.They are useful only on wireless guest networks.

E.They automatically create access policies for administrators.

AnswersA, B

Logs and accounting records capture who accessed what, when, and from where, giving post-event visibility that real-time controls alone cannot provide. This satisfies the scenario's focus on activity after access occurs, enabling detection of misuse and forensic reconstruction.

Why this answer

Option A is correct because logs and accounting records capture events and activity after access has occurred, giving security teams the visibility needed to detect anomalies, trace what happened, and reconstruct timelines during investigations. Option B is correct because these records establish accountability by tying actions to identities and support incident review, allowing responders to determine who did what, when, and how during a security event. Options C, D, and E are incorrect: logging and accounting do not replace authentication (they depend on it to attribute activity to a user or process), they are valuable across all systems and networks rather than only wireless guest networks, and they do not automatically generate access policies for administrators—policy creation remains a separate administrative function.

Exam trap

Don't confuse logs and accounting records with access control measures; they are about visibility and traceability, not prevention.

Why the other options are wrong

Logs and accounting records do not replace authentication; they complement it by recording who accessed what and when. Authentication is still required to verify identity before access is granted, and logs only capture activity after authentication occurs.

Logging and accounting are essential across all network segments, including wired, wireless, VPN, and data center environments. Limiting them to wireless guest networks would leave other critical areas unmonitored, creating security gaps.

Logs and accounting records are passive records of events; they do not automatically create or modify access policies. Policy creation requires administrative action based on analysis of logs, not the logs themselves.

Practice this question →

MCQmedium

Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?

A.PortFast

B.DHCP snooping

C.HSRP

D.LLDP

AnswerB

DHCP snooping is a Layer 2 security feature on switches that filters DHCP traffic by designating trusted ports (typically uplinks to known DHCP servers) and untrusted ports (end-user access ports). It builds a DHCP snooping binding table of legitimate leases and drops DHCPOFFER or DHCPACK messages arriving on untrusted ports, which directly blocks a rogue DHCP server from successfully handing out IP addresses. This is the standard mitigation for rogue DHCP server attacks.

Why this answer

DHCP snooping classifies interfaces as trusted or untrusted and can block unauthorized DHCP server replies arriving on untrusted ports.

Exam trap

Avoid confusing PortFast (which skips STP convergence) with DHCP-specific features like DHCP Snooping.

Why the other options are wrong

PortFast is a Spanning Tree Protocol feature that immediately transitions an access port to the forwarding state, bypassing the listening and learning states. It does not inspect or validate DHCP messages, so it cannot prevent a rogue DHCP server from handing out addresses.

HSRP (Hot Standby Router Protocol) provides first-hop redundancy by allowing multiple routers to share a virtual IP address, ensuring gateway availability. It does not inspect DHCP traffic or provide any mechanism to block unauthorized DHCP servers.

LLDP (Link Layer Discovery Protocol) is a vendor-neutral protocol used for discovering neighboring devices and their capabilities by exchanging information such as device type, management addresses, and VLAN IDs. It has no role in DHCP security or filtering DHCP messages.

Practice this question →

100

MCQhard

Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?

A.The ACL is applied in the wrong direction on the interface.

B.The ACL is missing a permit statement for the 192.168.20.0/24 destination.

C.The order of the ACL entries causes the deny statement to match first.

D.The implicit deny at the end is blocking the traffic to 192.168.20.0/24.

AnswerC

Extended IP access list 110 processes entries sequentially. Entry 10 denies traffic from 192.168.10.0/24 to 192.168.20.0/24, and entry 20 permits the same source to any destination. Because the deny is listed first, it is matched before the permit, causing the traffic to be dropped.

Why this answer

The ACL is processed top-down, and the first matching entry determines the action. In this scenario, the deny statement for 192.168.10.0/24 to 192.168.20.0/24 appears before any permit statement for that traffic, so packets from the 192.168.10.0/24 network to the 192.168.20.0/24 network are denied immediately, even if a later permit statement would have allowed them. This explains why hosts can reach other networks (including the Internet) but not the 192.168.20.0/24 servers.

Exam trap

Cisco often tests the concept of ACL order of operations, where candidates mistakenly think that a later permit statement will override an earlier deny, or that the implicit deny is the culprit when an explicit deny is actually matching first.

Why the other options are wrong

Candidates may assume any ACL misbehavior is due to wrong interface direction, ignoring that the specific symptom (only 192.168.20.0 is unreachable) points to the deny rule itself.

Candidates often focus on what an ACL ‘lacks’ rather than the sequence, missing that the existing permit any covers the destination but is shadowed by the earlier deny.

Candidates might recall that all ACLs have an implicit deny, but they fail to realize that a packet matching an earlier deny is already discarded, and the implicit deny only applies to unmatched traffic.

Practice this question →

101

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on a Cisco IOS-XE switch.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start by entering global configuration mode and enabling AAA with 'aaa new-model'. Next, create an authentication method list using 'aaa authentication dot1x default group radius' to define the method for 802.1X. Then, configure the RADIUS server parameters using 'radius-server host' and 'radius-server key' so the switch knows where to send authentication requests; note that the method list can reference the 'radius' group even before the server is specified.

Finally, enable 802.1X system-wide with the global command 'dot1x system-auth-control' to activate 802.1X globally. This order ensures each prerequisite is met before the next step.

Exam trap

A common mistake is omitting the global 'dot1x system-auth-control' command, which is required to enable 802.1X system-wide before configuring interface-level authentication.

Practice this question →

102

Multi-Selectmedium

Which TWO statements accurately describe Network Address Translation (NAT) types?

Select 2 answers

A.Static NAT creates a fixed one-to-one mapping between a local and global address and is typically used to allow external connectivity to internal servers.

B.Dynamic NAT assigns a public IP from a pool for the duration of a translation, but it does not modify Layer 4 port numbers.

C.PAT only translates TCP packets because it uses port numbers, leaving UDP translation unsupported.

D.Static NAT entries are automatically removed after periods of inactivity to free up public addresses.

E.With PAT, if the public IP address pool is exhausted, new translations fail because PAT requires unique public IPs for each private host.

AnswersA, B

Static NAT builds a permanent one-to-one binding between an inside local address and an inside global address, with no port translation. Because the mapping is fixed and predictable, external hosts can reliably initiate connections to internal servers, which is why it suits inbound service publishing.

Why this answer

Option A is correct because static NAT (also called one-to-one NAT) permanently maps a single private (local) address to a single public (global) address, which is exactly the configuration used to publish internal servers such as web or mail hosts to the Internet. Option B is correct because dynamic NAT draws a public address from a configured pool and creates a temporary one-to-one binding for the duration of the session, and since it operates strictly at Layer 3 it does not rewrite TCP/UDP port numbers (that is the job of PAT/overloading). Option C is wrong because PAT translates both TCP and UDP (and ICMP query IDs), since it multiplexes on any Layer 4 identifier, not TCP alone.

Option D is wrong because static NAT mappings are manually configured and persist until an administrator removes them; they are not aged out by inactivity timers. Option E is wrong because PAT specifically allows many private hosts to share a single public IP by translating source ports, so exhaustion of a public pool is not the failure mode described.

Exam trap

Cisco often tests the misconception that PAT only works with TCP, but in reality PAT supports both TCP and UDP, and the trap here is that candidates confuse PAT's use of port numbers with a protocol limitation.

Why the other options are wrong

PAT works with any transport protocol that has port fields—TCP, UDP, and even ICMP through the identifier field.

Only dynamic translations (from dynamic NAT or PAT) have idle timeouts; static mappings are permanent.

This statement describes dynamic NAT pool exhaustion, not PAT, which uses port multiplexing.

Practice this question →

103

MCQmedium

Why is disabling unused services on network devices considered a sound security practice?

A.Because it reduces unnecessary attack surface and exposure on the device.

B.Because it automatically improves routing convergence.

C.Because it guarantees the device cannot be misconfigured.

D.Because it converts the device into a controller.

AnswerA

Every enabled network service (e.g., HTTP server, SNMP, Telnet, CDP) creates listening ports and daemons that can be probed or exploited. Disabling unused services eliminates those potential entry points, shrinking the attack surface and reducing the device's exposure to malicious traffic or reconnaissance. This aligns with the security principle of least privilege, where only essential functions remain active.

Why this answer

It is considered sound because every enabled service is a potential attack surface or management exposure point. In practical terms, if a service is not needed, leaving it enabled creates unnecessary risk without business value. Reducing what is listening or available on a device helps limit opportunities for misuse or exploitation.

Option B is incorrect because disabling unused services does not affect routing protocol convergence; that is a routing protocol function. Option C is wrong because no single security practice can guarantee the device cannot be misconfigured; misconfiguration remains possible through other means. Option D is nonsensical because disabling services does not turn the device into a controller.

Exam trap

Don't confuse the primary goal of security practices with secondary benefits like performance or compliance.

Why the other options are wrong

Disabling unused services does not affect routing convergence, which depends on routing protocols and network topology. Service hardening and routing optimization are separate concerns.

Disabling services reduces risk but does not guarantee prevention of misconfiguration; human error can still occur in other settings. Security hardening is a layered approach, not a silver bullet.

Disabling services does not change a device's role; a router remains a router, and a switch remains a switch. Converting a device to a controller requires specific software and configuration changes.

Practice this question →

104

Multi-Selectmedium

Which two statements accurately describe why SSH is preferred over Telnet for device administration?

Select 2 answers

A.SSH is generally considered the more secure choice for remote CLI administration.

B.Telnet is generally considered less secure for remote device administration.

C.SSH eliminates the need for authentication and authorization policy.

D.Telnet is required before SSH can operate.

E.SSH is used only on wireless controllers and nowhere else.

AnswersA, B

SSH is generally considered the more secure choice for remote CLI administration because it encrypts all traffic, providing data confidentiality and integrity. It also uses cryptographic host keys to authenticate the server, and supports secure password and public-key authentication for the user. These protections make SSH the preferred protocol for managing network devices remotely over untrusted networks.

Why this answer

SSH is preferred because it encrypts all traffic, including authentication credentials, making it secure for remote CLI administration, whereas Telnet transmits data in plaintext and is considered less secure. Option C is incorrect because SSH does not eliminate authentication; it requires authentication and often enforces stronger policies. Option D is false because SSH and Telnet are independent protocols; Telnet is not required for SSH to operate.

Option E is wrong because SSH is used on routers, switches, firewalls, and many other devices, not only wireless controllers.

Exam trap

Don't confuse protocol security features with ease of configuration or performance. Focus on security benefits.

