| 1: | An administrator creates an access list prohibiting Telnet on his router. He then successfully initiates a Telnet session from the router. What is the most likely reason the access list failed?
|
| 2: | Which of the following are valid reasons to implement access lists? (Choose three.)
|
| 3: | Which of the following are types of access lists? (Choose three.)
|
| 4: | Which types of access lists can filter traffic based on the source port? (Choose two.)
|
| 5: | Which type of access list can filter based only on the source address of a packet?
|
| 6: | Which of the following identifiers can be used for standard access lists? (Choose two.)
|
| 7: | Which of the following identifiers can be used for extended access lists? (Choose two.)
|
| 8: | Which access list type allows you to delete entries in a specific access list?
|
| 9: | You are filtering traffic to an FTP site and you want only FTP traffic to reach the server. You do not want additional traffic to reach the server. Which traffic should be allowed?
|
| 10: | You have established a DNS server on one of your networks. You need to permit traffic, including queries and zone transfers, to the DNS server using access lists. Which traffic should be allowed?
|
| 11: | What happens to a packet that does not meet the conditions of any access list filters?
|
| 12: | Which of the following statements regarding outbound access lists are correct? (Choose two.)
|
| 13: | Which of the following statements regarding inbound access lists are correct? (Choose three.)
|
| 14: | You create an access list with a single entry to deny all FTP traffic. Which of the following is the most accurate statement regarding this access list?
|
| 15: | You have an IP address and wildcard mask of 172.16.99.25 0.0.255.255. Which of the following IP addresses are affected by this rule? (Choose two.)
|
| 16: | You have an IP address and wildcard mask of 10.0.20.5 255.255.0.0. Which of the following IP addresses are affected by this rule? (Choose two.)
|
| 17: | Which of the following is an abbreviation for the access list entry 172.16.32.3 0.0.0.0?
|
| 18: | What is the abbreviation for the wildcard mask of all ones?
|
| 19: | You want to create an access list to filter all traffic from the 172.16.16.0 255.255.240.0 network. What wildcard mask is appropriate?
|
| 20: | You want to create an access list to filter all traffic from the 10.0.64.0 255.255.224.0 network. What wildcard mask is appropriate?
|
| 21: | Regarding access lists, which of the following statements is correct?
|
| 22: | Which of the following is accurate regarding the ordering of access lists?
|
| 23: | You have an internal web server that must be accessed from the corporate Internet connection. This internal web server has the IP address 172.16.55.10. The router accesses the Internet through the FastEthernet0/1 interface. What NAT syntax is necessary to forward HTTP requests to the internal web server?
|
| 24: | You would like to configure NAT for a small office DSL connection, as shown in the figure below. Users on the 192.168.254.0/24 network should share the public address assigned to the router's Ethernet 0/3 interface for public access. In addition, one of the internal users (192.168.254.32) is running an FTP server containing files that need to be accessed from the Internet. Which of the following configurations accomplishes these objectives? Small office DSL connection.
|
| 25: | You create an access list in Notepad in preparation to apply it to an interface. Before you add the lines to the access list, you apply the list to the intended interface. What is the result?
|
| 26: | Network Address Translation (NAT) typically translates between one or more internal private addresses to public Internet addresses. What ranges are defined in RFC 1918 as internal private addresses? (Choose three.)
|
| 27: | You are troubleshooting a NAT configuration on your 2514 router. It seems that all of the syntax is in place, but users are not able to access the Internet. You are able to ping Internet websites from your router successfully. What is the most likely cause of the problem? Relevant router configuration: interface fastethernet 0
|
| 28: | Which of the following creates a standard access list that allows traffic from the 172.16 subnet?
|
| 29: | Which of the following access list lines denies access to a computer with an IP of 172.16.0.5?
|
| 30: | You want to create an access list that denies port 23 TCP traffic from the 172.30.10.0 network and that is destined for the 172.30.20.0 network. Which of the following commands accomplishes this?
|
| 31: | You want to create an access list that denies all outbound traffic to port 80 from the 10.10.0.0 network. Which access list entry meets your requirements?
|
| 32: | Which of the following forms of NAT allows you to translate one group of IP addresses to another in a 1:1 relationship with minimal configuration?
|
| 33: | You are configuring the Internet connection for the network pictured in the figure below. The initial NAT Overload configuration has been set up; you must now publish the internal FTP and web server to the Internet. What commands accomplish this? (Choose two.) Internet network connection.
