Examkin

IP Services

198 questions

All types198Multiple choice102Multiple select45Matching12Ordering27Short answer12
Question 21Question →

A network administrator is modifying syslog settings on a Cisco IOS router. The router currently has `logging trap errors` configured. The administrator needs to change the configuration so that all events up to severity level 4 (warnings) are forwarded to the remote syslog host, and log messages up to severity level 4 are displayed live during the active SSH session. Which set of commands accomplishes these requirements?

Show answer & explanation

Answer: Configure `logging trap warnings` in global configuration mode and execute `terminal monitor` in privileged EXEC mode.

Answer

Configure `logging trap warnings` in global configuration mode and execute `terminal monitor` in privileged EXEC mode.
The option specifying `logging trap warnings` in global configuration mode and `terminal monitor` in privileged EXEC mode correctly sets the syslog trap threshold to severity level 4 (which includes levels 0 through 4) and enables real-time logging output on the user's active SSH terminal session.

Step-by-Step Solution

1
Identify the numeric severity level and keyword for syslog warnings.
Syslog severity level 4 corresponds to the keyword 'warnings'. The levels range from 0 (Emergency) to 7 (Debugging).
The 'logging trap' command defines which messages are sent to remote syslog servers based on severity.
2
Determine the global configuration command to send messages up to severity level 4 to the syslog server.
Executing `logging trap warnings` (or `logging trap 4`) configures the router to forward severity levels 0 (Emergency), 1 (Alert), 2 (Critical), 3 (Error), and 4 (Warning) to the remote syslog host.
Syslog severity thresholds include all levels numerically equal to or lower than the specified severity.
3
Identify the operational command required to enable log message output on a remote SSH line.
Executing `terminal monitor` in privileged EXEC mode enables logging output for the current VTY line.
By default, console logging is enabled, but VTY (SSH/Telnet) sessions require `terminal monitor` to receive logging output in real time.

Key Concept

Syslog Operations, Severity Levels, and Log Destination Configuration
Estimated Time:1m 30s
Question 22Question →

An enterprise client workstation sends a DNS name resolution request for an external web service to its local internal Active Directory DNS server. The internal DNS server is configured to perform recursion but does not hold an authoritative zone or a local cached entry for the requested domain name. Which action does the internal DNS server perform to resolve the query for the client workstation?

Show answer & explanation

Answer: It performs iterative queries against external root, top-level domain (TLD), and authoritative DNS servers on behalf of the workstation and returns the final resolution result to the client.

Answer

The internal DNS server performs iterative queries against root, TLD, and authoritative DNS servers on behalf of the workstation and returns the resolved address to the client.
In enterprise network operations, host workstations make recursive DNS queries to an assigned internal DNS server. When the internal DNS server does not possess the record in cache or local authoritative zones, it acts as a recursive resolver by sending a series of iterative queries to external root, TLD, and authoritative servers. Once the final IP address is retrieved, the internal DNS server sends the answer back to the client host.

Step-by-Step Solution

1
Analyze client-to-DNS resolver request type
The client host sends a recursive query to its configured local internal DNS server, delegating the full lookup task to that server.
End-user hosts rely on internal recursive resolvers to handle multi-step domain hierarchy queries.
2
Evaluate internal DNS server cache and authority state
The server has no local zone authority or cached entry for the external domain.
Because it lacks local answers, the recursive server must query external hierarchy servers starting at the root level.
3
Trace external resolution mechanism
The internal DNS server performs iterative requests upstream (Root -> TLD -> Authoritative Server) until obtaining the final record, which it caches and sends back to the client workstation.
This insulates internal clients from direct internet exposure and centralizes enterprise DNS caching.

Key Concept

DNS Recursive Resolver vs Iterative Query Roles in Enterprise Name Resolution
Estimated Time:1m 15s
Question 23Question →

An internal host in an enterprise network queries the corporate DNS server to resolve the Fully Qualified Domain Name (FQDN) of an external cloud service. The internal DNS server does not hold the authoritative zone file for the requested external domain. Assuming standard recursive resolution is enabled on the server, which action does the internal DNS server take to resolve the query for the client?

Show answer & explanation

Answer: It queries external DNS servers on behalf of the host by following the DNS hierarchy until it receives the answer and returns it to the host.

Answer

The internal DNS server queries external DNS servers on behalf of the host by traversing the DNS hierarchy until it receives the answer and returns it to the host.
In enterprise networks, an internal DNS server configured for recursion acts as a recursive resolver for LAN clients. When a host requests resolution for a domain that the server is not authoritative for, the server performs the iterative lookups across external DNS servers (Root, TLD, and Authoritative) on behalf of the client and returns the resolved IP address.

