Title: ICND1 / 5. IP Services

Q: Which commands could you use to verify that a newly created access list that prevents Telnet and ICMP access to a server is set on the router?
A: show ip interface:
Router# show ip interface
Ethernet0 is up, line protocol is up
Internet address is 192.168.1.1/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is 100
show access-lists:
Router# show access-lists
Extended IP access list 100
permit tcp 192.168.0.0 0.0.255.255 any established
(189 matches)
permit udp host 192.168.1.39 any eq domain
(32 matches)

Q: Which command would be used to establish static translation between an inside local address and an inside global address?
A: You should use the following command:
Router(config)# ip nat inside source static local-ip global-ip
You can translate your own IP addresses into globally unique IP addresses when communicating outside of your network. You can configure static or dynamic inside source translation.
To establish static translation between an inside local address and an inside global address, you should use the ip nat inside source static local-ip global-ip command. This static configuration can be removed by entering the no ip nat inside source static global command.
The other options are incorrect as they are not valid Cisco IOS configuration commands.

Q: Which of the following represent valid ranges of access list numbers on a Cisco router for an Internet Protocol (IP) extended access list?
A: 100 - 199 and 2000 - 2699 are the ranges of IP extended access lists.

Q: What would be the syntax for an extended ACL to block all traffic from TCP port 4569?
A: access-list <###> deny tcp any any eq 4569

Q: Which Cisco Internetwork Operating System (IOS) command is used to view information about the Dynamic Host Configuration Protocol (DHCP) address pool?
A: show ip dhcp pool

Q: How would you stop an unauthorized user from establishing a Telnet connection to your router? (Choose two.)
A: Telnet security is achieved first by activating a login process and password on the VTY lines, configured as such:
Router(config)# line vty 0 4
Router(config-line)# login
Router(config-line)# password cisco
---
To further secure your router against unauthorized Telnet connections, an access control list (ACL) should be created and applied to the VTY lines, specifying only those hosts that should be allowed Telnet access, as follows:
Router(config)# access-list 1 permit 10.1.1.0 0.0.0.255
Router(config)# line vty 0 4
Router(config-line)# access-class 1 in

Q: Which of the following represent valid ranges of access list numbers on a Cisco router for an Internet Protocol (IP) standard access list? (Choose all that apply.)
A: 1 - 99 and 1300 - 1999 represent the ranges of IP standard access lists.

Q: You have added a new router to your network using all of the default settings. You can connect to everything by IP address, but the router doesn't seem to be resolving names to IP addresses. The DNS server is in a directly connected network. Which of the following is most likely the problem?
A: The most likely problem is that you configured an incorrect IP address for the DNS server.
ip name-server x.x.x.x

Q: You are the network administrator for your company. You want to restrict all ping attempts from outside your company from reaching internal hosts. Your internal network is using the IP network of 200.15.24.0/24.
A: access-list 100 deny icmp any 200.15.24.0 0.0.0.255 echo

Q: Which keywords can be substituted for access list wildcards while configuring access lists? (Choose two.)
A: The **any** keyword is used for a wildcard referring to all devices. The equivalent wildcard is 255.255.255.255. For example:
Router(config)# access-list 10 deny any
or
Router(config)# access-list 15 deny 0.0.0.0 255.255.255.255
---
The **host** keyword is equivalent to the 0.0.0.0 wildcard. For example, if you must permit IP address 192.168.144.25, you can configure the following:
Router(config)# access-list 20 permit 192.168.144.25 0.0.0.0
or
Router(config)# access-list 20 permit host 192.168.144.25

Q: Which command would be used to establish static translation between an inside local address 192.168.144.25 and an inside global address 202.56.63.102?
A: To establish a static translation between an inside local address 192.168.144.25 and an inside global address 202.56.63.102, you would use the command:
"ip nat inside source static 192.168.144.25 202.56.63.102"
executed in global configuration mode. The correct format of the command is:
ip nat inside source static local-ip global-ip

Q: Which command produced the following output?
----------------------------------------------------------------
IP address       Client-ID/              Lease expiration        Type
                 Hardware address
192.168.0.11     0030.F23A.0D57           --                     Automatic
192.168.0.12     00E0.B074.DE16           --                     Automatic
192.168.0.13     0002.16D9.DB22           --                     Automatic
192.168.0.14     0003.E4E3.18E9           --                     Automatic
----------------------------------------------------------------
A: show ip dhcp binding

Q: Which command produced the following output?
----------------------------------------------------------------
Pool LAN_A :
Utilization mark (high/low) : 100 / 0
Subnet size (first/next) : 0 / 0
Total addresses : 254
Leased addresses : 1
Pending event : none
1 subnet is currently in the pool :
Current index IP address range Leased addresses
172.16.2.102 172.16.2.1 - 172.16.2.254 1
----------------------------------------------------------------
A: show ip dhcp pool LAN_A

Q: The _________________ command lists the method through which the (DHCP) server added each address to the conflict list: either gratuitous ARP, as detected by the client, or ping, as detected by the server. The server avoids offering these conflicted addresses to any future clients, until the engineer uses the
________________ command to clear the list.
*Oct 16 19:28:59.220: %DHCPD-4-DECLINE_CONFLICT: DHCP address conflict: client
0063.6973.636f.2d30.3230.302e.3034.3034.2e30.3430.342d.4769.302f.30 declined
172.16.2.102.
R2# <<command redacted>>
IP address Detection method Detection time VRF
172.16.2.102 Gratuitous ARP Oct 16 2012 07:28 PM
A: show ip dhcp conflict,
clear ip dhcp conflict

Q: Which command produced the following output?
===========================================================================
Interface List
 10...b4 b5 2f 8e b1 eb ......Realtek PCIe GBE Family Controller
  2...1e d0 5a b5 da b1 ......Microsoft Wi-Fi Direct Virtual Adapter
  3...2c d0 5a b5 da b1 ......Qualcomm Atheros AR9485 802.11b/g/n WiFi Adap
  7...2c d0 5a b6 94 a1 ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
  5...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
  6...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.10.1   192.168.10.139     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
     192.168.10.0    255.255.255.0         On-link    192.168.10.139    281
   192.168.10.139  255.255.255.255         On-link    192.168.10.139    281
   192.168.10.255  255.255.255.255         On-link    192.168.10.139    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    192.168.10.139    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    192.168.10.139    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0       10.233.0.2  Default
===========================================================================
A: netstat -rn

Q: Which command produced the following output?
-----------------------------------------------------------------------
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.10.1              26  00E0.F74E.2B01  ARPA   FastEthernet0/0
Internet  10.10.10.2              -   00D0.97C5.D001  ARPA   FastEthernet0/0
Internet  192.168.0.1             -   00D0.97C5.D002  ARPA   FastEthernet0/1
Internet  192.168.0.11            24  0030.F23A.0D57  ARPA   FastEthernet0/1
-----------------------------------------------------------------------
A: show arp

Q: Which command produced the following output?
-------------------------------------------------------------
Conn Host Address Byte Idle Conn Name
1 Milwaukee 10.1.4.252 0 0 Milwaukee
* 2 NewYork 10.1.6.253 0 0 NewYork
-------------------------------------------------------------
A: show sessions,
where