29 IOS Command Line: Show & Configure Practice Questions & Answers

1. 1. On a Layer 3 switch, an engineer wants a one-line-per-interface summary that lists each interface's IPv4 address together with its Status and Protocol columns. Which command shows this summary?

   • A.show ip interface brief✓ Answer
   • B.show interfaces description
   • C.show ip interface
   • D.show interfaces status

   show ip interface brief prints one line per interface with the IP address, how it was assigned, and the Status (Layer 1) and Protocol (Layer 2) columns. show interfaces status is a switch-port summary of name, status, VLAN, duplex, speed and type with no IP address. show interfaces description lists status, protocol and description text but no addresses. show ip interface gives a long per-interface report (ACLs, helper address and more), not a one-line summary.

   Ref QB-T9WJ9QSource: Cisco IOS IP Addressing Services Command Reference — show ip interface (brief keyword); Cisco Catalyst command reference — show interfaces statusReport a problem with this question

2. 2. On access switch SW2, PC-A (MAC 0050.7966.6801) is supposed to be cabled to port Fa0/5 in VLAN 10. Gi0/1 is SW2's uplink trunk to the distribution switch. The MAC address table shows: Vlan Mac Address Type Ports 10 0050.7966.6801 DYNAMIC Gi0/1 What does this entry indicate?

   • A.Frames from that MAC most recently arrived on Gi0/1, so the PC's traffic enters SW2 via the uplink✓ Answer
   • B.SW2 sends frames for PC-A out Fa0/5, because the Ports column records where frames were last sent
   • C.An administrator configured this entry by hand on Gi0/1, because DYNAMIC marks a manually added MAC
   • D.The MAC was learned on Fa0/5, but the table lists the uplink because trunks own all learned entries

   A switch learns by recording the port on which a source MAC address was most recently seen, and DYNAMIC means the entry was learned from traffic (a configured entry shows STATIC). PC-A's MAC on Gi0/1 therefore means frames sourced from it are entering SW2 through the uplink, which points to the PC being cabled elsewhere, a loop, or a duplicate MAC. Trunk ports do not take over entries learned on access ports, and the Ports column is where SW2 will forward frames destined to that MAC, so SW2 would forward frames destined to PC-A out Gi0/1, not Fa0/5.

   Ref QB-ASQDPPSource: Cisco Catalyst switch command reference — show mac address-table (DYNAMIC vs STATIC entries, learned port)Report a problem with this question

3. 3. On router R1, the IPv6 interface summary shows: GigabitEthernet0/0 [up/up] FE80::C4A:7BFF:FE11:2233 2001:DB8:10::1 GigabitEthernet0/1 [up/up] FE80::C4A:7BFF:FE11:2234 What does this output show about GigabitEthernet0/1?

   • A.It has an IPv6 address from DHCPv6, and the brief view hides addresses learned from a server
   • B.It used SLAAC to form a global address, and the FE80:: line is the prefix learned from an RA
   • C.IPv6 is enabled on it, but it has only a link-local address and no global unicast address✓ Answer
   • D.IPv6 is disabled on it, and FE80:: is a placeholder shown for interfaces with no IPv6 config

   show ipv6 interface brief lists every IPv6 address on each interface. Gi0/0 shows both a link-local FE80:: address and a global unicast 2001:DB8 address, while Gi0/1 shows only FE80::, which is what an interface has after ipv6 enable or when no global address has been configured or learned. The brief view lists all addresses, including those learned by DHCPv6 or SLAAC; an interface without IPv6 shows 'unassigned' rather than an FE80:: line; and FE80:: is the interface's own link-local address, not a prefix from a router advertisement.

   Ref QB-S9J84PSource: Cisco IOS IPv6 Command Reference — show ipv6 interface (brief); IPv6 Addressing and Basic Connectivity Configuration Guide — link-local addressesReport a problem with this question

4. 4. On a distribution switch, an engineer needs one summary that lists every operational trunk port with its encapsulation, native VLAN, allowed VLANs, and the VLANs that are allowed, active and forwarding. Which command provides it?