|
| 34: | You want to use access list 1 to filter traffic on your inbound vty lines. What command do you enter?
|
| 35: | Which of the following statements are correct regarding the placement of access lists? (Choose two.)
|
| 36: | What command allows you to view access lists applied to interface serial 0/1?
|
| 37: | You want to view all entries in all access lists on your router. What is the appropriate command to enter?
|
| 38: | You need to link an extended access list to an Ethernet interface on your router. What command properly configures the interface?
|
| 39: | You need to permit SSH traffic. What port do you need to allow in your access lists?
|
| 40: | You are hosting a POP3-based email server that users need to access. You need to deny all traffic except to the POP3 server. What port must you allow?
|
| 41: | You want to prevent Telnet access to your router. After the access list is created, what configuration mode is appropriate to apply it?
|
| 42: | You want to prevent Telnet access through your router. What configuration mode is appropriate?
|
| 43: | You want to create access lists for vty lines. You also want to create an admin access list and a regular user access list. You've been told you should use the same access list for each line. Why should the same access lists be applied to all vty lines?
|
| 44: | You are troubleshooting a standard access list and realize that an incorrect entry has been made. You want to remove the incorrect entry. What steps must you take?
|
| 45: | You are troubleshooting a named access list and realize that an incorrect entry has been made. You want to remove the incorrect entry. What steps must you take?
|
| 46: | You are configuring an office to use a Cisco router to connect to the Internet. The onsite network administrator would like to publish an internal email server, two internal web servers, and an internal FTP server to the Internet so outside users can access them. What is necessary for this configuration?
|
| 47: | You are creating an access list entry to control access to a vty line. Which configuration mode should you be in to create the entry?
|
| 48: | Which keyword, when used with the access-list command, sends a message to the console?
|
| 49: | You want to remove access restrictions on your vty lines, after previously applying access list filters. What command should you enter?
|
| 50: | You need to devise a wildcard mask that checks the first four bits of an octet. Which of the following is correct?
|
| A1: | Answer: D. Access lists stop traffic going through the router—not traffic originating from the router, as in this scenario. Therefore, the administrator's Telnet session is able to connect. A is incorrect because Telnet uses TCP. B is incorrect. Telnet does use TCP traffic, but this is not the most likely cause of the problem. C is incorrect. Telnet connects to remote port 23 by default; however, the issue here is that the session initiated from the router, and access lists filter only traffic going through the router. |
| A2: | Answers: A, B, and C. Access lists can be used with QoS in implementing priority and custom queuing. Access lists can filter routing protocol updates. Access lists can also specify interesting traffic to trigger dial-on-demand routing. D is incorrect because access lists aren't used for console port security. |
| A3: | Answers: A, B, and E. Standard access lists check the packet's source address. Extended access lists check both source and destination packet addresses and other parts of the packets. Named access lists allow the use of a friendly name for the access list. C is incorrect because there are no restricted access lists. D is incorrect because there are no static access lists. F is incorrect, as there are no unnamed access lists. |
| A4: | Answers: B and E. Extended access lists can use source and destination information, including the source port, and named access lists can be either extended or standard, so they have the capability to filter based on the source port. A is incorrect because standard access lists can filter on source address information, but not source port. C is incorrect, as there are no restricted access lists. D is incorrect because there are no static access lists. F is incorrect because there are no unnamed access lists. |
| A5: | Answer: A. Standard access lists can filter based only on the source address, subnet, or source host IP address of a packet. B is incorrect because extended access lists can use source and destination information, including the source port. C is incorrect, as there are no dynamic access lists. D is incorrect because there are no static access lists. E is incorrect; if the named access list is an extended access list, this does not hold true. F is incorrect because there are no unnamed access lists. |
| A6: | Answers: A and D. Standard access lists can range from 1–99 and IP Standard Expanded ranges from 1300–1999. B is incorrect because this value is in the range for extended access lists. C is incorrect, as this is not a valid identifier for access lists. |
| A7: | Answers: B and C. Extended access lists can range from 100–199 and IP Extended Expanded ranges from 2000–2699. A is incorrect, as this is a standard access list identifier. D is incorrect, as this is outside the range of standard and extended access lists. |