Why the other options are wrong

SSH does not eliminate the need for authentication and authorization policies; it only provides a secure transport layer. Network devices still require AAA (Authentication, Authorization, and Accounting) or local username/password configurations to control access.

Telnet is not a prerequisite for SSH; they are independent protocols. SSH can be configured and used on a device without Telnet ever being enabled. In fact, many devices have SSH enabled by default while Telnet is disabled for security reasons.

SSH is not limited to wireless controllers; it is widely used on routers, switches, firewalls, servers, and many other network devices. It is a universal protocol for secure remote administration across all types of infrastructure.

Practice this question →

105

PBQhard

You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.

Network Topology

Hints

•Check the NAT direction on each interface: which one faces the internal LAN and which faces the internet?
•Look at the ACL in the PAT command — does it match the correct subnet?
•The PAT command is missing a keyword that enables port multiplexing.

A.Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

B.Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.

C.Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

D.Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/1
no ip nat inside
ip nat outside
exit
no ip nat inside source list 1 interface GigabitEthernet0/1
ip nat inside source list 1 interface GigabitEthernet0/1 overload
no access-list 1
access-list 1 permit 192.168.1.0 0.0.0.255
end

Why this answer

Three issues exist: (1) GigabitEthernet0/1 is the outside interface but is configured as 'ip nat inside' — it should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword, so it does one-to-one translation instead of port address translation. (3) ACL 1 permits 192.168.2.0/24, but the inside LAN is 192.168.1.0/24 — the ACL must match the correct subnet. Correcting these allows PAT for the LAN and static NAT for the web server.

Exam trap

Watch out for three common traps: (1) Misidentifying inside vs. outside interfaces—the interface facing the public network is always outside. (2) Forgetting the 'overload' keyword for PAT—without it, you get dynamic NAT, not PAT. (3) Using the wrong ACL—the ACL must match the inside network exactly.

Why the other options are wrong

The ACL must match the inside network; permitting a different subnet will not translate traffic from the correct LAN.

The NAT inside/outside designation is based on the direction of traffic; the interface facing the public network must be outside.

Without 'overload', the router will not use port numbers to multiplex multiple inside hosts to a single public IP.

Practice this question →

106

MCQmedium

Exhibit: A user can ping 8.8.8.8 successfully but cannot browse to www.example.com by name. Which service is the most likely failing component?

A.NTP

B.DNS

C.Syslog

D.CDP

AnswerB

Ping to 8.8.8.8 succeeds because it uses an IP address directly, bypassing any name resolution. Browsing a website normally requires translating a domain name (like www.example.com) into an IP address via DNS queries sent to a configured resolver, typically over UDP/53. If DNS is misconfigured, unreachable, or the resolver is down, the browser cannot resolve the hostname and will report a name resolution failure or server not found, while ICMP ping to a known IP remains unaffected.

Why this answer

If connectivity to an IP address works but name-based access fails, the path is up and the problem is usually name resolution. DNS is the service that translates hostnames into IP addresses.

Exam trap

A common exam trap is assuming that because a user can ping an IP address like 8.8.8.8, all network services are functioning correctly. This leads to mistakenly blaming routing or connectivity issues rather than DNS. Candidates may also confuse NTP or Syslog as affecting web access, but these services do not resolve domain names.

Misunderstanding the role of CDP as a discovery protocol rather than a name resolution service can also cause confusion. The key trap is not recognizing that ping tests IP connectivity but DNS is required for translating domain names to IP addresses.

Why the other options are wrong

NTP (Network Time Protocol) synchronizes clocks across network devices but does not impact the ability to resolve domain names or browse websites. Time synchronization issues rarely cause name resolution failures, so NTP is not the failing component here.

Syslog collects and stores system logs for monitoring and troubleshooting but does not affect DNS resolution or web browsing. A syslog failure would not prevent browsing by hostname, so it is not the cause.

CDP (Cisco Discovery Protocol) is used for discovering directly connected Cisco devices and does not play any role in DNS or web name resolution. CDP failure would not cause inability to browse websites by name.

Practice this question →

107

PBQmedium

You are connected to R1 via console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network administrator needs to monitor R1's system messages. Configure R1 to send syslog messages with severity level 5 (notifications) and above to the syslog server at 10.0.0.2. Also, ensure that logging is enabled and that messages include the timestamp and source interface.

Hints

•Use 'logging host' to specify the syslog server.
•Set the severity with 'logging trap' using the severity name or number.
•Configure the source interface with 'logging source-interface'.

A.logging on logging trap notifications logging source-interface GigabitEthernet0/0 logging host 10.0.0.2 service timestamps log datetime

B.logging on logging trap informational logging source-interface GigabitEthernet0/1 logging host 10.0.0.2 service timestamps log datetime

C.logging on logging trap 5 logging source-interface GigabitEthernet0/0 logging 10.0.0.2 service timestamps

D.logging on logging trap notifications logging source-interface GigabitEthernet0/1 logging host 10.0.0.2 service timestamps debug datetime

AnswerA

solution

! R1
logging host 10.0.0.2
logging trap notifications
logging source-interface GigabitEthernet0/0
logging on
service timestamps log datetime msec

Why this answer

The logging commands enable syslog output. 'logging trap notifications' sets severity to 5 (notifications). 'logging source-interface' ensures syslog messages originate from a consistent IP. 'service timestamps' adds time information to log entries for easier troubleshooting.

Exam trap

Pay close attention to the exact syntax of commands: 'logging host' vs 'logging', 'service timestamps log' vs 'service timestamps debug'. Also, remember that the source interface should be the one closest to the syslog server, not necessarily the LAN interface. Severity levels: emergencies (0) to debugging (7); notifications is level 5.

Why the other options are wrong

The specific factual error: The trap level is set too low (informational instead of notifications), and the source interface is incorrect.

The specific factual error: The logging host command is missing the 'host' keyword, and the timestamps command is incomplete.

The specific factual error: The timestamps command applies to debug messages instead of log messages, and the source interface is wrong.

108

Multi-Selecthard

A switch interface connected to a Cisco IP phone with a PC behind it must carry voice and data correctly. Which two switchport commands are appropriate on that access port?

Select 2 answers

A.switchport mode trunk

B.switchport access vlan 10

C.switchport voice vlan 20

D.channel-group 1 mode active

E.spanning-tree cost 1

AnswersB, C

The 'switchport access vlan 10' command sets the port's untagged VLAN for data frames, which is exactly how the connected PC should be carried. In the standard Cisco IP phone topology, the phone passes PC traffic through untagged while tagging its own voice frames on a separate VLAN. Assigning access VLAN 10 ensures the PC's traffic is placed in the correct data VLAN.

Why this answer

The access VLAN carries the workstation data traffic, and the voice VLAN carries tagged voice traffic for the IP phone. That is the standard campus switchport design for a phone with a PC behind it. The port itself remains an access port, but the two most directly relevant commands here are the access VLAN and voice VLAN assignments.

Exam trap

Don't confuse trunk mode with the need for VLAN tagging; access ports can handle both data and voice VLANs without being trunks.

Why the other options are wrong

Configuring an access port as a trunk would cause the switch to expect 802.1Q tagging on all frames, but the PC behind the phone typically sends untagged frames. This would break connectivity for the PC unless the phone is configured to tag PC traffic, which is not standard.

The channel-group command is used to create an EtherChannel, which bundles multiple physical links into a single logical link. This is not relevant for a single access port connecting to an IP phone and PC, as there is only one physical link.

The spanning-tree cost command manually sets the STP path cost for a port, which is used for loop prevention. It does not affect VLAN assignment or voice/data separation, so it does not address the requirement of carrying voice and data correctly.

Practice this question →

109

PBQhard

You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.

Network Topology

Hints

•The ACL is currently blocking all traffic because of the deny any any entry.
•You need to remove the existing ACL and recreate it with a permit statement for HTTPS.
•Remember the implicit deny at the end of every ACL; you don't need an explicit deny statement.

A.Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.

B.Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.

C.Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.

D.Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.

AnswerA

solution

! R1
configure terminal
no ip access-list extended BLOCK_IN
ip access-list extended BLOCK_IN
permit tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443
end
write memory

Why this answer

The ACL BLOCK_IN currently has a single deny ip any any entry, which blocks all traffic inbound on G0/1. The correct solution is to first remove the existing ACL, then create a new extended ACL that permits TCP 443 from source network 192.0.2.0/24 to destination network 203.0.113.0/24, and apply it inbound on G0/1. The implicit deny at the end of the ACL will then block all other traffic, achieving the desired policy.

Exam trap

The exam trap is that candidates may think adding a permit statement before the deny will work, but if they add a new entry without specifying a sequence number, it is inserted after the existing deny ip any any, so the deny remains first and blocks all traffic.

Why the other options are wrong

The specific factual error is that the order of entries matters; a deny any any at the end would block all traffic, but here it is placed before the permit, so the deny is evaluated first.

The specific factual error is that standard ACLs lack the capability to filter by protocol or port; extended ACLs are required for such granularity.

The specific factual error is that the permit statement uses 'any' for source and destination, making it too permissive and not matching the specified networks.

Practice this question →

110

MCQmedium

Why is NTP especially valuable when a network uses centralized Syslog servers?

A.Because synchronized clocks make log timestamps easier to correlate across devices

B.Because NTP converts Syslog into a routing protocol

C.Because NTP automatically creates DHCP pools

D.Because NTP eliminates the need for a Syslog server

AnswerA

When all network devices reference the same authoritative NTP source, their log timestamps are expressed in the same time scale, so an administrator can accurately sequence events across routers, switches, and firewalls during troubleshooting. Centralized log correlation depends on consistent timestamps; without NTP, even devices with identical configurations can drift, making a single incident appear to happen at different times or in the wrong order. NTP therefore makes centralized logging meaningful by providing a common temporal reference.

Why this answer

NTP is especially valuable because centralized logs are much easier to interpret when device clocks are synchronized. In plain language, if multiple routers and switches send messages to one logging server but each device believes a different time, the event sequence becomes confusing. NTP helps align those clocks so the timestamps in the logs are consistent and the team can reconstruct incidents more accurately.

This is a practical operations concept rather than a syntax question. Syslog solves the collection problem, and NTP solves the time-correlation problem. Together they make logs more useful than either one alone. That is why the best answer focuses on timestamp consistency rather than on routing, VLAN, or NAT behavior.

