Practice Chapters 11-15

Question 1

11.1 Which of the following are disadvantages of using NAT? (Choose three.)

A. Translation introduces switching path delays.
B. NAT conserves legally registered addresses.
C. NAT causes loss of end-to-end IP traceability.
D. NAT increases flexibility when connecting to the Internet.
E. Certain applications will not function with NAT enabled.
F. NAT reduces address overlap occurrence.

Answer 1

A, C, E. NAT is not perfect and can cause some issues in some networks. In most networks, it works just fine. NAT can cause delays and troubleshooting problems, and some applications just won’t work with it.

Question 2

11.2 Which of the following are advantages of using NAT? (Choose three.)

A. Translation introduces switching path delays.
B. NAT conserves legally registered addresses.
C. NAT causes loss of end-to-end IP traceability.
D. NAT increases flexibility when connecting to the Internet.
E. Certain applications will not function with NAT enabled.
F. NAT remedies address overlap occurrence.

Answer 2

B, D, F. NAT is not perfect, but there are some advantages. It conserves global addresses, allowing us to add millions of hosts to the Internet without “real” IP addresses. This provides flexibility in our corporate networks. NAT can also allow you to use the same subnet more than once in the same network without overlapping networks.

Question 3

11.3 Which command will allow you to see real-time translations on your router?

A. show ip nat translations
B. show ip nat statistics
C. debug ip nat
D. clear ip nat translations *

Answer 3

C. The command debug ip nat will show you in real time the translations occurring on your router.

Question 4

11.4 Which command will show you all the translations active on your router?

A. show ip nat translations
B. show ip nat statistics
C. debug ip nat
D. clear ip nat translations *

Answer 4

A. The command show ip nat translations will show you the translation table containing all the active NAT entries.

Question 5

11.5 Which command will clear all the translations active on your router?

A. show ip nat translations
B. show ip nat statistics
C. debug ip nat
D. clear ip nat translations *

Answer 5

D. The command clear ip nat translations * will clear all the active NAT entries in your translation table.

Question 6

11.6 Which command will show you the summary of the NAT configuration?

A. show ip nat translations
B. show ip nat statistics
C. debug ip nat
D. clear ip nat translations *
E. clear ip nat sh config summ *

Answer 6

B. The show ip nat statistics command displays a summary of the NAT configuration as well as counts of active translation types, hits to an existing mapping, misses (an attempt to create a mapping), and expired translations. *

Question 7

11.7 Which command will create a dynamic pool named Todd that will provide you with 30 global addresses?

A. ip nat pool Todd 171.16.10.65 171.16.10.94 net 255.255.255.240
B. ip nat pool Todd 171.16.10.65 171.16.10.94 net 255.255.255.224
C. ip nat pool todd 171.16.10.65 171.16.10.94 net 255.255.255.224
D. ip nat pool Todd 171.16.10.1 171.16.10.254 net 255.255.255.0

Answer 7

B. The command ip nat pool name creates the address pool that hosts can use to get onto the global Internet. What makes option B correct is that the range 171.16.10.65 through 171.16.10.94 includes 30 hosts, but the mask has to match 30 hosts as well, and that mask is 255.255.255.224. Option C is wrong because there is a lowercase t in the pool name. Pool names are case sensitive.

Question 8

11.8 Which of the following are methods of NAT? (Choose three.)

A. Static
B. IP NAT pool
C. Dynamic
D. NAT double-translation
E. Overload

Answer 8

A, C, E. You can configure NAT three ways on a Cisco router: static, dynamic, and NAT Overload (PAT).

Question 9

11.9 When creating a pool of global addresses, which of the following can be used instead of the netmask command?

A. / (slash notation)
B. prefix-length
C. no mask
D. block-size

Answer 9

B. Instead of the netmask command, you can use the prefix-length length statement.

Question 10

11.10 Which of the following would be a good starting point for troubleshooting if your router is not translating?

A. Reboot.
B. Call Cisco.
C. Check your interfaces for the correct configuration.
D. Run the debug all command.

Answer 10

C. In order for NAT to provide translation services, you must have ip nat inside and ip nat outside configured on your router’s interfaces.

