Cisco Certified Network Associate (CCNA) 200-301 Practice Test 47
Question 460
A branch edge needs a static NAT publication for inside host 10.10.20.10 at public address 198.51.100.10. External SYNs arrive on the outside interface, but `show ip nat translations` has no corresponding static entry. Which configuration defect should be corrected first?
- Replace the server DNS TTL with zero even though the packet reaches the public IP.
- Increase the dynamic PAT overload pool for outbound client sessions.
- Adjust OSPF Hello timers on an unrelated transit network.
- Create or restore the intended static inside-source translation and verify inside/outside interface roles.
Explanation
Correct Answer
D:Without an installed static mapping, the edge cannot translate the published public destination to 10.10.20.10. Configure the expected static NAT binding and verify the matching interfaces and translation table.
Incorrect Answers
A:The inbound SYN already arrives at the correct edge public destination, so DNS TTL is not the missing static translation.
B:PAT for outbound client connections is a different translation use case from a fixed inbound service publication.
C:OSPF timer matching matters for router adjacency, not for populating the static NAT mapping on the edge.
Question 461
A Cisco router performs dynamic inside-source NAT using a pool with only two global IPv4 addresses and no overload. Two inside hosts already have active mappings. A third host opens a new connection, but `show ip nat translations` creates no mapping for it, even though ACL matching and routing are valid. What is the most likely explanation?
- The global NAT pool is exhausted; the third inside host cannot receive a new one-to-one mapping until capacity is available.
- An OSPF 2-WAY neighbor state prevents the router from creating NAT entries for any client.
- A DHCP server sends too many DHCPOFFER messages and automatically consumes NAT global addresses.
- The outside interface has an excessively high STP port priority, so the NAT pool becomes empty.
Explanation
Correct Answer
A:Ordinary dynamic NAT without port overload assigns a public inside-global address from the pool to a translated inside host according to the router's allocation state. With two addresses already occupied and no overload, the third host may have no available global mapping despite matching the ACL and having valid routes. Inspect `show ip nat statistics`, active translations and the pool's allocation/exhaustion state. The remedy is to size the pool appropriately, allow eligible mappings to expire, or design port overloading if policy permits sharing. Do not assume every failed new session is an ACL problem when pool capacity evidence is explicit.
Incorrect Answers
B:OSPF neighbor state concerns routing adjacencies. A router may have a stable route and still run out of NAT translation addresses independently of OSPF. The scenario confirms routing is valid, and two clients already have mappings. Check the finite NAT pool rather than altering unrelated neighbor behavior.
C:DHCPOFFER messages allocate client IPv4 addresses according to DHCP server scopes; they do not directly consume the router's inside-global NAT pool slots as if they were NAT sessions. The observable limit here is two translated outside addresses already assigned to two hosts. DHCP can succeed even while new NAT mappings fail.
D:Spanning-tree port priority is a Layer 2 topology election attribute on suitable switching interfaces. It does not determine the size or allocation state of an IOS dynamic NAT global address pool. Since two mappings exist and the third fails with all pool addresses used, investigate translation capacity.
Question 462
A router uses a correct standard NAT selection ACL for internal clients, but `show ip nat translations` is empty while matching flows reach the edge. The LAN interface was marked `ip nat outside` and the WAN interface `ip nat inside`. What explains the failure?
- The standard source ACL must be incorrect because it permits the stated inside IPs.
- The inside/outside interface roles are reversed, so the intended inside-source translation is not applied in the expected traffic direction.
- Dynamic ARP inspection is dropping all DHCP offers in the LAN VLAN.
- The router is acting as an SNMP manager instead of a device agent.
Explanation
Correct Answer
B:Source NAT processes packets according to inside and outside interface roles. Matching an ACL is not sufficient if the interfaces were marked backward; fix the orientation and retest a matching flow with translation-table evidence.
Incorrect Answers
A:A correct ACL match was confirmed; the directly observed configuration error is interface NAT role reversal.
C:The symptom is missing NAT state despite matching traffic, not a reported DHCP or ARP validation failure.
D:SNMP role selection is unrelated to forwarding through inside-source NAT interfaces.
Question 463
An inside-NAT policy was intended to translate only 10.20.50.0/24, but the selection ACL uses an overbroad wildcard and now also translates 10.20.51.0/24. The pool itself has capacity. What should the administrator correct?
- Reverse `ip nat inside` and `ip nat outside` on otherwise correctly classified interfaces.
- Increase the number of public pool addresses to fix an alleged exhaustion.
- Restrict the NAT selection ACL to the intended 10.20.50.0/24 source using the proper 0.0.0.255 wildcard.
