CCNA IP Services: 170 practice questions

12 of the 170 IP Services questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. ip nat inside source static 10.50.10.20 198.51.100.20: Which configuration creates the required fixed one-to-o

1. ip nat inside source list 10.50.10.20 pool 198.51.100.20

   The list form requires an ACL and pool definition rather than a direct static mapping.
2. ip nat inside source static 198.51.100.20 10.50.10.20

   This reverses inside-local and inside-global roles, producing the wrong translation direction.
3. ip nat outside source static 10.50.10.20 198.51.100.20

   Outside-source translation describes external addresses, not the warehouse server's inside-local address.
4. ip nat inside source static 10.50.10.20 198.51.100.20 ✓

   This command creates a permanent one-to-one mapping from the inside-local address to the inside-global address.

Static inside-source NAT maps the warehouse server's private address permanently to its public address.

2. Configure `ntp server 192.0.2.25` on the router: Select TWO statements that satisfy or correctly describe this

Select two. More than one option is correct — every correct one is ticked below.

1. Configure `ntp server 192.0.2.25` on the router. ✓

   The `ntp server` command configures the router to use 192.0.2.25 as an NTP server.
2. Configure `ntp master 3` so the router obtains client time from 192.0.2.25.

   `ntp master 3` makes the router provide locally generated time at the configured stratum; it does not configure a client relationship with 192.0.2.25.
3. Configure the branch time zone so the router synchronizes its clock with 192.0.2.25.

   A time-zone setting changes local time display and does not establish NTP synchronization.
4. Use `show ntp status` to verify whether the router is synchronized. ✓

   `show ntp status` reports the router's synchronization state and reference information.
5. Use `show clock detail` to create the NTP relationship with 192.0.2.25.

   `show clock detail` displays clock information but does not configure an NTP server relationship.

Configure the NTP server relationship, then verify synchronization with the NTP status command.

3. Classification identifies traffic: What conclusion is correct?

1. Marking identifies voice traffic, while classification allocates bandwidth during congestion.

   The functions are reversed: classification identifies traffic and marking changes packet metadata; neither allocates bandwidth.
2. Classification identifies traffic, and marking writes DSCP metadata; neither action schedules transmission. ✓

   Classification selects matching traffic and marking changes its metadata. Queuing and scheduling determine transmission treatment during congestion.
3. The access list shapes voice traffic by buffering packets during WAN congestion.

   An access list classifies traffic; shaping requires a separate mechanism that buffers and delays excess traffic.
4. Setting DSCP EF automatically creates a strict-priority queue for voice packets.

   DSCP EF is packet metadata; a priority queue requires an explicitly configured queuing and scheduling policy.

Classification selects traffic, marking changes DSCP, and queuing determines congestion treatment.

4. Emergency, severity 0: Which event severity is forwarded to the syslog server?

1. Informational, severity 6

   Severity 6 is below the configured warnings threshold and therefore is not forwarded.
2. Emergency, severity 0 ✓

   A warnings threshold includes severity 4 and every more-severe level from 0 through 4.
3. Notifications, severity 5

   Severity 5 is less severe than warnings and is excluded by a warnings threshold.
4. Debugging, severity 7

   Debugging is the least severe level and is excluded by the warnings threshold.

Warnings level 4 includes emergency severity 0 because thresholds include all more-severe events.

5. Generate RSA keys on the router: Which action addresses the missing prerequisite?

1. Enable Telnet alongside SSH so the router can generate SSH keys automatically.

   Telnet does not generate SSH keys and would introduce an unnecessary insecure management method.
2. Generate RSA keys on the router. ✓

   SSH requires suitable host keys; generating RSA keys supplies the missing server-side cryptographic prerequisite.
3. Replace `login local` with `login` so SSH can use the console password.

   The plain login command requires a line password and does not provide the configured local-user authentication.
4. Configure `enable secret` because VTY authentication uses only the privileged password.

   The configured `login local` command uses the local username database, not the enable secret.

The router has SSH settings but no host keys, so RSA key generation is required.

6. The DHCP pool must include a DNS server address: What is the correct technical conclusion?

1. The clients need a larger address pool before DNS resolution can operate.

   Pool capacity affects lease allocation, not whether already configured clients know a resolver address.
2. The DHCP pool must include a DNS server address for clients. ✓

   DHCP can provide DNS server addresses, allowing clients to resolve names without manually configured resolver settings.
3. The DHCP server must advertise TCP port 53 as the default gateway.

   A default gateway forwards traffic; DNS port information is not configured as a gateway address.
4. The DHCP pool requires PAT before DNS queries can leave the subnet.

   PAT is unrelated to supplying resolver information when clients and DNS services already have reachable routes.

The pool needs a DNS server option so clients learn where to send resolver queries.