Step-by-Step Solution

1
Analyze the role of a recursive DNS server in enterprise name resolution.
A recursive DNS resolver accepts queries from local host clients and resolves names for domains outside its local authority.
Internal hosts are generally configured to point to an internal recursive resolver rather than querying root internet DNS servers directly.
2
Trace the recursive DNS lookup flow for non-authoritative external domains.
The internal DNS server queries the DNS hierarchy (Root →\rightarrow Top-Level Domain →\rightarrow Authoritative Server) on behalf of the requesting host.
Recursion delegates the responsibility of traversing the global DNS tree to the DNS server rather than forcing the client to issue iterative queries.
3
Return the final response to the host client.
Once the authoritative answer is returned to the enterprise DNS server, it caches the record and sends the IP resolution back to the host.
This process provides seamless name resolution and allows the enterprise server to cache records locally for future requests.

Key Concept

Recursive DNS Query Resolution Flow and Server Roles
Estimated Time:1m 0s
Question 24Question →

An enterprise network administrator is analyzing DNS name resolution behavior across a router configured for local host name lookup. During troubleshooting of large DNS response payloads generated by DNSSEC queries, the administrator notices changes in transport layer protocol utilization. Which two statements correctly describe DNS transport protocol operation and name resolution mechanics in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: When a DNS server response exceeds the 512-byte limit standard for traditional UDP DNS messages without EDNS0 extensions, the server returns a response header with the Truncation (TC) bit set, signaling the requesting client to re-query using TCP port 53.; DNS query operations primarily utilize UDP port 53 for low-latency name resolution, but fall back to TCP port 53 for transactions requiring guaranteed delivery or large data transfers such as zone transfers and truncated responses.

Answer

The correct answers state that a DNS response exceeding 512 bytes without EDNS0 sets the Truncation (TC) bit to prompt a re-query via TCP port 53, and that DNS uses UDP port 53 for standard low-overhead queries while utilizing TCP port 53 for large transfers, zone synchronization, and truncated responses.
DNS relies primarily on UDP port 53 for client lookups to minimize network overhead and latency. However, when a UDP DNS response exceeds 512 bytes (without EDNS0), the DNS server sets the Truncation (TC) bit in the header, instructing the client to establish a TCP port 53 connection to retrieve the complete record set. TCP port 53 is also explicitly required for zone transfers between DNS servers.

Step-by-Step Solution

1
Analyze standard DNS transport mechanisms and protocol defaults.
DNS uses UDP port 53 for standard name resolution queries due to connectionless efficiency, while TCP port 53 is used for reliability and data payload requirements exceeding UDP bounds.
Understanding transport protocol selection helps evaluate host and server behavior under varying query conditions.
2
Evaluate the behavior when DNS responses exceed maximum UDP message size limits.
Standard UDP DNS responses cap at 512 bytes. When records (such as DNSSEC or large TXT fields) overflow this boundary without EDNS0 support, the server flags the Truncation (TC) bit in the DNS header.
The TC bit alerts the client that data was omitted and instructs the resolver to re-issue the full query over a stateful TCP connection.
3
Identify misidentifications regarding UDP capabilities and DNS server resolution mechanics.
UDP cannot perform sliding window acknowledgments or dynamic payload adjustments because it lacks header fields for sequencing and flow control.
Eliminates options that attribute TCP connection-oriented mechanisms to UDP.

Key Concept

DNS Transport Protocols and Payload Truncation Mechanics
Question 25Question →

A network router is configured with the global configuration command `ntp master 6`. Additionally, the router has a configured association using `ntp server 172.16.40.10`. The remote NTP server at IP address 172.16.40.10172.16.40.10 is reachable and currently operates at Stratum 3. Assuming time synchronization between the router and the remote server succeeds, what stratum level will this router advertise to its downstream NTP clients?

Show answer & explanation

Answer: Stratum 4

Answer

The router will operate at and advertise Stratum 4 because it adds 1 to the stratum level of its active upstream reference source (Stratum 3).
In Network Time Protocol (NTP), stratum levels represent the distance from an authoritative reference clock (Stratum 0). When a router synchronizes with an NTP server at Stratum NN, the router's calculated stratum level becomes N+1N + 1. Since the upstream server is at Stratum 3, the router synchronizes to it and operates at Stratum 4. The `ntp master [stratum]` command configures the router as a master NTP server using its own internal clock only if external NTP sources fail or are unreachable.

