20 IP Services Practice Questions & Answers

Every IP Services practice question from the Cisco CCNA 200-301 Practice Test, with the correct answer and a short explanation.

Start practice test →

1. Branch router BR1 performs PAT for internal users. One translation entry shows internal host 10.1.1.10, source port 51000, mapped to 203.0.113.5 port 1025 while it talks to a web server at 198.51.100.20 port 443. Which NAT term describes 203.0.113.5?
- A.Inside local
- B.Outside global
- C.Inside global✓ Answer
- D.Outside local
Inside global is the public address that represents an inside host to the outside world. 10.1.1.10 is the inside local (private) address, and 198.51.100.20 is the outside global address of the web server; because no outside translation is done, the outside local address equals it.
Ref QB-CYS9SRSource: Cisco CCNA 200-301 Exam Topics — 4.1 Inside source NAT (inside local/inside global terminology)Report a problem with this question
2. Router EDGE1 has an ACL matching 10.20.0.0/24, a NAT pool containing the single public address 203.0.113.9, and a rule linking the ACL to the pool. Interfaces are correctly marked inside and outside. The first user reaches the internet, but every other user fails, and NAT statistics show misses climbing. What fixes this?
- A.Change the ACL to match the pool address instead
- B.Shorten the dynamic translation timeout value
- C.Enable overload so hosts share the address by port✓ Answer
- D.Swap the inside and outside interface markings
Without overload, dynamic NAT is one-to-one: the single pool address is bound to the first host, so later hosts find no free address and are counted as misses. Adding overload turns the rule into PAT, which distinguishes hosts by source port so all of them can share 203.0.113.9.
Ref QB-UFM47RSource: Cisco CCNA 200-301 Exam Topics — 4.1 Inside source NAT (dynamic pool vs PAT overload)Report a problem with this question
3. On router R5, G0/0 (10.1.1.1/24) connects to the LAN and G0/1 (203.0.113.2/30) connects to the ISP. The PAT ACL permits 10.1.1.0/24 and overload uses the G0/1 address. G0/0 is marked as NAT outside and G0/1 as NAT inside. Users cannot reach the internet and the translation table stays empty. What is the cause?
- A.PAT requires a pool rather than an interface address
- B.The ACL must permit the ISP-facing address instead
- C.Dynamic entries appear only after the timeout expires
- D.The inside and outside interface roles are reversed✓ Answer
Inside source NAT translates packets that arrive on an inside interface and leave through an outside interface while matching the ACL. With the LAN marked outside, packets from 10.1.1.0/24 never enter on an inside interface, so no translation is created. PAT can use an interface address, and the ACL must match inside local addresses.
Ref QB-BYEXKQSource: Cisco CCNA 200-301 Exam Topics — 4.1 Inside source NAT (inside/outside interface designation)Report a problem with this question
4. A mail server at 10.0.5.25 must accept connections started by hosts on the internet, using public address 203.0.113.25 at all times, even if the server has not sent any traffic first. Which NAT method meets this requirement?
- A.PAT overloading the outside interface address
- B.Dynamic NAT with a pool including 203.0.113.25
- C.Static NAT mapping 10.0.5.25 to 203.0.113.25✓ Answer
- D.Dynamic NAT with an ACL matching only 10.0.5.25
Static NAT creates a permanent one-to-one entry that is always in the translation table, so inbound sessions to 203.0.113.25 are translated even before the server sends anything. Dynamic NAT and PAT build entries only when an inside host initiates traffic, so unsolicited inbound connections have nothing to match.
Ref QB-TF9SZPSource: Cisco CCNA 200-301 Exam Topics — 4.1 Inside source NAT (static NAT)Report a problem with this question
5. Router R2 is configured as an NTP client of router R1 only. On R2, the NTP status reports that the clock is synchronized at stratum 4 with R1 as its reference. At what stratum is R1 operating?
- A.Stratum 3✓ Answer
- B.Stratum 1
- C.Stratum 5
- D.Stratum 4
Stratum counts hops from the reference clock, and a synchronized client takes its server's stratum plus 1. Because R2 reports stratum 4 with R1 as its reference, R1 must be at stratum 3.