| A8: | Answer: C. Named access lists allow the deletion of individual lines anywhere in the access list. The newer IOS versions support a named access list that can even add lines in between other lines. A is incorrect because standard access lists do not allow the deletion of specific lines. B is incorrect because extended access lists do not allow the deletion of specific lines. D is incorrect, as there are no unnamed access lists. |
| A9: | Answer: A. FTP uses TCP and ports 20 and 21. B is incorrect, as FTP uses TCP. C is incorrect because port 20 is required as well. D is incorrect, as UDP is not necessary. |
| A10: | Answer: A. TCP and UDP traffic need to be allowed on port 53. TCP is used typically by zone transfers, whereas UDP is used for queries. B is incorrect because port 69 is used by finger. C is incorrect, as port 67 is used by DHCP. D is incorrect because DNS queries use UDP and port 53. |
| A11: | Answer: C. A packet that does not meet any filters is dropped. A is incorrect because the packet is discarded instead of being routed. B is incorrect, as there is no mechanism to flag the packet. D is incorrect; although it is conceivable that an administrator could be notified, by default the packet is simply dropped. |
| A12: | Answers: A and D. No access list can filter packets originating from the router, and outbound access lists, if they are extended, can drop packets based on protocol numbers. B is incorrect because the filtering takes place after a routing decision has been made. C is incorrect because as the routing decision has been made, the router has already dropped packets that are not routable. |
| A13: | Answers: A, B, and D. No access lists can filter packets originating from a router; a routing decision has not been made until after the access list is processed; and extended access lists can be used as inbound access lists and can therefore filter packets based on protocol number. C is incorrect because the routeability of packets has not yet been determined, and access lists do not make routing judgments. |
| A14: | Answer: B. Because there is no permit statement and access lists end with an implicit deny all, no traffic is permitted. A is incorrect; this statement is true, but all traffic is denied, not just FTP traffic. C is incorrect because no traffic is permitted. D is incorrect, as all traffic is denied because of the lack of any permit statements. |
| A15: | Answers: A and D. The indicated mask affects the 172.16.0.0 network, so 172.16.99.1 and 172.16.1.1 are affected. B and C are incorrect, as 192.168.0.0 and 172.30 don't match the bits that matter—those set to 0 in the mask. |
| A16: | Answers: B and C. The significant bits are the last 16, indicated by the wildcard mask of 255.255.0.0. The IP addresses 192.168.20.5 and 172.30.20.5 match the last two octets, or 16 bits, of the 10.0.20.5 IP address. A and D are incorrect; although the first portions of the IP address match, it is the last two octets that are significant. |
| A17: | Answer: B. To abbreviate the all-0 wildcard mask, use the keyword host to specify a single host. A and D are incorrect, as this is invalid syntax. C is incorrect because this syntax results in an error message. |
| A18: | Answer: C. You can replace 255.255.255.255 with the keyword any. A, B, and D are all invalid syntax options. |
| A19: | Answer: B. The wildcard mask 0.0.15.255 affects the 172.16.16.0 255.255.240.0 network. In the third octet, the first four bits are checked in binary, resulting in 00000000.00000000.00001111.11111111. A is incorrect, as this does not match the given problem, checking too many bits (five) in the last octet. C is incorrect because this mask checks only three bits in the third octet. D is incorrect because this mask checks only two bits in the third octet. |
| A20: | Answer: C. The subnet mask, in the third octet as binary, is 1110 0000. This indicates that the first three bits are significant in the wildcard mask, and the last five bits of the third octet are not checked. This gives 00011111 in the third octet, which is 31 in decimal notation. A is incorrect, as this wildcard mask checks too many bits (five) in the third octet. B is incorrect because this choice checks four bits in the IP, which are too few. D is incorrect because this choice considers only two bits significant in the third octet, which are too few for the example. |
| A21: | Answer: A. You may create only one access list per protocol, per direction, per interface. B is incorrect because you can have multiple access lists for a single port number and only one per direction. C is incorrect, as you may have only one access list per protocol, not per port number. D is incorrect because you may not have more than one access list per interface, which is not listed. |
| A22: | Answer: D. Access lists are processed from the top down, so ordering is very important. A is incorrect, as named access list lines can be deleted from anywhere, but insertions are at the end. B is incorrect; ordering is important, because after a rule is matched, processing ends. C is incorrect. More general rules should be placed at the end; otherwise, traffic might be unintentionally affected by the filter, whereas specific rules might not be applied because they are never processed. |
