CCNA IP Services: 66 practice questions

12 of the 66 IP Services questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. Inside local, the private address the internal host uses: Using NAT terminology, what is 192.168.1.10 called?

1. Inside global, the public address that represents the internal host to servers on the internet after the router translates it

   Inside global is the translated public IP representing the host on the internet, which here is 203.0.113.5, not the host's private 192.168.1.10.
2. Inside local, the private address the internal host uses on the LAN before the router performs any NAT translation on it ✓

   The inside local address is the private IP assigned to the internal host - the address the host uses inside the network before NAT translates it.
3. Outside local, the address of an external host as it appears to devices inside the private network after any inbound NAT

   Outside local describes an external host as seen from inside, usually equal to outside global; it does not describe the internal host 192.168.1.10.
4. Outside global, the real public address of the remote external server as it appears to hosts outside the network

   Outside global is the real public address of the external server, not the internal host, so it does not apply to 192.168.1.10.

Inside local = the private IP of the internal host before translation. Inside global = the public IP representing that host on the internet.

2. PAT , which maps many private hosts to one public IP: Which NAT method should the network engineer configure?

1. Static NAT, which maps each private host to its own dedicated public IP through a permanent one-to-one address translation

   Static NAT creates one-to-one mappings; with only one public IP it cannot serve 150 hosts simultaneously, so it is unsuitable here.
2. Dynamic NAT, which maps private hosts to public IPs drawn on demand from a configured pool of several available addresses

   Dynamic NAT allocates from a pool of public IPs; with just one public IP it supports only one host at a time, so it cannot scale to 150 hosts.
3. PAT (NAT overload), which maps many private hosts to one public IP by assigning each session a unique source port number ✓

   PAT, also called NAT overload, maps many private addresses to a single public IP using unique source port numbers per session - ideal for one public IP with many hosts.
4. SNAT (Stateless NAT), which maps private hosts to a public IP without tracking any session state or per-flow port data

   SNAT is not a standard Cisco IOS NAT method; it is not a valid option for translating 150 hosts to a single public IP on an IOS router.

PAT (NAT overload) allows many hosts to share one public IP by differentiating sessions using unique source port numbers.

3. ntp server 10.0.0.1: Which command configures the router as an NTP client?

1. ntp master 2, which points the router at the upstream source and locks its own clock to that peer while advertising stratum 2

   'ntp master 2' makes the router itself an authoritative NTP server at stratum 2; it does not point to or synchronize from an external server.
2. ntp peer 10.0.0.1, which points the router at the upstream source in a symmetric relationship so that the two clocks sync mutually

   'ntp peer' forms a symmetric-active association for mutual sync between two servers; it is not the standard client-to-server command.
3. ntp authenticate 10.0.0.1, which points the router at the upstream source and verifies its identity before synchronizing its time

   'ntp authenticate' only enables NTP authentication as a feature and takes no server address; it does not designate a server to synchronize with.
4. ntp server 10.0.0.1, which points the router at the upstream source so the local clock synchronizes to that server as a client ✓

   'ntp server 10.0.0.1' designates a remote NTP source to synchronize to, making the local device an NTP client of 10.0.0.1.

'ntp server <ip>' makes the router an NTP client that synchronizes its clock from the specified server. 'ntp master' makes the router itself an NTP time source.

4. ip helper-address 10.99.0.10: Which command and interface resolve this?

1. ip helper-address 10.99.0.10 — configured on the VLAN 20 SVI ✓

   The 'ip helper-address' command on the client-facing SVI converts the DHCP broadcast (UDP port 67) from clients into a unicast packet forwarded to the DHCP server — enabling cross-subnet DHCP.
2. ip helper-address 10.99.0.10 — configured on the interface facing the DHCP server

   ip helper-address must be placed on the interface closest to the DHCP clients (the SVI receiving their broadcast), not on the server-side interface.
3. ip dhcp relay 10.99.0.10 — configured on the VLAN 20 SVI

   'ip dhcp relay' is not the correct Cisco IOS command. The correct command is 'ip helper-address'.
4. ip dhcp pool VLAN20 — network 10.20.0.0 255.255.255.0 — configured on the L3 switch

   Configuring a local DHCP pool on the switch would make the switch the DHCP server, bypassing the requirement to use the centralized server at 10.99.0.10.

'ip helper-address <server-ip>' on the client-side SVI forwards DHCP broadcasts across subnets as unicast to the DHCP server.

