總結挑戰 · Summary Challenge

Summary Challenge Questions

總結挑戰問題

Which statement correctly describes NAT?以下哪個敘述正確描述 NAT？

NAT is only performed for outbound traffic—traffic leaving an enterprise network to the internet.NAT 僅針對出向流量執行——即從企業網路離開前往網際網路的流量。NAT is performed between differently addressed enterprise network segments, when network segments use private addressing.當網路區段使用私有定址時，NAT 會在採用不同定址方式的企業網路區段之間執行。NAT is performed for outbound and inbound traffic.NAT 針對出向與入向流量皆會執行。NAT is only performed in home networks. Enterprise networks have dedicated public IPv4 addresses.NAT 僅在家庭網路中執行，企業網路則擁有專屬的公用 IPv4 位址。

To configure NAT, one of the commands the administrator used was ip nat pool NAT-POOL 209.165.201.5 209.165.201.10 netmask 255.255.255.240. Assume that outside routers do not have a default route configured. Which two networks could be present in the routing tables of outside routers so that the two-way reachability exists between inside and outside hosts? (Choose two.)為設定 NAT，管理員使用的其中一個指令是 ip nat pool NAT-POOL 209.165.201.5 209.165.201.10 netmask 255.255.255.240。假設外部路由器未設定預設路由，外部路由器的路由表中應存在哪兩個網路，才能讓內部與外部主機之間具備雙向可達性？（選擇兩項。）

route to 209.165.201.4/28 network通往 209.165.201.4/28 網路的路由route to 209.165.201.0/28 network通往 209.165.201.0/28 網路的路由route to 209.165.201.0/24 network通往 209.165.201.0/24 網路的路由route to 172.16.1.0/24 network通往 172.16.1.0/24 網路的路由route to 172.16.0.0/16 network通往 172.16.0.0/16 網路的路由route to 209.165.201.1/32 network通往 209.165.201.1/32 網路的路由

One of the drawbacks of NAT is that it might disrupt services that require the initiation of TCP connections from the outside network or disrupt stateless protocols, such as those using UDP. Why is NAT disruptive in these two cases?NAT 的其中一個缺點，是可能會干擾需要由外部網路發起 TCP 連線的服務，或干擾諸如使用 UDP 這類無狀態通訊協定的服務。為什麼 NAT 在這兩種情況下會造成干擾？

Inbound (outside to inside connections) depend on the presence of NAT mapping to be forwarded to the receiving host inside the network. NAT mappings can time out and, therefore, prevent the device from translating the incoming packets, which end up discarded.入向（由外部到內部的連線）依賴 NAT 對應表的存在，才能將封包轉發至網路內部的接收主機。NAT 對應可能逾時，因而導致裝置無法轉譯傳入的封包，使其最終遭到丟棄。TCP connections require three-way handshake to be completed. NAT allows initial TCP segment, which has flags SYN and ACK set to pass only from the inside to the outside and not from the outside to the inside.TCP 連線需要完成三向交握。NAT 只允許帶有 SYN 與 ACK 旗標的初始 TCP 區段從內部傳往外部，不允許從外部傳往內部。NAT does not translate packets for protocols that do not establish connections and do not maintain the state of the connections.NAT 不會轉譯那些不建立連線、也不維護連線狀態的通訊協定封包。For applications that use UDP, NAT always translates both IPv4 address and port number. Since UDP applications can use whatever port number, it is impossible to make mappings for all; therefore, NAT translations will not happen and UDP segments get discarded.對於使用 UDP 的應用程式，NAT 一律會同時轉譯 IPv4 位址與連接埠號。由於 UDP 應用程式可使用任意連接埠號，不可能為所有情況建立對應，因此 NAT 轉譯將無法進行，UDP 區段因而遭到丟棄。

Which three options are advantages of NAT? (Choose three.)以下哪三項是 NAT 的優點？（選擇三項。）

provides consistency for internal network addressing schemes為內部網路定址方案提供一致性affects End-to-end functionality影響端對端功能disrupts End-to-end IPv4 traceability破壞端對端 IPv4 可追蹤性makes tunneling more complicated使通道化變得更複雜increases the flexibility of connections to the public network提升連線至公用網路的彈性conserves public addresses節省公用位址disrupts TCP connections initiated from the outside破壞由外部發起的 TCP 連線