Step-by-Step Solution

1
Determine the active NTP source
The router has an active, reachable NTP server at 172.16.40.10 operating at Stratum 3.
An active external NTP server association takes precedence over the internal `ntp master` fallback command.
2
Calculate the local router's stratum level
Stratum level = Upstream Stratum + 1 = 3 + 1 = 4.
NTP stratum levels increment by 1 for each hop away from the authoritative reference clock (Stratum 0).

Key Concept

NTP Stratum Calculation and Fallback Master Precedence
Question 26Question →

A network administrator configures a Cisco IOS router to synchronize its time with an upstream NTP server operating at Stratum 2. Arrange the following steps in the correct chronological order from the initial synchronization attempt to successful time synchronization on the router.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with transmitting the NTP request packet (UDP 123), followed by receiving the server response with Stratum 2 details, calculating offset and delay, updating the local clock to Stratum 3, and finally marking the peer association as synchronized (∗*).
The NTP synchronization process must follow a logical operational sequence: first, sending a client poll via UDP port 123; second, receiving the server's timestamp and Stratum 2 payload; third, computing time drift and transit delay; fourth, adjusting the local clock and incrementing stratum to 3; and fifth, marking the verified peer as synchronized (∗*) in system output.

Step-by-Step Solution

1
Initiate NTP request
The router sends a client mode NTP packet on UDP port 123.
Synchronization begins when the client actively polls the configured NTP server.
2
Receive server payload
The server sends back an NTP packet indicating Stratum 2 and authoritative timestamp info.
The server provides the reference time data needed for calculation.
3
Compute clock offset and network delay
The router uses the four timestamps (origin, receive, transmit, destination) to determine offset.
Transit delay must be accounted for to accurately adjust the local clock.
4
Adjust system time and increment stratum
System clock is synchronized and stratum becomes 3 (2+12 + 1).
An NTP client's stratum is defined as the server's stratum plus one hop distance.
5
Flag active system peer
The peer displays an asterisk (∗*) in `show ntp associations`.
The asterisk denotes the configured NTP source currently selected for system clock synchronization.

Key Concept

NTP Client-Server Synchronization Sequence and Stratum Hierarchy Propagation
Question 27Question →

A network administrator connects to a Cisco IOS router via SSH to troubleshoot a line protocol issue. After establishing the session, the administrator executes the command `terminal monitor`. Assuming the router is running default syslog configurations, which range of syslog severity levels will be displayed in this SSH terminal session?

Show answer & explanation

Answer: All syslog messages with severity levels 0 (Emergency) through 7 (Debugging)

Answer

All syslog messages with severity levels 0 (Emergency) through 7 (Debugging) will be displayed in the session.
In Cisco IOS, the default logging severity level for terminal monitor logging is level 7 (Debugging). Syslog thresholds operate inclusively for all severity levels equal to or lower than the configured numerical value. Because severity 0 (Emergency) is the most critical and severity 7 (Debugging) is the least critical, setting or inheriting the default level 7 monitor threshold allows messages of all severities (0 through 7) to be output to the active VTY session once `terminal monitor` is enabled.

Step-by-Step Solution

1
Identify the function of the `terminal monitor` command.
The `terminal monitor` command enables the redirection of syslog messages to the active VTY (SSH/Telnet) session for the current user.
VTY sessions do not display syslog messages by default, unlike the physical console port.
2
Determine the default logging severity threshold for monitor logging in Cisco IOS.
The default severity level threshold for monitor logging is level 7 (Debugging).
Cisco IOS sets default logging thresholds for console, monitor, and buffered logging to debugging (level 7).
3
Evaluate how syslog threshold logic operates.
A logging threshold includes the specified severity level and all levels with lower numerical values (higher criticality).
Syslog severity ranges from 0 (Emergency) to 7 (Debugging). Therefore, a threshold of 7 includes all messages from 0 up to 7.

Key Concept

Cisco IOS Monitor Logging Default Severity Thresholds
Estimated Time:1m 30s
Question 28Question →

A network engineer is configuring logging thresholds on a Cisco IOS router and needs to categorize Syslog severity levels according to their standard numerical hierarchy. Arrange the following Syslog severity names in order from the MOST severe (lowest numerical level) to the LEAST severe (highest numerical level).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most severe (lowest numerical value) to least severe (highest numerical value) is: Critical (level 2), Error (level 3), Warning (level 4), and Informational (level 6).
Syslog levels range from 0 (Emergency) down to 7 (Debugging). Ordering the specified levels from most severe to least severe requires listing them in ascending order of their numerical values: Critical (2), Error (3), Warning (4), and Informational (6).

