NAT and DHCP practice questions

A network engineer is configuring a Cisco router to provide internet access to a small office using a single public IP address assigned by the ISP. The engineer wants to allow internal hosts to initiate connections to the internet, but also needs to make a web server on the internal network reachable from the internet. The engineer configures a standard access list for NAT and an ip nat inside source list command. However, external users cannot reach the internal web server. What is the most likely cause?

Trap 1: The access list used for NAT does not permit the web server's IP…

Incorrect because the access list is used to identify which inside local addresses are eligible for translation; it does not affect static mappings.

Trap 2: The ip nat inside and ip nat outside commands are applied on the…

Incorrect because the scenario does not indicate an interface misapplication; the issue is the lack of a static mapping.

Trap 3: The global configuration mode is missing the ip nat pool command.

Incorrect because a pool is not required for static NAT; it is used for dynamic NAT with multiple addresses.

A
The access list used for NAT does not permit the web server's IP address.
Why wrong: Incorrect because the access list is used to identify which inside local addresses are eligible for translation; it does not affect static mappings.
B
The engineer forgot to add the ip nat inside source static command for the web server.
Correct because a static NAT entry is required to map the public IP to the internal web server's private IP, allowing inbound connections.
C
The ip nat inside and ip nat outside commands are applied on the wrong interfaces.
Why wrong: Incorrect because the scenario does not indicate an interface misapplication; the issue is the lack of a static mapping.
D
The global configuration mode is missing the ip nat pool command.
Why wrong: Incorrect because a pool is not required for static NAT; it is used for dynamic NAT with multiple addresses.

Open the full VLAN trunking answer →

Question 2mediummultiple choice

A network engineer is troubleshooting a DHCP issue on a Cisco router configured as a DHCP server for a VLAN. Clients in the VLAN are able to obtain IP addresses from the DHCP server, but they are not receiving the correct DNS server address. The engineer checks the DHCP pool configuration and sees the dns-server command is configured with the correct IP address. What is the most likely cause of the problem?

Trap 1: The DNS server is unreachable from the DHCP server.

Incorrect because the DHCP server does not need to reach the DNS server to include its address in the DHCP offer; it only needs to provide the IP.

Trap 2: The ip dhcp excluded-address command is blocking the DNS server IP.

Incorrect because the excluded-address command prevents the DHCP server from assigning an IP address; it does not affect option delivery.

Trap 3: The DHCP client is configured with a static DNS server address.

Incorrect because if the client had a static DNS, it would ignore the DHCP option, but the scenario implies the client is using DHCP for all settings.

A
The DHCP pool is not associated with the correct VLAN interface using the network command.
Correct because if the network command in the DHCP pool does not match the subnet of the VLAN, the DHCP server may assign addresses but not apply the pool-specific options like DNS.
B
The DNS server is unreachable from the DHCP server.
Why wrong: Incorrect because the DHCP server does not need to reach the DNS server to include its address in the DHCP offer; it only needs to provide the IP.
C
The ip dhcp excluded-address command is blocking the DNS server IP.
Why wrong: Incorrect because the excluded-address command prevents the DHCP server from assigning an IP address; it does not affect option delivery.
D
The DHCP client is configured with a static DNS server address.
Why wrong: Incorrect because if the client had a static DNS, it would ignore the DHCP option, but the scenario implies the client is using DHCP for all settings.

Question 3hardmultiple choice

A network engineer is configuring NAT overload (PAT) on a Cisco router to allow multiple internal hosts to share a single public IP address. The engineer uses the command ip nat inside source list 1 interface GigabitEthernet0/0 overload. After testing, internal hosts can access the internet, but some applications fail intermittently. The engineer suspects a NAT issue. What is the most likely cause?

Trap 1: The access list 1 is too permissive and includes the public IP…

Incorrect because including the public IP in the access list would not cause intermittent failures; it might cause unnecessary translations but not port exhaustion.

Trap 2: The router is not configured with ip nat inside on the internal…

Incorrect because if the inside interface were missing the command, no translations would occur at all, not just intermittent failures.

Trap 3: The overload keyword is misspelled or not supported on this IOS…

Incorrect because the overload keyword is standard for PAT; a misspelling would cause a syntax error, not intermittent failures.

