25 IP Services questions with answers for ccna roles — 7 easy, 13 medium, 5 hard.
About IP Services
IP services keep a network usable and manageable. This topic covers DHCP and relay, DNS, NAT and PAT with the four NAT address terms, NTP, syslog, SNMPv2c and v3, TFTP and FTP for backups, and QoS with DSCP, CoS, policing and shaping. Expect scenario questions on missing DHCP leases, broken internet access after NAT changes and choppy voice calls.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
DHCP uses the DORA process: the client broadcasts Discover, the server answers with an Offer, the client broadcasts a Request for that offer, and the server confirms with an Acknowledgement. The lease includes IP, mask, gateway, DNS servers and lease time. Clients renew at 50 percent of the lease. DHCP uses UDP ports 67 for the server and 68 for the client.
DHCP Discover is a broadcast, and routers do not forward broadcasts, so a central DHCP server cannot hear clients on other subnets. A relay agent, configured with ip helper-address on the gateway interface, converts the broadcast into a unicast to the server and adds the gateway IP so the server picks the right scope. This lets one server serve many VLANs.
Network Address Translation rewrites IP addresses as packets cross a router, usually private inside addresses to public outside ones. Static NAT maps one inside address to one public address, often for servers. Dynamic NAT maps from a pool. PAT, or NAT overload, maps many inside hosts to one public IP using unique source ports, and is what almost every office and home router uses.
04
What is NTP and why does time matter on network devices?
NTP synchronises clocks over UDP 123 using a hierarchy of strata, where stratum 1 servers connect to an atomic or GPS clock. Correct time matters because syslog and incident timelines must line up across devices, certificates and authentication protocols check time, and logs are legal evidence. Devices can be NTP clients, servers or peers, and NTP authentication protects against fake time sources.
Syslog has eight levels from 0 to 7: emergency, alert, critical, error, warning, notification, informational and debugging. A useful memory line is Every Awesome Computer Engineer Will Need Ice cream Daily. Setting logging trap 6 sends levels 0 to 6 to the server. Syslog uses UDP 514 by default, and logs should carry timestamps with service timestamps log datetime msec.
Exclude static addresses first, then define the pool.
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool VLAN10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8 1.1.1.1
lease 7
show ip dhcp binding
show ip dhcp pool
07
How do you handle pressure when an outage affects many users?
Situation: DHCP failed for 300 users at 9 a.m. on a Monday. Task: restore service while keeping managers updated. Action: I stayed calm, followed the bottom-up method, found the DHCP server's scope was full after a lease time change, extended the scope and shortened leases. I sent updates every 15 minutes. Result: users were back in 30 minutes, and we added scope utilisation alerts to monitoring.
08
Explain the NAT terms inside local, inside global, outside local and outside global.
Inside local is the private address of an inside host, for example 192.168.1.10. Inside global is the public address that represents it outside, for example 203.0.113.5. Outside global is the real address of the remote host. Outside local is how the remote host appears to inside users, usually the same as outside global unless destination NAT is used. show ip nat translations displays these columns.
A client asks its configured resolver, for example for www.example.com. If it is not cached, the resolver queries a root server, which refers it to the .com TLD server, which refers it to the authoritative server for example.com, which returns the A or AAAA record. The answer is cached for its TTL. DNS uses UDP 53 for most queries and TCP 53 for zone transfers and large replies.
10
What is SNMP and the differences between v2c and v3?
SNMP lets a manager poll devices for counters and receive traps or informs about events, using a MIB with OIDs. Polling uses UDP 161 and traps UDP 162. SNMPv2c uses a plain-text community string with no encryption. SNMPv3 adds user-based authentication and encryption with authPriv mode, so it is the version to use in production, especially on networks reachable from many teams.
Quality of Service gives different treatment to traffic types when links are congested. Voice needs low delay (under 150 ms one way), low jitter (under 30 ms) and low loss (under 1 percent), while bulk file transfer can wait. QoS tools classify and mark traffic, queue it with priority queues for voice, and police or shape rates. Without congestion QoS has no effect.
12
Users behind a router can reach local servers but not the internet after a firewall change. NAT is configured. What do you check?
I check show ip nat translations to see whether translations appear when users browse. If none, I verify ip nat inside and ip nat outside on the correct interfaces, that the ACL used by NAT matches the user subnets, and that the overload interface has an IP. I also check the default route and run show ip nat statistics for hits and misses.
13
A new VLAN's users do not get DHCP addresses, but other VLANs work. What do you check?
