CertAce

CCNA practice test / CCNA IP Services Practice Questions

CCNA IP Services Practice Questions

10 original questions, each with an explanation for every option. On the 46 related questions in our full bank, CertAce users answer 51% correctly.

Start the questions Or start the free trial

I work as a network engineer, and I failed my first CCNA attempt with 58% before passing on a later try. IP services look like the easy part of the blueprint because each one fits in a few lines of config. The trouble is that the exam rarely asks you to recite those lines. It shows you output, a log message or a half-finished config and asks what is missing or what will happen next.

This page covers the services you meet on almost every production router and switch: DHCP and the relay agent, DNS resolution on the device itself, NTP and stratum, SNMP versions, syslog severity levels, SSH versus Telnet, and FTP versus TFTP. NAT has its own page. The common thread is that each service has one or two details that decide the answer: which interface gets the helper address, which number a severity level has, which SNMP security level encrypts, which transport a protocol uses.

Work each question as if you were at the CLI. Read the exhibit before the choices, decide what you would type or check next, and only then look for the matching answer. The explanations cover every choice, so read them even when you get a question right; the wrong options are the mistakes people really make in the field.

Adrian, network engineer and founder of CertAce.

How to work these questions

  1. Start at the client: an address in 169.254.0.0/16 means no DHCP answer arrived at all, while a wrong subnet or gateway means a server answered from the wrong pool.
  2. Check the access port and VLAN: the client port must be up and in the VLAN you expect, and that VLAN must be allowed on the trunk to the router or SVI.
  3. Check the gateway interface for that VLAN: if the server is on another subnet, `ip helper-address <server IP>` must be on the client-facing interface or subinterface, not on the server side.
  4. Check the server is reachable from that gateway address, because the server replies to the relay's interface IP (giaddr) and needs a route back to it.
  5. Check the pool: the `network` must match the client subnet, `default-router` must be in it, and `ip dhcp excluded-address` (global mode) must not cover the whole range; `show ip dhcp binding` and `show ip dhcp pool` show whether leases are being handed out.

Practice questions

Pick an answer to see right away whether it is correct and why every option is right or wrong.

  1. Question 1 of 10Exhibit

    PC-A in VLAN 20 shows the address 169.254.17.32. The DHCP server 10.1.99.10 has a scope for 10.1.20.0/24 and works for other sites. Based on the exhibit, which change on R1 fixes the problem?

    PC-A (VLAN 20) -- SW1 -- trunk -- Gi0/0 R1 Gi0/1 -- 10.1.99.10 (DHCP server)

R1# show running-config | section ^interface
interface GigabitEthernet0/0
 no ip address
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 10.1.20.1 255.255.255.0
interface GigabitEthernet0/1
 ip address 10.1.99.1 255.255.255.0
 ip helper-address 10.1.99.10
    1. Add ip dhcp excluded-address 10.1.20.1 in global mode
    2. Add ip helper-address 10.1.99.1 under Gi0/0.20
    3. Move ip helper-address 10.1.99.10 to Gi0/0.20
    4. Create a pool on R1 with network 10.1.99.0 /24
    Show the answer

    Answer: C

    A client with 169.254.x.x got no DHCP answer. When the server is on another subnet, `ip helper-address <server>` goes on the interface or subinterface where the client broadcasts arrive. The helper turns the broadcast into a unicast to the server with the interface IP as giaddr, so the server picks the right pool.

    • A. Excluding the gateway address only stops it from being leased; it does nothing to get PC-A's broadcast to the server.
    • B. The helper is on the right interface but points to R1's own Gi0/1 address, so the request never reaches the server at 10.1.99.10.
    • C. The Discover is a broadcast that arrives on Gi0/0.20, so the relay must be configured there and point to the server; on Gi0/1 it never sees PC-A's broadcasts.
    • D. A pool for 10.1.99.0/24 would not match the VLAN 20 subnet, and the server already has the right scope.

  2. Question 2 of 10Config

    R1 already has the pool in the exhibit. Addresses 192.168.50.1 through 192.168.50.20 are used by servers and printers and must never be leased. Which command completes the configuration?