| A23: | Answer: B. The ip nat syntax can be quite cryptic because the Cisco router gives you plenty of flexibility with the form and directions of NAT translation. In this case, you are looking to create a static NAT translation to allow TCP port 80 (HTTP) to pass through the Cisco router to the internal web server. There are two ways to accomplish this: You can create a static NAT translation from the inside perspective or from the outside perspective. In this question, the only correct answer is the translation performed from the inside: ip nat inside source static tcp 172.16.55.10 80 interface fastEthernet 0/1 80. If you were to perform the static NAT translation from the outside perspective, you would not be given the option to choose to translate from an interface (fastEthernet 0/1, in this case). All other answers result in an invalid syntax message. |
| A24: | Answer: C. This is a fairly complex NAT configuration that combines both static NAT and NAT Overload features into a single configuration. First, all interfaces on the router are marked as either inside or outside NAT interfaces. Second, a standard access list needs to be created that shows the router what addresses should be translated. Third, the NAT Overload configuration is applied as coming from the addresses in access-list 50 going to the fastEthernet 2/0 interface. Finally, the static NAT translation is defined for port 21 (FTP) from the internal host (192.168.254.32) to the fastEthernet 2/0 interface. Answer A is incorrect because it is missing the static NAT translation. It also uses invalid syntax on the NAT Overload configuration. The Cisco router cannot translate from one interface to another; it always needs an access list defining the internal range. Answer B is incorrect because it is missing the protocol (TCP) and port number (21) for the static NAT translation and also uses the same invalid NAT Overload configuration as answer A. Answer D is incorrect because the static NAT translation goes between interfaces rather than to an internal IP address. The overload keyword is also missing from the NAT Overload syntax. This means only one IP address at a time can access the Internet. |
| A25: | Answer: B. If an empty access list is applied to an interface, all traffic is permitted through the interface. C is incorrect because traffic is allowed through the interface, not blocked. A and D are incorrect because you do not receive an error message. |
| A26: | Answers: A, D, and E. RFC 1918 defines a private address range for each of the three classes of usable addresses: Class A: 10.0.0.0/8, Class B: 172.16.0.0/16–172.31.255.255/16, and Class C: 192.168.0.0/24–192.168.255.255/24. Answer B is incorrect because it defines only one of the Class B ranges that are considered private; any address from the range 172.16.0.0/16–172.31.255.255/16 is considered a private address. Answer C is incorrect because this range represents addresses that are automatically assigned to a computer when it cannot obtain a valid address through DHCP (these are called local link addresses). They are not defined in RFC 1918 as a private address. Answer F is incorrect because this is the first range of Class D addresses, which are used for multicast. |
| A27: | Answer: B. The NAT configuration is missing the ip nat inside command under the fastethernet 0 interface. Without this command, the router does not know the interface it should use when translating internal, source addresses. Answer A is incorrect because static routes can be pointed to an exit interface or a next-hop address. Answer C is incorrect because Static NAT is commonly combined with NAT Overload features to accomplish required objectives. Answer D is incorrect because…well, this should be pretty obvious. |
| A28: | Answer: A. This answer has the correct syntax of the access-list command followed by the list number, permit/deny, and IP address, and a wildcard mask. B and D are incorrect because they indicate an extended access list. C is incorrect because the wildcard mask has been reversed. |
| A29: | Answer: B. This command uses the host keyword to specify a single host. A is incorrect, as deny follows the access list number. C is incorrect because the wildcard mask should be all zeros. D is incorrect because the access list number represents an extended access list. |
| A30: | Answer: C. An extended access list is required, and 101 fits. Additionally, this answer shows deny properly preceding tcp in the syntax. A is incorrect because deny should precede tcp. B and D are incorrect because the access list numbers are for a standard access list. |
| A31: | Answer: D. Use the any keyword to specify all destinations. A is incorrect because no destination is specified. B is incorrect, as this specifies a standard access list. C is incorrect because all is not the proper keyword. |
| A32: | Answer: D. Dynamic NAT allows you to configure multiple pools of IP addresses and translate between them. The router dynamically matches each IP address to one another as a request is made. Answer A is incorrect because Port Address Translation (PAT) is just another name for NAT Overload. Answer B is incorrect. Although Static NAT could perform this task, it would take quite a bit of configuration to manually map IP addresses in large pools. Answer C is incorrect because NAT Overload takes a group of IP addresses and translates them to a single (overloaded) IP address. |
| A33: | Answers: C and D. The generic Static NAT syntax for TCP translations is ip nat inside source static tcp |
| A34: | Answer: D. The access-class 1 in command is used to apply access-list 1 inbound to the vty interface. A is incorrect because the access-group command is used on physical interfaces. B is incorrect because the vty keyword is invalid. C is incorrect because the access-list command is used to create access list entries. |