Step-by-Step Solution

1
Identify the numerical Syslog severity level assigned to each named severity.
Critical = Level 2, Error = Level 3, Warning = Level 4, Informational = Level 6.
Cisco IOS Syslog protocol assigns integer values from 0 (most urgent) to 7 (least urgent).
2
Sort the severity names by their numerical levels in ascending order.
Level 2 (Critical) < Level 3 (Error) < Level 4 (Warning) < Level 6 (Informational).
Lower numerical values indicate higher severity and greater urgency.
3
Construct the final sequence based on the sorted values.
Critical -> Error -> Warning -> Informational.
This sequence properly orders the Syslog messages from highest urgency to lowest urgency.

Key Concept

Cisco IOS Syslog Severity Levels and Hierarchy
Question 29Question →

An enterprise core router is designated to act as both an NTP client to an upstream stratum 2 server and an NTP server for internal distribution switches. To ensure reliable operations and consistent packet parameters, the network engineer must force the router to send NTP packets using a specific logical interface address and allow the router to serve as an authoritative time source if the upstream connection becomes unavailable. Which TWO Cisco IOS global configuration commands satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: ntp source Loopback0; ntp master 5

Answer

The correct commands are 'ntp source Loopback0' and 'ntp master 5'.
Configuring 'ntp source Loopback0' ensures all outbound NTP control packets carry the loopback IP address as their source address, which aids access list matching and system stability. Configuring 'ntp master 5' allows the router to serve as a backup NTP server to downstream peers/clients at Stratum 5 when upstream synchronization fails.

Step-by-Step Solution

1
Identify the requirement for specifying the NTP packet source address.
The global configuration command 'ntp source <interface>' ensures NTP request/response packets use a stable IP address.
Loopback interfaces remain up as long as the router is powered, providing a consistent source IP for network management and security control.
2
Identify the requirement for providing fallback authoritative time synchronization.
The global configuration command 'ntp master [stratum]' enables the internal hardware clock to act as an NTP server.
Setting 'ntp master 5' allows downstream clients to synchronize with this device at stratum 5 if connection to the primary stratum 2 server is lost.

Key Concept

NTP Source Interface and Master Clock Fallback Configuration
Question 30Question →

During a network maintenance window, a network engineer attempts to transfer a software image to a Cisco IOS XE switch located across an enterprise WAN link with mild latency and occasional packet loss. When using Trivial File Transfer Protocol (TFTP), the transfer repeatedly stalls and experiences severe throughput degradation whenever a single packet is dropped. However, when switching to File Transfer Protocol (FTP) over the same link, the transfer completes smoothly despite identical network conditions. Which underlying transport protocol characteristic explains why FTP recovers from packet loss far more efficiently than TFTP during file transfers?

Show answer & explanation

Answer: FTP operates over TCP using dynamic sliding window mechanisms and selective acknowledgments, whereas TFTP operates over UDP using a lock-step stop-and-wait acknowledgment mechanism where each individual block must be acknowledged before the next block is transmitted.

Answer

FTP operates over TCP using sliding window mechanisms, whereas TFTP operates over UDP using a lock-step stop-and-wait acknowledgment mechanism where each block must be acknowledged prior to sending the next.
The correct answer highlights the foundational difference in flow control and reliability mechanics. FTP utilizes TCP, which features sliding window mechanisms that allow continuous stream transmission and selective retransmission of missing segments. TFTP uses UDP and requires an explicit ACK for every single data block before transmitting the next block (stop-and-wait), creating massive throughput bottlenecks when packets are dropped over WAN links.

Step-by-Step Solution

1
Analyze transport protocols utilized by TFTP and FTP.
TFTP runs over UDP on port 69, while FTP runs over TCP on ports 20 and 21.
Understanding the transport layer foundation determines reliability mechanics.
2
Examine TFTP application-layer behavior during file transfer.
TFTP uses a lock-step (stop-and-wait) protocol design where block NN must be explicitly acknowledged by the receiver before block N+1N+1 can be sent.
Because UDP does not provide native sequence numbers or windowing, TFTP enforces retransmission at the application layer per block.
3
Examine FTP transport-layer behavior during file transfer.
FTP relies on TCP's connection-oriented sliding window flow control, sequence numbers, and cumulative/selective ACKs.
TCP allows multiple segments to be transmitted concurrently without waiting for individual acknowledgments, drastically diminishing loss recovery overhead over WAN links.

Key Concept

TFTP (UDP 69, lock-step stop-and-wait per block) vs FTP (TCP 20/21, sliding windows, reliable streaming)
Question 31Question →

A network administrator is configuring logging thresholds and destinations on a Cisco IOS device to monitor system events. Which TWO statements accurately describe Cisco IOS syslog operations and severity levels?

Select all that apply

Show answer & explanation

Answer: The logging trap global configuration command specifies the severity threshold for syslog messages sent to an external syslog server.; Syslog severity level 3 represents Error conditions, which are more critical than severity level 5 Notice conditions.