Ref QB-AY3MEPSource: Cisco CCNA 200-301 Exam Topics — 4.2 NTP client and server mode (stratum)Report a problem with this question
6. During an incident review, an engineer finds that router CORE2's log timestamps cannot be lined up with other devices. NTP status on CORE2 reports: clock is unsynchronized, stratum 16, no reference clock. What does this indicate?
- A.It is 16 hops away from an atomic clock
- B.It is not synchronized to any time source✓ Answer
- C.It is synced but uses the wrong time zone
- D.It is acting as a master clock at stratum 16
In NTP, stratum 16 is the reserved value meaning unsynchronized; it is not a real hop count. Until CORE2 synchronizes to a server, its clock can drift, so its syslog timestamps cannot be correlated with other devices and time-dependent checks such as certificate validity are unreliable.
Ref QB-SFWEUNSource: Cisco CCNA 200-301 Exam Topics — 4.2 NTP client and server mode (stratum 16 = unsynchronized)Report a problem with this question
7. A PC receives DHCPOFFER messages from two DHCP servers on its subnet. What does the PC send next, and how is that message addressed?
- A.A Request, broadcast so every server sees the choice✓ Answer
- B.A Request, unicast only to the server it picked
- C.A second Discover, broadcast to confirm the offer
- D.An Acknowledge, unicast to the server it picked
In the DORA exchange the client answers an offer with a DHCPREQUEST that is broadcast, because it still has no confirmed address and because every offering server must learn which offer was accepted so the others can release their reserved addresses. The Acknowledge is sent by the server, not the client.
Ref QB-9YQ99NSource: Cisco CCNA 200-301 Exam Topics — 4.3 Role of DHCP (DORA); RFC 2131Report a problem with this question
8. An administrator wants shop.example.net to resolve to the same server as www.example.net, so that if the server's IPv4 address changes, only one record has to be updated. What kind of record should shop.example.net be?
- A.A PTR record pointing to www.example.net
- B.An MX record pointing to www.example.net
- C.An A record holding the server's IPv4 address
- D.A CNAME record pointing to www.example.net✓ Answer
A CNAME makes one name an alias of another, so resolving shop.example.net follows the alias to www.example.net and uses its A record; changing that single A record updates both names. A second A record would have to be edited separately, PTR records map addresses back to names, and MX records identify mail servers.
Ref QB-VPE524Source: Cisco CCNA 200-301 Exam Topics — 4.3 Role of DNS (record types); RFC 1035Report a problem with this question
9. On a router that cannot reach any name server, a technician mistypes 'shwo version' in privileged EXEC mode. The CLI prints a 'Translating...' message and hangs for several seconds. Why does this happen?
- A.It is reloading the parser after a syntax error
- B.It is checking NTP time before accepting input
- C.It is treating the unknown word as a hostname to resolve✓ Answer
- D.It is forwarding the command to a syslog server
IOS has DNS lookup enabled by default and interprets an unrecognized single word at the EXEC prompt as a hostname for a Telnet connection, so it tries to resolve it and waits for the query to time out. Disabling domain lookup, or defining a reachable name server, removes the delay.
Ref QB-C79YE3Source: Cisco CCNA 200-301 Exam Topics — 4.3 Role of DNS within the network (IOS domain lookup)Report a problem with this question
10. Router R1 has G0/0 at 10.10.20.1/24 facing a client VLAN and G0/1 at 10.10.99.1/24 facing the server subnet, where the DHCP server is 10.10.99.10. Clients on the 10.10.20.0/24 subnet get no address. Where should the DHCP relay (helper) address be configured, and what should it point to?
- A.On G0/0, pointing to 10.10.20.1
- B.On G0/0, pointing to 10.10.99.10✓ Answer
- C.On G0/1, pointing to 10.10.20.255
- D.On G0/1, pointing to 10.10.99.10
The relay must be on the interface that receives the clients' broadcasts, which is the client subnet's gateway interface G0/0, because routers do not forward broadcasts. It points to the DHCP server's address, 10.10.99.10, so the router can forward the request as a unicast. Placing it on the server-facing interface never sees the client broadcasts.