   • A.show vtp status
   • B.show vlan brief
   • C.show interfaces trunk✓ Answer
   • D.show spanning-tree

   show interfaces trunk lists only operational trunks and prints their mode, encapsulation, status and native VLAN, then the VLANs allowed, the VLANs allowed and active, and the VLANs in spanning-tree forwarding state and not pruned. show vlan brief lists VLANs and their access ports and leaves trunk ports out. show spanning-tree shows STP roles and states per VLAN, and show vtp status shows the VTP mode, domain and revision number.

   Ref QB-DSSD7TSource: Cisco Catalyst switch command reference — show interfaces trunk; VLAN configuration guide — verifying trunk portsReport a problem with this question

5. 5. Switch ASW1 shows this spanning-tree output for VLAN 10: Root ID Priority 24586 Address 0019.aaaa.0001 Bridge ID Priority 32778 Address 0019.bbbb.0002 Interface Role Sts Cost Gi0/1 Root FWD 4 Gi0/2 Altn BLK 4 Fa0/5 Desg FWD 19 Which statement about ASW1 in VLAN 10 is correct?

   • A.ASW1 is the root, since its Bridge ID priority is numerically higher than the Root ID's
   • B.ASW1 is not the root; Gi0/2 is an alternate path to the root, blocked to prevent a loop✓ Answer
   • C.ASW1 is not the root; Fa0/5 is its path to the root, because Desg marks the root port
   • D.ASW1 is the root; Gi0/2 shows BLK because BPDU guard has error-disabled that port

   The Root ID (priority 24586, MAC 0019.aaaa.0001) differs from ASW1's own Bridge ID, so ASW1 is not the root; on the root the output says 'This bridge is the root'. Gi0/1 in Root FWD is ASW1's root port, and Gi0/2 in Altn BLK is an alternate port: a second path to the root held in blocking so it cannot form a loop. BPDU guard would leave the port err-disabled rather than Altn BLK, Desg means designated port rather than root port, and the lower bridge priority value wins the root election, so 32778 loses to 24586.

   Ref QB-V9M8MSSource: Cisco Catalyst Layer 2 configuration guide — Configuring STP/Rapid PVST+ (port roles, bridge ID); command reference — show spanning-treeReport a problem with this question

6. 6. On switch SW1, the EtherChannel summary shows this line (no legend is shown): Group Port-channel Protocol Ports 1 Po1(SU) LACP Gi0/1(P) Gi0/2(D) What does this output show?

   • A.Po1 is an in-use Layer 3 bundle; Gi0/1 is bundled, while Gi0/2 waits as a hot-standby link
   • B.Po1 is an in-use Layer 2 bundle; Gi0/1 is bundled, while Gi0/2 is down and carries nothing✓ Answer
   • C.Po1 is an in-use Layer 2 bundle; Gi0/2 is the active member, because D marks the designated one
   • D.Po1 is a suspended bundle; S marks it suspended, and U means no member port is in use yet

   In show etherchannel summary, S means Layer 2 and U means in use, so Po1(SU) is a working Layer 2 port channel. P on Gi0/1 means bundled in the port channel, and D on Gi0/2 means that member is down, so all traffic currently uses Gi0/1. A Layer 3 bundle would show R, a hot-standby member shows H, a suspended member shows a lowercase s, and D always means down, not designated.

   Ref QB-CSE32SSource: Cisco Catalyst Layer 2 configuration guide — Configuring EtherChannels; command reference — show etherchannel summary (flags)Report a problem with this question

7. 7. Router R3 sits in OSPF area 1. Its routing table contains this line: O IA 172.16.30.0/24 [110/65] via 10.0.13.1, 00:04:12, GigabitEthernet0/1 What does the code O IA tell you about this route?