I check that the SVI for the new VLAN is up and has ip helper-address pointing to the DHCP server, that the server has a scope for that subnet with the right gateway, and that the scope is activated. I confirm the VLAN is allowed on trunks. If DHCP snooping is enabled, I check the uplink is trusted, otherwise offers from the server are dropped.
14
Syslog timestamps from different devices do not match during an incident review. What do you fix?
Clocks are not synchronised. I configure all devices to use the same internal NTP servers with ntp server, set the timezone with clock timezone IST 5 30, add service timestamps log datetime msec localtime, and enable NTP authentication. Then I check show ntp associations and show ntp status to confirm synchronisation. This makes future incident timelines reliable.
15
An internal web server must be reachable from the internet on a public IP. How do you set it up?
Use static NAT or port forwarding so the public IP maps to the server's private IP, for example ip nat inside source static tcp 192.168.1.20 443 203.0.113.10 443. Add an ACL or firewall rule allowing only port 443 inbound, put the server in a DMZ VLAN, and create a public DNS record. Ideally place a firewall or reverse proxy in front instead of exposing the server directly.
Mark interfaces, match inside hosts with an ACL and overload the outside interface.
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside
access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
show ip nat translations
17
How do you configure a router as a DHCP relay and verify it?
Add the helper address on the client-facing interface.
interface vlan 20
ip helper-address 10.0.0.50
show ip interface vlan 20 | include Helper
debug ip dhcp server packet
The helper also forwards some other UDP broadcasts such as TFTP and DNS by default; use no ip forward-protocol udp to limit them.
18
How do you back up and restore a device configuration?
Copy the config to a server and back.
copy running-config tftp://10.0.0.40/R1-backup.cfg
copy running-config scp://admin@10.0.0.40/R1.cfg
copy tftp://10.0.0.40/R1-backup.cfg running-config
configure replace flash:R1-good.cfg
archive
path flash:R1-archive
write-memory
configure replace gives a clean rollback instead of merging.
19
Tell me about a time you automated or simplified a repetitive task.
Situation: our team manually backed up 80 router configs each week. Task: save time and avoid missed backups. Action: I enabled the archive feature with time-period on each device and later wrote a small Python script with Netmiko to pull and store configs in Git. Result: weekly effort dropped from four hours to zero, and we could see config differences after every change.
20
After moving DHCP to a new central server, remote PCs get addresses but IP phones fail to download their configuration. What do you check?
The phones need extra DHCP options that were probably not copied, such as option 150 or option 66 for the TFTP or call server and sometimes a voice VLAN option. Check the scope options on the new server, confirm the relay on each SVI points to it, and capture the DHCP offer to see which options arrive. Also verify the voice VLAN scope exists and that ACLs allow TFTP from the phone subnets to the call server.
CoS is a 3-bit priority field in the 802.1Q tag, values 0 to 7, used only on Layer 2 trunks. DSCP is a 6-bit field in the IP header, values 0 to 63, which survives across routed hops. Common values: EF (46) for voice, AF41 (34) for video, CS3 (24) for call signalling and default (0) for best effort. Mark close to the source and trust markings only at controlled boundaries.
22
What is the difference between policing and shaping?
Policing drops or re-marks traffic that exceeds a rate immediately, with no buffering, so it causes TCP retransmissions; it is used inbound or by ISPs. Shaping buffers excess traffic and sends it later, smoothing bursts to a configured rate at the cost of delay; it is used outbound, for example to match a 100 Mbps subscription on a 1 Gbps port.
23
Voice calls are choppy during office hours when the WAN link is busy. How do you fix it?
Choppy voice under load means congestion on the WAN. I make sure phones mark RTP as EF and the access switches trust phone markings, then on the WAN router create a policy with a low latency priority queue for EF limited to the needed bandwidth, CBWFQ for other classes, and shaping to the real carrier rate so queuing happens on my router, not the provider's.
24
How do you configure NTP, syslog and SNMPv3 on a device?
A simple five-class model works for most branches.
Voice (EF) priority queue, about 10 percent
Video (AF41) guaranteed 20-25 percent
Signalling (CS3) 5 percent
Business apps (AF21) 25-30 percent
Default (BE) remaining, with fair queuing
Scavenger (CS1) small share for backups and updates
Frequently asked questions
How important is IP Services in CCNA interviews?
IP services keep a network usable and manageable. This topic covers DHCP and relay, DNS, NAT and PAT with the four NAT address terms, NTP, syslog, SNMPv2c and v3, TFTP and FTP for backups, and QoS with DSCP, CoS, policing and shaping. Expect scenario questions on missing DHCP leases, broken internet access after NAT changes and choppy voice calls.
How should I use the IP Services sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.