Exam trap

A common exam trap is selecting an answer that incorrectly attributes routing or DHCP functions to NTP, such as thinking NTP converts Syslog into a routing protocol or automatically creates DHCP pools. These options confuse NTP’s fundamental role in time synchronization with unrelated network services. Another trap is assuming NTP eliminates the need for a Syslog server, which is false because NTP only provides accurate timestamps; it does not collect or store logs.

Understanding that NTP’s value lies in timestamp consistency, not in changing or replacing other protocols, is critical to avoid these mistakes.

Why the other options are wrong

Incorrect because NTP does not convert Syslog into a routing protocol; NTP’s function is strictly time synchronization, unrelated to routing protocols.

Incorrect because NTP does not create DHCP pools; DHCP pool creation is unrelated to time synchronization and is managed by DHCP services.

Incorrect because NTP does not eliminate the need for a Syslog server; it complements Syslog by providing accurate timestamps but does not replace log collection.

Practice this question →

111

MCQmedium

A network administrator is configuring DHCP snooping on a Cisco Catalyst switch. The switch has a trunk port Gi1/0/24 connecting to another switch, and several access ports connecting to end-user PCs. The administrator issues the commands 'ip dhcp snooping', 'ip dhcp snooping vlan 10', and then configures interface Gi1/0/24 with 'ip dhcp snooping trust'. A PC connected to Gi1/0/5 (an untrusted port) sends a DHCPDISCOVER. What will the switch do with this DHCPDISCOVER message?

A.Drop the DHCPDISCOVER because only trusted ports can send DHCP messages.

B.Forward the DHCPDISCOVER to trusted ports only, and drop any DHCPOFFER received on untrusted ports.

C.Forward the DHCPDISCOVER to all ports in VLAN 10, including untrusted access ports.

D.Convert the untrusted port to a trusted port automatically after receiving the first DHCPDISCOVER.

AnswerB

With DHCP snooping enabled on VLAN 10, the switch treats Gi1/0/5 as untrusted by default. It allows client-originated DHCPDISCOVER messages to be forwarded toward trusted ports (such as the uplink to the DHCP server) but blocks DHCP server replies like DHCPOFFER on untrusted ports. This prevents rogue DHCP servers on access ports while permitting legitimate client requests.

Why this answer

When DHCP snooping is enabled on a VLAN, switch ports are untrusted by default. Client DHCP messages such as DHCPDISCOVER are allowed from untrusted ports and forwarded toward trusted ports. Server messages such as DHCPOFFER, DHCPACK, and DHCPNAK are dropped if received on untrusted ports.

Trusting the uplink port allows legitimate server replies to enter the switch while blocking rogue DHCP servers on access ports.

Exam trap

The trap here is assuming that untrusted ports cannot send any DHCP messages, when in fact they can send client-originated requests but cannot receive server replies.

Practice this question →

112

MCQhard

A switch is configured with DHCP snooping and Dynamic ARP Inspection. Hosts suddenly lose connectivity after changing IP settings manually. Which explanation is strongest?

A.DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.

B.STP is blocking the host because its MAC address changed.

C.OSPF authentication failed on the access port.

D.The switch requires PPP authentication before allowing ARP traffic.

AnswerA

Dynamic ARP Inspection (DAI) intercepts ARP packets arriving on untrusted switch ports and validates them against the DHCP snooping binding table. When the administrator manually changed the IP address on the host, that new address is absent from the binding table, so DAI considers the ARP packet invalid and drops it. The switch also verifies that the sender MAC matches the bound MAC, further reinforcing the rejection.

Why this answer

DAI uses DHCP snooping binding to validate ARP messages; a manual IP change creates a mismatch, causing DAI to block ARP. Option B is incorrect because STP prevents loops and does not block based on MAC address changes. Option C is incorrect because OSPF authentication is a routing protocol feature irrelevant on an access port.

Option D is incorrect because PPP authentication applies to serial links, not Ethernet ARP.

Exam trap

Be cautious not to confuse DHCP snooping's role with DHCP server functionality or ARP cache operations.

Why the other options are wrong

STP (Spanning Tree Protocol) prevents loops in redundant topologies and does not block hosts based on IP or MAC address changes. It operates at Layer 2 and is unrelated to IP address configuration.

OSPF is a Layer 3 routing protocol used between routers, not on access ports connecting hosts. OSPF authentication is configured on router interfaces and does not apply to host ARP traffic on a switch.

PPP (Point-to-Point Protocol) authentication is used on serial links or PPPoE connections, not on Ethernet switch ports. It is unrelated to ARP inspection or DHCP snooping in a switched network.

Practice this question →

113

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure PAT (overload) on a Cisco router using a single public IP address on the outside interface.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order is A, B, C, D, E. First, enter global configuration mode. Second, create an access list to match the traffic to be translated.

Third, configure the inside interface with 'ip nat inside'. Fourth, configure the outside interface with 'ip nat outside'. Fifth, apply PAT with 'ip nat inside source list <ACL> interface <outside-if> overload'.

This final command enables PAT using the outside interface's public IP.

Exam trap

Learners often forget to assign the 'ip nat inside' and 'ip nat outside' interface commands, or they configure them in the wrong order relative to the source NAT statement.

Practice this question →

114

MCQhard

A branch router uses PAT for Internet access. Users can browse out, but the administrator wants a specific internal web server to be reachable from outside on a consistent public address. Which design fits that requirement best?

A.Use static NAT for the server and PAT for general user outbound traffic.

B.Use only PAT for everything, including predictable outside server reachability.

C.Disable NAT entirely because private IPv4 addresses are Internet-routable.

D.Use DHCP relay to publish the server externally.

AnswerA

Static NAT maps the server's private address to a fixed public address, giving inbound reachability on a consistent address, while PAT overloads the router's public address for outbound user sessions. This satisfies the stem's requirement for both consistent inbound access and general Internet browsing.

Why this answer

The best design is to use static NAT for the internal web server while continuing to use PAT for general user outbound access. In plain language, PAT is ideal for many inside users sharing one public address for ordinary outbound traffic, but a server that must be reachable predictably from the outside needs a fixed public identity. Static NAT provides that one-to-one mapping.

This is a practical mixed-design scenario. The network can use PAT for user convenience and address conservation while still reserving a stable translation for a server that external clients need to find reliably. The correct answer recognizes that different NAT methods can serve different purposes in the same environment.

Exam trap

A common exam trap is selecting PAT alone to provide external access to an internal server. While PAT efficiently supports many users sharing one public IP for outbound traffic, it does not assign a fixed public IP to any internal host. This means the server’s public identity changes dynamically, preventing reliable inbound connections.

Candidates often confuse PAT’s port translation with static IP mapping, overlooking that servers need static NAT for consistent external reachability. Misunderstanding this distinction leads to incorrect answers and design flaws in real networks.

Why the other options are wrong

Incorrect because PAT alone cannot provide a stable public IP for inbound connections to a server, making it unsuitable for predictable external access to internal services.

Incorrect because private IPv4 addresses are not routable on the Internet, so disabling NAT would prevent internal hosts from accessing external networks and external clients from reaching internal servers.

Incorrect because DHCP relay is used to forward DHCP requests across networks and does not influence NAT or the public accessibility of internal servers.

Practice this question →

115

Multi-Selecthard

Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?

Select 2 answers

A.NetFlow can export flow data to a collector

B.NetFlow helps identify traffic patterns and top talkers

C.Syslog and NetFlow are the same feature with different names

D.NetFlow replaces routing protocols for path selection

E.NetFlow only works on Layer 2 switches and never on routers

AnswersA, B

NetFlow operates on the device by maintaining an in-memory cache of active flows; when a flow expires or the cache fills, the exporter packages the records into UDP datagrams, usually on port 2055 or 9996, and sends them to an external collector. The collector (e.g., SolarWinds, PRTG, Elastic) stores and correlates these records for historical reporting, capacity planning, and traffic accounting. Thus export is the essential delivery mechanism that makes the captured flow metadata usable for centralized analysis.

Why this answer

NetFlow exports flow records to a collector and is useful for traffic analysis and accounting visibility, enabling identification of top talkers and application usage (options A and B are correct). Syslog reports events and messages, but does not replace flow records for conversation-level traffic statistics, so option C is incorrect. NetFlow does not replace routing protocols for path selection; it is a traffic monitoring tool, not a routing mechanism, so option D is incorrect.

NetFlow works on routers and Layer 3 switches, not only Layer 2 switches, so option E is incorrect.

Exam trap

Be cautious not to confuse general network monitoring tools like Syslog and SNMP with specialized traffic analysis tools like NetFlow.

Why the other options are wrong

NetFlow does not replace routing protocols; it is a monitoring tool that provides traffic statistics, not a path-selection mechanism.

NetFlow operates on routers and Layer 3 switches, not just Layer 2 switches, and is commonly used on routers for traffic analysis.

Practice this question →

116

PBQmedium

You are connected to R1 via the console. R1 is an NTP client that should synchronize its clock with NTP server 192.168.1.100. The timezone is UTC-5 (Eastern Standard Time). Configure NTP on R1 so that it becomes an NTP client. Additionally, configure the router to log NTP synchronization status messages to the console and buffer logging using the numeric severity level 6 (informational).

Network Topology

Hints

•Use ntp server command to point to the NTP server.
•Logging level 6 corresponds to informational.
•Buffered and console logging commands are separate.

A.ntp server 192.168.1.100 logging console informational logging buffered informational

B.ntp peer 192.168.1.100 logging console 6 logging buffered 6

C.ntp server 192.168.1.100 logging console 6 logging buffered 6

D.ntp server 192.168.1.100 logging console informational logging buffered 6

AnswerC

solution

! R1
ntp server 192.168.1.100
logging buffered 6
logging console 6

Why this answer

The correct configuration uses 'ntp server 192.168.1.100' to set the NTP server, and 'logging console 6' and 'logging buffered 6' to set both console and buffer logging to severity level 6 (informational). The numeric level 6 is equivalent to 'informational', but the question specifies using the numeric severity level 6.

Exam trap

200-301 often tests the difference between numeric and keyword logging levels; candidates may assume they are interchangeable, but the question may require a specific format.

Why the other options are wrong

Uses the keyword 'informational' instead of the required numeric severity level 6.

The ntp peer command establishes a peer relationship, not a client-server relationship. The logging syntax is also incorrect.

Mixes numeric and keyword severity levels; both must be numeric 6 to meet the requirement.