- Disable all source-NAT translations regardless of subnet.
Explanation
Correct Answer
C:The overbroad wildcard is matching unintended inside hosts and causing unauthorized translation. The specific network source match must be restricted to the approved /24.
Incorrect Answers
A:An interface-role reversal is a separate fault that can stop legitimate translations. Nothing in the evidence establishes reversed roles.
B:The described effect is translation of too many source subnets, not a shortage of available global addresses.
D:Disabling all translation would also break the legitimate 10.20.50.0/24 users; narrow the ACL instead.
Question 464
A router should have a persistent static source NAT mapping `10.1.1.10` to `198.51.100.10`. Before the repair, public-to-private sessions fail and the static mapping is missing. Which CLI evidence most directly confirms it has been installed?
- `show ip route` contains a default route but no static NAT mapping.
- `show ip nat translations` shows the intended static inside-local `10.1.1.10` and inside-global `198.51.100.10` mapping.
- `show ip nat statistics` shows a nonzero dynamic pool size but the named static mapping remains absent.
- `show interfaces` reports that the LAN switchport is up, without any NAT state.
Explanation
Correct Answer
B:Static source NAT defines a lasting one-to-one inside-local/inside-global mapping; its presence in the NAT table verifies the configured address relation. End-to-end inbound success also depends on public routing, filtering and appropriate inside/outside role.
Incorrect Answers
A:A gateway of last resort cannot prove the necessary public-to-private address translation exists.
C:Dynamic pool capacity does not establish the specific one-to-one public-to-private mapping.
D:Layer 1/2 link status cannot verify a configured static translation binding.
Question 465
A dynamic NAT pool ran out of globally usable addresses after the first few clients connected. After enlarging the pool, what result best verifies that new sessions no longer fail due to address exhaustion?
- Concurrent test clients acquire active translations without allocation failures, and NAT statistics show usable address capacity under expected load.
- Only the first client reaches the Internet while subsequent translations still fail with pool exhaustion.
- A static route to 0.0.0.0/0 exists, but no NAT session or utilization check is performed.
- The NAT ACL is displayed but the pool has no free addresses at the required concurrency.
Explanation
Correct Answer
A:Without overload, one-to-one dynamic translations consume pool addresses while active. Exercising the expected concurrency and inspecting the table/allocator is more conclusive than merely seeing one already-mapped client reach the Internet.
Incorrect Answers
B:A working translation for one client does not show that a NAT address pool has enough remaining mappings for concurrent clients. If additional hosts cannot obtain translations because the pool is exhausted, the capacity fault persists.
C:Default routing cannot establish enough public translation addresses for simultaneous sessions.
D:Correct address selection does not create extra usable public mapping capacity.
Question 466
R1 should synchronize its IOS clock with reachable NTP server `192.0.2.123`, so syslog events can be correlated across routers. Which configuration is the direct NTP-client action?
- Configure `ntp server 192.0.2.123` on R1, then confirm an actual selected synchronized peer.
- Set `logging host 192.0.2.123` and assume syslog transport automatically synchronizes the router clock.
- Set an arbitrary local date once and expect the clocks never to drift.
- Set only a timezone display setting without selecting an NTP source.
Explanation
Correct Answer
A:An IOS `ntp server` statement identifies the time source. Reachability and NTP protocol exchange must succeed before the local clock is synchronized; configured peer text alone is not proof of synchronized state.
Incorrect Answers
B:Syslog forwards event records but does not establish an NTP time association.
C:Manual clock adjustment does not maintain synchronization against independent oscillator drift.
D:Timezone changes presentation, not the actual time-of-day synchronization between devices.
Question 467
An administrator inspects `show ntp associations` on an IOS router and sees a reachable peer selected for synchronization, while another peer has a lower stratum but is unreachable. Which interpretation is appropriate?
- Stratum zero is always a reachable public NTP server that routers should configure directly.
- A lower stratum guarantees better local time even when the peer cannot be reached.
- NTP selection considers usable, reachable timing sources and quality; a lower stratum value alone does not make an unreachable peer the correct source.
- NTP stratum represents a syslog severity number and has no relation to clock hierarchy.
Explanation
Correct Answer
C:NTP stratum indicates distance from a reference clock in the synchronization hierarchy, but it is not a standalone proof of current reachability or timing accuracy. A peer that cannot be reached cannot supply usable synchronization just because it advertises a smaller stratum value. Inspect association reachability, selection markers, offset and jitter as supported by the platform. Confirm `show ntp status` indicates actual synchronization and that the selected source is authorized and reasonably stable. A healthy, reachable candidate at a higher stratum can be more useful than a nominally closer but unavailable source.