Question 11

12.1 How can you efficiently restrict the read-only function of a requesting SNMP management station based on the IP address?

A. Place an ACL on the logical control plane.
B. Place an ACL on the line when configuring the RO community string.
C. Place an ACL on the VTY line.
D. Place an ACL on all router interfaces.

Answer 11

B. You can enter the ACL directly in the SNMP configuration to provide security, using either a number or a name.

Question 12

12.2 A switch is configured with the snmp-server community Cisco RO command running SNMPv2c. An NMS is trying to communicate to this router via SNMP. What can be performed by the NMS? (Choose two.)

A. The NMS can only graph obtained results.
B. The NMS can graph obtained results and change the hostname of the router.
C. The NMS can only change the hostname of the router.
D. The NMS can use GETBULK and return many results.

Answer 12

A, D. With a read-only community string, no changes can be made to the router. However, SNMPv2c can use GETBULK to create and return multiple requests at once.

Question 13

12.3 Which is true regarding SNMP? (Choose two.)

A. SNMPv2c offers more security than SNMPv1.
B. SNMPv3 uses TCP and introduced the GETBULK operation.
C. SNMPv2c introduced the INFORM operation.
D. SNMPv3 provides the best security of the three versions.

Answer 13

C, D. SNMPv2c introduced the GETBULK and INFORM SNMP messages but didn’t offer any more security than SNMPv1. SNMPv3 uses TCP and provides encryption and authentication.

Question 14

12.4 Which command can you use to determine the IP address of a directly connected neighbor?

A. show cdp
B. show cdp neighbors
C. show cdp neighbors detail
D. show neighbor detail

Answer 14

C. This command can be run on both routers and switches, and it displays detailed information about each device connected to the device you’re running the command on,
including the IP address.

Question 15

12.5 According to the output, which interface does SW-2 use to connect to SW-3?
SW-3#sh cdp neighbors
Capability Codes: R - Router, T - Trans Bridge, B - Source Route BridgeS -
Switch, H - Host, I - IGMP, r - Repeater, P - Phone, D - Remote, C - CVTA, M
- Two-port Mac Relay Device ID
Local Intrfce Holdtme Capability Platform Port ID
SW-1 Fas 0/1 170 S I WS-C3560- Fas 0/15
SW-1 Fas 0/2 170 S I WS-C3560- Fas 0/16
SW-2 Fas 0/5 162 S I WS-C3560- Fas 0/2

A. Fas 0/1
B. Fas 0/16
C. Fas 0/2
D. Fas 0/5

Answer 15

C. The Port ID column describes the interfaces on the remote device end of the connection.

Question 16

12.6 Which of the following commands enables syslog on a Cisco device with debugging as the level?

A. syslog 172.16.10.1
B. logging 172.16.10.1
C. remote console 172.16.10.1 syslog debugging
D. transmit console messages level 7 172.16.10.1

Answer 16

B. Syslog levels range from 0–7, and level 7 (known as Debugging or local7) is the default if you were to use the logging ip_address command from global config.

Question 17

12.7 What is the default syslog facility level?

A. local4
B. local5
C. local6
D. local7

Answer 17

D. By default, Cisco IOS devices use facility local7. Moreover, most Cisco devices provide options to change the facility level from their default value.

Question 18

12.8 Which three statements about syslog utilization are true? (Choose three.)

A. Utilizing syslog improves network performance.
B. The syslog server automatically notifies the network administrator of network problems.
C. A syslog server provides the storage space necessary to store log files without using router disk space.
D. There are more syslog messages available within Cisco IOS than there are comparable SNMP trap messages.
E. Enabling syslog on a router automatically enables NTP for accurate time stamping.
F. A syslog server helps in aggregation of logs and alerts.

Answer 18

C, D, F. There are significantly more syslog messages available within IOS as compared to SNMP Trap messages. System logging is a method of collecting messages from devices to a server running a syslog daemon. Logging to a central syslog server helps in aggregation of logs and alerts.