7. Configure ip helper-address 10.50.1.20: Which configuration change satisfies the requirement to relay requests

1. Configure ip forward-protocol udp 67 on GigabitEthernet0/1.

   Forward-protocol permits selected UDP forwarding but does not replace a DHCP helper destination.
2. Configure ip dhcp relay information option on GigabitEthernet0/1.

   That command modifies relay information behavior but does not establish a destination for DHCP broadcasts.
3. Configure ip helper-address 10.50.1.20 on the DHCP server-facing interface.

   The relay must receive broadcasts on the client-facing interface, not only forward traffic toward the server.
4. Configure ip helper-address 10.50.1.20 on GigabitEthernet0/1. ✓

   The helper belongs on the routed interface receiving client broadcasts, forwarding DHCP requests toward the reachable server.

Place the helper address on the client-facing routed interface that receives the DHCP broadcast.

8. Gi1/0/2 transmitted more octets than it received during: Which conclusion is supported?

1. Gi1/0/1 transmitted more octets than it received during the interval.

   Its inbound delta is 8,000,000 octets and its outbound delta is 1,000,000 octets.
2. The switch sent an unsolicited trap containing these counter values.

   The manager polled the MIB counters and computed deltas; that is polling, not an unsolicited trap.
3. Gi1/0/3 transmitted traffic despite reporting an operationally down state.

   The interface is down and both measured deltas are zero, so the supplied data do not show transmitted traffic.
4. Gi1/0/2 transmitted more octets than it received during the interval. ✓

   Gi1/0/2 has an outbound delta of 9,000,000 octets and an inbound delta of 1,000,000 octets.

The counter deltas show that Gi1/0/2 transmitted more octets than it received.

9. The initial TFTP request uses UDP port 69: Which conclusion is correct about this transfer?

1. The initial TFTP request uses UDP port 53.

   UDP port 53 supports DNS queries, not the initial request for a TFTP file transfer.
2. The initial TFTP request uses TCP port 22.

   TCP port 22 supports SSH, while TFTP begins using UDP port 69 without built-in encryption.
3. The initial TFTP request uses TCP port 21.

   TCP port 21 is associated with FTP control, whereas TFTP uses UDP and begins at port 69.
4. The initial TFTP request uses UDP port 69. ✓

   TFTP begins with a request directed to UDP port 69 before subsequent transfer exchanges use negotiated ports.

TFTP starts at UDP 69, then uses negotiated transfer ports for the file exchange.

10. Use show ip nat translations to inspect current mapped: Which verification step directly resolves that uncerta

1. Use show ip nat translations to inspect current mapped addresses. ✓

   The translation table reveals active inside-local and inside-global mappings created by the NAT process.
2. Use show cdp neighbors detail to verify inside-global addresses.

   CDP displays neighboring Cisco device information and cannot reveal NAT translation bindings.
3. Use show ip route nat to inspect dynamically allocated translations.

   The routing table does not display active NAT translation bindings or pool allocation results.
4. Use show interfaces accounting to identify the NAT pool entries.

   Interface accounting reports traffic statistics, not individual NAT mappings or pool utilization.

The NAT translation table directly shows active mappings and their inside-global addresses.

11. The switch should report stratum 3 after resynchronizing: What behavior should be expected?

1. The switch should report stratum 1 because the server improved its reference.

   Stratum 1 identifies a directly connected reference, not a client synchronized through a stratum 2 server.
2. The switch should report stratum 3 after resynchronizing. ✓

   An NTP client normally reports one stratum higher than its selected reference, so stratum 2 yields stratum 3.
3. The switch should report stratum 2 because clients copy the server's stratum.

   NTP clients add one stratum level to represent their logical distance from the reference source.
4. The switch should report stratum 4 because the server previously operated at stratum 3.

   The client's new stratum follows the current selected server, not the server's earlier stratum value.

A client synchronized to a stratum 2 server normally operates at stratum 3.

12. Excess voice packets are dropped at the outbound interface: The class matches voice traffic, and the requireme

1. Excess voice packets are buffered and delayed until the WAN becomes available.

   Buffering and delaying excess traffic describes shaping, whereas this policy applies policing with an explicit drop action.
2. Excess voice packets are dropped at the outbound interface. ✓

   The police action explicitly transmits conforming traffic and drops traffic exceeding the two-megabit rate.
3. Voice packets are remarked to a lower DSCP value when they exceed two megabits.

   The configured exceed action is drop, and no remark action appears in the policy.
4. All outbound traffic is dropped after voice reaches two megabits per second.

   The policy applies the police action only to the VOICE class, not every outbound traffic class.

The policy polices the VOICE class and drops packets exceeding its two-megabit allowance.

Other CCNA domains

• IP Connectivity — 425 questions →
• Network Access — 340 questions →
• Network Fundamentals — 339 questions →
• Security Fundamentals — 255 questions →
• Automation and Programmability — 170 questions →
• All 1699 CCNA questions →
• CCNA certification: requirements, cost and exam format →