117

MCQmedium

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

A.In the HTTP Authorization header

B.In the Ethernet trailer

C.In the DNS response section

D.In the TCP checksum field

AnswerA

RFC 6750 specifies that a bearer token is transmitted in the HTTP Authorization request header using the Bearer authentication scheme (e.g., `Authorization: Bearer <token>`). This header is parsed by the resource server to validate the client's identity and permissions before processing the request. Because HTTP is the application-layer protocol used for REST APIs, this is the only correct placement for the token among the options listed.

Why this answer

Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.

Exam trap

Remember that bearer tokens are part of the request, not the response, and should be in the Authorization header, not in query parameters or the request body.

Why the other options are wrong

The Ethernet trailer contains a Frame Check Sequence (FCS) for error detection at Layer 2, not application-layer data like bearer tokens. Tokens are part of the HTTP application layer and are never placed in the Ethernet trailer.

DNS responses contain resource records like A, AAAA, or CNAME, which map domain names to IP addresses. They have no role in carrying authentication tokens for REST API calls, as DNS is a separate protocol for name resolution.

The TCP checksum field is used for error detection of the TCP segment header and payload at the transport layer. It is computed by the sender and verified by the receiver; it does not carry any application data such as bearer tokens.

Practice this question →

118

PBQhard

You are connected to R1, a Cisco IOS-XE router that serves as the DNS resolver for the local network. The router can reach the DNS server at 198.51.100.53, but internal hosts cannot resolve the hostname 'fileserver.courseiva.com' (expected IP 203.0.113.10). Which configuration will resolve the issue?

Network Topology

Hints

•The DNS server returns NXDOMAIN, meaning it has no record for that hostname or IP.
•Use the 'ip host' command to create a static DNS entry on the router.
•For reverse lookup, the PTR record must be configured; a single 'ip host' with the IP first automatically creates a PTR entry.

A.Add a static host entry: ip host fileserver.courseiva.com 203.0.113.10

B.Change the DNS server to 203.0.113.53 using the command 'ip name-server 203.0.113.53'

C.Add a static route to 198.51.100.53 via the next-hop interface

D.Configure the router to use the DNS server at 8.8.8.8 using 'ip name-server 8.8.8.8'

AnswerA

solution

! R1
ip host fileserver.courseiva.com 203.0.113.10
ip host 203.0.113.10 fileserver.courseiva.com

Why this answer

The DNS server is reachable but does not have an A record for fileserver.courseiva.com, so NXDOMAIN is returned. The router can resolve the name locally by adding a static host entry with `ip host`. This bypasses the external DNS and directly maps the hostname to the correct IP.

Changing the DNS server to another unknown IP does not guarantee resolution, and static routes or external public DNS are irrelevant for this internal name.

Exam trap

Candidates often attempt to change the DNS server IP or troubleshoot routing, but the core issue is the absence of a DNS record. The `ip host` command provides a simple, static solution without altering external DNS infrastructure.

Why the other options are wrong

The current DNS server is reachable but lacks the record; simply changing the DNS server to an arbitrary IP would not guarantee resolution unless that server is known to hold the correct record, and there is no indication that 203.0.113.53 is a valid DNS server.

DNS resolution failure is not due to routing: the router can already reach the DNS server. Adding a static route will not fix missing DNS records.

The Google public DNS server likely does not have an entry for the internal hostname fileserver.courseiva.com, so this will not enable resolution.

Practice this question →

119

MCQhard

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?

A.The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.

B.The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.

C.The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.

D.The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.

AnswerB

After successful 802.1X authentication, the switch can dynamically assign the port to a VLAN specified in the RADIUS Access-Accept message. If that VLAN exists but is not the correct user VLAN—for example, a dead-end VLAN or a VLAN where the default gateway IP is not configured or reachable—the device will appear authorized but will be unable to reach the gateway, exactly matching the symptoms.

Why this answer

The switch port is in the 'authorized' state, indicating that 802.1X authentication succeeded and the RADIUS server sent an Access-Accept. However, the workstation cannot ping the default gateway, pointing to a connectivity issue after authentication. The most likely cause is that the RADIUS server returned a VLAN assignment (via the Tunnel-Private-Group-ID attribute) that placed the port in a VLAN that is not the intended one, such as a management VLAN without a gateway, or a VLAN missing a routed SVI, leaving the workstation isolated despite successful authentication.

Exam trap

Cisco often tests the distinction between authentication success (port state 'authorized') and network connectivity success (correct VLAN assignment), tricking candidates into focusing on authentication failures when the real issue is a post-authentication VLAN misconfiguration.

Why the other options are wrong

The show authentication sessions output indicates 'Authz Success', meaning authentication and authorization succeeded. A shared secret mismatch would cause authentication failure, not a successful authorization.

The show command output clearly shows the port status as 'AUTHORIZED' and 'Authz Success'. There is no indication of err-disable. Port-security violations would show a different status, such as 'err-disabled' or 'security-violation'.

The output shows 'authVlan = 100' and the session is authorized with 'method = dot1x' and 'status = AUTHORIZED'. This indicates the supplicant successfully authenticated and was placed in the auth VLAN, not the guest VLAN. If the supplicant had failed, the port would be in the guest VLAN.

Practice this question →

120

MCQhard

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

A.Authorization

B.Authentication

C.Accounting

D.DNS

AnswerA

Authorization is the AAA component that determines what an authenticated user is permitted to do, including which commands they may execute and whether they can enter privileged EXEC or global configuration modes. In this scenario, authentication already succeeded because the user logged in, but the router's authorization policy restricts this user to lower privilege levels, preventing configuration access. Thus, the correct answer is authorization.

Why this answer

Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce.

This is a good example of why authentication and authorization are not the same thing.

Exam trap

A common exam trap is assuming that authentication alone controls all user permissions after login. Candidates often confuse authentication with authorization, thinking that successful login means full access. However, authentication only verifies identity, while authorization determines what commands or modes the user can access.

This confusion leads to incorrect answers, especially when a user can log in but cannot enter configuration mode. Remember, authorization is the AAA function that restricts user capabilities after authentication succeeds.

Why the other options are wrong

Authentication is incorrect because it only verifies the user's identity to allow login; it does not control what commands or modes the user can access after login.

Accounting is incorrect because it only records user activity and command usage for auditing purposes and does not influence login permissions or command access.

DNS is incorrect because it is related to name resolution and does not control user authentication, authorization, or command permissions on network devices.

Practice this question →

121

Drag & Dropmedium

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

AAA configuration must precede 802.1X. The correct order is: first enable AAA globally with 'aaa new-model', then define the RADIUS server with 'radius server RADIUS-SERVER', then globally enable 802.1X with 'dot1x system-auth-control', and finally on the interface set authentication port-control with 'authentication port-control auto'.

Exam trap

Do not confuse the order of global AAA enablement and RADIUS server definition. AAA must be enabled first. Also, remember that global 802.1X enablement comes before interface-specific commands.

Practice this question →

122

MCQhard

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

A.The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

B.The switch port connecting to the router is not configured as a trusted port for DHCP snooping.

C.The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

D.DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

AnswerB

DHCP snooping trusts only designated ports to forward DHCP server messages. Since the router relays the DHCPOFFER onto the trunk port, an untrusted port will cause the switch to discard the offer, resulting in DHCP failure.

Why this answer

DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Exam trap

Cisco often tests the distinction that DHCP snooping blocks DHCP server messages (OFFER/ACK/NAK) on untrusted ports, not client messages (DISCOVER/REQUEST), leading candidates to incorrectly assume client messages are dropped.

Why the other options are wrong

This distractor exploits the common tendency to blame the helper address configuration first, overlooking the security feature that silently drops the returning DHCPOFFER.

This plays on the misconception that a switch requires an IP address on the client VLAN to facilitate DHCP, when in fact the router acting as the relay agent provides Layer 3 connectivity.

This misinterprets DHCP snooping behavior: it assumes all DHCP traffic is filtered on untrusted ports, overlooking the critical distinction that only server-side messages are blocked, not client requests.

Practice this question →

123

MCQmedium

A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?

A.The port received a BPDU and BPDU Guard shut it down.

B.DHCP snooping blocked the user's ARP requests.

C.Port security moved the port to protect mode.

D.The trunk native VLAN matched incorrectly.

AnswerA

BPDU Guard on a PortFast-enabled edge port immediately err-disables the interface upon receiving any BPDU, typically from an unauthorized switch. This matches the symptom of a desk port stopping right after connection, and the log would explicitly show 'bpduguard error detected' putting the port in err-disable state.

Why this answer

BPDU Guard is commonly enabled on PortFast access ports to protect the topology. If the port receives a BPDU, the switch assumes another switch may have been connected and places the port into err-disabled state. That is exactly the protective behavior you want at the edge.

Exam trap

A frequent exam trap is mistaking BPDU Guard triggers for issues caused by DHCP snooping or port security. Candidates may incorrectly assume that DHCP snooping blocking ARP or port security violations cause the err-disabled state when the log explicitly mentions BPDU Guard. Another pitfall is confusing native VLAN mismatches on trunks as the cause, but these do not generate BPDU Guard errors.

The key is to recognize that BPDU Guard specifically responds to receiving BPDUs on PortFast-enabled ports, which signals an unexpected switch connection and leads to err-disable. Misreading the log or symptoms can lead to selecting incorrect answers that do not align with BPDU Guard’s function.

Why the other options are wrong

Incorrect. DHCP snooping blocks unauthorized DHCP messages but does not cause BPDU Guard to err-disable a port. The log specifically mentions BPDU Guard, so DHCP snooping is unrelated here.

Incorrect. Port security violations cause err-disable states but are triggered by MAC address violations, not by receiving BPDUs. The log message points to BPDU Guard, not port security.

Incorrect. A trunk native VLAN mismatch causes VLAN tagging issues but does not trigger BPDU Guard or err-disable a port due to BPDU reception. This option does not explain the BPDU Guard log message.

Practice this question →

124

MCQmedium

Which protocol is most directly responsible for keeping device clocks synchronized across a network?

A.NTP

B.TFTP

C.DHCP

D.CDP

AnswerA

NTP (Network Time Protocol) is the correct answer because it is the industry-standard protocol designed specifically to synchronize device clocks across a network. It uses a hierarchical stratum system to distribute accurate time from authoritative time sources, typically over UDP port 123, ensuring consistent timestamps for syslogs, authentication, and network troubleshooting. Without NTP, event logs and monitoring data from different devices cannot be reliably correlated.

Why this answer

The correct protocol is NTP. In plain language, NTP helps devices agree on the current time so that logs, authentication events, monitoring data, and troubleshooting records line up accurately. Without consistent time, a network team may see events from multiple devices but be unable to reconstruct the actual sequence correctly.