A
The access list 1 is too permissive and includes the public IP address of the router.
Why wrong: Incorrect because including the public IP in the access list would not cause intermittent failures; it might cause unnecessary translations but not port exhaustion.
B
The NAT translation table is filling up due to a large number of concurrent sessions, causing new translations to be denied.
Correct because PAT has a limited number of available port numbers (approximately 65,000 per public IP), and if many sessions are active, the table can become full, dropping new connections.
C
The router is not configured with ip nat inside on the internal interface.
Why wrong: Incorrect because if the inside interface were missing the command, no translations would occur at all, not just intermittent failures.
D
The overload keyword is misspelled or not supported on this IOS version.
Why wrong: Incorrect because the overload keyword is standard for PAT; a misspelling would cause a syntax error, not intermittent failures.

Open the full VLAN trunking answer →

Question 4mediummultiple choice

A network engineer is configuring a Cisco router as a DHCP relay agent to forward DHCP requests from a client VLAN to a centralized DHCP server located in a different subnet. The engineer configures the ip helper-address command on the VLAN interface. However, clients in the VLAN are not receiving IP addresses. The DHCP server is reachable from the router. What is the most likely cause?

Trap 1: The ip helper-address command is applied on the wrong interface…

Incorrect because the command must be applied on the interface that receives the client broadcast, not on the server-facing interface.

Trap 2: The DHCP server is not configured with a scope for the client…

Incorrect because the DHCP server would still send a reply (possibly with no offer) but the client would not receive it; however, the most common issue is routing of the reply.

Trap 3: The DHCP client is using DHCPv6 instead of DHCPv4.

Incorrect because the scenario implies IPv4 DHCP; the ip helper-address command works for DHCPv4 broadcasts.

A
The ip helper-address command is applied on the wrong interface (e.g., the interface facing the DHCP server).
Why wrong: Incorrect because the command must be applied on the interface that receives the client broadcast, not on the server-facing interface.
B
The DHCP server is not configured with a scope for the client subnet.
Why wrong: Incorrect because the DHCP server would still send a reply (possibly with no offer) but the client would not receive it; however, the most common issue is routing of the reply.
C
The router does not have a return route to the client subnet, so the DHCP server's reply is dropped.
Correct because the DHCP server sends the reply to the relay agent (router), which then forwards it as a broadcast to the client. If the router cannot reach the client subnet, the reply is lost.
D
The DHCP client is using DHCPv6 instead of DHCPv4.
Why wrong: Incorrect because the scenario implies IPv4 DHCP; the ip helper-address command works for DHCPv4 broadcasts.

Question 5hardmultiple choice

A network engineer is troubleshooting a NAT issue where an internal host cannot establish an SSH session to a remote server on the internet. The engineer checks the NAT translations on the border router and sees that the translation for the host's source IP is present. However, the SSH session times out. The engineer also notices that the remote server's IP is not in the NAT translation table. What is the most likely cause?

Trap 1: The SSH server is blocking connections from the public IP address.

Incorrect because the SSH session would still attempt to establish; the timeout indicates a routing/translation issue, not a firewall block.

Trap 2: The NAT overload is causing port conflicts for SSH.

Incorrect because SSH uses a specific port (22), and PAT can handle multiple SSH sessions by using different source ports.

Trap 3: The access list used for NAT is denying the SSH traffic.

Incorrect because if the access list denied SSH, no translation would be created at all.

A
The router is performing NAT only for the source IP, but the return traffic is taking a different path that does not go through the NAT router.
Correct because if the return traffic does not pass through the same NAT router, the router will not create an inbound translation entry, and the packet will not be translated back to the private IP.
B
The SSH server is blocking connections from the public IP address.
Why wrong: Incorrect because the SSH session would still attempt to establish; the timeout indicates a routing/translation issue, not a firewall block.
C
The NAT overload is causing port conflicts for SSH.
Why wrong: Incorrect because SSH uses a specific port (22), and PAT can handle multiple SSH sessions by using different source ports.
D
The access list used for NAT is denying the SSH traffic.
Why wrong: Incorrect because if the access list denied SSH, no translation would be created at all.