5. Discover, then Offer, then Request, then Acknowledge: What is the correct sequence of messages in the DHCP add

1. Discover, then Request, then Offer, then Acknowledge, in the order client-broadcast, client-accept, server-offer, server-confirm

   A client cannot send REQUEST before receiving an OFFER; the server's Offer must precede the client's Request, so this order is wrong.
2. Discover, then Offer, then Request, then Acknowledge, following client-broadcast, server-offer, client-accept, server-confirm ✓

   The DORA process: client broadcasts DISCOVER, server sends OFFER, client broadcasts REQUEST to accept, and server sends ACKNOWLEDGE to confirm the lease.
3. Request, then Discover, then Offer, then Acknowledge, following client-accept, client-broadcast, server-offer, server-confirm

   A client with no lease cannot send a targeted Request first; it must broadcast Discover to locate servers, so starting with Request is incorrect.
4. Offer, then Discover, then Request, then Acknowledge, as server-offer, client-broadcast, client-accept, server-confirm

   A server cannot Offer before a client Discovers; the server only replies to client-initiated messages, so leading with Offer is wrong.

DHCP follows DORA: Discover (client broadcast) → Offer (server) → Request (client broadcast) → Acknowledge (server).

6. SNMPv3 with authPriv: Which SNMP version and security level should be configured?

1. SNMPv2c with a community string, which controls access using a shared plaintext secret and provides no hashing or encryption

   SNMPv2c uses cleartext community strings with no authentication hash and no encryption, so it meets neither requirement.
2. SNMPv3 with authNoPriv, which authenticates the sender using SHA or MD5 but sends the payload in cleartext without any encryption

   authNoPriv authenticates but does not encrypt, so messages remain in cleartext and the encryption requirement is not met.
3. SNMPv3 with authPriv, which both authenticates the sender using SHA or MD5 and encrypts the payload with AES or DES for privacy ✓

   SNMPv3 authPriv provides authentication (verifying identity via MD5/SHA) and privacy (encrypting messages with AES/DES), meeting both requirements.
4. SNMPv3 with noAuthNoPriv, which provides neither sender authentication nor payload encryption for any of the SNMP management traffic

   noAuthNoPriv provides neither authentication nor privacy, equivalent to community-string security, so it meets neither requirement.

SNMPv3 authPriv = authentication + encryption. SNMPv3 authNoPriv = authentication only. SNMPv2c = cleartext community string.

7. Severity 0 through severity 4: Which syslog messages will be stored in the router's buffer?

1. Severity 4 (Warning) only, capturing solely the single configured level and excluding every other severity above and below it

   Setting level 4 does not capture only level 4; it includes level 4 and all lower-numbered, higher-severity levels 0 through 4.
2. Severity 4 (Warning) through severity 7 (Debug), capturing level 4 and every less-severe, higher-numbered level above it

   Syslog numbering is inverse: 0 is most severe, 7 least. 'buffered 4' captures 0-4, not 4-7, so the less-severe levels are excluded.
3. Severity 5 (Notification) through severity 7 (Debug), capturing only the less-severe, higher-numbered levels past the mark

   These higher-numbered, less-severe levels are excluded when buffered is 4; only levels 0 through 4 are captured.
4. Severity 0 (Emergency) through severity 4 (Warning), capturing level 4 and every more-severe, lower-numbered level below it ✓

   Logging level 4 captures Warning (4) and all higher-severity, lower-numbered messages: Emergency(0), Alert(1), Critical(2), Error(3), and Warning(4).

Syslog level 4 captures messages with severity 0–4 (Emergency, Alert, Critical, Error, Warning). Lower numbers = higher severity. Setting a level captures that level and all more severe levels.

8. Policing: Which QoS mechanism is the provider using?

1. Policing ✓

   Policing enforces a hard rate limit by dropping (or re-marking) packets that exceed the configured rate — excess traffic is discarded immediately without being buffered.
2. Shaping

   Shaping also enforces rate limits but delays (buffers) excess traffic to smooth the output rate — it does not immediately drop excess packets, causing delay instead.
3. WRED (Weighted Random Early Detection)

   WRED is a congestion avoidance mechanism that selectively drops packets before a queue is completely full to prevent TCP synchronization — it does not enforce a hard bandwidth rate limit.
4. Classification

   Classification identifies and categorizes traffic into QoS classes — it does not enforce rate limits or drop packets.

Policing drops excess traffic immediately (hard enforcement). Shaping buffers excess traffic and delays it (smooth enforcement). Both enforce rate limits but handle bursts differently.

9. crypto key generate rsa modulus 2048: Which step is missing?