This matters more than many people realize because accurate time underpins many operational workflows. Syslog messages, security events, and monitoring alerts become much easier to trust when devices are synchronized. DHCP, TFTP, and CDP are useful for other purposes, but they do not exist to align device clocks. NTP is the protocol specifically associated with time synchronization.

Exam trap

A frequent exam trap is selecting DHCP, TFTP, or CDP as the protocol responsible for clock synchronization. DHCP is often confused because it deals with network configuration, but it does not synchronize time. TFTP might seem relevant due to its role in transferring files like configurations, but it has no time-related function.

CDP is a Cisco proprietary protocol for device discovery and neighbor information exchange, not for time services. Candidates must recognize that only NTP is designed specifically to keep device clocks synchronized across a network, which is critical for accurate logging and event correlation.

Why the other options are wrong

TFTP is incorrect because it is a simple file transfer protocol used for tasks like configuration file transfers, not for synchronizing device clocks.

DHCP is incorrect because it provides IP addressing and network configuration to clients but does not handle time synchronization between devices.

CDP is incorrect because it is a Cisco proprietary protocol for device discovery and neighbor information exchange, not for clock synchronization.

Practice this question →

125

Multi-Selectmedium

Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?

Select 2 answers

A.PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.

B.PAT requires a 1:1 mapping of internal to external IP addresses.

C.PAT can only be configured with a pool of public IP addresses.

D.PAT uses both IP addresses and port numbers to track translations.

E.PAT translations are always static and never time out.

AnswersA, D

PAT distinguishes between multiple internal hosts sharing the same public IP by assigning a different source port for each session. The router maintains a translation table that tracks the original internal IP and port along with the assigned public IP and port.

Why this answer

PAT (Port Address Translation) translates multiple internal private IP addresses to a single public IP address by assigning unique source port numbers to each session, allowing many internal hosts to share one public IP. This is correctly described in option A. Option D is also correct because PAT uniquely identifies each translation by both the IP address and the port number, enabling the router to demultiplex return traffic.

Option B is wrong because PAT uses many-to-one mapping, not 1:1; a 1:1 mapping is characteristic of static NAT. Option C is incorrect because PAT can operate with a single public IP address (often the outside interface address) rather than requiring a pool. Option E is false because PAT translations are dynamically created and time out after a period of inactivity; they are not static.

Exam trap

Cisco often tests the misconception that PAT requires a pool of public IPs or a 1:1 mapping, when in fact PAT is designed for many-to-one translation using port numbers, and can operate with a single public IP address.

Why the other options are wrong

PAT does not require a 1:1 mapping; it allows many internal addresses to share a single public IP. A 1:1 mapping is characteristic of static NAT, not PAT.

PAT can be configured with either a single public IP address (using the interface address) or a pool of public IP addresses. It does not require a pool; a single address is sufficient for PAT overload.

PAT translations are dynamic and have a timeout (default 86400 seconds for general translations, but shorter for TCP/UDP). They are removed after the session ends or the timeout expires.

Practice this question →

126

PBQhard

You are connected to R1, a branch router. Configure an extended ACL named BRANCH_IN that permits only HTTP (TCP port 80) traffic from the internal network 192.168.1.0/24 to the web server at 203.0.113.10, and permits ICMP echo-reply from any source to any destination. Apply the ACL inbound on the interface facing the internal network. Then verify that only the specified traffic is allowed.

Network Topology

Hints

•The ACL is defined but not yet applied to an interface.
•Consider which direction traffic from the internal network flows relative to the interface.
•Use 'ip access-group' under the correct interface configuration mode.

A.ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in

B.ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN out

C.ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in

D.ip access-list extended BRANCH_IN permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80 permit icmp any any echo-reply ! interface GigabitEthernet0/0 ip access-group BRANCH_IN in ! interface GigabitEthernet0/1 ip access-group BRANCH_IN in

AnswerA

solution

! R1
interface GigabitEthernet0/0
ip access-group BRANCH_IN in

Why this answer

It creates an extended ACL that permits TCP port 80 from the internal 192.168.1.0/24 to the web server 203.0.113.10 and permits only ICMP echo-reply, then applies it inbound on the internal interface G0/0, matching the requirement. Option B is wrong because the ACL is applied outbound on G0/0, but traffic from internal hosts to the web server exits via the WAN interface (G0/1), not G0/0. Option C is wrong because it permits all ICMP (any any) instead of only echo-reply, allowing unnecessary ICMP traffic.

Option D is wrong because it applies the ACL inbound on both G0/0 and G0/1; applying it on G0/1 would incorrectly filter inbound traffic from the ISP, potentially blocking the web server's responses.

Exam trap

Pay close attention to the direction of traffic flow. The ACL must be applied inbound on the interface that receives traffic from the internal network. Also, be precise with ICMP types: 'echo-reply' is the response to a ping, not the initial echo request.

Why the other options are wrong

The ACL is applied in the wrong direction. Applying it outbound would filter traffic leaving the interface, not entering it.

The ACL permits all ICMP traffic instead of only echo-reply. This violates the requirement to permit only ICMP echo-reply.

Applying the ACL to an additional interface (G0/1) is unnecessary and may cause unintended filtering. The requirement specifies only one interface.

Practice this question →

127

MCQhard

A network technician is troubleshooting a DHCP relay issue. The router at the branch office is supposed to forward DHCP requests from local clients to a central DHCP server. Clients connected to Gi0/1 are not receiving IP addresses. The technician verifies that the DHCP server is reachable from the router, that no ACLs are blocking DHCP traffic, and that the DHCP scope on the server has available leases. Upon checking the running configuration, the technician notices that the ip helper-address command is applied to interface Gi0/0 (the WAN link toward the server) instead of Gi0/1. What should the technician do next?

A.Check the DHCP server logs for any error or warning messages related to the clients' requests.

B.Move the ip helper-address command from interface Gi0/0 to interface Gi0/1.

C.Issue the show ip interface brief command to ensure that interface Gi0/1 is in an up/up state.

D.Remove the ip helper-address from Gi0/0 and then reapply it to the same interface to ensure the command is active.

AnswerB

DHCP relay requires the helper address to be configured on the interface that faces the DHCP clients (the broadcast domain where clients send their DHCPDISCOVER messages). By moving the command to Gi0/1, the router will correctly intercept and forward client requests to the DHCP server.

Why this answer

The ip helper-address command must be applied to the interface that receives the DHCP broadcast from clients, which is Gi0/1 in this scenario. It converts the broadcast into a unicast directed to the DHCP server. Applying it to Gi0/0 (the WAN interface) is ineffective because broadcasts are not forwarded across routers by default, and the helper address must be on the ingress interface of the client subnet.

Exam trap

Cisco often tests the misconception that the ip helper-address should be placed on the interface closest to the server (outbound), when in fact it must be on the interface that receives the client broadcast (inbound).

Why the other options are wrong

This skips the obvious configuration mismatch and targets the wrong component. It assumes the issue is on the server side rather than the router's DHCP relay placement.

This action investigates Layer 1/2 status when the problem is already identified as a Layer 3 (DHCP relay) configuration error. It skips applying the fix and delays resolution.

Candidates might think the command simply didn't take effect and that reapplying it solves the problem, misunderstanding the directional requirement of DHCP relay placement.

Practice this question →

128

MCQhard

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

A.The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

B.The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.

C.DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

D.The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

AnswerB

DHCP snooping drops DHCPOFFER and DHCPACK messages received on untrusted ports, since only trusted ports are allowed to accept server-originated replies. The switch port connected to the legitimate DHCP server in VLAN 200 must be explicitly configured as trusted with 'ip dhcp snooping trust'. Without that, the relay agent forwards the client's DISCOVER, but the server's OFFER/ACK are silently discarded, leaving clients without a lease despite the relay configuration.

Why this answer

DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Exam trap

Cisco often tests the interaction between DHCP snooping and DHCP relay, where candidates mistakenly think the relay bypasses snooping or that the issue is with the helper-address configuration, rather than the untrusted port blocking the server's unicast reply.

Why the other options are wrong

Many engineers mistakenly think the helper should reside on the server VLAN; however, it must reside on the client-facing L3 interface.

A common misconception is that DHCP relay bypasses snooping, but snooping still inspects the server's unicast response and drops it unless the ingress port is trusted.

Candidates often suspect routing issues, but verified reachability eliminates this. The problem lies in the snooping policy, not IP connectivity.

Practice this question →

129

MCQmedium

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

A.Configure spanning-tree mode rapid-pvst.

B.Increase the bridge priority on SW2 for VLAN 40.

C.Disable PortFast on all access ports.

D.Convert the uplink to a routed port.

AnswerA

Configuring `spanning-tree mode rapid-pvst` directly addresses the 30-second connectivity loss by enabling Rapid PVST+ (R-PVST+). PVST+ utilises fixed listening and learning states, contributing to the observed delay during topology changes. R-PVST+ employs a rapid convergence mechanism, such as the Proposal/Agreement (P/A) process, allowing designated and root ports to transition to forwarding much faster, often within sub-seconds. This significantly reduces the reconvergence time for VLAN 40 when SW2's uplink flaps, directly improving user connectivity.

Why this answer

The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Exam trap

A frequent exam trap is selecting options that change the root bridge election or port roles, such as increasing bridge priority, assuming this will speed up convergence. While root bridge placement affects path selection, it does not reduce the inherent delay caused by legacy STP timers. Another trap is disabling PortFast on access ports, which only affects edge port transitions and does not influence uplink link flap recovery times.

Additionally, converting uplinks to routed ports changes the network design and removes STP from those ports, which is not the intended solution for VLAN-specific STP convergence delays. The key mistake is confusing topology optimization with protocol speed improvements.

Why the other options are wrong

Increasing bridge priority changes root bridge election but does not speed up the STP convergence process, so it does not resolve the 30-second connectivity loss.

Disabling PortFast affects only edge ports and does not influence the convergence time of uplink ports or VLANs experiencing link flaps.

Converting the uplink to a routed port removes it from STP but alters network design and does not specifically improve VLAN 40’s STP convergence speed.

Practice this question →

130

PBQhard

You are connected to R1. The inside network 192.168.1.0/24 must be translated to the outside interface IP (198.51.100.1) using PAT (NAT overload). Additionally, a static NAT entry must map host 192.168.1.10 to 203.0.113.10. The current configuration is incomplete and contains errors. Correct the configuration so that both translations work properly.

Network Topology

Hints

•Check the direction of NAT on each interface (inside vs outside).
•The PAT command requires the keyword 'overload' to enable port address translation.
•The access list must match the inside local network, not a different subnet.