Question 6easymultiple choice

A network engineer is configuring a Cisco router to act as a DHCP server for a branch office. The engineer creates a DHCP pool for the 192.168.1.0/24 subnet and configures the default-router, dns-server, and domain-name options. However, clients are able to obtain IP addresses but cannot ping the default gateway. The engineer verifies that the router's interface IP is 192.168.1.1. What is the most likely cause?

Trap 1: The DHCP pool is missing the lease command.

Incorrect because the lease command is optional; without it, a default lease is used, and clients can still ping the gateway.

Trap 2: The router's interface is administratively down.

Incorrect because if the interface were down, the DHCP server would not be able to assign addresses from that subnet (the pool would be inactive).

Trap 3: The ip dhcp excluded-address command is blocking the default…

Incorrect because the excluded-address command prevents the DHCP server from assigning that IP to a client, but the router still owns it.

A
The router's interface is not configured with an IP address in the 192.168.1.0/24 subnet.
Correct because if the router interface is not in the same subnet, the clients will have a default gateway that is unreachable.
B
The DHCP pool is missing the lease command.
Why wrong: Incorrect because the lease command is optional; without it, a default lease is used, and clients can still ping the gateway.
C
The router's interface is administratively down.
Why wrong: Incorrect because if the interface were down, the DHCP server would not be able to assign addresses from that subnet (the pool would be inactive).
D
The ip dhcp excluded-address command is blocking the default gateway IP.
Why wrong: Incorrect because the excluded-address command prevents the DHCP server from assigning that IP to a client, but the router still owns it.

Question 7easymultiple choice

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source list 100 interface GigabitEthernet0/0 overload, where access list 100 permits only the 10.0.0.0/8 network. After testing, hosts in the 10.0.0.0/8 network can access the internet, but hosts in the 172.16.0.0/16 network cannot. The engineer verifies that the 172.16.0.0/16 hosts have connectivity to the router. What is the most likely cause?

Trap 1: The router's interface GigabitEthernet0/0 is not configured with ip…

Incorrect because if the outside interface were missing the command, no translations would work at all.

Trap 2: The 172.16.0.0/16 hosts have a default gateway pointing to a…

Incorrect because the engineer verified connectivity to the router, implying the default gateway is correct.

Trap 3: The NAT pool is exhausted for the 172.16.0.0/16 network.

Incorrect because the configuration uses overload (PAT), which does not require a pool; it uses the interface IP.

A
The access list 100 does not permit the 172.16.0.0/16 network.
Correct because the NAT configuration only translates traffic that matches the access list; hosts not in the list are not translated.
B
The router's interface GigabitEthernet0/0 is not configured with ip nat outside.
Why wrong: Incorrect because if the outside interface were missing the command, no translations would work at all.
C
The 172.16.0.0/16 hosts have a default gateway pointing to a different router.
Why wrong: Incorrect because the engineer verified connectivity to the router, implying the default gateway is correct.
D
The NAT pool is exhausted for the 172.16.0.0/16 network.
Why wrong: Incorrect because the configuration uses overload (PAT), which does not require a pool; it uses the interface IP.

Question 8mediummultiple choice

A network engineer is troubleshooting a DHCP issue where a client is not receiving an IP address from a Cisco router configured as a DHCP server. The engineer checks the DHCP pool configuration and sees that the network command is configured with the correct subnet. The engineer also verifies that the ip dhcp excluded-address command is not blocking any addresses. However, the client's DHCP discover message is not reaching the router. What is the most likely cause?

Trap 1: The router's interface is configured with the no ip…

Incorrect because that command would affect DHCP relay, not the local DHCP server.

Trap 2: The DHCP pool is configured with the wrong default-router option.

Incorrect because the default-router option is only sent in the DHCP offer; it does not affect whether the discover message is received.

Trap 3: The router's DHCP server is disabled globally with the no service…

Incorrect because if the DHCP server were disabled, no pool would be active, but the engineer would likely see an error message.