Ref QB-YH73WSSource: Cisco CCNA 200-301 Exam Topics — 4.6 DHCP client and relay (helper address placement)Report a problem with this question
11. A central DHCP server holds pools for 10.10.20.0/24 and 10.10.30.0/24. Router R1 relays requests from both subnets to it. When a relayed Discover arrives, how does the server choose the correct pool?
- A.From the relay agent address the router inserts✓ Answer
- B.From the client's source IP in the Discover
- C.From the vendor prefix of the client's MAC
- D.From the TTL remaining when the packet arrives
When the relay converts the broadcast to a unicast, it fills the giaddr field with the IP address of the interface that received the request. The server matches giaddr to the subnet of one of its pools. The client's source address is 0.0.0.0 at this stage, so it carries no subnet information.
Ref QB-G2D8GTSource: Cisco CCNA 200-301 Exam Topics — 4.6 DHCP client and relay (giaddr); RFC 2131Report a problem with this question
12. A network management station must remotely change the administrative state of an interface on a router running SNMPv2c. Which SNMP message does it send, and what community access does that require?
- A.A Set message, using a read-only community
- B.A Set message, using a read-write community✓ Answer
- C.A Trap message, using a read-write community
- D.A Get message, using a read-only community
A Set changes the value of a MIB variable on the agent, while Get only reads one. In SNMPv1/v2c, a read-only community allows only Get-type operations, so changing a value requires a read-write community. A Trap is an unsolicited notification sent by the agent to the manager, not a command.
Ref QB-XHUQQRSource: Cisco CCNA 200-301 Exam Topics — 4.4 SNMP function (Get/Set, RO/RW communities)Report a problem with this question
13. After a firewall was installed between the network management station and the routers, traps from the routers still reach the management station, but polling of interface counters fails. Which traffic must the firewall permit from the management station to the routers?
- A.UDP 162 to the router agents
- B.TCP 161 to the router agents
- C.UDP 161 to the router agents✓ Answer
- D.UDP 514 to the router agents
SNMP agents listen for Get/Set requests on UDP port 161, so polling needs that port open toward the routers. UDP 162 is where the manager receives traps and informs, which is why traps still work. UDP 514 is syslog, and SNMP normally runs over UDP, not TCP.
Ref QB-F22WASSource: Cisco CCNA 200-301 Exam Topics — 4.4 SNMP function (manager/agent, UDP 161/162)Report a problem with this question
14. A router console displays: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down. What severity level name does this message carry?
- A.Errors
- B.Notifications✓ Answer
- C.Warnings
- D.Informational
The syslog format is %FACILITY-SEVERITY-MNEMONIC, so the 5 in LINEPROTO-5 is the severity. Level 5 is Notifications (normal but significant). Errors is 3, as used by %LINK-3-UPDOWN, Warnings is 4 and Informational is 6.
Ref QB-2JWQ8VSource: Cisco CCNA 200-301 Exam Topics — 4.5 Syslog facilities and severity levels; RFC 5424Report a problem with this question
15. Router R3 sends syslog to a server with the trap severity set to warnings. Within one minute it generates %LINK-3-UPDOWN, %SYS-5-CONFIG_I and %SEC-6-IPACCESSLOGP. Which of these messages reach the server?
- A.Only the %LINK-3-UPDOWN message✓ Answer
- B.Only the %SYS-5 and %SEC-6 messages
- C.None, as none is exactly level 4
- D.All three messages, levels 3, 5 and 6
Warnings is level 4, and setting a level sends that level plus every more severe (lower-numbered) level, so levels 0 through 4 are sent. Only the level 3 message qualifies; the level 5 and level 6 messages are less severe and are filtered out.
Ref QB-J24WTVSource: Cisco CCNA 200-301 Exam Topics — 4.5 Syslog severity levels (level threshold includes lower numbers)Report a problem with this question
16. During congestion, WRED on a WAN interface takes drop precedence into account. Packets in the same queue are marked AF21, AF22 and AF23. Which packets are most likely to be dropped first?