Question 19

12.9 You need to configure all your routers and switches so they synchronize their clocks from one time source. Which command will you type for each device?

A. clock synchronization ip_address
B. ntp master ip_address
C. sync ntp ip_address
D. ntp server ip_address version number

Answer 19

D. To enable a device to be an NTP client, use the ntp server IP_address version number command at global configuration mode. That’s all there is to it! Assuming your NTP server is working, of course.

Question 20

12.10 A network administrator enters the following command on a router: logging trap 3. Choose the three message types that will be sent to the syslog server:

A. Informational
B. Emergency
C. Warning
D. Critical
E. Debug
F. Error

Answer 20

B, D, F. If you specify a level with the logging trap level command, that level and all the higher levels will be logged. For example, when you use the logging trap 3 command, emergencies, alerts, critical, and error messages will be logged. Only three of these were
listed as possible options.

Question 21

12.11 Which two of the following commands are required when configuring SSH on your router? (Choose two.)

A. enable secret password
B. exec-timeout 0 0
C. ip domain-name name
D. username name password password
E. ip ssh version 2

Answer 21

C, D. To configure SSH on your router, you need to set the username command, the IP domain name, login local, transport input ssh under the VTY lines and the crypto key command. SSH version 2 is suggested but not required.

Question 22

15.1. Which of the following commands will enable AAA on a router?
A. aaa enable
B. enable aaa
C. new-model aaa
D. aaa new-model

Answer 22

D. To enable the AAA commands on a router or switch, use the global configuration command aaa new-model.

Question 23

15.2 Which of the following will mitigate access layer threats? (Choose two.)
A. Port security
B. Access lists
C. Dynamic ARP inspection
D. AAA

Answer 23

A, C. To mitigate access layer threats, use port security, DHCP snooping, dynamic ARP inspection, and identity-based networking.

Question 24

15.3 Which of the following is not true about DHCP snooping? (Choose two.)

A. Validates DHCP messages received from untrusted sources and filters out invalid messages.
B. Builds and maintains the DHCP snooping binding database, which contains information about trusted hosts with leased IP addresses.
C. Rate-limits DHCP traffic from trusted and untrusted sources.
D. DHCP snooping is a layer 2 security feature that acts like a firewall between hosts.

Answer 24

C, D. The key words in the question are not true. DHCP snooping validates DHCP messages, builds and maintains the DHCP snooping binding database, and rate-limits DHCP traffic for trusted and untrusted source.

Question 25

15.4 Which of the following are true about TACACS+? (Choose two.)

A. TACACS+ is a Cisco proprietary security mechanism.
B. TACACS+ uses UDP.
C. TACACS+ combines authentication and authorization services as a single process—after users are authenticated, they are also authorized.
D. TACACS+ offers multiprotocol support.

Answer 25

A, D. TACACS+ uses TCP, is Cisco proprietary, and offers multiprotocol support as well as separated AAA services.

Question 26

15.5 Which of the following is not true about RADIUS?

A. RADIUS is an open standard protocol.
B. RADIUS separates AAA services.
C. RADIUS uses UDP.
D. RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted.

Answer 26

B. Unlike TACACS+, which separates AAA services, this is not an option when configuring RADIUS.

Question 27

15.6 You want to configure RADIUS so your network devices have external authentication, but you also need to make sure you can fallback to local authentication. Which command will you use?

A. aaa authentication login local group MyRadiusGroup
B. aaa authentication login group MyRadiusGroup fallback local
C. aaa authentication login default group MyRadiusGroup external local
D. aaa authentication login default group MyRadiusGroup local

Answer 27

D. The correct answer is option D. Take your newly created RADIUS group and use it for authentication and be sure to use the keyword local at the end.

Question 28

15.7 Which is true about DAI?

A. It must use TCP, BootP, and DHCP snooping in order to work.
B. DHCP snooping is required in order to build the MAC-to-IP bindings for DAI validation.
C. DAI is required in order to build the MAC-to-IP which protects against man in the middle attacks.
D. DAI tracks ICMP-to-MAC bindings from DHCP.