Answer

The statement that the 'logging trap' command sets the severity threshold for remote syslog servers and the statement that severity level 3 (Error) is more critical than severity level 5 (Notice) are correct.
The 'logging trap' global configuration command specifies the severity threshold for log messages forwarded to external syslog servers. Additionally, syslog severity numerical levels range from 0 (Emergency) to 7 (Debugging), meaning lower numerical values indicate higher severity/criticality. Severity level 3 (Error) is higher priority than severity level 5 (Notice).

Step-by-Step Solution

1
Analyze the function of the 'logging trap' command
Confirm that 'logging trap' defines the severity threshold for forwarding log messages to a remote syslog daemon.
By default, Cisco IOS forwards messages up to level 6 (Informational) to configured syslog hosts, which is modified globally using 'logging trap <level>'.
2
Evaluate the syslog severity numerical hierarchy
Recall that syslog severity numbers range from 0 (Emergency - highest priority) to 7 (Debugging - lowest priority).
Lower numerical values represent higher criticality. Level 3 (Error) is therefore higher priority than Level 5 (Notice).
3
Evaluate the incorrect choices regarding logging thresholds and destinations
A trap threshold of 4 includes all levels 0 through 4 (so level 2 messages are sent). Displaying log messages on SSH or Telnet terminal sessions requires 'terminal monitor', whereas 'logging buffered' stores logs in system RAM.
Common candidate misconceptions invert numerical severity levels or confuse RAM log buffering with active terminal session monitoring.

Key Concept

Syslog Severity Levels and Log Destination Configuration
Question 32Question →

A network administrator is configuring a Cisco IOS router to synchronize its clock with a remote time server located at IP address 192.168.10.5. The router must operate strictly in client mode, polling time from the specified server without allowing the remote device to synchronize to the local router clock. Which global configuration command meets this requirement?

Show answer & explanation

Answer: ntp server 192.168.10.5

Answer

The command 'ntp server 192.168.10.5' configures the router to operate in NTP client mode toward the target server.
The global configuration command 'ntp server 192.168.10.5' configures the router as an NTP client to the target remote NTP server. In client mode, the local device receives time updates from the specified server but will not allow the server to synchronize to the local system clock.

Step-by-Step Solution

1
Identify the required NTP association mode
The requirement specifies a client-server relationship where the local device polls time from the remote server without providing time to it.
NTP supports client/server, peer, and master modes.
2
Select the corresponding Cisco IOS global configuration syntax
The command 'ntp server <ip-address>' establishes a client-to-server NTP association.
'ntp peer' creates a symmetric active partnership, while 'ntp master' enables local authoritative master clock operation.

Key Concept

NTP Client vs Peer Mode Configuration
Question 33Question →

An enterprise network administrator is deploying Quality of Service (QoS) across access switch ports where desktop PCs are daisy-chained through Cisco IP Phones. Which two statements accurately describe Layer 2 and Layer 3 QoS field characteristics and trust boundary enforcement in this design?

Select all that apply

Show answer & explanation

Answer: The 3-bit Class of Service (CoS) priority field is located in the IEEE 802.1Q header tag and is stripped when frames cross a Layer 3 routed boundary.; Extending a trust boundary to the Cisco IP Phone allows the switch to accept voice CoS values from the phone while re-marking untrusted data traffic from the PC to CoS 0.

Answer

The two correct statements are that the 3-bit Class of Service (CoS) field resides within the IEEE 802.1Q header tag and is stripped when traversing a Layer 3 boundary, and extending the trust boundary to a Cisco IP Phone allows trusting phone voice markings while re-marking untrusted PC traffic to CoS 0.
Layer 2 Class of Service (CoS) consists of 3 bits in the 802.1Q header tag, which is removed whenever a router decapsulates an Ethernet frame at a Layer 3 boundary. Additionally, extending a trust boundary to a Cisco IP Phone ensures that voice traffic from the phone retains high priority while untrusted PC frames passing through the phone are reset to CoS 0 / DSCP 0.

Step-by-Step Solution

1
Analyze Layer 2 vs Layer 3 QoS header field encapsulation
CoS is a 3-bit field (Priority Code Point / PCP) inside the 802.1Q VLAN tag. Because Layer 2 tags are stripped by a router at a L3 hop, CoS markings do not survive routing unless translated into 6-bit L3 DSCP markings within the IP header.
Differentiates L2 link-specific marking from L3 end-to-end IP marking.
2
Evaluate Cisco IP Phone trust boundary behavior
Using commands such as `mls qos trust device cisco-phone`, the switch trusts the CoS/DSCP generated by the phone itself but forces untrusted PC traffic arriving at the phone's switch port down to CoS 0.
Prevents end-user PCs from spoofing high-priority QoS markings to gain unauthorized bandwidth prioritization.
3
Differentiate Traffic Policing mechanics from Traffic Shaping and Queuing
Policers measure traffic against a CIR and enforce rate limits by dropping or remarking excess frames immediately without buffering. Buffering excess burst packets is exclusively performed by shapers.
Refutes distractors that claim policing buffers or queues non-conforming traffic.