- A.All alike, DSCP 18 to 22
- B.AF23 packets, DSCP 22✓ Answer
- C.AF21 packets, DSCP 18
- D.AF22 packets, DSCP 20
In AFxy, x is the class and y is the drop precedence, and a higher y means the packet is dropped earlier. AF23 has the highest drop precedence in class 2; its decimal value is 8 x 2 + 2 x 3 = 22. WRED uses these markings to drop AF23 before AF22 and AF21.
Ref QB-ZHJD3USource: Cisco CCNA 200-301 Exam Topics — 4.7 QoS marking and congestion avoidance; RFC 2597 (Assured Forwarding)Report a problem with this question
17. An ISP polices a customer's 1 Gbps handoff to a contracted rate of 100 Mbps and drops all excess traffic. The customer wants its traffic bursts to be delayed instead of being dropped by the ISP. What should the customer apply on its own router?
- A.Policing to 100 Mbps, outbound toward the ISP
- B.Shaping to 100 Mbps, inbound from the ISP
- C.Policing to 100 Mbps, inbound from the ISP
- D.Shaping to 100 Mbps, outbound toward the ISP✓ Answer
Shaping buffers excess packets and sends them later, smoothing traffic to the contracted rate at the cost of added delay, and it works only in the outbound direction. Policing never buffers; it drops or re-marks excess, so policing on the customer side would still lose packets. Shaping cannot be applied inbound.
Ref QB-H2RJNUSource: Cisco CCNA 200-301 Exam Topics — 4.7 QoS policing and shapingReport a problem with this question
18. A WAN link uses CBWFQ with guaranteed bandwidth for each class, yet voice calls suffer jitter whenever bulk transfers fill the link. Which queuing change helps voice while keeping the other classes from being starved?
- A.Add LLQ, a policed strict-priority queue for voice✓ Answer
- B.Give voice its own FIFO queue with no rate limit
- C.Apply WRED to the voice class to drop it early
- D.Replace CBWFQ with one large FIFO output queue
LLQ adds a strict-priority queue to CBWFQ, so voice packets are always sent first, which minimizes delay and jitter. The priority queue is policed to its configured bandwidth, so voice cannot consume the whole link and starve the other classes. WRED drops traffic, which harms voice, and FIFO gives voice no preference.
Ref QB-4JMDKXSource: Cisco CCNA 200-301 Exam Topics — 4.7 QoS queuing (CBWFQ and LLQ)Report a problem with this question
19. Switch SW1 has a hostname, a domain name, 2048-bit RSA keys, and a local user created with a secret. Its vty lines use password-based login with no line password set and allow SSH only. SSH logins fail every time, even with the correct local username and secret. What is the cause?
- A.The RSA modulus is too small for SSH version 2
- B.The domain name must be set after the RSA keys
- C.The vty lines must also permit Telnet as fallback
- D.The vty lines do not use the local user database✓ Answer
SSH authenticates with a username and password, so the vty lines must be set to log in against the local user database. With plain password login and no line password, the switch has no way to authenticate and closes the session. A 2048-bit key exceeds the 768-bit minimum for SSHv2, Telnet is not needed, and the domain name must exist before the keys are generated, not after.
Ref QB-M2TJ6YSource: Cisco CCNA 200-301 Exam Topics — 4.8 Configure network devices for remote access using SSHReport a problem with this question
20. An engineer must pull a new IOS image from a file server that accepts only authenticated logins, and first wants to list the server's directory to confirm the exact file name. Which protocol supports this, and which port does its control session use?
- A.TFTP, with requests on UDP 69
- B.FTP, with control on UDP 21
- C.TFTP, with requests on TCP 69
- D.FTP, with control on TCP 21✓ Answer
FTP runs over TCP, uses port 21 for its control connection, requires a username and password, and supports directory listings. TFTP uses UDP 69 and offers only simple read and write of a named file, with no authentication and no way to list directories, so it cannot meet either requirement.
Ref QB-F75H5QSource: Cisco CCNA 200-301 Exam Topics — 4.9 TFTP/FTP capabilities; RFC 959 (FTP), RFC 1350 (TFTP)Report a problem with this question

