Skip to content
Log in Sign up My account

IP Services Practice Questions

15 original questions covering ENCOR 3.3.a to 3.3.d. Answer every one before opening any explanation. Target: 12 of 15 (80%).

1. Blueprint 3.3.a

Refer to the exhibit.

SW4# show ntp associations

  address         ref clock       st   when   poll reach  delay  offset   disp
+~10.255.255.11   10.255.255.1     3     40     64   377  1.402   0.811  1.020
*~10.255.255.12   10.255.255.1     3     12     64   377  1.118   0.204  0.874
x~10.255.255.30   192.0.2.50       4     25     64   377  2.900  912.33  1.310
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

Which two statements are true? (Choose two.)

  • A. SW4 is synchronized to 10.255.255.12 and is at stratum 4
  • B. SW4 is at stratum 3
  • C. 10.255.255.30 is unreachable
  • D. 10.255.255.30 was rejected because its time disagrees with the other sources
  • E. 10.255.255.11 is not usable because it is not marked with *
Answer: A, D

The * marks the system peer, a stratum 3 server, so SW4 is stratum 4 (B is wrong). The x marks a falseticker: reach 377 shows it answers every poll (C is wrong), but its offset of over 900 ms disagrees with the other two sources, so the selection algorithm discards it. The + on 10.255.255.11 means it is a valid candidate that is combined with the system peer and would take over if the peer failed (E).

2. Blueprint 3.3.a

Refer to the exhibit. R5 never synchronizes to 10.1.1.1. The server is reachable, has key 7 defined with the same string, and serves other clients successfully.

R5:
ntp authentication-key 7 md5 Time7Key
ntp authenticate
ntp server 10.1.1.1 key 7

What is the fix?

  • A. Add ntp master to R5
  • B. Change ntp server to ntp peer
  • C. Remove key 7 from the ntp server line
  • D. Add ntp trusted-key 7 to R5
Answer: D

With ntp authenticate enabled, a client only synchronizes to a server whose key is defined and trusted. Key 7 is defined but not listed with ntp trusted-key, so the server is never selected. ntp master (A) would make R5 its own source, which hides the problem instead of fixing it. A peer association (B) still needs a trusted key. Removing the key (C) makes the client send unauthenticated requests, and with ntp authenticate on, the unauthenticated replies are still not trusted.

3. Blueprint 3.3.a

Which statement about PTP boundary and transparent clocks is true?

  • A. A transparent clock synchronizes its own clock to the grandmaster and then acts as master on its other ports
  • B. A boundary clock terminates PTP on its slave port and acts as a master toward downstream devices
  • C. Both clock types are selected using the NTP stratum of the upstream server
  • D. A boundary clock forwards PTP messages unchanged and adds residence time to a correction field
Answer: B

A boundary clock has one port in the slave (secondary) state toward the grandmaster and acts as master on its other PTP ports, regenerating timing. A transparent clock does not act as master; it forwards PTP messages and adds the time they spent in the switch to the correction field, so A and D describe the two types swapped. PTP has no stratum; clock roles are chosen with the Best Master Clock Algorithm (C).

4. Blueprint 3.3.b

An internal web server at 10.20.20.50 must be reachable from the internet at http://203.0.113.2:8443, where 203.0.113.2 is the address of R1's outside interface Gi0/0. The server listens on TCP 443. R1 already runs PAT for users to Gi0/0. Which command completes the task?

  • A. ip nat inside source static 10.20.20.50 203.0.113.2
  • B. ip nat inside source static tcp 10.20.20.50 8443 203.0.113.2 443
  • C. ip nat inside source static tcp 10.20.20.50 443 interface GigabitEthernet0/0 8443
  • D. ip nat outside source static tcp 203.0.113.2 8443 10.20.20.50 443
Answer: C

Static PAT lists the inside local address and port first, then the inside global address (here the interface) and port. A maps every port of the interface address to the server, which would break PAT for all users and is not what was asked. D uses outside source NAT, which translates outside hosts, not inside servers. B has the ports reversed: the server would need to listen on 8443 and users would connect to 443.

5. Blueprint 3.3.b

Refer to the exhibit. A static NAT entry maps 10.20.20.10 to 203.0.113.10. Internet users cannot reach the server on TCP 22, but users inside can.

interface GigabitEthernet0/0
 ip nat outside
 ip access-group FROM-INTERNET in
!
ip access-list extended FROM-INTERNET
 permit tcp any host 10.20.20.10 eq 22
 permit tcp any any established

Why does the traffic fail?

  • A. The ACL should be applied outbound
  • B. TCP 22 cannot be translated
  • C. Static NAT does not support inbound sessions
  • D. An inbound ACL on the outside interface is processed before NAT, so it sees destination 203.0.113.10
Answer: D

For traffic arriving on an outside interface, the inbound ACL runs first and NAT outside-to-inside runs after it. The packet's destination at that point is the inside global address 203.0.113.10, which the first ACL entry does not match, and a new SSH session has no ACK bit so established does not match either. Rewrite the entry as permit tcp any host 203.0.113.10 eq 22. Static NAT does allow sessions started from outside (C), and any TCP port can be translated (B).

Free account required for the rest

This page has 15 questions and the first 5 are shown here. You're seeing a free sample. A free account unlocks everything: every question bank, the timed exams, the cram sheets, the simulations and the lab files.

Create a free account Log in