A
The router's interface is configured with the no ip forward-protocol udp bootps command.
Why wrong: Incorrect because that command would affect DHCP relay, not the local DHCP server.
B
The router's interface is not in the same VLAN as the client, and no ip helper-address is configured.
Correct because if the router is not directly connected to the client's VLAN, the DHCP broadcast will not reach the router unless a DHCP relay (ip helper-address) is configured on the client's VLAN interface.
C
The DHCP pool is configured with the wrong default-router option.
Why wrong: Incorrect because the default-router option is only sent in the DHCP offer; it does not affect whether the discover message is received.
D
The router's DHCP server is disabled globally with the no service dhcp command.
Why wrong: Incorrect because if the DHCP server were disabled, no pool would be active, but the engineer would likely see an error message.

Question 9hardmultiple choice

A network engineer is configuring NAT on a Cisco router to allow internal hosts to access the internet. The engineer uses the command ip nat inside source static tcp 192.168.1.10 80 203.0.113.1 80. After testing, external users can access the internal web server using the public IP. However, internal hosts cannot access the web server using the public IP. What is the most likely cause?

Trap 1: The static NAT entry is missing the extendable keyword.

Incorrect because the extendable keyword is used when multiple static NAT entries share the same public IP; it is not related to hairpinning.

Trap 2: The internal hosts have a route to the public IP via the router's…

Incorrect because even with a route, the NAT translation would not occur for inside-to-inside traffic without hairpinning.

Trap 3: The access list used for NAT is blocking internal traffic.

Incorrect because the static NAT entry does not use an access list; it is a direct mapping.

A
The router does not have NAT hairpinning enabled, so internal traffic to the public IP is not translated.
Correct because by default, Cisco routers do not perform NAT for traffic that enters and leaves the same interface (inside-to-inside). This requires the ip nat enable route-map or similar configuration.
B
The static NAT entry is missing the extendable keyword.
Why wrong: Incorrect because the extendable keyword is used when multiple static NAT entries share the same public IP; it is not related to hairpinning.
C
The internal hosts have a route to the public IP via the router's outside interface.
Why wrong: Incorrect because even with a route, the NAT translation would not occur for inside-to-inside traffic without hairpinning.
D
The access list used for NAT is blocking internal traffic.
Why wrong: Incorrect because the static NAT entry does not use an access list; it is a direct mapping.

Question 10mediummultiple choice

A network engineer runs the following command on Router R1:

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- --- 192.0.2.11 10.0.0.11 --- ---

Based on this output, what can be concluded?

Trap 1: Dynamic NAT is configured with a pool of addresses.

Dynamic NAT entries would show protocol and timers; this output shows static entries without protocol.

Trap 2: PAT is translating multiple internal addresses to a single global…

PAT would show the same inside global address with different ports; here each inside global is unique.

Trap 3: NAT is not operational because no outside local addresses are shown.

Static NAT entries do not require outside local addresses to be displayed in this output.

A
Dynamic NAT is configured with a pool of addresses.
Why wrong: Dynamic NAT entries would show protocol and timers; this output shows static entries without protocol.
B
Static NAT is configured for two internal hosts.
The absence of protocol and the presence of inside global/local pairs indicate static NAT.
C
PAT is translating multiple internal addresses to a single global address.
Why wrong: PAT would show the same inside global address with different ports; here each inside global is unique.
D
NAT is not operational because no outside local addresses are shown.
Why wrong: Static NAT entries do not require outside local addresses to be displayed in this output.

Question 11mediummultiple choice

A network engineer runs the following command on Router R2:

R2# debug ip dhcp server events
*Mar  1 00:05:23.123: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 on interface GigabitEthernet0/1
*Mar  1 00:05:23.124: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)
*Mar  1 00:05:23.125: DHCPD: DHCPREQUEST received from client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30
*Mar  1 00:05:23.126: DHCPD: Sending DHCPACK to client 0063.6973.636f.2d30.3030.302e.3030.3030.2e30.3030.312d.4574.30 (10.0.0.2)

Based on this debug output, what can be concluded?

Trap 1: The DHCP server failed to allocate an IP address to the client.

The sequence ends with DHCPACK, indicating successful allocation.

Trap 2: The client is using DHCPv6 because of the long client ID.

The client ID is a DHCPv4 client identifier; DHCPv6 uses DUIDs.

Trap 3: The DHCP server is configured with a pool that excludes 10.0.0.2.

The server assigned 10.0.0.2, so it is not excluded.