    R1(config)# ip dhcp pool LAN50
R1(dhcp-config)# network 192.168.50.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.50.1
R1(dhcp-config)# dns-server 192.168.50.53
R1(dhcp-config)# lease 0 8
R1(dhcp-config)# exit
R1(config)#
    1. ip dhcp excluded-address 192.168.50.1 192.168.50.20
    2. ip dhcp excluded-address 192.168.50.0 0.0.0.20
    3. ip dhcp pool LAN50 exclude 192.168.50.1 .20
    4. lease 192.168.50.21 192.168.50.254
    Show the answer

    Answer: A

    `ip dhcp excluded-address <low> [<high>]` is a global command, not a pool command. The pool's `network` sets the range, `default-router` and `dns-server` set the options, and `lease <days> <hours> <minutes>` sets the lease time (default 1 day).

    • A. Exclusions are configured in global mode with a low and a high address, so this keeps .1 to .20 out of the LAN50 range.
    • B. The command takes a start and an end address, not a wildcard; 0.0.0.20 would be taken as an end address lower than the start, so the range is rejected.
    • C. There is no exclude keyword on the pool command; exclusions are separate global commands.
    • D. lease sets the lease time in days, hours and minutes (here 0 8 = 8 hours); it cannot define an address range.

  3. Question 3 of 10Concept

    A new client joins a LAN where a DHCP server sits on the same subnet. Which statement about the DHCP exchange is true?

    1. The client unicasts a Discover to the server on UDP port 68
    2. The client broadcasts a Discover and answers an Offer with a Request
    3. The server sends an Acknowledge first, then the client sends a Request
    4. The client sends a Request first and waits for any Offer to arrive
    Show the answer

    Answer: B

    DORA: Discover (client broadcast), Offer (server), Request (client), Acknowledge (server). The server listens on UDP 67 and the client on UDP 68. Because the Discover is a broadcast, a router will not forward it unless it is configured as a relay with ip helper-address.

    • A. The client has no address and does not know the server, so the Discover is a broadcast, and it goes to server port UDP 67 from client port 68.
    • B. The order is Discover, Offer, Request, Acknowledge (DORA); the client broadcasts the Discover and then requests the offered address.
    • C. The Acknowledge is the last message and confirms the lease after the client's Request.
    • D. A new client starts with a Discover; a Request first is what a client renewing or rebooting with a known address can send.

  4. Question 4 of 10Exhibit

    R1 is configured with ntp server 198.51.100.7 and ntp server 198.51.100.8. Based on the output, which statement is true?

    R1# show ntp associations

  address         ref clock       st   when   poll reach  delay  offset   disp
*~198.51.100.7    192.0.2.1        2     41     64   377  1.204  -0.311   0.952
 ~198.51.100.8    .INIT.          16      -   1024     0  0.000   0.000 15937.
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured
    1. R1 is synchronized to 198.51.100.7 and runs at stratum 3
    2. R1 is synchronized to 198.51.100.8 and runs at stratum 16
    3. R1 is synchronized to 198.51.100.7 and runs at stratum 2
    4. R1 is unsynchronized because one server has reach 0
    Show the answer

    Answer: A

    In show ntp associations, * is the peer you are synced to and st is that peer's stratum; your own stratum is one higher. Stratum 16 means unsynchronized. Reach 377 (octal) means the last eight polls all got answers. show ntp status confirms 'Clock is synchronized, stratum 3'.

    • A. The asterisk marks 198.51.100.7 as the sys.peer; it is stratum 2, so R1 becomes stratum 2 + 1 = 3.
    • B. 198.51.100.8 is still in .INIT. with stratum 16 and reach 0, which means R1 has never heard from it.
    • C. The server's stratum is 2, but a client always sits one level below its source, so R1 is stratum 3, not 2.
    • D. One working server is enough; the unreachable second server does not stop R1 from syncing to the first.

  5. Question 5 of 10Exhibit

    R2 has the logging configuration in the exhibit. In the next minute it generates %LINK-3-UPDOWN, %LINEPROTO-5-UPDOWN, %SYS-5-CONFIG_I and %OSPF-5-ADJCHG. Which messages are sent to the syslog server?