Which two statements correctly describe port forwarding? (Choose two.)以下哪兩個敘述正確描述連接埠轉發（port forwarding）？（選擇兩項。）

Port forwarding is defined as a static mapping.連接埠轉發被定義為一種靜態對應。Port forwarding enables devices in the private network to reach critical services in external networks.連接埠轉發讓私有網路中的裝置能夠存取外部網路中的關鍵服務。Port forwarding enables local resource in private network to be available to external networks.連接埠轉發讓私有網路中的本地資源可供外部網路使用。Port forwarding changes only port numbers and is a mechanism that forces applications to use arbitrarily chosen port numbers.連接埠轉發僅變更連接埠號，是一種強制應用程式使用任意選定連接埠號的機制。Port forwarding is dynamic translation mechanism that enables multiple hosts from external networks to access the same resource in the private network.連接埠轉發是一種動態轉譯機制，讓來自外部網路的多台主機能夠存取私有網路中的同一項資源。Port forwarding statically defines multiple ports and the number of ports determines how many connections can be established to the same resource in the private network.連接埠轉發會靜態定義多個連接埠，連接埠數量決定了可對私有網路中同一項資源建立多少連線。

A company designs its network so that the PCs in the internal network are assigned IPv4 addresses from DHCP servers, and the packets that are sent to the internet are translated through a NAT-enabled router. Which type of NAT enables the router to populate the translation table from a pool of unique public addresses, as the PCs send packets through the router to the internet?某公司在設計其網路時，讓內部網路中的 PC 由 DHCP 伺服器指派 IPv4 位址，而傳往網際網路的封包則透過啟用 NAT 的路由器進行轉譯。當 PC 透過路由器將封包送往網際網路時，哪種類型的 NAT 能讓路由器從一組唯一的公用位址集區中填入轉譯表？

static NAT靜態 NATdynamic NAT動態 NATPATPATport forwarding連接埠轉發

Refer to the exhibit. The router NAT configuration command is shown above the router. A user is trying to access company web server by using the URL http://192.168.10.254. What is the user doing wrong?請參閱圖示。路由器 NAT 設定指令顯示於路由器上方。使用者嘗試透過網址 http://192.168.10.254 存取公司的網頁伺服器。這位使用者做錯了什麼？

The user is using an IPv4 address in the URL, instead of a domain name.使用者在網址中使用 IPv4 位址，而非網域名稱。The user is using an incorrect IPv4 address.使用者使用了錯誤的 IPv4 位址。The user is using unsecure HTTP protocol, instead of secure HTTPS.使用者使用了不安全的 HTTP 協定，而非安全的 HTTPS。The user is not doing anything wrong, the mapping in the NAT command is wrong.使用者並沒有做錯，是 NAT 指令中的對應設定有誤。The user is not doing anything wrong, the NAT configuration does not allow inbound connections.使用者並沒有做錯，是 NAT 設定不允許入向連線。

Refer to the exhibit. Which type of NAT is being configured? Router(config)#access-list 1 permit 172.16.1.0 0.0.0.255
Router(config)#ip nat pool NAT-POOL 209.165.201.10 209.165.201.14 netmask 255.255.255.224
Router(config)#interface Gi 0/1
Router(config-if)#ip address 209.165.201.1 255.255.255.224
Router(config-if)#ip nat outside
Router(config-if)#exit
Router(config)#interface Gi 0/0
Router(config-if)#ip address 172.16.1.1 255.255.255.0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)#ip nat inside source list 1 pool NAT-POOL overload請參閱圖示。此處設定的是哪種類型的 NAT？Router(config)#access-list 1 permit 172.16.1.0 0.0.0.255
Router(config)#ip nat pool NAT-POOL 209.165.201.10 209.165.201.14 netmask 255.255.255.224
Router(config)#interface Gi 0/1
Router(config-if)#ip address 209.165.201.1 255.255.255.224
Router(config-if)#ip nat outside
Router(config-if)#exit
Router(config)#interface Gi 0/0
Router(config-if)#ip address 172.16.1.1 255.255.255.0
Router(config-if)#ip nat inside
Router(config-if)#exit
Router(config)#ip nat inside source list 1 pool NAT-POOL overload

What is the purpose of entering the ip nat inside source static tcp 192.168.10.2 80 209.165.200.223 8080 command at the global configuration prompt?在全域設定提示字元下輸入 ip nat inside source static tcp 192.168.10.2 80 209.165.200.223 8080 指令的目的為何？

