Cisco CCNA 200-301 IP Services Practice Questions

Free CCNA 200-301 IP Services practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main Cisco CCNA 200-301 page. Sign up free to practice the full set.

1. Question 1IP Services

   Which type of NAT maps multiple private IP addresses to a single public IP address using port numbers to distinguish sessions?

   • APAT (Port Address Translation)Correct
   • BDynamic NAT
   • CStatic NAT
   • DNAT64
   ✓ Correct answer: A

   PAT, also called NAT overload, allows many internal hosts to share a single public IP address by tracking each session using unique source port numbers. When a packet leaves, the router replaces the private source IP and assigns a unique port number, recording the mapping in the NAT table. Return traffic is matched against this table to forward replies to the correct internal host.

   Why the other options are wrong

   • BDynamic NAT maps private IP addresses to a pool of public IP addresses on a one-to-one basis per session - it does not use port numbers to multiplex multiple hosts onto a single public address.
   • CStatic NAT creates a permanent one-to-one mapping between a single private IP address and a single public IP address; it cannot share one public address among multiple hosts.
   • DNAT64 translates between IPv6 addresses and IPv4 addresses to enable communication across different IP versions; it is not a mechanism for multiplexing multiple private IPv4 hosts onto one public IPv4 address.
2. Question 2IP Services

   Cascade Telecom is configuring NTP on their network devices. Which command configures a Cisco router to synchronize its clock with an NTP server at 10.0.0.1?

   • AClock set 10.0.0.1
   • BNtp peer 10.0.0.1
   • CNtp sync 10.0.0.1
   • DNtp server 10.0.0.1Correct
   ✓ Correct answer: D

   The 'ntp server' command places the router in client mode, causing it to synchronize its clock from the specified NTP server address. This is the standard way to configure NTP client behavior on Cisco IOS.

   Why the other options are wrong

   • AClock set is a privileged EXEC command used to manually configure the router's clock with a specific date and time - it does not configure automatic synchronization with an external NTP server at an IP address.
   • Bntp peer 10.0.0.1 configures a symmetric active peer relationship where both devices mutually synchronize - this is used between NTP servers, not to configure a router as a client that receives time from a server.
   • Cntp sync is not a valid Cisco IOS command - no such command exists in the NTP configuration set, and using it would result in an 'unrecognized command' error.
3. Question 3IP ServicesSelect all that apply

   Which two QoS mechanisms are used to manage network congestion? (Choose 2)

   • ADHCP snooping with port rate limiting
   • BARP inspection
   • CWeighted Random Early Detection (WRED)Correct
   • DWeighted Fair Queuing (WFQ)Correct
   • EPort security
   ✓ Correct answer: C, D

   Weighted Random Early Detection (WRED) manages congestion by proactively dropping lower-priority packets before a queue fills completely, avoiding tail-drop. Weighted Fair Queuing (WFQ) manages congestion by dividing bandwidth among flows based on assigned weights, ensuring lower-bandwidth or higher-priority flows are not starved during congestion.

   Why the other options are wrong

   • ADHCP snooping filters rogue DHCP replies; it does nothing about queue congestion.
   • BARP inspection (Dynamic ARP Inspection) validates ARP packets to prevent ARP spoofing attacks and is a security mechanism, not a QoS congestion tool.
   • EPort security restricts access to a switch port based on MAC addresses to prevent unauthorized device connections and is unrelated to QoS congestion management.
4. Question 4IP Services

   What is the purpose of a DHCP relay agent (ip helper-address)?

   • ATo forward client DHCP broadcasts to a remote serverCorrect
   • BTo assign IP addresses directly from the router
   • CTo turn DHCP broadcasts into unicast DNS server queries
   • DTo drop DHCP traffic on untrusted access ports
   ✓ Correct answer: A

   Configured with ip helper-address on the client-facing interface, a DHCP relay agent converts client broadcast DHCP messages into unicast and forwards them to a DHCP server on a different subnet. This allows one central server to serve many subnets. Without it, broadcasts would not cross the router.

