CCNA 200-301 ACL + NAT

Which statement about the nature of NAT overload is true?

• A. applies a one-to-many relationship to internal IP addresses

• B. applies a one-to-one relationship to internal IP addresses

• C. applies a many-to-many relationship to internal IP addresses

• D. can be configured only on Gigabit interface

Which keyword in a NAT configuration enables the use of one outside IP address for multiple inside hosts?

• A. source

• B. static

• C. pool

• D. overload

Which type of address is the public IP address of a NAT device?

• A. outside global

• B. outside local

• C. inside global

• D. inside local

• E. outside public

Refer to the exhibit. Router R1 is configured with static NAT. Addressing on the router and the web server are correctly configured, but there is no connectivity between the web server and users on the Internet. What is a possible reason for this lack of connectivity?

• A. The router NAT configuration has an incorrect inside local address

• B. The inside global address is incorrect

• C. The NAT configuration on interface S0/0/1 is incorrect.

• D. Interface Fa0/0 should be configured with the command ip nat outside

An engineer is configuring NAT to translate the source subnet of 10.10.0.0/24 to any of three addresses 192.168.3.1, 192.168.3.2, 192.168.3.3. Which configuration should be used?

• A. Option A

• B. Option B

• C. Option C

Refer to the exhibit. A network engineer must block access for all computers on VLAN 20 to the web server via HTTP. All other computers must be able to access the web server. Which configuration when applied to switch A accomplishes this task?

• A. config t

  ip access-list extended wwwblock

  deny tcp any host 10.30.0.100 eq 80

  int vlan 100

  ip access-group wwwblock in

• B. config t

  ip access-list extended wwwblock

  deny tcp any host 10.30.0.100 eq 80

  permit ip any any

  int vlan 20

  ip access-group wwwblock in

• C. config t

  ip access-list extended wwwblock

  permit ip any any

  deny tcp any host 10.30.0.100 eq 80

  int vlan 30

  ip access-group wwwblock in

• D. config t

  ip access-list extended wwwblock

  deny tcp any host 10.30.0.100 eq 80

  int vlan 20

  ip access-group wwwblock in

Refer to the exhibit. An extended ACL has been configured and applied to router R2. The configuration failed to work as intended. Which two changes stop outbound traffic on TCP ports 25 and 80 to 10.0.20.0/26 from the 10.0.10.0/26 subnet while still allowing all other traffic? (Choose two)

• A. Add a “permit ip any any” statement to the beginning of ACL 101 for allowed traffic

• B. Add a “permit ip any any” statement at the end of ACL 101 for allowed traffic

• C. The source and destination IPs must be swapped in ACL 101

• D. The ACL must be configured the Gi0/2 interface inbound on R1

• E. The ACL must be moved to the Gi0/1 interface outbound on R2

While examining excessive traffic on the network, it is noted that all incoming packets on an interface appear to be allowed even though an IPv4 ACL is applied to the interface. Which two misconfigurations cause this behavior? (Choose two)

• A. The packets fail to match any permit statement

• B. A matching permit statement is too high in the access list

• C. A matching permit statement is too broadly defined

• D. The ACL is empty

• E. A matching deny statement is too high in the access list

Refer to the exhibit. What configuration on R1 denies SSH access from PC-1 to any R1 interface and allows all other traffic?

• A. access-list 100 deny tcp host 172.16.1.33 any eq 22

  access-list 100 permit ip any any

  interface GigabitEthernet0/0

  ip access-group 100 in

• B. access-list 100 deny tcp host 172.16.1.33 any eq 22

  access-list 100 permit ip any any

• C. line vty 0 15

  access-class 100 in

  access-list 100 deny tcp host 172.16.1.33 any eq 23

  access-list 100 permit ip any any

  interface GigabitEthernet0/0

  ip access-group 100 in

• D. access-list 100 deny tcp host 172.16.1.33 any eq 23

  access-list 100 permit ip any any

  line vty 0 15

  access-class 100 in

Refer to the exhibit. An administrator configures the following ACL in order to prevent devices on the 192.168.1.0 subnet from accessing the server at 10.1.1.5:

Where should the administrator place this ACL for the most efficient use of network resources?

• A. inbound on router A Fa0/0

• B. outbound on router B Fa0/0

• C. outbound on router A Fa0/1

• D. inbound on router B Fa0/1