   • A.OSPF learned it within area 1, from a router in the same area as R3
   • B.OSPF summarized it automatically at the classful network boundary
   • C.OSPF imported it from another routing protocol, as an external route
   • D.OSPF learned it from a different area, via an area border router✓ Answer

   In show ip route, O IA marks an OSPF inter-area route: the prefix belongs to another area and an area border router advertised it into area 1. A plain O is an intra-area route from R3's own area, O E1 or O E2 marks an external route redistributed into OSPF from another source, and OSPF does not auto-summarize at classful boundaries. The [110/65] pair is OSPF's administrative distance and the route's cost.

   Ref QB-U99WERSource: Cisco IOS IP Routing: OSPF Command Reference and IP Routing command reference — show ip route (route source codes O, IA, E1, E2)Report a problem with this question

8. 8. An engineer wants a single display that shows the OSPF router ID, the networks OSPF is routing for, and the list of passive interfaces. Which command shows all three?

   • A.show ip ospf neighbor
   • B.show ip route ospf
   • C.show ip ospf interface brief
   • D.show ip protocols✓ Answer

   show ip protocols summarizes each running routing process: for OSPF it prints the router ID, the 'Routing for Networks' statements, the 'Passive Interface(s)' list, the routing information sources and the administrative distance. show ip ospf neighbor lists adjacencies, show ip route ospf lists only OSPF-learned routes, and show ip ospf interface brief lists each OSPF interface's area, address, cost and state without the router ID or passive list.

   Ref QB-7SND6KSource: Cisco IOS IP Routing: Protocol-Independent Command Reference — show ip protocolsReport a problem with this question

9. 9. An engineer needs a list showing each OSPF neighbor's router ID, its adjacency state (such as FULL/DR or 2WAY/DROTHER), its address and the local interface it was learned on, one line per neighbor. Which command provides this list?

   • A.show ip route ospf
   • B.show ip ospf neighbor✓ Answer
   • C.show ip ospf interface
   • D.show ip ospf database

   show ip ospf neighbor prints one line per neighbor with the neighbor ID (its router ID), priority, state and DR role, dead time, neighbor address and local interface. show ip ospf database lists the LSAs in the link-state database, show ip ospf interface gives per-interface details such as cost, network type, timers and DR/BDR, and show ip route ospf lists the OSPF routes installed in the routing table.

   Ref QB-P9G8KJSource: Cisco IOS IP Routing: OSPF Command Reference — show ip ospf neighborReport a problem with this question

10. 10. Router DS2 shows this HSRP summary: Interface Grp Pri P State Active Standby Virtual IP Vl10 10 90 P Standby 10.10.10.3 local 10.10.10.1 Which statement is correct?

    • A.DS2 is the standby router; the P flag shows preemption is disabled on this group
    • B.DS2 is the standby router; 10.10.10.3 forwards traffic for gateway 10.10.10.1✓ Answer
    • C.DS2 is the active router; 10.10.10.3 is the standby that takes over if DS2 fails
    • D.DS2 is the standby router; hosts must use 10.10.10.3 as their default gateway

    In show standby brief, State Standby means this router (DS2) is the standby, the Active column gives the real address of the active router (10.10.10.3), and 'local' in the Standby column refers to DS2 itself. The active router answers for the Virtual IP 10.10.10.1, which is the address hosts use as their default gateway, not 10.10.10.3. The P column means preemption is configured on DS2, not disabled.

    Ref QB-NPUERASource: Cisco IOS First Hop Redundancy Protocols Command Reference — show standby (brief); FHRP Configuration Guide — Configuring HSRPReport a problem with this question

11. 11. On an edge router performing PAT, an engineer wants to see each current mapping of an internal host's inside local address and port to its inside global address and port. Which command shows these mappings?

    • A.show ip interface
    • B.show ip nat statistics
    • C.show access-lists
    • D.show ip nat translations✓ Answer

    show ip nat translations lists every active entry with the protocol and the Inside global, Inside local, Outside local and Outside global addresses and ports. show ip nat statistics gives totals (active translations, hits and misses, inside and outside interfaces, pool usage) but not individual mappings. show access-lists shows the ACL that selects which traffic is translated, with match counters, and show ip interface shows per-interface IP settings, including whether NAT is enabled on the inside or outside.