Answer 28

B. DAI, used with DHCP snooping, tracks IP-to-MAC bindings from DHCP transactions to protect against ARP poisoning. DHCP snooping is required in order to build the MACto- IP bindings for DAI validation.

Question 29

15.8 The IEEE 802.1x standard allows you to implement identity-based networking on wired and wireless hosts by using client-server access control. There are three roles. Which of the following are these three roles?

A. Client
B. Forwarder
C. Security Access Control
D. Authenticator
E. Authentication Server

Answer 29

A, D, E. There are three roles: Client, also referred to as a supplicant, is software that runs on a client that is 802.1x compliant. The authenticator is typically a switch that controls physical access to the network and is a proxy between the client and the authentication server. The authentication server (RADIUS) authenticates each client before many available any services.

Question 30

15.9 Which of the following is not a password alternative?

A. Multi-Factor Authentication (MFA)
B. Malware lookups
C. Biometrics
D. Certificates

Answer 30

B. MFA, biometrics, and certificates are all password alternatives.

Question 31

15.10 Security Awareness is not defined by which of the following?

A. Smart card
B. User awareness
C. Training
D. Physical security

Answer 31

A. A security program that is backed by a security policy is one of the best ways to maintain a secure posture at all times. This program should cover many elements, but three
are key: user awareness, training, and physical security.

Question 32

15.11 Which of the following are examples of a TCP/IP weakness? (Choose three.)

A. Trojan horse
B. HTML attack
C. Session replaying
D. Application-layer attack
E. SNMP
F. SMTP

Answer 32

C, E, F. There are many problems with the IP stack, especially in Microsoft products. Session replaying is a weakness that is found in TCP. Both SNMP and SMTP are listed by Cisco as inherently insecure protocols in the TCP/IP stack.

Question 33

15.12 Which Cisco IOS feature would you use to protect TCP server from TCP SYN-flooding attacks?

A. Rerouting
B. TCP intercept
C. Access control lists
D. Encryption

Answer 33

B. The TCP intercept feature implements software to protect TCP servers from TCP SYNflooding attacks, which are a type of denial-of-service attack.

Question 34

15.13 Which of the following can be used to counter an unauthorized access attempt? (Choose three.)

A. Encrypted data
B. Cisco Lock and Key
C. Access Lists
D. PAP
E. CHAP
F. IKE
G. TACACS

Answer 34

B, E, G. By using the Cisco Lock and Key along with CHAP and TACACS, you can create a more secure network and help stop unauthorized access.

Question 35

15.14 Which one of the following threats is an example of snooping and network sniffing?

A. Repudiation
B. Masquerade threats
C. Eavesdropping
D. DoS

Answer 35

C. Network snooping and packet sniffing are common terms for eavesdropping.

Question 36

15.15 In a masquerade attack, what does an attacker steal when pretending to come from a trusted host?

A. Account identification
B. User group
C. IP address
D. CHAP password

Answer 36

C. IP spoofing is fairly easy to stop once you understand the way spoofing takes place. An IP spoofing attack occurs when an attacker outside your network pretends to be a trusted computer by using an IP address that is within the range of IP addresses for your network. The attacker wants to steal an IP address from a trusted source so it can use this to gain access to network resources.

Question 37

14.1 What is the default priority setting on an HSRP router?

A. 25
B. 50
C. 100
D. 125

Answer 37

C. By setting a higher number than the default on a router, that router would become the active router. Setting preempt would assure that if the active router went down, it would become the active router again when it come back up.

Question 38

14.2 What is a true regarding any type of FHRP? (Choose two.)

A. The FHRP supplies hosts with routing information.
B. The FHRP is a routing protocol.
C. The FHRP provides default gateway redundancy.
D. The FHRP is only standards-based.

Answer 38

C. The idea of a first hop redundancy protocol is to provide redundancy for a default gateway.

Question 39

14.3 Which of the following are an HSRP state? (Choose two.)

A. INIT
B. ACTIVE
C. ESTABLISHED
D. IDLE

Answer 39

A, B. A router interface can be in many states with HSRP, and Established and Idle are not HSRP states.