Key Concept

QoS Trust Boundaries, CoS vs DSCP Header Lifecycles, and Policing Mechanics
Estimated Time:2m 0s
Question 34Question →

An enterprise router is experiencing intermittent interface flaps. To capture log messages for troubleshooting, an engineer configures the commands `logging host 172.16.10.5` and `logging trap notice` in global configuration mode. Which set of syslog severity levels will the router send to the remote server?

Show answer & explanation

Answer: Emergency, Alert, Critical, Error, Warning, and Notice (levels 0 through 5)

Answer

The router will send Emergency, Alert, Critical, Error, Warning, and Notice messages (numerical severity levels 0 through 5) to the remote syslog host.
In Cisco IOS, syslog trap thresholds include the configured severity level and all levels of higher criticality (which have lower numerical values). The `notice` keyword corresponds to severity level 5. Therefore, messages with severity levels 0 (Emergency), 1 (Alert), 2 (Critical), 3 (Error), 4 (Warning), and 5 (Notice) are forwarded to the configured syslog host.

Step-by-Step Solution

1
Identify the numerical value associated with the specified syslog severity keyword.
The syslog keyword `notice` corresponds to severity level 5.
Cisco IOS syslog severity levels range from 0 (Emergency) to 7 (Debugging), where level 5 represents Notice messages.
2
Apply the Cisco IOS trap logging threshold logic.
Configuring `logging trap notice` directs the router to send all log messages with a numerical severity level less than or equal to 5 (levels 0, 1, 2, 3, 4, and 5).
Lower numerical severity values indicate higher criticality in Syslog logging.

Key Concept

Syslog severity level threshold evaluation in Cisco IOS
Question 35Question →

A network administrator is configuring time synchronization on a newly installed Cisco IOS router. Arrange the following operational events in the correct chronological order, from initial CLI configuration to serving downstream clients.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Executing `ntp server 10.1.1.50` on the router, 2) Exchanging NTP polling messages to calculate delay and offset, 3) Adjusting the local system clock, 4) Transitioning to a synchronized state at Stratum 3 (upstream + 1), and 5) Responding to downstream client requests at Stratum 3.
The NTP operation sequence begins with establishing the peer/server relationship via `ntp server`. Polling packets are then exchanged to calculate offset and dispersion. Once metrics are validated, the local clock synchronizes, allowing the router to assign itself Stratum 3 (upstream Stratum 2 + 1). Finally, the router serves downstream clients accurately.

Step-by-Step Solution

1
Identify the initial configuration trigger
The command `ntp server 10.1.1.50` creates the server association.
No NTP message exchange can take place until the target IP server is defined in the configuration.
2
Analyze the packet exchange sequence
The router initiates NTP polling requests over UDP port 123.
Timestamped control packets must be exchanged to filter dispersion and compute clock offset.
3
Determine system clock adjustment
The system clock synchronizes to the upstream reference time.
Clock offset calculation must be completed before the router can adjust its internal clock.
4
Calculate the local stratum level
Stratum level becomes Stratum 2 + 1 = Stratum 3.
NTP protocol rules state that a device takes on the stratum level of its reference server plus one.
5
Identify downstream server operation
The router acts as an authoritative time source for internal network devices.
A Cisco router only advertises valid, authoritative time to clients after its own clock is synchronized.

Key Concept

NTP Synchronization Sequence and Stratum Propagation
Estimated Time:1m 30s
Question 36Question →

A network administrator needs to enable DHCP relay functionality on a Cisco IOS router so that hosts located in VLAN 40 (10.40.0.0/2410.40.0.0/24) can receive dynamic IP addresses from a centralized DHCP server located at 192.168.100.50192.168.100.50 in the management network. Subinterface GigabitEthernet0/0/0.40 serves as the default gateway for VLAN 40, while GigabitEthernet0/0/1 connects directly to the core switch leading to the DHCP server. On which interface must the administrator execute the `ip helper-address 192.168.100.50` command?