    Ref QB-672MBBSource: Cisco IOS IP Addressing Services Command Reference — show ip nat translations; IP Addressing: NAT Configuration GuideReport a problem with this question

12. 12. A router is acting as the DHCP server for two user subnets. An engineer needs to list each IPv4 address the router has leased, with the client's hardware address or client ID and the lease expiration. Which command shows this?

    • A.show ip arp
    • B.show ip dhcp binding✓ Answer
    • C.show ip interface
    • D.show ip dhcp pool

    show ip dhcp binding lists every lease the IOS DHCP server has handed out: the IP address, the client ID or hardware address, the lease expiration and the binding type. show ip dhcp pool shows each pool's subnet, address range and counts of leased addresses rather than the individual clients. show ip arp shows IP-to-MAC mappings learned through ARP, whether or not DHCP assigned them, and show ip interface shows interface settings such as the helper address.

    Ref QB-MPG4K9Source: Cisco IOS IP Addressing Services Command Reference — show ip dhcp binding; DHCP Configuration Guide — Configuring the Cisco IOS DHCP ServerReport a problem with this question

13. 13. An access switch displays this for port Fa0/7: Port Security : Enabled Port Status : Secure-shutdown Violation Mode : Shutdown Maximum MAC Addresses : 1 Total MAC Addresses : 1 Security Violation Count : 1 Last Source Address:Vlan : 0011.2233.4455:10 Which statement describes the state of Fa0/7?

    • A.An administrator shut the port down, and the counter shows one manual shutdown event
    • B.The port still forwards for its learned MAC and only drops frames from 0011.2233.4455
    • C.The port is waiting for 0011.2233.4455 to be learned as sticky before it forwards traffic
    • D.A frame from 0011.2233.4455 broke the one-MAC limit, so the port is now err-disabled✓ Answer

    show port-security interface reports Port Status Secure-shutdown when a violation in shutdown mode (the default) has err-disabled the port. With a maximum of 1 address already in use, a frame from a second source, recorded as the last source address 0011.2233.4455, raised the violation count to 1 and shut the port, so it forwards nothing until it is recovered. Forwarding for the learned MAC while dropping the intruder is what protect or restrict mode does; a manual shutdown does not raise the violation counter; and sticky learning does not hold a port down.

    Ref QB-57P96ASource: Cisco Catalyst security configuration guide — Configuring Port Security (violation modes); command reference — show port-security interfaceReport a problem with this question

14. 14. Router R2 should be filtering traffic with an IPv4 ACL on GigabitEthernet0/1. Which command most directly confirms which ACL is applied to that interface and in which direction?

    • A.show interfaces g0/1
    • B.show ip interface brief
    • C.show ip interface g0/1✓ Answer
    • D.show access-lists

    show ip interface for a specific interface prints the lines 'Outgoing access list is ...' and 'Inbound access list is ...', naming the ACL applied in each direction (or 'not set'). show access-lists displays each ACL's entries, sequence numbers and match counters but not which interface uses it. show interfaces g0/1 reports Layer 1 and Layer 2 status and counters, and show ip interface brief shows only addresses with Status and Protocol.

    Ref QB-KP5SD8Source: Cisco IOS IP Addressing Services Command Reference — show ip interface; Security Configuration Guide: Access Control Lists — verifying ACL applicationReport a problem with this question

15. 15. After several changes, a technician wants to see the configuration stored in NVRAM, which the switch will load at its next reload, to compare it with what is currently running. Which command displays that saved configuration?

    • A.show startup-config✓ Answer
    • B.show flash:
    • C.show running-config
    • D.show version

    show startup-config displays the configuration saved in NVRAM, which is loaded at boot, so changes not yet saved with copy running-config startup-config are absent from it. show running-config displays the active configuration in RAM, including unsaved changes. show version reports the software version, uptime, image file and configuration register, and show flash: lists the files stored in flash memory.