A.interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10

B.interface GigabitEthernet0/1 ip nat inside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static 192.168.1.10 203.0.113.10

C.interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 10.0.0.0 0.255.255.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 ip nat inside source static 192.168.1.10 203.0.113.10

D.interface GigabitEthernet0/1 ip nat outside ! access-list 1 permit 192.168.1.0 0.0.0.255 ! ip nat inside source list 1 interface GigabitEthernet0/1 overload ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80

AnswerA

solution

! R1
interface GigabitEthernet0/1
ip nat outside
exit
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.1.0 0.0.0.255

Why this answer

The configuration has three issues: 1) GigabitEthernet0/1 is incorrectly set as 'ip nat inside' instead of 'ip nat outside'. 2) The PAT command is missing the 'overload' keyword. 3) Access-list 1 permits 10.0.0.0/8, not the inside subnet 192.168.1.0/24. The commands fix these: change the interface to 'ip nat outside', add 'overload' to the PAT command, and update the ACL to permit the correct inside network.

Exam trap

Watch out for three common mistakes: 1) Forgetting to set the outside interface as 'ip nat outside'. 2) Using an ACL that does not match the inside network. 3) Omitting the 'overload' keyword for PAT. Also, do not add protocol/port to static NAT unless specifically required.

Why the other options are wrong

The specific factual error is that the interface facing the outside (public) network is incorrectly configured as 'ip nat inside'.

The specific factual errors are: 1) The ACL does not match the correct inside network. 2) The 'overload' keyword is omitted, preventing PAT from working.

The specific factual error is that the static NAT command includes protocol and port, limiting the translation to TCP port 80 only.

Practice this question →

131

MCQmedium

Why is NTP especially valuable when a company uses a centralized Syslog server?

A.It synchronizes device clocks so centralized log timestamps can be correlated accurately.

B.It assigns the Syslog server its IP address.

C.It replaces the need for Syslog entirely.

D.It encrypts all Syslog messages automatically.

AnswerA

Syslog entries carry only local device clocks, so unsynchronised clocks make correlating events across devices impossible. NTP aligns all devices to a common time source, giving the centralised Syslog server consistent timestamps for accurate forensic and troubleshooting timelines.

Why this answer

NTP is especially valuable because it aligns device clocks, which makes centralized log timestamps much easier to interpret. In practical terms, if devices disagree on time, the combined log stream becomes harder to trust and correlate. NTP improves the timeline accuracy of operational and security analysis.

This is why NTP and Syslog are often discussed together. One centralizes events, and the other makes those events easier to line up correctly.

Exam trap

A common exam trap is to confuse NTP’s role with other network functions such as IP addressing or encryption. Some candidates incorrectly think NTP assigns IP addresses to devices or encrypts Syslog messages. This misunderstanding leads to selecting options that describe unrelated functions.

NTP’s sole purpose is to synchronize clocks across devices, enabling accurate timestamping of logs. Misinterpreting this can cause candidates to overlook the critical importance of time alignment in centralized logging environments, which is the core reason NTP is valuable when using a centralized Syslog server.

Why the other options are wrong

Incorrect because NTP does not assign IP addresses; IP addressing is handled by DHCP or manual configuration, not time synchronization protocols.

Incorrect because NTP does not replace Syslog; NTP provides time synchronization, while Syslog collects and centralizes log messages from devices.

Incorrect because NTP does not encrypt Syslog messages; encryption requires separate protocols such as TLS or IPsec, not time synchronization services.

Practice this question →

132

PBQhard

You are connected to R1 via console. R1 is a router that connects two internal subnets (192.168.1.0/24 and 192.168.2.0/24) to the internet via a serial link to ISP. Currently, no ACL is applied. Your task is to configure an extended named ACL on R1 that permits only HTTP (TCP/80) and HTTPS (TCP/443) traffic from the 192.168.1.0/24 subnet to the internet, and denies all other traffic from that subnet. Traffic from 192.168.2.0/24 must be permitted without restriction. Apply the ACL inbound on the interface facing the internal subnets. Additionally, verify that the implicit deny is not blocking necessary traffic by ensuring that the ACL correctly handles the traffic.

Network Topology

Hints

•Traffic from 192.168.1.0/24 enters R1 through G0/0, so apply the ACL inbound on G0/0.
•The ACL must include a permit statement for 192.168.2.0/24 to avoid being blocked by implicit deny.
•Use the 'eq' keyword to match specific port numbers for HTTP (80) and HTTPS (443).

A.ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER in

B.ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER out

C.ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/1 ip access-group FILTER in

D.ip access-list extended FILTER permit tcp 192.168.1.0 0.0.0.255 any eq 80 permit tcp 192.168.1.0 0.0.0.255 any eq 443 permit ip 192.168.2.0 0.0.0.255 any interface g0/0 ip access-group FILTER in interface g0/1 ip access-group FILTER in

AnswerA

solution

! R1
ip access-list extended FILTER
permit tcp 192.168.1.0 0.0.0.255 any eq 80
permit tcp 192.168.1.0 0.0.0.255 any eq 443
permit ip 192.168.2.0 0.0.0.255 any
interface gigabitEthernet0/0
ip access-group FILTER in

Why this answer

The task required an extended ACL to permit HTTP/HTTPS from 192.168.1.0/24 and all traffic from 192.168.2.0/24. The candidate must create a named ACL (e.g., FILTER), add two permit statements for TCP/80 and TCP/443 from 192.168.1.0 0.0.0.255 to any, then a permit ip from 192.168.2.0 0.0.0.255 to any. The ACL is applied inbound on G0/0 (the interface facing 192.168.1.0/24) because traffic from that subnet enters R1 through G0/0.

Applying it outbound on G0/0 would be incorrect, as it would only filter traffic leaving that subnet, not entering. Also, the ACL must be applied on the correct interface to avoid blocking traffic from 192.168.2.0/24, which enters via G0/1.

Exam trap

The most common trap is confusing inbound vs outbound ACL application. Remember: inbound ACL filters traffic entering the interface; outbound ACL filters traffic leaving the interface. For traffic originating from a subnet, apply the ACL inbound on the interface connected to that subnet.

Why the other options are wrong

The ACL is applied in the wrong direction. For traffic originating from 192.168.1.0/24, the ACL must be applied inbound on the interface where that traffic enters the router (G0/0).

The ACL is applied on the wrong interface. The interface facing the restricted subnet (192.168.1.0/24) is G0/0, not G0/1.

The ACL should only be applied on the interface where the restricted subnet traffic enters (G0/0). Applying it on G0/1 is redundant and could inadvertently filter traffic from 192.168.2.0/24 if the ACL is modified later.

Practice this question →

133

MCQmedium

A network engineer successfully logs in to a router, but cannot enter configuration mode because the command is rejected by policy. Which AAA function is controlling this behavior?

A.Authentication

B.Authorization

C.Accounting

D.Encryption

AnswerB

Authorization is the AAA component that determines which commands a successfully authenticated user is permitted to execute. Even after a valid login, the router consults authorization rules, such as privilege levels or per-command permissions from a TACACS+ or RADIUS server, to decide whether to allow a specific command. If the user lacks the required privilege or is not explicitly authorized, the command is rejected. Thus, the engineer's inability to run the command is directly due to authorization failing.

Why this answer

Authentication confirms identity. Authorization determines which commands, privilege levels, or resources that authenticated user is permitted to access.

Exam trap

A common exam trap is confusing authentication with authorization. Candidates often think that if a user cannot enter configuration mode, it means the login failed, which is incorrect. Authentication only confirms the user's identity during login.

Once authenticated, authorization controls what commands or modes the user can access. Misunderstanding this distinction leads to incorrect answers. The question states the user successfully logged in, so the failure to enter configuration mode is due to authorization restrictions, not authentication failure.

Why the other options are wrong

Authentication is the process of verifying a user's identity during login. Since the engineer successfully logged in, authentication has already succeeded and is not preventing command execution.

Accounting records user activities and commands for auditing purposes but does not grant or deny access to commands or configuration modes, so it cannot be the cause of the command rejection.

Encryption protects data confidentiality during transmission but does not control user access or command permissions, so it is unrelated to the inability to enter configuration mode.

Practice this question →

134

MCQhard

Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?

A.The NAT statement is missing the overload keyword

B.The access list should deny the inside subnet

C.The inside and outside interface roles are reversed in the exhibit

D.NAT cannot be used with RFC1918 addresses

AnswerA

The NAT configuration lacks the overload keyword, which enables Port Address Translation (PAT). Without overload, the router performs one-to-one dynamic NAT, mapping each inside host to a unique public IP address. If only one public IPv4 address is available, only one host can be translated at a time, producing the one-at-a-time connectivity behavior described. Adding overload lets many inside hosts share that single public address by multiplexing on source port.

Why this answer

Without overload, dynamic NAT uses one public address per internal session mapping. PAT with overload is what lets many inside hosts share a single outside interface address at the same time.

Exam trap

A frequent exam trap is assuming that reversing the inside and outside interface roles causes the symptom of only one host accessing the internet at a time. While interface roles are critical for NAT operation, reversing them typically prevents translation altogether rather than limiting it to a single host. Another trap is thinking that the ACL should deny the inside subnet to fix the issue, but denying the inside subnet in the ACL stops all translations, causing no internet access.

The real cause is missing the overload keyword, which is essential for PAT to allow multiple hosts to share one public IP simultaneously.

Why the other options are wrong

Denying the inside subnet in the ACL would prevent any NAT translation from occurring, which would block all inside hosts from reaching the internet, not just limit access to one at a time.

Reversing inside and outside interface roles typically stops NAT from functioning entirely rather than allowing only one host at a time. The symptom points more directly to missing overload.

NAT is specifically designed to translate RFC1918 private IP addresses to public IP addresses. Saying NAT cannot be used with RFC1918 addresses is incorrect and contradicts common practice.

Practice this question →

135

MCQhard

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

A.The ISP-B route has a lower administrative distance.

B.Static routes with a higher next-hop IP are preferred.

C.The router always prefers the route configured last.

D.The route names force policy-based routing.

AnswerA

Cisco routers select the best route by administrative distance first for identical prefixes. The ISP-B static route has AD 5 while ISP-A has AD 10, so ISP-B is deemed more trustworthy and wins, causing packets to bypass the intended ISP-A link. This precedence overrides any other preferences like configuration order or next-hop address.

Why this answer

The route via ISP-B has a lower administrative distance, so it wins for the identical /24 prefix. For routes to the same destination and mask, the router compares AD before considering anything else between different route sources.