    R2# show running-config | include logging|timestamps
service timestamps log datetime msec
logging buffered 16384
logging trap warnings
logging host 10.10.10.50
    1. All four, because logging host ignores the trap level
    2. Only the three severity 5 messages, since 5 is above 4
    3. None, because warnings is level 6 and blocks levels 3 and 5
    4. Only %LINK-3-UPDOWN, since 3 is within levels 0 to 4
    Show the answer

    Answer: D

    Syslog levels: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging. logging trap <level> sends that level and all lower numbers to the logging host; the default is informational (6). The digit in %FACILITY-N-MNEMONIC is the severity.

    • A. logging trap sets exactly which severities go to the hosts configured with logging host; it is not ignored.
    • B. A trap level sends that level and everything more severe (lower number); level 5 is less severe than warnings (4), so it is filtered.
    • C. Warnings is level 4, not 6 (informational is 6), and the level sets a ceiling, not a block.
    • D. Warnings is level 4, so only messages with severity 0 to 4 are sent; the number after the facility shows LINK-3 is error (3).

  6. Question 6 of 10Config

    You are enabling SSH on a new switch and see the output in the exhibit. Which two commands must you enter before the RSA key can be generated? (Choose two.)

    Switch(config)# crypto key generate rsa
% Please define a hostname other than Switch.
    1. ip ssh version 2
    2. hostname SW1
    3. transport input ssh
    4. ip domain-name lab.example
    5. service password-encryption
    Show the answer

    Answer: B and D

    SSH checklist: hostname (non-default), ip domain-name, crypto key generate rsa (modulus at least 768 for SSHv2, 2048 recommended), a local user with username ... secret, then under line vty: login local and transport input ssh. Telnet sends everything, including passwords, in clear text on TCP 23; SSH encrypts on TCP 22.

    • A. ip ssh version 2 restricts SSH to version 2 after a key exists; it is not a prerequisite for generating the key.
    • B. The key label is built from the hostname and domain name, so the default hostname must be changed first.
    • C. transport input ssh goes under the VTY lines to block Telnet; it does not affect key generation.
    • D. Without a domain name the switch refuses the key with '% Please define a domain-name first.', so it is the second prerequisite.
    • E. service password-encryption only obscures type 7 passwords in the config; it has no part in SSH key generation.

  7. Question 7 of 10Scenario

    Your NMS polls switches with SNMP GET requests and receives traps when interfaces go down. The security team now requires that SNMP messages be authenticated and that their contents be encrypted on the wire. Which SNMP setup meets the requirement?

    1. SNMPv2c with a long read-only community string
    2. SNMPv3 with the noAuthNoPriv security level
    3. SNMPv3 with the authNoPriv security level
    4. SNMPv3 with the authPriv security level
    Show the answer

    Answer: D

    SNMPv1/v2c use community strings (RO or RW) sent in clear text. SNMPv3 adds users and three security levels: noAuthNoPriv, authNoPriv (authentication) and authPriv (authentication plus encryption). Polling (GET/SET from the manager, UDP 161) and traps or informs (from the agent, UDP 162) both read and report variables identified by OIDs defined in MIBs.

    • A. v2c sends the community string in clear text and has no encryption, however long the string is.
    • B. noAuthNoPriv uses only a username match, with no authentication hash and no encryption.
    • C. authNoPriv adds HMAC authentication and integrity, but the payload still travels unencrypted.
    • D. authPriv both authenticates each message (HMAC with SHA or MD5) and encrypts the payload (AES or DES), which is what was asked.

  8. Question 8 of 10Scenario

    You must back up R4's running configuration to a file server. The firewall between them inspects and permits TFTP, but drops all TCP traffic from R4. Which command can succeed?

    1. copy running-config ftp:, since FTP runs over UDP 21
    2. copy running-config tftp:, since TFTP runs over UDP 69
    3. copy running-config scp:, since SCP runs over UDP 22
    4. copy running-config ftp:, since FTP data uses UDP 20
    Show the answer

    Answer: B

    FTP: TCP, port 21 for control and 20 for active-mode data, supports usernames and passwords and directory listing. TFTP: UDP 69 for the initial request, no authentication, no directory listing, simple lock-step transfers. Both send data in clear text; SCP (over SSH, TCP 22) is the encrypted option.