    Ref QB-47BXY8Source: Cisco IOS Configuration Fundamentals Command Reference — show startup-config, show running-config; Managing Configuration Files configuration guideReport a problem with this question

16. 16. On router R1, interface GigabitEthernet0/0 is the only IPv6 router on its segment. At R1(config-if)#, the engineer must give it a global unicast address in 2001:db8:acad:1::/64 whose interface ID is built from the interface's MAC address. Which command does this?

    • A.ipv6 address 2001:db8:acad:1::/64 anycast
    • B.ipv6 address 2001:db8:acad:1::/64 eui-64✓ Answer
    • C.ipv6 address autoconfig default
    • D.ipv6 address 2001:db8:acad:1::1/64

    The eui-64 keyword takes the configured /64 prefix and builds the low 64 bits from the interface MAC address: it splits the MAC, inserts FFFE and flips the seventh bit. The ::1/64 form sets a manually chosen interface ID that has nothing to do with the MAC. The autoconfig default form makes the interface learn its prefix from another router's router advertisements and install a default route, but no other router is on this segment. The anycast keyword marks the address as anycast and uses it exactly as typed, with no MAC-derived interface ID.

    Ref QB-JPSE87Source: Cisco IOS IPv6 Command Reference, ipv6 address eui-64; Cisco IPv6 Addressing and Basic Connectivity Configuration Guide (modified EUI-64 interface identifiers)Report a problem with this question

17. 17. Router R2's GigabitEthernet0/1 must use the first usable host address of the subnet 198.51.100.64/27. Which command, entered at R2(config-if)#, configures the interface correctly?

    • A.ip address 198.51.100.65 0.0.0.31
    • B.ip address 198.51.100.65 255.255.255.240
    • C.ip address 198.51.100.65 255.255.255.224✓ Answer
    • D.ip address 198.51.100.64 255.255.255.224

    A /27 mask is 255.255.255.224, which gives blocks of 32 addresses, so this subnet runs from network address .64 to broadcast .95 and its first usable host is .65. Entering .64 with the /27 mask assigns the network address itself, and IOS rejects it with a bad-mask error. Entering .65 with 255.255.255.240 is accepted but places the interface in 198.51.100.64/28 (hosts .65 to .78), the wrong subnet. 0.0.0.31 is a wildcard mask; the ip address command requires a dotted-decimal subnet mask and rejects it.

    Ref QB-37YKT7Source: Cisco IOS IP Addressing Services Command Reference, ip address; RFC 950 (Internet Standard Subnetting Procedure)Report a problem with this question

18. 18. Trunk port Gi0/24 on switch DSW1 currently allows VLANs 10, 20, 30 and 40. VLAN 30 must stop crossing this trunk, while VLANs 10, 20 and 40 stay allowed and no other VLAN is added to the list. Which command, entered at DSW1(config-if)#, does this?

    • A.switchport trunk allowed vlan except 30
    • B.switchport trunk allowed vlan 30
    • C.switchport trunk allowed vlan add 30
    • D.switchport trunk allowed vlan remove 30✓ Answer

    The remove keyword deletes only the listed VLAN from the current allowed list, leaving 10, 20 and 40 in place. With no keyword, the command replaces the whole list, so only VLAN 30 would be allowed. The except keyword allows every VLAN from 1 to 4094 except 30, which re-admits many VLANs that were not on the list. The add keyword appends VLAN 30 to the list; since it is already there, nothing changes.

    Ref QB-HPE436Source: Cisco Catalyst switch command reference, switchport trunk allowed vlan (add, all, except, none, remove keywords)Report a problem with this question

19. 19. On router BR1, changes were made in global configuration mode, and they must survive the next reload. Which command, entered at BR1#, saves them so that the router loads them when it boots?

    • A.copy running-config startup-config✓ Answer
    • B.copy startup-config running-config
    • C.copy running-config flash:
    • D.copy running-config tftp:

    The running configuration lives in RAM and is lost on reload, while the startup configuration in NVRAM is what the router reads at boot, so the running configuration must be copied to startup-config (equivalent to write memory). Copying startup-config to running-config goes the other way: it merges the saved file into the active configuration and saves nothing. Copying to tftp: sends a backup to a remote server, which the router does not read at boot. Copying to flash: writes a separate file in flash memory, which is not the startup configuration the router loads.

