Font size
WorksheetsCCNA 200-301 ACL + NAT
Total questions: 15
Worksheet time: 30mins
Which statement about the nature of NAT overload is true?
A. applies a one-to-many relationship to internal IP addresses
B. applies a one-to-one relationship to internal IP addresses
C. applies a many-to-many relationship to internal IP addresses
D. can be configured only on Gigabit interface
Which keyword in a NAT configuration enables the use of one outside IP address for multiple inside hosts?
A. source
B. static
C. pool
D. overload
Which type of address is the public IP address of a NAT device?
A. outside global
B. outside local
C. inside global
D. inside local
E. outside public
Refer to the exhibit. Router R1 is configured with static NAT. Addressing on the router and the web server are correctly configured, but there is no connectivity between the web server and users on the Internet. What is a possible reason for this lack of connectivity?
A. The router NAT configuration has an incorrect inside local address
B. The inside global address is incorrect
C. The NAT configuration on interface S0/0/1 is incorrect.
D. Interface Fa0/0 should be configured with the command ip nat outside
An engineer is configuring NAT to translate the source subnet of 10.10.0.0/24 to any of three addresses 192.168.3.1, 192.168.3.2, 192.168.3.3. Which configuration should be used?
A. Option A
B. Option B
C. Option C
Refer to the exhibit. A network engineer must block access for all computers on VLAN 20 to the web server via HTTP. All other computers must be able to access the web server. Which configuration when applied to switch A accomplishes this task?
A. config t
ip access-list extended wwwblock
deny tcp any host 10.30.0.100 eq 80
int vlan 100
ip access-group wwwblock in
B. config t
ip access-list extended wwwblock
deny tcp any host 10.30.0.100 eq 80
permit ip any any
int vlan 20
ip access-group wwwblock in
C. config t
ip access-list extended wwwblock
permit ip any any
deny tcp any host 10.30.0.100 eq 80
int vlan 30
ip access-group wwwblock in
D. config t
ip access-list extended wwwblock
deny tcp any host 10.30.0.100 eq 80
int vlan 20
ip access-group wwwblock in
Refer to the exhibit. An extended ACL has been configured and applied to router R2. The configuration failed to work as intended. Which two changes stop outbound traffic on TCP ports 25 and 80 to 10.0.20.0/26 from the 10.0.10.0/26 subnet while still allowing all other traffic? (Choose two)
A. Add a “permit ip any any” statement to the beginning of ACL 101 for allowed traffic
B. Add a “permit ip any any” statement at the end of ACL 101 for allowed traffic
C. The source and destination IPs must be swapped in ACL 101
D. The ACL must be configured the Gi0/2 interface inbound on R1
E. The ACL must be moved to the Gi0/1 interface outbound on R2
While examining excessive traffic on the network, it is noted that all incoming packets on an interface appear to be allowed even though an IPv4 ACL is applied to the interface. Which two misconfigurations cause this behavior? (Choose two)
A. The packets fail to match any permit statement
B. A matching permit statement is too high in the access list
C. A matching permit statement is too broadly defined
D. The ACL is empty
E. A matching deny statement is too high in the access list
Refer to the exhibit. What configuration on R1 denies SSH access from PC-1 to any R1 interface and allows all other traffic?
A. access-list 100 deny tcp host 172.16.1.33 any eq 22
access-list 100 permit ip any any
interface GigabitEthernet0/0
ip access-group 100 in
B. access-list 100 deny tcp host 172.16.1.33 any eq 22
access-list 100 permit ip any any
C. line vty 0 15
access-class 100 in
access-list 100 deny tcp host 172.16.1.33 any eq 23
access-list 100 permit ip any any
interface GigabitEthernet0/0
ip access-group 100 in
D. access-list 100 deny tcp host 172.16.1.33 any eq 23
access-list 100 permit ip any any
line vty 0 15
access-class 100 in
Refer to the exhibit. An administrator configures the following ACL in order to prevent devices on the 192.168.1.0 subnet from accessing the server at 10.1.1.5:
Where should the administrator place this ACL for the most efficient use of network resources?
A. inbound on router A Fa0/0
B. outbound on router B Fa0/0
C. outbound on router A Fa0/1
D. inbound on router B Fa0/1
Refer to the exhibit. Which two configurations would be used to create and apply a standard access list on R1, so that only the 10.0.70.0/25 network devices are allowed to access the internal database server? (Choose two)
A. R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip access-group 5 out
B. R1(config)# access-list 5 permit 10.0.54.0 0.0.1.255
C. R1(config)# interface Serial0/0/0
R1(config-if)# ip access-group 5 in
D. R1(config)# access-list 5 permit 10.0.70.0 0.0.0.127
E. R1(config)# access-list 5 permit any
Refer to the exhibit.
interface GigabitEthernet0/1
ip address 192.168.1.2 255.255.255.0
ip access-group 2699 in
!
access-list 2699 deny icmp any 10.10.1.0 0.0.0.255 echo
access-list 2699 deny ip any 10.20.1.0 0.0.0.255
access-list 2699 permit ip any 10.10.1.0 0.0.0.255
access-list 2699 permit tcp any 10.20.1.0 0.0.0.127 eq 22
A network administrator must permit SSH access to remotely manage routers in a network. The operations team resides on the 10.20.1.0/25 network. Which command will accomplish this task?
A. access-list 2699 permit udp 10.20.1.0 0.0.0.255
B. no access-list 2699 deny tcp any 10.20.1.0 0.0.0.127 eq 22
C. access-list 2699 permit tcp any 10.20.1.0 0.0.0.255 eq 22
D. no access-list 2699 deny ip any 10.20.1.0 0.0.0.255
Refer to exhibit
Which configuration must be applied to the router that configures PAT to translate all addresses in VLAN 200 while allowing devices on VLAN 100 to use their own IP addresses?
Option A
Router1(config)#access-list 99 permit 209.165.201.2 0.0.0.0
Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200
Router1(config)#ip nat inside
Router1(config)#interface gi1/0/0
Router1(config)#ip nat outside
Option B
Router1(config)#access-list 99 permit 209.165.201.2 255.255.255.255
Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200
Router1(config)#ip nat inside
Router1(config)#interface gi1/0/0
Router1(config)#ip nat outside
Option C
Router1(config)#access-list 99 permit 192.168.100.0 0.0.0.255
Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200
Router1(config)#ip nat inside
Router1(config)#interface gi1/0/0
Router1(config)#ip nat outside
Option D
Router1(config)#access-list 99 permit 192.168.100.32 0.0.0.31
Router1(config)#ip nat inside source list 99 interface gi1/0/0 overload
Router1(config)#interface gi2/0/1.200
Router1(config)#ip nat inside
Router1(config)#interface gi1/0/0
Router1(config)#ip nat outside
A. Option A
B. Option B
C. Option C
D. Option D
Refer to the exhibit.
An access list is required to permit traffic from any host on interface G0/0 and deny traffic from interface Gi0/1. Which access list must be applied?
A. Option A
B. Option B
C. Option C
D. Option D
Which command verifies whether any IPv6 ACLs are configured on a router?
A. show ipv6 interface
B. show access-list
C. show ipv6 access-list
D. show ipv6 route