   Why the other options are wrong

   • BThe relay forwards requests to a server; it does not assign addresses itself, which is the DHCP server's job.
   • CThe relay forwards DHCP, not DNS, and does not create DNS queries.
   • DDropping DHCP on untrusted ports describes DHCP snooping, not a relay agent.
5. Question 5IP Services

   In QoS, which per-hop behavior (PHB) is marked with DSCP value 46 and is intended for low-latency traffic such as voice?

   • ADefault (DSCP 0)
   • BAssured Forwarding 41 (DSCP 34)
   • CExpedited Forwarding (DSCP 46)Correct
   • DClass Selector 6 (DSCP 48)
   ✓ Correct answer: C

   EF (DSCP 46) provides low loss, low latency, and low jitter, making it the standard marking for real-time voice (RTP) traffic. It is given priority queuing treatment on QoS-enabled devices.

   Why the other options are wrong

   • ADSCP 0 is best-effort default forwarding with no priority.
   • BAF41 (DSCP 34) is typically used for interactive video, not voice EF treatment.
   • DCS6 (DSCP 48) is reserved for network control traffic such as routing protocols.
6. Question 6IP ServicesSelect all that apply

   Which two reasons explain why DNS may use TCP port 53 instead of UDP port 53? (Choose two.)

   • AWhen a response exceeds the size limit for a UDP datagramCorrect
   • BDuring zone transfers between DNS serversCorrect
   • CFor every standard recursive query from a client
   • DTo reduce the number of DNS records returned
   ✓ Correct answer: A, B

   Standard small queries use UDP/53 for efficiency, but when a response is truncated (too large for a UDP datagram, e.g., DNSSEC or many records) the resolver retries over TCP/53. Zone transfers (AXFR) between primary and secondary servers also rely on TCP for reliable bulk data delivery.

   Why the other options are wrong

   • COrdinary client queries use UDP/53 by default, not TCP for every query.
   • DTCP does not reduce the number of records returned; it handles larger or reliable transfers.
7. Question 7IP Services

   Which command enables SNMP read-only access on a Cisco device using the community string 'public'?

   • Asnmp-server community public RW
   • Bsnmp-server community public ROCorrect
   • Csnmp-server host public RO
   • Dsnmp-server enable traps public
   ✓ Correct answer: B

   In SNMPv1/v2c, community strings act as passwords. The 'RO' keyword grants read-only access, allowing a management station to poll values but not change them. 'RW' would allow modifications.

   Why the other options are wrong

   • AThe 'RW' keyword grants read-write access, allowing configuration changes, which is not read-only.
   • C'snmp-server host' specifies a trap/notification receiver, not a community access level.
   • D'snmp-server enable traps' turns on trap generation; it does not define a read-only community.
8. Question 8IP Services

   A Cisco router is configured with 'ntp server 10.1.1.1' but 'show ntp status' reports the clock is unsynchronized. Local time is off by several hours. Which condition most commonly prevents NTP synchronization in this scenario?

   • AThe router's time zone is not configured
   • BNTP authentication keys do not match and authentication is required
   • CThe interface toward the NTP server is administratively shut downCorrect
   • DThe router has fewer than three configured NTP servers
   ✓ Correct answer: C

   NTP requires bidirectional UDP/123 reachability to the server. If the interface used to reach 10.1.1.1 is administratively down (or otherwise unreachable), no NTP packets are exchanged and synchronization never completes. Verifying basic IP reachability to the server is the first troubleshooting step.

   Why the other options are wrong

   • AA missing time zone only affects displayed local time, not the ability to synchronize the system clock to NTP.
   • BAuthentication only blocks sync when it is actually configured and required; the scenario does not mention NTP authentication.
   • DA single NTP server is sufficient to synchronize; three or more improves accuracy and redundancy but is not required.

How IP Services is tested

This domain holds 70 of the 705 questions in the CCNA 200-301 bank, about 10%. The mix is 59 single-answer multiple choice and 11 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill IP Services on its own rather than re-running full-length mocks.

Other CCNA 200-301 exam domains

• Network Fundamentals148 questions
• Network Access137 questions
• IP Connectivity175 questions
• Security Fundamentals105 questions
• Automation and Programmability70 questions
• All CCNA 200-301 practice questions705 total
• IP Services study notesKey concepts
• Cisco practice examsAll Cisco

CCNA 200-301 IP Services FAQ