Quick Reference

Saturday, November 17, 2007

Implement, verify, and troubleshoot NAT and ACLs

CCNA (640-802) exam topic Implement, verify, and troubleshoot NAT and ACLs in a medium-size Enterprise branch office network .

What are two reasons that a network administrator would use access lists? (Choose two.)
A:to control vty access into a router
B:to control broadcast traffic through a router
C:to filter traffic as it passes through a router
D:to filter traffic that originates from the router
E:to replace passwords as a line of defense against security incursions

Answers: A, C

Question 2:
Refer to the exhibit. The access list has been configured on the S0/0 interface of router RTB in the outbound direction. Which two packets, if routed to the interface, will be denied? (Choose two.)
access-list 101 deny tcp any eq telnet
access-list 101 permit ip any any

A:source ip address:; destination port: 21
B:source ip address:, destination port: 21
C:source ip address:, destination port: 21
D:source ip address:, destination port: 23
E:source ip address:; destination port: 23
F:source ip address:, destination port: 23

Answers: D, E

access-list 101 deny tcp any eq telnet
access-list 101 permit ip any any
The above two access-list statements are configured on RTB router and placed in outbound direction on S 0/0 interface.

First ACL statement denies all telnet ( port 23) connections from source address range - to any destination hosts.

Since we need to find the two packets that will be denied when routed outside s 0/0 interface .
source ip address:, destination port: 23 this matches the ACL statement so this packet is denied.

source ip address:; destination port: 23 also matches the ACL statment so this packet is denied.

Question 3:
Refer to the exhibit. Why would the network administrator configure RA in this manner?

A: to give students access to the Internet
B: to prevent students from accessing the command prompt of RA
C: to prevent administrators from accessing the console of RA
D: to give administrators access to the Internet
E: to prevent students from accessing the Internet
F: to prevent students from accessing the Admin network

Answers: B

The above config entered on RA by administrator is to allow only Admin people ( to access RA command prompt using telnet . Since there is an implicit deny any statement at the end of access-list 2, so rest all (students) are prevented from accessing command prompt of RA using telnet.

Question 4:
What is the function of the Cisco IOS command ip nat inside source static
A: It creates a global address pool for all outside NAT transactions.
B: It establishes a dynamic address pool for an inside static address.
C: It creates dynamic source translations for all inside local PAT transactions.
D: It creates a one-to-one mapping between an inside local address and an inside global address. E: It maps one inside source address to a range of outside global addresses.

Answers: D

This command creates a static NAT translation entry for inside local address( to inside global address( .

Question 5:
What is the effect of the following access list condition?

access-list 101 permit ip any

A: permit all packets matching the first three octets of the source address to all destinations
B: permit all packets matching the last octet of the destination address and accept all source addresses
C: permit all packets from the third subnet of the network address to all destinations
D: permit all packets matching the host bits in the source address to all destinations
E: permit all packets to destinations matching the first three octets in the destination address

Answers: A

The wild card mask ( " 0's in wildcard mask needs a definite match" .

So for the above access-list wildcard mask specifies that it need to match first three octets of source address.

Destination address for the ACL is any so it permits all packets that matches the first three octets of source address to all destinations

Question 6:
What does the "Inside Global" address represent in the configuration of NAT?

A: the summarized address for all of the internal subnetted addresses
B: the MAC address of the router used by inside hosts to connect to the Internet
C: a globally unique, private IP address assigned to a host on the inside network
D: a registered address that represents an inside host to an outside network

Answers: D

Inside global address— A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world.

Question 7:
What three pieces of information can be used in an extended access list to filter traffic? (Choose three.)

B:VLAN number
C:TCP or UDP port numbers
D:source switch port number
E:source IP address and destination IP address
F:source MAC address and destination MAC address

Answers: A, C, E

Question 8:
An access list was written with the four statements shown in the graphic. Which single access list statement will combine all four of these statements into a single statement that will have exactly the same effect?

A: access-list 10 permit
B: access-list 10 permit
C: access-list 10 permit
D: access-list 10 permit
E: access-list 10 permit

Answers: C

To combine all four ACL statements into one ACL statement with same effect we need new network that matches all 4 statements network statement and new wildcard mask for the new network we will use.

New Network for the ACL statement: AND operation needs to be perform on all four statements.
AND operation: (AND: The output is true only when both inputs A and B are true.)

A - B = Output
0 -0 = 0; 0-1 = 0 ; 1-0 = 0; 1-1= 1
Following above AND operations procedure = 10101100.00011101.00010000.00000000 = 10101100.00011101.00010001.00000000 = 10101100.00011101.00010010.00000000 = 10101100.00011101.00010011.00000000
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: = 10101100.00011101.00010000.00000000

new network after AND operation is

Now to find out Wildcard mask to match all four networks we need to perform XOR operations.

XOR operation: (XOR: The output is true when either inputs A or B are true, but not if both A and B are true.)