A
The DHCP server failed to allocate an IP address to the client.
Why wrong: The sequence ends with DHCPACK, indicating successful allocation.
B
The client is using DHCPv6 because of the long client ID.
Why wrong: The client ID is a DHCPv4 client identifier; DHCPv6 uses DUIDs.
C
The DHCP server successfully assigned IP address 10.0.0.2 to the client.
The DHCPACK sent with address 10.0.0.2 confirms successful assignment.
D
The DHCP server is configured with a pool that excludes 10.0.0.2.
Why wrong: The server assigned 10.0.0.2, so it is not excluded.

Question 12hardmultiple choice

A network engineer runs the following command on Router R3:

R3# show ip nat statistics

Total active translations: 5 (0 static, 5 dynamic; 5 extended) Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 1234 Misses: 5 CEF Translated packets: 1200, CEF Punted packets: 34 Expired translations: 10 Dynamic mappings: -- Inside Source

[Id] ip nat pool POOL1 203.0.113.1 203.0.113.10 netmask 255.255.255.240

refcount 5

Based on this output, what can be concluded?

Trap 1: The NAT pool has exhausted all available addresses.

Only 5 of 10 addresses are used, so the pool is not exhausted.

Trap 2: The NAT translations are all static.

The output shows 0 static and 5 dynamic translations.

Trap 3: The inside interface is GigabitEthernet0/0.

The inside interface is GigabitEthernet0/1; outside is GigabitEthernet0/0.

A
The NAT pool has exhausted all available addresses.
Why wrong: Only 5 of 10 addresses are used, so the pool is not exhausted.
B
The NAT translations are all static.
Why wrong: The output shows 0 static and 5 dynamic translations.
C
The router is performing Port Address Translation (PAT).
The translations are 'extended', which indicates PAT is being used.
D
The inside interface is GigabitEthernet0/0.
Why wrong: The inside interface is GigabitEthernet0/1; outside is GigabitEthernet0/0.

Question 13mediummultiple choice

A network engineer runs the following command on Router R4:

R4# show ip dhcp binding

Bindings from all pools not associated with VRF:

IP address       Client-ID/              Lease expiration        Type

Hardware address/ User name

10.0.0.10        0063.6973.636f.2d30.    Mar 01 2025 12:00 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.

10.0.0.11        0063.6973.636f.2d30.    Mar 01 2025 12:05 PM   Automatic
                 3030.302e.3030.3030.
                 2e30.3030.312d.4574.

Based on this output, what can be concluded?

Trap 1: Both clients have static DHCP reservations.

The type is 'Automatic', not 'Manual' which would indicate a reservation.

Trap 2: The DHCP server is out of addresses.

Only two addresses are shown; there is no indication of exhaustion.

Trap 3: The clients are using DHCPv6.

The client-ID format is typical for DHCPv4; DHCPv6 uses DUID.

A
Both clients have static DHCP reservations.
Why wrong: The type is 'Automatic', not 'Manual' which would indicate a reservation.
B
The DHCP server has two active leases.
Two bindings are listed, both with future lease expiration times.
C
The DHCP server is out of addresses.
Why wrong: Only two addresses are shown; there is no indication of exhaustion.
D
The clients are using DHCPv6.
Why wrong: The client-ID format is typical for DHCPv4; DHCPv6 uses DUID.

Question 14hardmultiple choice

A network engineer runs the following command on Router R5:

R5# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80

Based on this output, what can be concluded?

Trap 1: The router is configured with static NAT for two internal hosts.

Static NAT would not show ports; this is PAT with dynamic translations.

Trap 2: The router is performing destination NAT.

Destination NAT would show different outside local/global pairs; here they match.

Trap 3: The inside local address 10.0.0.20 is using two different global…

Both translations use the same inside global address 192.0.2.20.

A
The router is configured with static NAT for two internal hosts.
Why wrong: Static NAT would not show ports; this is PAT with dynamic translations.
B
The router is performing Port Address Translation (PAT) for multiple sessions from the same internal host.
Same inside global IP with different ports indicates PAT.
C
The router is performing destination NAT.
Why wrong: Destination NAT would show different outside local/global pairs; here they match.
D
The inside local address 10.0.0.20 is using two different global addresses.
Why wrong: Both translations use the same inside global address 192.0.2.20.