It identifies the inside NAT interface on the router.識別路由器上的內部 NAT 介面。It prevents the router from establishing a connection with any device that does not have the specified address and port number.防止路由器與任何未指定位址及連接埠號的裝置建立連線。It binds the inside local address and local port to the specified inside global address and global port.將內部本地位址與本地連接埠，繫結到指定的內部全域位址與全域連接埠。It enables a one-to-one translation between different internal port numbers.在不同的內部連接埠號之間啟用一對一轉譯。

A NAT-enabled router is configured to perform inside PAT. The IPv4 packet arrives at the outside interface of the router, as a response to the client in the inside network. Provided that inside PAT is correctly configured, which fields in the received IPv4 packets must match to which NAT mapping element, for the packet to be forwarded to the inside host?一台啟用 NAT 的路由器已設定執行內部 PAT。IPv4 封包作為對內部網路中用戶端的回應，抵達路由器的外部介面。假設內部 PAT 已正確設定，收到的 IPv4 封包中哪些欄位必須與哪個 NAT 對應元素相符，封包才能被轉發至內部主機？

Destination IPv4 address and destination port number must match outside global address and port in the mapping table.目的地 IPv4 位址與目的地連接埠號，必須與對應表中的外部全域位址及連接埠相符。Source IPv4 address and source port number must match inside global address and port number in the mapping table.來源 IPv4 位址與來源連接埠號，必須與對應表中的內部全域位址及連接埠號相符。Source IPv4 address and source port number must match inside local address and port number in the mapping table.來源 IPv4 位址與來源連接埠號，必須與對應表中的內部本地位址及連接埠號相符。Destination IPv4 address and destination port number must match inside global address and port in the mapping table.目的地 IPv4 位址與目的地連接埠號，必須與對應表中的內部全域位址及連接埠相符。

Refer to the exhibit showing the NAT information on the device. Which command was used to provide the output? Total active translations: 6 (1 static, 5 dynamic; 2 extended)
Peak translations: 6, occurred 00:05:03 ago
Outside interfaces:
Ethernet0/3
Inside interfaces:
Ethernet0/0, Ethernet0/1
Hits: 124 Misses: 0
CEF Translated packets: 124, CEF Punted packets: 0
Expired translations: 2
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 10 pool NAT_POOL refcount 5
pool NAT_POOL: netmask 255.255.255.0
start 198.51.100.100 end 198.51.100.149
type generic, total addresses 50, allocated 3 (6%), misses 0

Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0請參閱圖示，其中顯示裝置上的 NAT 資訊。使用了哪個指令才能產生此輸出？Total active translations: 6 (1 static, 5 dynamic; 2 extended)
Peak translations: 6, occurred 00:05:03 ago
Outside interfaces:
Ethernet0/3
Inside interfaces:
Ethernet0/0, Ethernet0/1
Hits: 124 Misses: 0
CEF Translated packets: 124, CEF Punted packets: 0
Expired translations: 2
Dynamic mappings:
-- Inside Source
[Id: 1] access-list 10 pool NAT_POOL refcount 5
pool NAT_POOL: netmask 255.255.255.0
start 198.51.100.100 end 198.51.100.149
type generic, total addresses 50, allocated 3 (6%), misses 0

Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0

show ip nat translationsshow ip nat translationsshow running-configurationshow running-configurationshow interface statusshow interface statusshow ip nat statisticsshow ip nat statistics

A network administrator configures the border router with the command ip nat inside source list 14 pool accounting. Which ACL is required to be configured in order for this command to function?網路管理員在邊界路由器上設定了指令 ip nat inside source list 14 pool accounting。若要讓此指令生效，必須設定哪一種 ACL？

An access list named accounting that defines the starting and ending public IPv4 addresses.一個名為 accounting 的存取清單，定義起始與結束的公用 IPv4 位址。An access list named accounting that defines the private addresses that are translated by NAT.一個名為 accounting 的存取清單，定義由 NAT 轉譯的私有位址。An access list that is numbered 14 that defines the starting and ending public IPv4 addresses.一個編號為 14 的存取清單，定義起始與結束的公用 IPv4 位址。An access list that is numbered 14 that defines the private addresses that are translated by NAT.一個編號為 14 的存取清單，定義由 NAT 轉譯的私有位址。

Summary Challenge總結挑戰

Summary Challenge Questions

總結挑戰問題