Question 40

14.4 Which command configures an interface to enable HSRP with the virtual router IP address 10.1.1.10?

A. standby 1 ip 10.1.1.10
B. ip hsrp 1 standby 10.1.1.10
C. hsrp 1 ip 10.1.1.10
D. standby 1 hsrp ip 10.1.1.10

Answer 40

A. Only option D has the correct sequence to enable HSRP on an interface.

Question 41

14.5 Which command displays the status of all HSRP groups on a Cisco router or layer 3 switch?

A. show ip hsrp
B. show hsrp
C. show standby hsrp
D. show standby
E. show hsrp groups

Answer 41

D. This is a question that I used in a lot of job interviews on prospects. Show standby is your friend when dealing with HSRP.

Question 42

14.6 Two routers are part of an HSRP standby group and there’s no priority configured on the routers for the HSRP group. Which of the following statements is correct?

A. Both router will be in the active state.
B. Both routers will be in the standby state.
C. Both routers will be in the listen state.
D. One router will be active the other standby.

Answer 42

D. There’s nothing wrong with leaving the priorities at the defaults of 100. The first router up with be the active router.

Question 43

14.7 Which of the following statements is true about the HSRP version 1 hello packet?

A. HSRP hello packets are sent to multicast address 224.0.0.5.
B. HSRP RP hello packets are sent to multicast address 224.0.0.2 with TCP port 1985.
C. HSRP hello packets are sent to multicast address 224.0.0.2 with UDP port 1985.
D. HSRP hello packets are sent to multicast address 224.0.0.10 with UDP port 1986.

Answer 43

C. In version 1, HSRP messages are sent to the multicast IP address 224.0.0.2 and UDP port 1985. HSRP version 2 uses the multicast IP address 224.0.0.102 and UDP port 1985.

Question 44

14.8 Routers HSRP1 and HSRP2 are in HSRP group 1. HSRP1 is the active router with a priority of 120 and HSRP2 has the default priority. When HSRP1 reboots, HSRP2 will become the active router. Once HSRP1 comes back up, which of the following statements will be true? (Choose two.)

A. HSRP1 will become the active router.
B. HSRP2 will stay the active router.
C. HSRP1 will become the active router if it is also configured to preempt.
D. Both routers will go into Speak state.

Answer 44

B, C. If HSRP1 is configured to preempt, then it will become active because of the higher priority. If not, HSRP2 will remain the active router.

Question 45

14.9 What’s the multicast and port number used for HSRP version 2?

A. 224.0.0.2, UDP port 1985
B. 224.0.0.2. TCP port 1985
C. 224.0.0.102, UDP port 1985
D. 224.0.0.102, TCP port 1985

Answer 45

C. In version 1, HSRP messages are sent to the multicast IP address 224.0.0.2 and UDP port 1985. HSRP version 2 uses the multicast IP address 224.0.0.102 and UDP port 1985.

Question 46

15.1 Which two of the following are GRE characteristics? (Choose two.)
A. GRE encapsulation uses a protocol-type field in the GRE header to support the encapsulation of any OSI layer 3 protocol.
B. GRE itself is stateful. It includes flow-control mechanisms, by default.
C. GRE includes strong security mechanisms to protect its payload.
D. The GRE header, together with the tunneling IP header, creates at least 24 bytes of additional overhead for tunneled packets

Answer 46

A, D. GRE tunnels have the following characteristics: GRE uses a protocol-type field in the GRE header so any layer 3 protocol can be used through the tunnel, GRE is stateless and has no flow control, GRE offers no security, and GRE creates additional overhead for tunneled packets—at least 24 bytes.

Question 47

15.2 A GRE tunnel is flapping with the following error message:
07:11:49: %LINEPROTO-5-UPDOWN:
Line protocol on Interface Tunnel0, changed state to up
07:11:55: %TUN-5-RECURDOWN:
Tunnel0 temporarily disabled due to recursive routing
07:11:59: %LINEPROTO-5-UPDOWN:
Line protocol on Interface Tunnel0, changed state to down
07:12:59: %LINEPROTO-5-UPDOWN:
What could be the reason for this?