1. service password-encryption, which applies Type 7 obfuscation to passwords so they do not appear in plaintext in the config

   'service password-encryption' only obscures passwords in the config; it does not create the RSA keys SSH needs, so it is not the missing step.
2. crypto key generate rsa modulus 2048, which creates the RSA key pair SSH needs to negotiate an encrypted session with clients ✓

   SSH requires an RSA key pair for its encryption. Without generating the keys, SSH cannot start even when version and VTY settings are correct.
3. ip domain-lookup, which enables DNS name resolution so the router can resolve the hostnames used during remote SSH connections

   'ip domain-lookup' enables DNS resolution and is unrelated to SSH key generation, so it does not fix failing SSH connections.
4. username admin password cisco, which creates a local account so that remote users can authenticate when they open an SSH session

   Local credentials help authenticate users, but without RSA keys SSH cannot negotiate a session at all, so this is not the missing step.

SSHv2 requires: hostname + domain name + RSA key (crypto key generate rsa) + 'ip ssh version 2' + 'transport input ssh' on VTY lines.

10. TFTP using UDP port 69: Which protocol and transport should be used?

1. FTP using TCP ports 20 and 21

   FTP requires authentication (username and password) — it does not meet the no-authentication requirement. FTP also uses TCP, not UDP.
2. SFTP using TCP port 22

   SFTP (SSH File Transfer Protocol) uses SSH and requires authentication — it does not meet the no-authentication requirement.
3. TFTP using UDP port 69 ✓

   TFTP (Trivial File Transfer Protocol) requires no authentication, uses UDP port 69, and is the standard method for transferring IOS images and configuration files on Cisco devices.
4. SCP using UDP port 69

   SCP (Secure Copy Protocol) uses SSH (TCP port 22), not UDP port 69 — and requires authentication. UDP 69 is TFTP's port, not SCP's.

TFTP uses UDP port 69 and requires no authentication — it is the standard Cisco protocol for IOS image and config file transfers. FTP uses TCP ports 20/21 and requires credentials.

11. The router assigns unique source port numbers in its PAT: How does the router distinguish return traffic desti

1. The router assigns unique source port numbers in its PAT table to steer return traffic to each host ✓

   PAT tracks both the IP and the TCP/UDP source port, assigning each outbound flow a unique port on the public IP so return traffic is matched to the correct inside host and port.
2. The router uses DSCP QoS markings recorded in its PAT table to steer return traffic to each inside host

   DSCP is a QoS priority marking, not a NAT identifier; PAT distinguishes sessions using IP addresses and port numbers, not QoS fields.
3. The router draws a distinct public IP from a NAT pool to map return traffic to each inside host

   Using multiple public IPs from a pool describes dynamic NAT, not PAT; PAT overloads a single public IP and separates sessions by unique port numbers.
4. The router records inside MAC addresses in its PAT table to map return traffic to each host

   MAC addresses are Layer 2 and are not carried in NAT tables; PAT operates at Layer 3/4 using IP addresses and ports.

PAT tracks unique source port numbers per session. Each outbound connection gets a unique port on the shared public IP. Return traffic's destination port identifies the correct inside host.

12. It syncs from a stratum 2 server that itself syncs: What does this indicate about the router's time source?

1. It is the primary stratum 1 reference clock that distributes accurate time to the whole network

   A primary reference (GPS or atomic) is stratum 1; a stratum 3 router is three hops away and is a client, not the primary reference source.
2. It syncs from a stratum 2 server that itself syncs from a stratum 1 reference clock device ✓

   Stratum counts hops from a reference clock: stratum 1 is directly attached to the reference, stratum 2 syncs from stratum 1, and stratum 3 syncs from stratum 2.
3. Its NTP synchronization has failed, so the clock is unsynchronized and unreliable now

   Stratum 3 indicates a healthy sync three hops from the reference; stratum 16 signals an unsynchronized source, while stratum 1-15 are valid.
4. It can only serve NTP time to devices that sit at stratum 1 or stratum 2 above it

   A stratum 3 server serves stratum 4 clients; stratum numbers increase away from the reference, so it cannot serve stratum 1 or 2 devices.

Stratum 3 = three hops from a reference clock. The router synchronizes from a stratum 2 server, which synchronizes from a stratum 1 server connected to an atomic/GPS clock.

Other CCNA domains

• Network Fundamentals — 116 questions →
• IP Connectivity — 97 questions →
• Network Access — 96 questions →
• Security Fundamentals — 68 questions →
• Automation and Programmability — 51 questions →
• All 494 CCNA questions →