Exam trap

A frequent exam trap is assuming that the next-hop IP address or the order in which static routes are configured affects route selection. Candidates might incorrectly believe that a higher next-hop IP or the last configured route is preferred, but Cisco routers do not use these factors in route preference. Another common mistake is thinking that route names or descriptions influence routing decisions or enforce policy-based routing, which they do not.

The key is to remember that administrative distance is the primary factor in route selection when multiple routes to the same prefix exist.

Why the other options are wrong

This option is incorrect because the next-hop IP address does not influence route preference. Cisco routers do not consider the numeric value of the next-hop IP when selecting routes.

This option is incorrect because the router does not prefer routes based on the order they were configured. Route selection depends on administrative distance and metrics, not configuration sequence.

This option is incorrect because route names or descriptions are only for human readability and do not enforce policy-based routing. Policy-based routing requires explicit configuration beyond naming.

Practice this question →

136

Matchingmedium

Match each access-control term to its most accurate meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Verification of identity

Determination of allowed actions

Limiting access to only what is necessary

Credential store maintained on the device itself

Why these pairings

AAA is a framework for controlling access. Authentication verifies identity, authorization grants permissions, and accounting logs activities. Identification is the initial claim, and auditing is the review of logs.

Exam trap

The exam often tests the distinction between authentication (verifying identity) and authorization (granting permissions). Many candidates mix these up. Also, remember that accounting is about logging, not access decisions.

Practice this question →

137

Drag & Drophard

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a local subnet and enable a DHCP relay agent on a different interface to forward client requests to that server.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The DHCP server must be configured first on the local subnet, then the relay agent on the remote interface to forward requests; verification ensures both server and relay function correctly.

Exam trap

Do not confuse the order of configuration: the DHCP server must be configured first, then the relay agent. Verification should be performed after both are configured to test end-to-end functionality.

Practice this question →

138

Multi-Selecteasy

Which two statements correctly describe syslog severity levels?

Select 2 answers

A.Level 0 is the most severe

B.Level 7 is debugging

C.Higher numbers always mean more critical issues

D.Severity levels are used only by NTP

E.Syslog has only four severity levels

AnswersA, B

Severity level 0 is 'emergency' and is indeed the most severe, indicating that the system is unusable and requires immediate attention. It is assigned the highest priority, meaning any message with this level should be processed and reported before all others. The severity scale decreases numerically as urgency increases, so 0 outranks 1 ('alert'), 2 ('critical'), and every other level up to 7.

Why this answer

Syslog uses numbered severity levels where lower numbers indicate more critical events. Level 0 (Emergency) is the most severe, and Level 7 (Debugging) is the least. Option D is incorrect because severity levels are a syslog function, not specific to NTP.

Option E is wrong because syslog defines eight severity levels (0–7), not four.

Exam trap

A common mistake is assuming that higher syslog severity numbers mean more critical issues, but the opposite is true—lower numbers indicate higher severity.

Why the other options are wrong

Severity levels are a fundamental part of the syslog protocol and are not limited to or used only by NTP.

Syslog defines eight severity levels (0 through 7), not four.

Practice this question →

139

MCQhard

Refer to the exhibit. A network administrator notices that newly connected devices on the 192.168.1.0/24 subnet are failing to obtain IP addresses via DHCP and are instead assigning themselves APIPA addresses. The administrator issues the show ip dhcp pool command on the router and receives the output shown. What is the most likely cause of this issue?

A.DHCP snooping is blocking DHCP Offer messages on the VLAN.

B.The DHCP pool has an address conflict, causing all addresses to be marked as ineligible.

C.The lease time is set to 7 days, causing old devices to hold IP addresses long after disconnecting.

D.The pool's subnet mask is incorrectly configured as /24 instead of /25, limiting available addresses.

AnswerC

The lease time is set to 7 days, and this long lease duration is why the pool remains exhausted even if some of the 253 bound clients have disconnected. DHCP does not reclaim an address when a client goes offline; it only frees the address when the lease expires or the client explicitly releases it. With a 7-day lease, any device that disconnects ahead of expiration still holds its IP address for up to a full week, starving new clients that request an address during that window. This matches the exhibit: 254 total addresses, 253 currently bound, and a 'Lease expiration' of 7 days.

Why this answer

A 7-day lease time means that IP addresses assigned to devices are held for a full week, even after those devices disconnect from the network. If the subnet is small (e.g., 192.168.1.0/24 provides 254 usable addresses) and many devices have come and gone, the DHCP pool can become exhausted, leaving no available addresses for new devices. When DHCP fails, clients fall back to APIPA (169.254.x.x) addresses per RFC 3927.

Exam trap

Cisco often tests the concept that a long lease time can exhaust a DHCP pool even if the subnet is large, tricking candidates into thinking the issue is a subnet mask mismatch or a security feature like DHCP snooping.

Why the other options are wrong

Candidates often prematurely blame security features when DHCP fails, ignoring the pool statistics right in front of them.

A common mistake is assuming that conflicts always fill up a pool, but the zero value directly disproves this.

Misunderstanding subnet sizing often leads candidates to blame the mask, but the exhibit confirms the mask is appropriate for the pool size.

Practice this question →

140

MCQmedium

A router is configured as follows: interface g0/1 ip address 172.16.1.1 255.255.255.0 ip helper-address 10.20.20.10 Hosts on 172.16.1.0/24 are not receiving addresses from the DHCP server at 10.20.20.10. The server is reachable by ping from the router. What is the purpose of the ip helper-address command in this scenario?

A.It converts DHCP unicast replies into broadcasts on the client segment

B.It forwards certain UDP broadcasts, including DHCP requests, to a remote server

C.It provides DNS resolution for DHCP clients before they receive an address

D.It creates a static route to the DHCP server

AnswerB

Correct. This is correct. The command relays certain UDP broadcasts, including DHCP client requests, to a server on another subnet. That is why DHCP can work even when the server is not local to the client VLAN.

Why this answer

The ip helper-address command exists to solve a broadcast-boundary problem. DHCP clients begin by sending broadcast traffic because they do not yet have a valid IP configuration. Routers normally do not forward broadcasts between subnets, so if the DHCP server lives on a different network, the client request would stop at the router.

The helper-address function listens for that local broadcast and relays it as unicast traffic to the remote DHCP server. In plain language, it lets a client on one VLAN ask a DHCP server on another VLAN for an address. The command is not a routing statement and it is not a DNS feature.

It is a relay mechanism for broadcast-based UDP services such as DHCP.

Exam trap

A frequent exam trap is confusing the ip helper-address command as a feature that converts DHCP unicast replies into broadcasts on the client segment. In reality, the router forwards DHCP client broadcasts as unicast to the server, not the other way around. Another mistake is assuming the command creates static routes or provides DNS resolution, which it does not.

Misunderstanding these functions leads to incorrect troubleshooting and answer choices, especially when the DHCP server is reachable by ping but clients still fail to get addresses due to missing broadcast relay.

Why the other options are wrong

Option A incorrectly states that the ip helper-address converts DHCP unicast replies into broadcasts. The command actually relays client broadcast requests as unicast to the server, not the reverse. This reverses the direction of the relay function and misunderstands the broadcast boundary issue.

Option C incorrectly claims the command provides DNS resolution for DHCP clients before they receive an address. DNS resolution is unrelated to the ip helper-address function, which only relays UDP broadcasts like DHCP requests and does not perform name resolution.

Option D mistakenly suggests that the command creates a static route to the DHCP server. Routing and static routes are separate functions; the ip helper-address does not affect routing tables but only relays broadcast traffic as unicast.

Practice this question →

141

MCQhard

Refer to the exhibit. A network engineer is troubleshooting an issue where syslog messages at severity 6 (informational) and severity 7 (debugging) are not being sent to the syslog server at 192.168.100.50, even though the device appears to generate these messages locally. Based on the exhibit, what is the most likely cause?

A.The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

B.The syslog server IP address 192.168.100.50 is unreachable from the router.

C.The trap logging level is set to errors (severity 3), filtering out informational and debug messages.

D.Console logging is disabled, so only severity 3 and lower messages appear.

AnswerC

The 'Trap logging: level errors (3)' line in the exhibit explicitly limits syslog messages sent to the syslog server to severity 0–3. Informational (6) and debug (7) are higher in numeric value (less severe) and are dropped by this filter.

Why this answer

The exhibit shows that the logging trap level is configured to 'errors' (severity 3). This means only syslog messages with a severity of 0 (emergencies) through 3 (errors) are sent to the syslog server. Informational (severity 6) and debugging (severity 7) messages are filtered out because they are below the configured trap threshold.

This directly explains why those messages are not reaching the server, even though they are generated locally.

Exam trap

Cisco often tests the distinction between different logging destinations (console, monitor, buffer, trap) and their independent severity thresholds, so candidates mistakenly assume that if messages appear locally (e.g., in the buffer), they must also be sent to the syslog server.

Why the other options are wrong

Candidates may associate local buffer behavior with remote logging, but the buffer is just local storage, independent of trap forwarding.

A reachability problem would affect all severities equally, not selectively filter only informational and debug messages.

Candidates may confuse console and trap logging, but each destination has its own independent severity level.

Practice this question →

142

Matchingmedium

Match each security control or idea to its most accurate purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Secures remote management sessions

Provides authentication, authorization, and accounting framework

Limits access to only what is necessary

Centralizes visibility into device events and messages

Why these pairings

A firewall controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks. Option A correctly describes this function. Option B, detecting and alerting on suspicious activity, is the role of an Intrusion Detection System (IDS).

Option C, preventing and blocking intrusions in real time, is the function of an Intrusion Prevention System (IPS). Option D, authenticating users and managing access rights, pertains to AAA (Authentication, Authorization, and Accounting) frameworks.

Exam trap

Candidates often confuse the roles of firewalls, IDS, and IPS. Firewalls filter traffic based on rules but do not inherently detect or block intrusions; that is the job of IDS and IPS.

Practice this question →

143

MCQmedium

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

A.Static NAT

B.Policy-based routing

C.PAT overload

D.Port security

AnswerC

PAT overload, enabled with the overload keyword on an ip nat inside source rule, maps multiple private IP addresses from 192.168.10.0/24 to a single public address by tracking unique TCP/UDP port numbers. This allows all inside hosts to share the outside interface's IP, which is exactly what the administrator needs to provide internet access without public IP exhaustion. The overload keyword distinguishes it from static NAT by enabling many-to-one translation.

Why this answer

When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.