Show answer & explanation

Answer: Subinterface GigabitEthernet0/0/0.40

Answer

Subinterface GigabitEthernet0/0/0.40 is the correct interface for configuring the helper address.
DHCP DISCOVER and REQUEST messages are sent as Local Subnet Broadcasts (255.255.255.255255.255.255.255). To forward these requests across network boundaries to a remote DHCP server, the router must intercept the broadcast at the client's default gateway interface. Therefore, `ip helper-address` must be applied to subinterface GigabitEthernet0/0/0.40, which inspects incoming broadcasts, inserts its IP address into the `giaddr` field, and unicasts the request to 192.168.100.50192.168.100.50.

Step-by-Step Solution

1
Identify the ingress boundary for client broadcast traffic
Hosts on VLAN 40 send DHCP DISCOVER broadcasts to their default gateway at subinterface GigabitEthernet0/0/0.40.
Routers block broadcast traffic by default. The DHCP relay agent listens for incoming UDP broadcasts on the specific client gateway interface.
2
Apply the IP helper address configuration
Entering `ip helper-address 192.168.100.50` under interface configuration mode for subinterface GigabitEthernet0/0/0.40 enables broadcast-to-unicast conversion.
This sets the Gateway IP Address (giaddr) field to the subinterface IP address and forwards the unicast packet to the centralized DHCP server.

Key Concept

DHCP Relay Agent Interface Configuration
Estimated Time:1m 30s
Question 37Question →

A network engineer is configuring a Cisco IOS router to relay DHCP requests from hosts on VLAN 50 (192.168.50.0/24192.168.50.0/24) to a centralized DHCP server with the IP address 10.10.10.510.10.10.5 located on VLAN 10. The default gateway for VLAN 50 is configured on subinterface GigabitEthernet 0/0/0.50.

Which two statements accurately describe the required configuration and behavior of the DHCP relay agent in this scenario? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The `ip helper-address 10.10.10.5` command must be configured under subinterface GigabitEthernet 0/0/0.50.; The router converts incoming client DHCP DISCOVER broadcast packets into unicast UDP packets directed to 10.10.10.5.

Answer

The helper address command must be applied on subinterface GigabitEthernet 0/0/0.50, and the router converts incoming client broadcast packets into unicast UDP packets directed to the DHCP server IP address.
DHCP relay agents must be configured on the client-facing gateway interface that receives client broadcast messages. When a client broadcasts a DHCP DISCOVER message, the router intercepts it on subinterface GigabitEthernet 0/0/0.50, populates the Gateway IP Address (giaddr) field with its own interface IP address, and unicasts the frame to the specified DHCP server IP address (10.10.10.5).

Step-by-Step Solution

1
Identify the ingress interface receiving client broadcasts
Client hosts reside on VLAN 50, which connects to the router via subinterface GigabitEthernet 0/0/0.50.
DHCP broadcast messages arrive on the gateway interface for that subnet.
2
Apply the IP helper address configuration
The command `ip helper-address 10.10.10.5` is placed directly under subinterface GigabitEthernet 0/0/0.50.
This instructs the router interface to listen for incoming IPv4 UDP broadcasts (including ports 67/68 for DHCP) and forward them.
3
Analyze relay agent packet rewriting mechanism
The router populates the `giaddr` field with its subinterface IP address and unicasts the packet to 10.10.10.510.10.10.5 using UDP port 67.
Routers do not forward Layer 2 broadcasts; they convert the payload to a unicast packet to cross network boundaries.

Key Concept

DHCP Relay Agent Interface Binding and Broadcast-to-Unicast Forwarding Mechanics
Question 38Question →

An enterprise network engineer is designing a Quality of Service (QoS) traffic conditioning policy on a WAN edge router connecting to a service provider with a Committed Information Rate (CIR) lower than the physical link bandwidth. Which two statements accurately describe the operational mechanics and application constraints of traffic shaping versus traffic policing in this scenario?

Select all that apply

Show answer & explanation

Answer: Traffic shaping buffers excess packets in a queue to smooth out bursts, resulting in a regulated transmission rate across the egress interface.; Traffic policing immediately drops or remarks packets exceeding the configured threshold without utilizing memory buffers.

Answer

Traffic shaping buffers excess packets to smooth out traffic bursts for steady egress transmission, whereas traffic policing immediately drops or remarks packets exceeding specified limits without buffering.
Traffic shaping smooths out traffic bursts by delaying packets in buffer memory, producing a predictable egress rate. In contrast, traffic policing does not buffer packets; it acts immediately on out-of-profile traffic by dropping or remarking excess packets.