A - B = Output
0 - 0 = 0 ; 0 - 1 = 1 ; 1-0 = 1 ; 1 - 1 = 0

Following above XOR operations procedure
172.29.16.x = 10101100.00011101.00010000.x
172.29.17.x = 10101100.00011101.00010001.x
172.29.18.x = 10101100.00011101.00010010.x
172.29.19.x = 10101100.00011101.00010011.x
0.0.3.x = 00000000.00000000.00000011.x

Since we are only concern about first three octets the last octet can be 255 so the new wildcard mask is

The complete single acl statement with new network and wildcard mask that matches all four networks is
access-list 10 permit

Question 9:
An inbound access list has been configured on a serial interface to deny packet entry for TCP and UDP ports 21, 23 and 25. What types of packets will be permitted by this ACL? (Choose three.)


Answers: D, E, F

Ports 21, 23 and 25 are denied by ACL.
21 = FTP ; 23= Telnet ; 25= SMTP
Remaining ports are permited so DNS, HTTP and POP3 ports are permitted by ACL.

Quesstion 10:
Refer to the exhibit. The FMJ manufacturing company is concerned about unauthorized access to the Payroll Server. The Accounting1, CEO, Mgr1, and Mgr2 workstations should be the only computers with access to the Payroll Server. What two technologies should be implemented to help prevent unauthorized access to the server? (Choose two.)

A:access lists
B:encrypted router passwords
F:wireless LANs

Answers: A, D

Access-lists are created to permit only Accounting1, CEO, Mgr1, and Mgr2 workstations to Payroll server.
VLAN can be created which creates a separate Broadcast domain with vlan members only Accounting1, CEO, Mgr1, and Mgr2 workstations including Payroll server.

Question 11:
A network administrator would like to implement NAT in the network shown in the graphic to allow inside hosts to use a private addressing scheme. Where should NAT be configured?

A: Corporate router
B: Engineering router
C: Sales router
D: all routers
E: all routers and switches

Answers: A

Question 12:

An access list has been designed to prevent HTTP traffic from the Accounting Department from reaching the HR server attached to the Holyoke router. Which of the following access lists will accomplish this task when grouped with the e0 interface on the Chicopee router?

A: permit ip any any
deny tcp eq 80
B: permit ip any any
deny tcp eq 80
C: deny tcp eq 80
permit ip any any
D: deny tcp eq 80
permit ip any any

Answers: D

We need to create a ACL which denies Account department network from accessing HTTP on HR server.

Source address is account department network: mask
Destination address is HR server :
Port number for HTTP traffic on destination addresss : 80

First create deny statement
access-list 100 deny tcp 80

Since there is a implicit deny any any statement at the end of ACL we need to permit remaining traffic.
access-list 100 permit ip any any


Anonymous said...

Hi, Thanks for your all posts. I would like to take exam 640-802 on December. Please suggest me which topics should i study from your site? Including the older topics also? Can you please separate the topics for 640-802?
Thanks again.

a3tips said...


Currently I am working on 640-802 topics (two topics already been posted along with the SIMs NAT,topology based Questions and Lab)... You can also check old topics those have good explanations which will help you.
Keep visiting the site still i finish the entire Topics of CCNA 640-802.
You can view the various topics that i will cover by visiting at cisco link http://www.cisco.com/web/learning/le3/current_exams/640-802.html


Anonymous said...

Thanks for ur posts. i passed 640-802 with the help of ur solutions.
i will surely buy u a beer.
Prince from Ghana

Anonymous said...

heyy,how are u doing all,its really fantastic site,it helped me alot to understand many ques,i will take the exam after 4 days i already studied latest p4s 245 ques is that enough!!!!,i really will appreciate if any1 that passes it inform me about the new exam

Sumit said...

Hi, this is Sumit from Bangladesh. First of all i want to give u lot of thanks for a wonderfull site.Actually its help me lots abt CCNA.still am not sitting for CCNA 640-802;hope it will be Jan/2008.can you update all of your question by that time.

Anonymous said...

Hi a3tips,

Hope u r fine. We didn't find any further update of ur beautiful site since November 17. I am gonna to sit for da exam next week. Plz give me some suggestions and update with latest Q's if available. What about da new sim's. Plz advise. Waiting for ur reply. Thank you.

a3tips said...


Will update this blog as soon as possible ...


Anonymous said...

Hi, thanks for the site. I am taking the 640-802 exam on Saturday, so I appreciate all of your hard work. Other than what you already updated is there anything else major that I should cram for before saturday morning? Thank you very much!!

pramod said...

thank you for bloggger i read carefully you all 640-802 simulation and your explation i pass the exam 960/1000 marks
agin thanks for a3tips

Carey said...

Hi, great site you have here, I'm finding the content extremly helpful. Are there any updates for the ccna 640-802 exam as I am sitting it in the next few days. Many thanks!!

Ahamed said...

It's a great resource and veryvery helpfull .. pls keep it up and continue to add contents...