A. IP routing hasn’t been enabled on tunnel interface.
B. There is an MTU issue on the tunnel interface.
C. The router is trying to route to the tunnel destination address using the tunnel interface
itself.
D. Access-list is blocking traffic on the tunnel interface.

Answer 47

C. If you receive this flapping message when you configure your GRE tunnel, it means you used your tunnel interface address instead of the tunnel destination address.

Question 48

15.3 Which of the following commands will not tell you if the GRE tunnel 0 is in “up/up” state?

A. show ip interface | brief
B. show interface tunnel 0
C. show ip interface tunnel 0
D. show run interface tunnel 0

Answer 48

D. The show running-config interface tunnel 0 command will show you the configuration of the interface, not the status of the tunnel.

Question 49

15.4 You’ve configured a serial interface with GRE IP commands on a corporate router with a point-to-point link to a remote office. Which command will show you the IP addresses and tunnel source and destination addresses of the interfaces?

A. show int serial 0/0
B. show ip int brief
C. show interface tunnel 0
D. show tunnel ip status
E. debug ip interface tunnel

Answer 49

C. The show interfaces tunnel 0 command shows the configuration settings and the interface status as well as the IP address and tunnel source and destination address.

Question 50

15.5 You want to allow remote users to send protected packets to the corporate site, but you don’t want to install software on the remote client machines. What’s the best solution you could implement?

A. GRE tunnel
B. Web VPN
C. VPN Anywhere
D. IPsec

Answer 50

B. All web browsers support Secure Sockets Layer (SSL), and SSL VPNs are known as Web VPNs. Remote users can use their browser to create an encrypted connection and they don’t need to install any software. GRE doesn’t encrypt the data.

Question 51

15.6 Which of the following are benefits to using a VPN in your internetwork? (Choose three.)

A. Security
B. Private high-bandwidth links
C. Cost savings
D. Incompatibility with broadband technologies
E. Scalability

Answer 51

A, C, E. VPNs can provide good security by using advanced encryption and authentication protocols, which help protect your network from unauthorized access. By connecting the corporate remote offices to their closest Internet provider and then creating a VPN tunnel with encryption and authentication, you’ll gain a huge savings over opting for traditional leased point-to-point lines. VPNs scale very well to quickly bring up new offices or have mobile users connect securely while traveling or when connecting from home. VPNs are very compatible with broadband technologies.

Question 52

15.7 Which two technologies are examples of layer 2 MPLS VPN technologies? (Choose two.)

A. VPLS
B. DMVPM
C. GETVPN
D. VPWS

Answer 52

A, D. Internet providers who have an existing Layer 2 network may choose to use layer 2 VPNs instead of the other common layer 3 MPLS VPN. Virtual Private Lan Switch (VPLS) and Virtual Private Wire Service (VPWS) are two technologies that provide layer 2 MPLS VPNs.

Question 53

15.8 Which of the following is an industry-wide standard suite of protocols and algorithms that allows for secure data transmission over an IP-based network that functions at the layer 3 Network layer of the OSI model?

A. HDLC
B. Cable
C. VPN
D. IPsec
E. xDSL

Answer 53

D. IPsec is an industry-wide standard suite of protocols and algorithms that allows for secure data transmission over an IP-based network that functions at the layer 3 Network layer of the OSI model.

Question 54

15.9 Which of the following describes the creation of private networks across the Internet, enabling privacy and tunneling of non-TCP/IP protocols?

A. HDLC
B. Cable
C. VPN
D. IPsec
E. xDSL

Answer 54

C. A VPN allows or describes the creation of private networks across the Internet, enabling privacy and tunneling of TCP/IP protocols. A VPN can be set up across any type of link.

Question 55

15.10 Which two VPNs are examples of service provider-managed VPNs? (Choose two.)

A. Remote-access VPNs
B. Layer 2 MPLS VPN
C. Layer 3 MPLS VPN
D. DMVPN

Answer 55

B, C. Layer 2 MPLS VPNs and the more popular Layer 3 MPLS VPN are services provided to customers and managed by the provider.