Cisco Certified Network Associate (CCNA) IP Services Syllabus

Which command clears dynamic NAT translation entries?

clear ip nat translation * (or specify a particular entry).

What debug command shows NAT activity in real time for troubleshooting?

debug ip nat.

A NAT translation works but the host has no Internet access; what common cause should you check?

Verify correct ip nat inside/outside interface assignments, the ACL matches the hosts, the pool/route is valid, and the default route exists.

What is the purpose of NTP (Network Time Protocol)?

To synchronize the clocks of network devices to a common, accurate time source for accurate logging, certificates, and timestamps.

What transport protocol and port does NTP use?

UDP port 123.

In NTP, what does a 'stratum' value represent?

The distance (number of hops) from an authoritative reference clock; stratum 1 is directly attached to a reference source, and higher numbers are farther away.

What is the stratum value of the reference clock itself (e.g., atomic/GPS)?

Stratum 0.

What command configures a Cisco router as an NTP client pointing to a server?

ntp server <ip-address> (in global config mode).

How does NTP client/server mode operate?

The client periodically polls the configured NTP server, which replies with its time; the client adjusts its clock toward the server's time based on the server's stratum and reliability.

Which command verifies NTP synchronization status and stratum on a Cisco device?

show ntp status (and show ntp associations for peer details).

What is the purpose of Syslog?

To collect, timestamp, and send log/event messages from network devices to a central server for monitoring and troubleshooting.

What transport protocol and port does Syslog use by default?

UDP port 514.

List the eight Syslog severity levels from 0 to 7.

0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notification, 6 Informational, 7 Debugging.

In Syslog, does a lower or higher severity number indicate a more serious event?

A lower number is more severe (0 = Emergency is most critical; 7 = Debugging is least critical).

A mnemonic for Syslog levels 0-7 is 'Every Awesome Cisco Engineer Will Need Ice cream Daily'; what does the 'W' stand for?

Warning (level 4).

What Cisco command sends Syslog messages to a server at a given IP?

logging host <ip-address> (or logging <ip-address>).

What command sets the minimum severity level of messages sent to the Syslog server?

logging trap <level> (by name or number).

In a Cisco Syslog message like %LINK-3-UPDOWN, what does the number 3 indicate?

The severity level (3 = Error).

What is the function of SNMP in network operations?

Simple Network Management Protocol monitors and manages network devices by collecting status data (via a manager polling agents) and receiving event notifications.

What transport ports does SNMP use for polling and for traps?

UDP 161 for agent polling/queries and UDP 162 for traps/notifications to the manager.

What is an SNMP MIB?

The Management Information Base, a hierarchical database of managed objects (each identified by an OID) that an SNMP agent exposes to the manager.

What is the difference between an SNMP 'get' and an SNMP 'trap'?

A get is initiated by the manager polling the agent for data; a trap is an unsolicited message sent by the agent to alert the manager of an event.

Why is SNMPv3 preferred over v1 and v2c?

SNMPv3 adds security: authentication, message integrity, and encryption, whereas v1/v2c rely only on plaintext community strings.

What is the role of DHCP?

Dynamic Host Configuration Protocol automatically assigns IP addresses and related parameters (mask, default gateway, DNS) to hosts, reducing manual configuration.

What are the four DHCP message exchange steps (DORA)?

Discover, Offer, Request, Acknowledge.

What transport ports does DHCP use?

UDP port 67 (server) and UDP port 68 (client).

Why are DHCP Discover messages sent as broadcasts?

Because the client has no IP address yet and does not know the server's address, so it broadcasts to reach any available DHCP server.

What feature lets a router forward DHCP broadcasts to a server on a different subnet?

A DHCP relay agent, configured with the 'ip helper-address <server-ip>' command on the client-facing interface.

What command excludes addresses from being handed out by a Cisco DHCP server?

ip dhcp excluded-address <start> <end> (in global config).

What is the role of DNS?

The Domain Name System resolves human-readable hostnames (e.g., www.cisco.com) into IP addresses so hosts can communicate.

What transport protocol and port does DNS primarily use for queries?

UDP port 53 for standard queries (TCP 53 for zone transfers and large responses).

Describe the DNS resolution process when a name is not cached.

The resolver queries a recursive DNS server, which queries the root server, then the TLD server, then the authoritative server, returning the IP back down the chain to the client.

What command configures a Cisco device to use a DNS server for name resolution?

ip name-server <ip-address> (and ip domain-lookup must be enabled).

On a Windows PC, which command verifies the IP address, mask, and gateway received from DHCP?

ipconfig (use ipconfig /all to also see DNS and DHCP server details).

Which Windows commands release and renew a DHCP-assigned address?

ipconfig /release and ipconfig /renew.

What does QoS (Quality of Service) provide in a network?

Mechanisms to manage congestion by classifying, marking, queuing, and prioritizing traffic so latency-sensitive flows (voice/video) get preferential forwarding treatment.

What is Per-Hop Behavior (PHB) in QoS?

The forwarding treatment (queuing, dropping, scheduling) that each individual router applies to a packet based on its QoS marking, independently at every hop.

What is a QoS trust boundary?

The point in the network where QoS markings from endpoints are accepted as valid; markings from untrusted devices beyond it are ignored or remarked, typically placed at the access layer.

Which header field carries QoS markings in an IP packet, and what is the DSCP?

The Type of Service (ToS) byte; DSCP (Differentiated Services Code Point) uses its 6 high-order bits to classify traffic into per-hop behaviors.

What is the difference between classification and marking in QoS?

Classification identifies and groups traffic into classes; marking sets a field value (e.g., DSCP or CoS) on the packet so downstream devices can apply the proper PHB.

Which QoS tools address congestion management versus congestion avoidance?

Congestion management uses queuing/scheduling (e.g., CBWFQ, LLQ) when congestion occurs; congestion avoidance uses dropping (e.g., WRED) to prevent queues from overflowing.

What is the purpose of TFTP and what transport/port does it use?

Trivial File Transfer Protocol performs simple file transfers (e.g., IOS images, configs) with no authentication, using UDP port 69.

What is the purpose of FTP and what transport/ports does it use?

File Transfer Protocol transfers files with authentication and directory operations, using TCP ports 20 (data) and 21 (control).

What are the key differences between TFTP and FTP?

TFTP is UDP-based, has no authentication, and is lightweight for simple transfers; FTP is TCP-based, supports authentication and richer commands, and is more reliable.

What Cisco command backs up the running configuration to a TFTP server?

copy running-config tftp (then supply the TFTP server IP and destination filename).