Exam trap

Be careful not to confuse the different types of NAT. Remember, PAT is specifically for sharing one public IP among many devices using port numbers.

Why the other options are wrong

Static NAT requires a one-to-one mapping between an inside local address and an inside global address, which would consume multiple public IPs if multiple hosts need internet access. It does not allow multiple inside hosts to share a single public IP.

Policy-based routing (PBR) is used to override the routing table based on policies (e.g., source/destination IP, protocol), not to perform address translation. It does not modify IP addresses or enable multiple hosts to share a single public IP.

Port security is a switchport security feature that restricts MAC addresses allowed on a port to prevent unauthorized access. It does not perform IP address translation or enable internet access for multiple hosts.

Practice this question →

144

Drag & Dropmedium

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Exam trap

Be careful with the order of ACL entries: always place more specific permits before general denies. Also, remember that ACLs must be created before they can be applied, and the direction (inbound/outbound) must match the requirement.

Practice this question →

145

MCQmedium

Which DHCP message does the client send to formally accept an offered address?

A.DISCOVER

B.OFFER

C.REQUEST

D.ACK

AnswerC

The DHCPREQUEST is the client's formal acceptance message. After receiving a DHCPOFFER, the client sends this broadcast to bind the offered lease, effectively saying 'I accept this configuration.' The server only commits the lease upon receiving the DHCPREQUEST, making it the definitive acceptance step in the DHCP handshake.

Why this answer

In the DORA process, the client sends DHCPREQUEST after receiving an offer. The server then responds with DHCPACK if the lease is granted.

Exam trap

Be careful not to confuse the direction of messages in the DHCP process. Remember which messages are client-initiated and which are server responses.

Why the other options are wrong

The DISCOVER message is used by the client to locate available DHCP servers, not to accept an offered address. It is the first step in the DORA process.

The OFFER message is sent by the DHCP server to propose an IP address to the client, not by the client to accept it. The client cannot send an OFFER.

The ACK message is sent by the DHCP server to confirm the lease after receiving the REQUEST, not by the client. The client does not send ACK.

Practice this question →

146

PBQhard

You are connected to R1. Configure DHCP services so that hosts on VLAN 10 (192.168.10.0/24) can obtain IP addresses from R1. Additionally, configure the switch SW1 to prevent rogue DHCP server attacks on that VLAN. The current configuration has a misconfigured helper-address and an excluded-address range that is too broad.

Network Topology

Hints

•The helper-address should point to the DHCP server itself, not an external address.
•The excluded-address range is too wide; leave room for hosts to get IPs.
•On the switch, only the port connecting to the legitimate DHCP server should be trusted.

A.On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as trusted.

B.On R1, change the helper-address to 192.168.10.255 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set all ports as trusted.

C.On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.254. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

D.On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

AnswerA

solution

! R1
configure terminal
no ip dhcp excluded-address 192.168.10.1 192.168.10.254
ip dhcp excluded-address 192.168.10.1 192.168.10.10
interface GigabitEthernet0/0.10
no ip helper-address 10.0.0.2
ip helper-address 192.168.10.1
end

! SW1
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
ip dhcp snooping trust
interface GigabitEthernet0/2
no ip dhcp snooping limit rate 10
ip dhcp snooping limit rate 15
end

Why this answer

The helper-address on R1's subinterface points to 10.0.0.2 instead of the DHCP server's IP (R1 itself, which is the server). The excluded-address range excludes all addresses in the subnet, preventing any host from getting an IP. The fix: change helper-address to 192.168.10.1 (loopback or interface IP of R1), and narrow the excluded range to the first 10 addresses (or just the gateway).

On SW1, enable DHCP snooping globally and for VLAN 10, and mark the port facing R1 (G0/1) as trusted; other ports should be untrusted to block rogue servers.

Exam trap

Watch out for two common traps: (1) The helper-address must be the DHCP server's unicast IP, not a broadcast address. (2) DHCP snooping trusted ports are for server connections; untrusted ports are for clients. Misplacing these will break DHCP or security.

Why the other options are wrong

The helper-address must be a unicast IP address of the DHCP server, not a broadcast address. Additionally, only ports connected to legitimate DHCP servers should be trusted; all other ports must be untrusted to block rogue servers.

The excluded-address range should only reserve a few addresses (e.g., for the gateway and static assignments), not the entire subnet. The port connected to the DHCP server must be trusted to allow DHCP server messages; untrusted ports block such messages.

DHCP snooping requires that ports connected to legitimate DHCP servers be configured as trusted. Untrusted ports are for client-facing ports where rogue servers might appear; they drop DHCP server messages.

Practice this question →

147

MCQhard

A network engineer notices that hosts in the 192.168.2.0/24 network connected to router R1's GigabitEthernet0/1 interface cannot reach the Internet. R1 has a standard ACL 10 configured as 'access-list 10 permit 192.168.1.0 0.0.0.255' and applied inbound on interface GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. What is the most likely cause?

A.The implicit deny at the end of ACL 10 is blocking all outbound traffic from the 192.168.2.0/24 network.

B.The ACL is filtering return traffic from the Internet that enters G0/0, because it is applied inbound on that interface instead of outbound.

C.The router is not performing inter-VLAN routing between the 192.168.1.0 and 192.168.2.0 networks.

D.The ACL is missing a permit statement for the 192.168.2.0/24 network to allow traffic from that subnet.

AnswerB

Inbound ACLs on G0/0 inspect packets arriving from the Internet. The ACL permits only source 192.168.1.0/24, so return packets from Internet hosts with random source IPs are denied by the implicit deny, breaking connectivity for 192.168.2.0/24 hosts.

Why this answer

ACL 10 is applied inbound on GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. When traffic from the Internet returns to hosts in the 192.168.2.0/24 network, it enters G0/0 inbound and is evaluated against ACL 10, which only permits source addresses from 192.168.1.0/24. The implicit deny at the end of the ACL then blocks all return traffic destined for 192.168.2.0/24, preventing those hosts from reaching the Internet.

Exam trap

The trap here is that candidates often assume ACLs filter outbound traffic from the local network, but Cisco tests the nuance that an inbound ACL on the WAN-facing interface filters return traffic, not the original outbound traffic.

Why the other options are wrong

Misunderstanding of ACL direction leads candidates to think that the implicit deny blocks any traffic leaving the interface.

Confusing ACL filtering with routing functionality; ACLs do not prevent the router from routing between connected subnets unless they explicitly deny the traffic on the appropriate interface and direction.

Candidates often try to add a permit for the source subnet of the initiating traffic, neglecting the direction of the ACL. Because the ACL is inbound on the egress interface, outbound traffic is not filtered.

Practice this question →

148

MCQmedium

A network administrator needs to configure a Cisco router to act as a DHCP server for a small LAN. The router should lease addresses from the 192.168.10.0/24 network, exclude addresses 192.168.10.1 through 192.168.10.10 for static devices, and set the default gateway to 192.168.10.1. Which command is required to exclude the static addresses from the DHCP pool?

A.ip dhcp excluded-address 192.168.10.1 192.168.10.10

B.ip dhcp pool excluded 192.168.10.1 192.168.10.10

C.exclude-address 192.168.10.1 192.168.10.10

D.ip dhcp excluded-address 192.168.10.1 255.255.255.0

AnswerA

The ip dhcp excluded-address command, entered in global configuration mode, specifies a range of addresses that the DHCP server will not assign to clients. Using the start and end addresses excludes the entire range 192.168.10.1 through 192.168.10.10, which are reserved for static devices such as the router and servers.

Why this answer

The ip dhcp excluded-address command is used in global configuration mode to prevent the DHCP server from assigning specific addresses. It takes a starting and ending IP address, and any address in that range is excluded from all DHCP pools. This is the correct way to reserve addresses for static devices like routers, servers, and printers.

Exam trap

The trap here is confusing the global excluded-address command with a pool-level command, or using a subnet mask instead of an end address.

Practice this question →

149

MCQhard

Which switch security feature uses DHCP snooping bindings to validate ARP packets and help stop ARP spoofing?

A.PortFast

B.Dynamic ARP Inspection

C.UDLD

D.HSRP preemption

AnswerB

Dynamic ARP Inspection (DAI) validates ARP packets in a VLAN by cross-referencing the sender IP and MAC address against the DHCP snooping binding table, which is built from DHCP message exchanges. DAI intercepts all ARP requests and replies on untrusted interfaces and drops any packet whose IP-to-MAC mapping is not present or valid in that table. This direct reliance on DHCP snooping bindings is the precise mechanism that mitigates ARP spoofing, making DAI the correct answer.

Why this answer

Dynamic ARP Inspection compares ARP information to trusted bindings, often learned through DHCP snooping, to block forged ARP packets.

Exam trap

A common exam trap is selecting PortFast, UDLD, or HSRP preemption as the answer because these features are well-known switch security or stability mechanisms. However, PortFast only speeds up STP port transitions and does not inspect ARP packets. UDLD focuses on detecting unidirectional links and does not validate ARP traffic.

HSRP preemption deals with gateway redundancy and has no role in ARP security. The key to avoiding this trap is recognizing that only Dynamic ARP Inspection uses DHCP snooping bindings to validate ARP packets and stop ARP spoofing.

Why the other options are wrong

PortFast is a feature that allows switch ports to bypass the usual STP listening and learning states to quickly transition to forwarding. It does not perform any ARP packet validation or security checks, so it cannot prevent ARP spoofing.

UDLD (Unidirectional Link Detection) is designed to detect and disable unidirectional links between switches to prevent network loops or blackholes. It does not inspect or validate ARP packets and thus does not stop ARP spoofing.

HSRP preemption is a feature related to first-hop redundancy protocols that allows a higher priority router to take over as the active gateway. It does not provide any ARP packet validation or protection against ARP spoofing.

Practice this question →

150

Matchingmedium

Match each operations or assurance technology to its most accurate purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Centralized event and message reporting

Monitoring and management information exchange

Visibility into traffic flows and conversations

Clock synchronization for consistent timing

Why these pairings

Each technology serves a specific assurance purpose: Syslog provides centralized event and message reporting, SNMP enables monitoring and management information exchange, NetFlow offers visibility into traffic flows and conversations, and NTP ensures clock synchronization for consistent timing across network devices.

Exam trap

Be careful not to confuse the functions of NetFlow (flow analysis) and IP SLA (performance measurement), or SNMP (management) and Syslog (logging). Also, remember that SPAN is for local mirroring and RSPAN for remote mirroring; the 'R' stands for remote.

Practice this question →