1. Branch router BR1 performs PAT for internal users. One translation entry shows internal host 10.1.1.10, source port 51000, mapped to 203.0.113.5 port 1025 while it talks to a web server at 198.51.100.20 port 443. Which NAT term describes 203.0.113.5?

4. A mail server at 10.0.5.25 must accept connections started by hosts on the internet, using public address 203.0.113.25 at all times, even if the server has not sent any traffic first. Which NAT method meets this requirement?

5. Router R2 is configured as an NTP client of router R1 only. On R2, the NTP status reports that the clock is synchronized at stratum 4 with R1 as its reference. At what stratum is R1 operating?

6. During an incident review, an engineer finds that router CORE2's log timestamps cannot be lined up with other devices. NTP status on CORE2 reports: clock is unsynchronized, stratum 16, no reference clock. What does this indicate?

7. A PC receives DHCPOFFER messages from two DHCP servers on its subnet. What does the PC send next, and how is that message addressed?

8. An administrator wants shop.example.net to resolve to the same server as www.example.net, so that if the server's IPv4 address changes, only one record has to be updated. What kind of record should shop.example.net be?

9. On a router that cannot reach any name server, a technician mistypes 'shwo version' in privileged EXEC mode. The CLI prints a 'Translating...' message and hangs for several seconds. Why does this happen?

10. Router R1 has G0/0 at 10.10.20.1/24 facing a client VLAN and G0/1 at 10.10.99.1/24 facing the server subnet, where the DHCP server is 10.10.99.10. Clients on the 10.10.20.0/24 subnet get no address. Where should the DHCP relay (helper) address be configured, and what should it point to?

11. A central DHCP server holds pools for 10.10.20.0/24 and 10.10.30.0/24. Router R1 relays requests from both subnets to it. When a relayed Discover arrives, how does the server choose the correct pool?

12. A network management station must remotely change the administrative state of an interface on a router running SNMPv2c. Which SNMP message does it send, and what community access does that require?

13. After a firewall was installed between the network management station and the routers, traps from the routers still reach the management station, but polling of interface counters fails. Which traffic must the firewall permit from the management station to the routers?

14. A router console displays: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down. What severity level name does this message carry?

15. Router R3 sends syslog to a server with the trap severity set to warnings. Within one minute it generates %LINK-3-UPDOWN, %SYS-5-CONFIG_I and %SEC-6-IPACCESSLOGP. Which of these messages reach the server?

16. During congestion, WRED on a WAN interface takes drop precedence into account. Packets in the same queue are marked AF21, AF22 and AF23. Which packets are most likely to be dropped first?

17. An ISP polices a customer's 1 Gbps handoff to a contracted rate of 100 Mbps and drops all excess traffic. The customer wants its traffic bursts to be delayed instead of being dropped by the ISP. What should the customer apply on its own router?

18. A WAN link uses CBWFQ with guaranteed bandwidth for each class, yet voice calls suffer jitter whenever bulk transfers fill the link. Which queuing change helps voice while keeping the other classes from being starved?

19. Switch SW1 has a hostname, a domain name, 2048-bit RSA keys, and a local user created with a secret. Its vty lines use password-based login with no line password set and allow SSH only. SSH logins fail every time, even with the correct local username and secret. What is the cause?

20. An engineer must pull a new IOS image from a file server that accepts only authenticated logins, and first wants to list the server's directory to confirm the exact file name. Which protocol supports this, and which port does its control session use?

Other topics in this exam