    Ref QB-27M9N6Source: Cisco IOS Configuration Fundamentals Command Reference, copy running-config startup-config; Managing Configuration Files configuration guideReport a problem with this question

20. 20. Router R3 has the route ip route 172.16.0.0 255.255.0.0 10.0.0.2 with default settings. A backup path through 10.0.0.6 must be used only if the route through 10.0.0.2 is lost. Which command, entered in global configuration mode, adds the backup route?

    • A.ip route 172.16.0.0 255.255.0.0 10.0.0.6 tag 5
    • B.ip route 172.16.0.0 255.255.0.0 10.0.0.2 5
    • C.ip route 172.16.0.0 255.255.0.0 10.0.0.6
    • D.ip route 172.16.0.0 255.255.0.0 10.0.0.6 5✓ Answer

    A bare number at the end of ip route sets the administrative distance; a static route defaults to 1, so a backup with distance 5 is less preferred and stays out of the routing table until the primary route is removed, which makes it a floating static route. Without a distance, both routes have AD 1 and the router load-shares across them. Re-entering the route through 10.0.0.2 with 5 only changes the primary route's distance and configures no backup at all. The tag 5 option sets a route tag for policy matching and leaves the distance at 1, so the router again load-shares.

    Ref QB-MB4J8MSource: Cisco IOS IP Routing: Protocol-Independent Command Reference, ip route (distance argument); IP Static Routes configuration guide (floating static routes)Report a problem with this question

21. 21. Router EDGE1 has IP routing enabled. Every packet whose destination matches no more specific route must be sent to the ISP router at 203.0.113.1. Which global configuration command does this?

    • A.ip route 0.0.0.0 0.0.0.0 Null0
    • B.ip default-network 203.0.113.0
    • C.ip default-gateway 203.0.113.1
    • D.ip route 0.0.0.0 0.0.0.0 203.0.113.1✓ Answer

    A static route to 0.0.0.0 0.0.0.0 has a zero-length prefix, so it matches every destination that no longer prefix matches, and with 203.0.113.1 as the next hop it becomes the gateway of last resort. ip default-gateway is used only when IP routing is disabled, as on a Layer 2 switch, so a routing router ignores it for forwarding. The Null0 default route sends unmatched packets to the discard interface, dropping them. ip default-network flags an existing network as a candidate default and needs a route to that network; it does not itself install 203.0.113.1 as the next hop.

    Ref QB-4UWCNKSource: Cisco IOS IP Routing: Protocol-Independent Command Reference, ip route, ip default-network and ip default-gatewayReport a problem with this question

22. 22. Router R4 has GigabitEthernet0/0 at 192.168.10.1/24, GigabitEthernet0/1 at 192.168.11.1/24 and GigabitEthernet0/2 at 192.168.12.1/24. Using a single network statement at R4(config-router)# under router ospf 1, the engineer must place G0/0 and G0/1 in area 0 and leave G0/2 out of OSPF. Which command does this?

    • A.network 192.168.10.0 0.0.7.255 area 0
    • B.network 192.168.11.0 0.0.0.255 area 0
    • C.network 192.168.10.0 0.0.1.255 area 0✓ Answer
    • D.network 192.168.10.0 0.0.0.255 area 0

    OSPF enables every interface whose address matches the network statement, where a 1 bit in the wildcard means ignore. The wildcard 0.0.1.255 ignores the last bit of the third octet, so it matches 192.168.10.0 through 192.168.11.255, which covers G0/0 and G0/1 but not 192.168.12.1. The wildcard 0.0.0.255 with 192.168.10.0 matches only G0/0. The wildcard 0.0.7.255 matches 192.168.8.0 through 192.168.15.255, which also pulls in G0/2. 192.168.11.0 with 0.0.0.255 matches only G0/1.