| A35: | Answers: A and D. Extended access lists should go near the source of the traffic, and standard access lists should go close to the destination. B is incorrect because extended access lists close to the destination cause routers to process more packets than necessary. C is incorrect because standard access lists close to the source may drop too much traffic and prohibit network communications. |
| A36: | Answer: C. The correct syntax is show ip interface serial 0/1, which displays detailed information about the interface, including the applied access lists. A is incorrect, as this is invalid syntax and results in an error. B and D are invalid commands. |
| A37: | Answer: C. The show access-lists command is correct and displays each access list defined on the device, as well as its entries. A is incorrect because the keyword ip is used only if you want to see the IP standard and extended access lists. It does not show you any MAC address, IPX, or AppleTalk access lists, and the question specifically states you would like to see all access lists. B and D are incorrect because the keyword all is invalid. |
| A38: | Answer: B. To apply the access list to an interface, enter Interface Configuration mode and use the ip access-group command, specifying the list and direction. A is incorrect, as the interface is not specified in the command, but by entering Interface Configuration mode. C is incorrect, as access-group is the correct command, and the direction is not specified. D is incorrect because the command is access-group, not access-list. |
| A39: | Answer: A. SSH uses port 22. B is incorrect, as port 23 is used by Telnet. C is incorrect, as port 69 is used by finger. D is incorrect because port 443 is used by HTTPS. |
| A40: | Answer: C. POP3 uses TCP port 110. A is incorrect, as SMTP uses port 25. B is incorrect, as IMAP uses port 143. D is incorrect because port 443 is used by HTTPS. |
| A41: | Answer: D. You need to apply the access list to a vty line in Line Configuration mode for it to be effective. A is incorrect because even though you are in Privileged EXEC mode, this answer is too general. B is incorrect, as the access list is created in Global Configuration mode. C is incorrect because vty access is controlled by Line Configuration mode, not Interface Configuration mode. |
| A42: | Answer: C. You need to restrict Telnet traffic through the appropriate interfaces. A is incorrect because Privileged EXEC mode is not specific. B is incorrect because Global Configuration mode is used to create the access list. D is incorrect because Line Configuration mode can be used to control Telnet access to the router, but not through it. |
| A43: | Answer: D. You cannot choose which line you connect to when telnetting from an outside location, so it is typically best to apply the same rules for each line. A is incorrect because although you do want to keep intruders out, this is not the best reason. B is not correct, as this is effectively what you are doing, but it is not a compelling reason to do so. C is incorrect because you do not have to apply the same list to each line. |
| A44: | Answer: C. You must delete the list and re-create it entirely. The remaining responses are incorrect because you cannot selectively delete lines. |
| A45: | Answer: D. You can selectively delete lines in named access lists, and only in named access lists. C is incorrect because although you could re-create the entire list, it is much more work than is necessary. A and B are incorrect because you cannot selectively delete lines. |
| A46: | Answer: D. NAT can accomplish some pretty amazing feats; however, sharing an IP address for two servers that use the same port number is not one of them. In this case, you need two public Internet addresses to allow both internal web servers to be accessed on TCP port 80. The other servers can use port 21 (FTP) and port 25 (SMTP) on either of the public Internet IP addresses. Answer A could be used to solve this problem, but it is not the best solution because it is more costly to deploy than answer D. B is incorrect because NAT Overload allows the servers to share only a single IP address when accessing the Internet, not when the requests originate from the Internet. Answer C is incorrect because you can map only TCP port 80 on the single IP address to one of the internal web servers. The other cannot be accessed from the Internet. |
| A47: | Answer: B. Access list entries are created and defined in Global Configuration mode. A is incorrect because Privileged EXEC mode is too general. C is incorrect, as vty lines are configured in Line Configuration mode, but access list entries are created in Global Configuration mode. D is incorrect because Line Configuration mode is for applying the access list. |
| A48: | Answer: B. The log option sends a message to the console. A, C, and D are all invalid keywords. |
| A49: | Answer: C. The no access-class 1 command removes the access list from the vty line. A and B are incorrect, as they are not valid commands on the vty line. D is incorrect, as there is no delete switch in the syntax. |
| A50: | Answer: A. A 0 indicates the bit is checked or significant. B is incorrect because the first four bits are ignored. C is incorrect because the first two bits are ignored. D is incorrect because the first six bits are checked. |