    • A. FTP uses TCP, with control on port 21, so the firewall drops it.
    • B. TFTP starts on UDP 69 and needs no login, so it is the only listed transfer the firewall allows.
    • C. SCP runs over SSH, which is TCP port 22, so it is dropped as well.
    • D. FTP active-mode data uses TCP 20, not UDP, and the control session on TCP 21 never gets through anyway.

  9. Question 9 of 10Scenario

    You compare logs during an outage. R1's entries show today's date, but every entry in show logging on SW2 looks like '*Mar 1 02:14:07.351: %LINK-3-UPDOWN: Interface Gi1/0/5, changed state to down'. What is the most likely cause?

    1. SW2 lacks service timestamps, so it cannot show dates
    2. SW2 is configured with ntp master 1 and overrides R1
    3. SW2's clock is not synchronized to any NTP server
    4. SW2 logs in UTC while R1 uses a local time zone
    Show the answer

    Answer: C

    A leading * on a timestamp means the clock is not synchronized, and a date of Mar 1 usually means the clock was never set. Logs from different devices are only comparable when every device syncs to NTP and uses service timestamps log datetime msec. Time also matters for certificates and for any audit trail.

    • A. The entries already carry a date and milliseconds, which is what service timestamps log datetime msec produces; without it you would see uptime instead.
    • B. An ntp master would be authoritative and its clock would not be marked with an asterisk; it also would not change R1's own log format.
    • C. Mar 1 is the default boot date of a device with no set clock, and the leading asterisk means the time is not authoritative; configure ntp server so logs can be correlated.
    • D. A time zone difference shifts the hour by a fixed offset; it does not put the date back to March 1.

  10. Question 10 of 10Exhibit

    Users can reach the file server by IP address, but R3 cannot reach it by name. R3 can ping 10.0.0.53. Based on the exhibit, which change lets R3 resolve the name?

    R3# show running-config | include domain|name-server
no ip domain lookup
ip domain name corp.example
ip name-server 10.0.0.53

R3# ping files.corp.example
% Unrecognized host or address, or protocol not running.
    1. Move ip name-server 10.0.0.53 under the LAN interface
    2. Remove ip domain name, because it overrides the DNS server
    3. Enter ip domain lookup to re-enable DNS name resolution
    4. Add dns-server 10.0.0.53 to the DHCP pool used by R3
    Show the answer

    Answer: C

    A router resolves names with DNS only when ip domain lookup is on (the default) and at least one ip name-server is set; ip domain name supplies the default suffix. Many admins disable lookup to stop typos at the exec prompt from being treated as hostnames, and then forget it breaks name resolution.

    • A. ip name-server is a global command; there is no interface version of it.
    • B. ip domain name only appends a default suffix to unqualified names and is also needed for SSH keys; it does not block DNS.
    • C. no ip domain lookup disables DNS queries entirely, so the configured name server is never used; ip domain lookup (enabled by default) turns them back on.
    • D. dns-server in a DHCP pool is handed to DHCP clients; R3's own name resolution uses ip name-server.

Want more like these? The full CertAce bank has timed exams, a review pool for the questions you miss and readiness per exam domain.

Start free trial

3 days and 100 questions, no card needed.

Common mistakes

Questions people ask

What does a 169.254.x.x address on a client tell me?

It is an APIPA (link-local) address the client gave itself because its DHCP Discover got no answer. Look for a down port, a wrong VLAN, a missing ip helper-address on the client's gateway interface, or a server that is unreachable or has no matching pool.

Which syslog levels does logging trap informational send?

Informational is level 6, so the router sends levels 0 through 6 to the syslog server, which is everything except debugging (7). Informational is also the default trap level on Cisco IOS.

Does a router configured with ntp master serve time to other devices?

Yes. ntp master makes the router an authoritative NTP source using its own clock, by default at stratum 8, so clients that sync to it run at stratum 9. Use it in labs or isolated networks; in production, sync to a real upstream server with ntp server.

More CCNA topics

Questions written by CertAce. CertAce is not affiliated with or endorsed by Cisco Systems. CCNA and Cisco are trademarks of Cisco Systems, Inc.