    Ref QB-KBR73KSource: Cisco IOS IP Routing: OSPF Command Reference, network area (wildcard mask matching)Report a problem with this question

23. 23. At R2(config-if)# for interface GigabitEthernet0/1, the engineer must enable OSPF process 10 in area 0 directly on this interface, without using any network statement under the routing process. Which command does this?

    • A.ip ospf 10 area 0✓ Answer
    • B.ip ospf cost 10
    • C.ip ospf mtu-ignore
    • D.ip ospf priority 0

    The interface command ip ospf process-id area area-id attaches the interface to that OSPF process and area, so OSPF advertises its subnet and sends hellos on it with no network statement needed. ip ospf cost 10 only sets the interface's OSPF cost and does not enable OSPF. ip ospf priority 0 only makes the interface ineligible to become DR or BDR. ip ospf mtu-ignore only turns off the MTU check in database description packets. None of those three enables OSPF on the interface.

    Ref QB-3UJ2GJSource: Cisco IOS IP Routing: OSPF Command Reference, ip ospf area; ip ospf cost, ip ospf priority and ip ospf mtu-ignoreReport a problem with this question

24. 24. Router R1's GigabitEthernet0/0 connects to the user LAN 10.1.50.0/24. Extended ACL 110 denies Telnet from that LAN to server 10.9.9.10 and then permits all other IP traffic. Following the rule of placing extended ACLs close to the source, the engineer applies it on G0/0. Which command, entered at R1(config-if)# for G0/0, filters the users' traffic correctly?

    • A.ip access-group 110 out
    • B.access-class 110 in
    • C.ip access-group 110 in✓ Answer
    • D.access-class 110 out

    Packets from the users arrive on G0/0, so the ACL must be applied inbound there with ip access-group 110 in to examine them as they enter the router. Applied out, the same ACL examines only packets the router sends toward the LAN, such as replies, so the users' Telnet sessions are never matched. access-class is a line configuration command used under line vty to filter management sessions to the router itself, not an interface filter, in either direction.

    Ref QB-PBT7KPSource: Cisco IOS Security Command Reference, ip access-group and access-class; Security Configuration Guide: Access Control Lists (applying an ACL to an interface)Report a problem with this question

25. 25. On router R5, GigabitEthernet0/0 (10.1.1.1/24) faces the LAN and is marked ip nat inside. GigabitEthernet0/1 holds the single public address assigned by the ISP and is marked ip nat outside. Access list 1 permits 10.1.1.0 0.0.0.255, and no NAT pool exists. All LAN hosts must share the G0/1 address. Which global configuration command completes PAT?

    • A.ip nat inside source list 1 pool PUBLIC-POOL overload
    • B.ip nat inside source list 1 interface GigabitEthernet0/1 overload✓ Answer
    • C.ip nat inside source list 1 interface GigabitEthernet0/0 overload
    • D.ip nat inside source static 10.1.1.9 interface GigabitEthernet0/1

    PAT translates every source address matched by access list 1 to the address of the named outside interface, and the overload keyword lets all hosts share it by tracking port numbers. Naming GigabitEthernet0/0 would translate to the private LAN address, which cannot be routed on the internet. The static form maps only host 10.1.1.9 to the G0/1 address, so the other hosts get no translation. The pool form refers to PUBLIC-POOL, which does not exist, so no addresses are available to translate to.

    Ref QB-6UM2ZNSource: Cisco IOS IP Addressing Services Command Reference, ip nat inside source (list, interface, overload); NAT configuration guide (configuring PAT)Report a problem with this question

26. 26. On router R1, the engineer has entered ip dhcp pool VLAN20 and a network command for 10.10.20.0/24. At R1(dhcp-config)#, which command makes DHCP clients receive 10.10.20.1 as their default gateway?

    • A.default-router 10.10.20.1✓ Answer
    • B.dns-server 10.10.20.1
    • C.netbios-name-server 10.10.20.1
    • D.next-server 10.10.20.1

    In DHCP pool configuration mode, default-router sets the router option that clients install as their default gateway. dns-server sets the DNS server address that clients use for name resolution. next-server sets the boot server that clients contact for a boot file, as used for network booting. netbios-name-server sets the WINS server option for NetBIOS name resolution. Only default-router supplies the gateway.