Incorrect Answers
A:Stratum zero represents reference clock sources within the NTP model, not a general category of ordinary publicly reachable NTP servers that one must configure as a network peer. Network servers expose their own suitable stratum. Select reachable authoritative sources and validate actual synchronization state.
B:Lower stratum is closer in the logical NTP hierarchy, but it does not override network reachability, synchronization validity, or measured quality. An unreachable peer supplies no timestamps to the client. The router should rely on a usable timing source rather than treating one numeric field as an unconditional priority.
D:NTP stratum and syslog severity are distinct protocol fields. Syslog severity values classify event importance, while NTP stratum describes relative placement in a time-reference hierarchy. Both may be shown as integers, but their meanings and operational verification procedures are unrelated.
Question 468
Two switches show syslog timestamps that differ by 90 seconds even after their display timezones were aligned. Which change addresses the event-correlation problem at its cause?
- Change only `clock timezone` on both switches while their underlying clocks keep drifting.
- Increase the syslog severity threshold so fewer events are logged.
- Change the SNMP polling interval and leave NTP unsynchronized.
- Synchronize both devices to valid NTP time sources and verify their clock synchronization, rather than only formatting timezone labels.
Explanation
Correct Answer
D:Timezone settings affect human-readable timestamp display; NTP disciplines the actual device clocks. Event correlation needs a common timebase and correct timezone interpretation, not just identical displayed zones.
Incorrect Answers
A:Timezone does not correct clock frequency or offset to a common time source.
B:Filtering log volume cannot align the timestamps of events across the two devices.
C:Polling cadence is unrelated to the local clocks used to stamp log messages.
Question 469
A Cisco router has `ntp server 10.10.10.5` configured, but `show ntp associations` reports that peer with reach 0 and no selected synchronization marker. `show ntp status` says the clock is unsynchronized. What should be checked first?
- Change the router timezone so its current wall-clock display matches the server.
- Enable OSPF on the NTP server even if ordinary routing to 10.10.10.5 already exists.
- Verify IP reachability and NTP UDP/123 request/reply exchange with 10.10.10.5.
- Configure a static NAT translation for all traffic, regardless of the peer address.
Explanation
Correct Answer
C:The configured peer is not exchanging usable responses: reach 0 in `show ntp associations` indicates no successful recent poll responses, and `show ntp status` confirms no selected source. First verify the router can route toward 10.10.10.5, return traffic can come back, and security filters allow the expected UDP port 123 exchanges. Inspect the NTP server service and association detail if basic reachability succeeds. Cisco's troubleshooting reference pairs peer reach/selection information with the overall clock synchronization state. Increasing a stratum number or changing a timezone cannot correct missing packets. A nonzero reach value alone is not complete proof of synchronization; check the selected peer marker and status together.
Incorrect Answers
A:NTP operates with time and timezone concepts, but timezone settings only change local display conventions; they do not explain why no replies are recorded from the configured NTP server. A reach value of zero indicates recent polls have not produced successful responses. The operator should first distinguish transport reachability or server availability from incorrect local human-readable time formatting.
B:OSPF is one possible routing protocol for reaching a network, not a requirement of NTP. The scenario does not establish that the NTP host requires OSPF adjacency with the router, and a route can exist through static or other protocols. Enabling a dynamic routing process would add unnecessary configuration changes without identifying whether the NTP UDP exchange works.
D:NAT is not a generic prerequisite for using NTP. A statically translated address might be relevant in a specific private/public topology, but no such boundary or translation need is supplied. Adding broad NAT would complicate packet tracing and could cause new problems. The observed zero reach counter should lead to source/destination, UDP and service verification, not unrelated translation configuration.
Question 470
R1 reports NTP stratum 16 and `show ntp status` says the clock is unsynchronized. The configured NTP server IP is present, but reachability to it is not verified. How should the status be interpreted?
- Stratum 16 confirms the most precise synchronized server in the hierarchy.
- The presence of an `ntp server` line proves that time synchronization has succeeded.
- Changing the router hostname is the required fix for a stratum-16 state.
- Stratum 16 means this router is not synchronized to a valid time source; check peer reachability and NTP association state.
Explanation
Correct Answer
D:An unsynchronized NTP client is not a trustworthy clock source, and Cisco commonly presents stratum 16 for unsynchronized status. Verify actual association, peer reachability and access controls.
Incorrect Answers
A:High stratum does not indicate better precision, and stratum 16 is an unsynchronized condition rather than the best upstream clock.
B:A configuration line expresses an intended peer, not evidence of successful reachability or synchronization.
C:Hostname changes do not establish NTP exchange or cause a router to synchronize to a peer.