Question 15mediummultiple choice

A network engineer runs the following command on Router R6:

R6# show ip dhcp conflict
IP address       Detection method     Detection time         VRF
10.0.0.10        Ping                 Mar 01 2025 10:00 AM   default
10.0.0.15        Gratuitous ARP       Mar 01 2025 10:05 AM   default

Based on this output, what can be concluded?

Trap 1: The DHCP server has successfully assigned these addresses to…

Conflicted addresses are not assigned; they are removed from the pool.

Trap 2: The DHCP server uses only ping to detect conflicts.

Both ping and gratuitous ARP methods are shown.

Trap 3: The conflicts were caused by the DHCP server itself.

Conflicts indicate another device on the network is using the same IP.

A
The DHCP server has successfully assigned these addresses to clients.
Why wrong: Conflicted addresses are not assigned; they are removed from the pool.
B
The addresses 10.0.0.10 and 10.0.0.15 are unavailable for DHCP assignment.
Conflicted addresses are excluded from the pool until the conflict is cleared.
C
The DHCP server uses only ping to detect conflicts.
Why wrong: Both ping and gratuitous ARP methods are shown.
D
The conflicts were caused by the DHCP server itself.
Why wrong: Conflicts indicate another device on the network is using the same IP.

Question 16mediummultiple choice

A network engineer runs the following command on Router R7:

R7# show ip nat translations verbose

Pro Inside global Inside local Outside local Outside global --- 192.0.2.10 10.0.0.10 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:05:00 timeout: never, flags: static --- 192.0.2.11 10.0.0.11 --- --- create: 03/01/2025 09:00:00, use: 03/01/2025 09:06:00 timeout: never, flags: static

Based on this output, what can be concluded?

Trap 1: These translations will expire after a configurable timeout.

The timeout is 'never', so they do not expire.

Trap 2: The translations are dynamic and will be removed after idle timeout.

The flags indicate 'static', not dynamic.

Trap 3: The router is performing PAT for these addresses.

No protocol or port is shown; these are simple static NAT entries.

A
These translations will expire after a configurable timeout.
Why wrong: The timeout is 'never', so they do not expire.
B
The translations are dynamic and will be removed after idle timeout.
Why wrong: The flags indicate 'static', not dynamic.
C
The router is performing PAT for these addresses.
Why wrong: No protocol or port is shown; these are simple static NAT entries.
D
The translations are static and will remain until manually removed.
Static NAT entries with timeout 'never' persist indefinitely.

Question 17hardmultiple choice

A network engineer runs the following command on Router R8:

R8# show ip dhcp server statistics

Memory usage: 12345 Address pools: 2 Database agents: 0 Automatic bindings: 10 Manual bindings: 2 Expired bindings: 1 Malformed messages: 0

Message Received

BOOTREQUEST    0

DHCPDISCOVER 100 DHCPREQUEST 95 DHCPDECLINE 1 DHCPRELEASE 2 DHCPINFORM 0

Based on this output, what can be concluded?

Trap 1: The DHCP server has 12 active leases.

Automatic bindings are 10, manual are 2, but expired bindings are 1; the total active is 12, but the question asks about the discrepancy.

Trap 2: The DHCP server rejected 5 DHCPDISCOVER messages.

There is no indication of rejection; the DISCOVERs were received.

Trap 3: The DHCP server has 2 manual bindings that are static reservations.

This is true but not the best conclusion from the data; the key insight is the DISCOVER/REQUEST mismatch.

A
The DHCP server has received more DHCPDISCOVER messages than DHCPREQUEST messages, indicating some clients did not proceed to request.
100 DISCOVER vs 95 REQUEST shows 5 clients did not send REQUEST.
B
The DHCP server has 12 active leases.
Why wrong: Automatic bindings are 10, manual are 2, but expired bindings are 1; the total active is 12, but the question asks about the discrepancy.
C
The DHCP server rejected 5 DHCPDISCOVER messages.
Why wrong: There is no indication of rejection; the DISCOVERs were received.
D
The DHCP server has 2 manual bindings that are static reservations.
Why wrong: This is true but not the best conclusion from the data; the key insight is the DISCOVER/REQUEST mismatch.