Step-by-Step Solution

1
Analyze the functional mechanism of traffic shaping.
Recognize that shaping buffers out-of-profile packets in software queues and schedules them for later transmission to yield a smooth rate.
Shaping is designed to handle bursty traffic without immediate packet drops when connecting to lower-speed CIR lines.
2
Analyze the functional mechanism of traffic policing.
Recognize that policing acts immediately on packets that exceed the token bucket criteria by either dropping them or remarking their QoS headers.
Policing enforces strict rate boundaries without delay or buffer allocations.
3
Evaluate directionality constraints for both QoS mechanisms.
Confirm that shaping is supported only outbound (egress) due to buffer management requirements, whereas policing can function inbound (ingress) and outbound (egress).
Queuing engine operations require egress scheduling control.

Key Concept

Operational differences between QoS Traffic Shaping and Traffic Policing
Question 39Question →

A network administrator is hardening remote management access on a gateway router named WAN-Edge01. The router already has a non-default hostname, a domain name configured (enterprise.net), and a 2048-bit RSA key generated. Security standards mandate that SSH Version 1 connections must be explicitly disabled and incoming VTY sessions must authenticate using the local router user database.

Which combination of commands satisfies these operational requirements?

Show answer & explanation

Answer: Execute 'ip ssh version 2' in global configuration mode and 'login local' in line vty configuration mode.

Answer

Executing 'ip ssh version 2' in global configuration mode and 'login local' in line vty configuration mode satisfies both requirements by enforcing SSH version 2 and requiring local database authentication for incoming sessions.
The requirement asks to explicitly disable SSH v1 (enforce SSH v2) and require authentication via the local router database. Using 'ip ssh version 2' globally restricts remote SSH connections to version 2 only. Entering 'login local' under line vty configuration mode binds incoming terminal connections to the router's local user account database.

Step-by-Step Solution

1
Enforce SSH Version 2 globally
Disables legacy SSH v1.5/v1 connections on the router
The command 'ip ssh version 2' restricts SSH connections strictly to SSH v2 protocols for security compliance.
2
Configure VTY lines for local authentication
Requires incoming VTY connections to authenticate against local user accounts
The command 'login local' under 'line vty 0 15' forces the Cisco IOS device to check username and password credentials defined in the local running configuration.

Key Concept

SSH Version 2 Enforcement and VTY Local Authentication
Question 40Question →

A network administrator is deploying SSHv2 on a newly installed Cisco IOS branch gateway router named BR-GW01. Place the required CLI configuration tasks in the correct logical execution sequence from initial global configuration mode to final line security binding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence to configure SSHv2 on Cisco IOS is: 1) Set hostname and domain name to construct the FQDN, 2) Generate RSA keys with at least 768 bits modulus (e.g., 1024 bits), 3) Enforce SSH version 2 globally, 4) Create local user credentials, and 5) Configure line VTY for local login and SSH transport input.
The correct sequence follows the mandatory dependency hierarchy of Cisco IOS SSHv2 configuration. First, an FQDN must exist by defining a non-default host name and IP domain name. Second, an RSA key pair of at least 768 bits (1024 bits in this case) must be generated, which enables the SSH daemon. Third, 'ip ssh version 2' explicitly locks SSH to version 2. Fourth, local user credentials must be created in global configuration mode. Finally, virtual terminal lines (line vty) must be configured with 'login local' to use the local user database and 'transport input ssh' to restrict incoming traffic strictly to SSH.

Step-by-Step Solution

1
Set Hostname and Domain Name
Defines the Fully Qualified Domain Name (FQDN) for the device (BR-GW01.enterprise.net).
Cisco IOS cannot generate RSA keys without an established FQDN because the key pair name is derived directly from the host name and domain name.
2
Generate RSA Cryptographic Key Pair
Creates the public/private RSA key pair and automatically enables the SSH server process.
An RSA modulus size of 768 bits or greater (such as 1024 or 2048 bits) is strictly required to support SSH version 2 operations.
3
Specify SSH Version 2
Globally locks SSH operations to version 2 only.
By default, Cisco IOS supports both SSH v1.5 and v2 upon key generation. Forcing version 2 eliminates vulnerability to v1 protocol negotiation downgrades.
4
Create Local User Credentials
Populates the local database with an administrative user account.
SSH connection attempts require user authentication; creating a local account provides local database verification when AAA is not using remote RADIUS/TACACS+ servers.
5
Bind Authentication and Transport Restrictions to Line VTY
Configures 'login local' and 'transport input ssh' on virtual terminal lines.
This step ensures inbound remote management connections require local username/password verification and explicitly blocks unencrypted protocols like Telnet.

Key Concept

Cisco IOS SSHv2 Configuration Dependencies and Deployment Sequence
PreviousPage 2 / 10Next
IP Services Practice Questions — Cisco CCNA — Page 2 | Examkin