    Ref QB-NBFVDNSource: Cisco IOS IP Addressing Services Command Reference, default-router (DHCP pool configuration); DHCP server configuration guideReport a problem with this question

27. 27. Switch SW1 has a non-default hostname and a local user created with username ... secret. When the engineer enters crypto key generate rsa modulus 2048 to prepare for SSH, IOS rejects the command and asks for a domain name to be defined first. Which global configuration command fixes this?

    • A.ip domain-name example.com✓ Answer
    • B.ip host example.com 192.0.2.10
    • C.ip domain-list example.com
    • D.ip name-server 192.0.2.53

    IOS names the RSA key pair from the hostname and the device's default domain name, so ip domain-name (also accepted as ip domain name on IOS XE) must be set before the keys can be generated. ip name-server only tells the device which DNS server to query for lookups. ip host only creates a static name-to-address mapping in the host table. ip domain-list only sets search suffixes appended to unqualified names during lookups; it does not define the device's own domain name used for the keys.

    Ref QB-5U9QTMSource: Cisco Secure Shell Configuration Guide (prerequisites: hostname and ip domain-name before crypto key generate rsa); Cisco IOS Security Command Reference, crypto key generate rsaReport a problem with this question

28. 28. Access port Fa0/10 on switch ASW1 connects to a single PC. At ASW1(config-if)#, the port must move to forwarding immediately when the link comes up, and it must be err-disabled if it ever receives a BPDU. Which pair of commands does this?

    • A.spanning-tree portfast; spanning-tree guard loop
    • B.spanning-tree portfast; spanning-tree bpdufilter enable
    • C.spanning-tree portfast; spanning-tree bpduguard enable✓ Answer
    • D.spanning-tree portfast; spanning-tree guard root

    spanning-tree portfast lets an edge port skip the listening and learning delay, and spanning-tree bpduguard enable err-disables the port as soon as any BPDU arrives. spanning-tree guard root puts the port into a root-inconsistent blocking state only when a superior BPDU arrives, and it recovers automatically, so the port is never err-disabled. spanning-tree bpdufilter enable stops the port from sending and processing BPDUs instead of shutting it down. spanning-tree guard loop blocks a port that stops receiving BPDUs, which is the opposite condition.

    Ref QB-GBP7JFSource: Cisco Catalyst switch Layer 2 configuration guide, Configuring Optional Spanning-Tree Features (PortFast, BPDU guard, BPDU filtering, root guard, loop guard)Report a problem with this question

29. 29. Access port Fa0/3 on switch SW2 already has switchport mode access and switchport port-security configured. At SW2(config-if)#, the port must accept up to two MAC addresses, learn them dynamically, and write them into the running configuration as secure addresses. Which pair of commands does this?

    • A.switchport port-security maximum 2; switchport port-security mac-address sticky✓ Answer
    • B.switchport port-security maximum 2; switchport port-security violation protect
    • C.switchport port-security maximum 2; switchport port-security aging time 2
    • D.switchport port-security maximum 2; switchport port-security violation restrict

    maximum 2 raises the secure address limit from its default of one, and mac-address sticky converts dynamically learned addresses into sticky secure entries that appear in the running configuration. violation restrict only changes what happens when a third address appears: frames are dropped, logged and counted. aging time 2 only sets how many minutes secure addresses are kept before they age out. violation protect only drops the offending frames silently. None of those three writes learned addresses into the configuration.

    Ref QB-YTG2YESource: Cisco Catalyst switch security configuration guide, Configuring Port Security (maximum, sticky MAC addresses, violation modes, aging)Report a problem with this question

Practice questions written to Cisco's published CCNA 200-301 exam topics and the IEEE and IETF standards behind them. Cisco and CCNA are trademarks of Cisco Systems, Inc.; this site is not affiliated with or endorsed by Cisco. Exam topics are revised periodically — check the current official topic list before you book. About the CCNA exam (Cisco) →