Question 18hardmultiple choice

A network engineer runs the following command on Router R9:

R9# show ip nat translations

Pro Inside global Inside local Outside local Outside global udp 192.0.2.20:1234 10.0.0.20:1234 203.0.113.1:53 203.0.113.1:53 tcp 192.0.2.20:5678 10.0.0.20:5678 198.51.100.1:80 198.51.100.1:80 --- 192.0.2.21 10.0.0.21 --- ---

Based on this output, what can be concluded?

Trap 1: All translations are dynamic.

The third entry has no protocol, indicating it is static.

Trap 2: The router is configured with a single NAT pool.

Static NAT does not use a pool; PAT may use a pool or interface.

Trap 3: The inside global address 192.0.2.20 is used for both static and…

192.0.2.20 is used only for dynamic PAT; static uses 192.0.2.21.

A
All translations are dynamic.
Why wrong: The third entry has no protocol, indicating it is static.
B
The router is using both static NAT and PAT simultaneously.
Static NAT for 10.0.0.21 and PAT for 10.0.0.20 are both active.
C
The router is configured with a single NAT pool.
Why wrong: Static NAT does not use a pool; PAT may use a pool or interface.
D
The inside global address 192.0.2.20 is used for both static and dynamic translations.
Why wrong: 192.0.2.20 is used only for dynamic PAT; static uses 192.0.2.21.

Question 19mediummultiple choice

Consider the following configuration snippet: ```

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip nat inside

interface GigabitEthernet0/2
 ip address 203.0.113.1 255.255.255.0
 ip nat outside

ip nat inside source list 1 interface GigabitEthernet0/2 overload
access-list 1 permit 192.168.1.0 0.0.0.255

``` What is the effect of this configuration?

Trap 1: It performs static NAT for each host in 192.168.1.0/24 to a unique…

Incorrect. This is dynamic NAT with overload, not static NAT.

Trap 2: It translates only traffic from 192.168.1.1 to the outside…

Incorrect. Access-list 1 permits the entire subnet, not just the host.

Trap 3: The configuration is invalid because 'ip nat inside' and 'ip nat…

Incorrect. The inside/outside assignment is correct for typical NAT scenarios.

A
It translates all traffic from 192.168.1.0/24 to the IP address 203.0.113.1, using port address translation.
Correct. The 'overload' keyword enables PAT, and the interface IP is used as the translated address.
B
It performs static NAT for each host in 192.168.1.0/24 to a unique IP in the 203.0.113.0/24 network.
Why wrong: Incorrect. This is dynamic NAT with overload, not static NAT.
C
It translates only traffic from 192.168.1.1 to the outside interface IP.
Why wrong: Incorrect. Access-list 1 permits the entire subnet, not just the host.
D
The configuration is invalid because 'ip nat inside' and 'ip nat outside' are on the wrong interfaces.
Why wrong: Incorrect. The inside/outside assignment is correct for typical NAT scenarios.

Question 20mediummultiple choice

Examine this DHCP configuration: ```

ip dhcp pool POOL1
 network 10.10.10.0 255.255.255.0

default-router 10.10.10.1 dns-server 8.8.8.8 lease 0 12 !

ip dhcp excluded-address 10.10.10.1 10.10.10.10

``` Which statement is true?

Trap 1: The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.

Incorrect. The excluded-address range prevents assignment of 10.10.10.1 through 10.10.10.10.

Trap 2: The default lease is used because the lease command is incomplete.

Incorrect. The lease command is valid and specifies 12 hours.

Trap 3: The DNS server is set to 8.8.8.8, but clients will ignore it.

Incorrect. The DNS server option is provided to clients via DHCP.

A
DHCP clients will receive a lease for 12 hours.
Correct. The lease command specifies 0 days, 12 hours.
B
The router will assign IP addresses from 10.10.10.1 to 10.10.10.254.
Why wrong: Incorrect. The excluded-address range prevents assignment of 10.10.10.1 through 10.10.10.10.
C
The default lease is used because the lease command is incomplete.
Why wrong: Incorrect. The lease command is valid and specifies 12 hours.
D
The DNS server is set to 8.8.8.8, but clients will ignore it.
Why wrong: Incorrect. The DNS server option is provided to clients via DHCP.