ExamFinch.com My Study

Study guide

4.6 IP Services — Comprehensive Review

Practice this exam

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

4.6 IP Services — Comprehensive Review

Key Takeaways Explain This Topic AI

Know every IP-services port: DHCP UDP 67/68, DNS 53, NTP UDP 123, SNMP UDP 161/162, Syslog UDP 514, TFTP UDP 69, FTP TCP 20/21, SSH 22, Telnet 23.

NAT needs ip nat inside/outside on interfaces plus an ip nat inside source rule; overload enables PAT.

Secure replacements: SSH (22) for Telnet (23), HTTPS (443) for HTTP (80), SCP/SFTP for FTP/TFTP, SNMPv3 for v1/v2c.

Ping-by-IP success but name failure isolates the fault to DNS, not connectivity.

Syslog and SNMP logging levels send the configured severity plus everything more severe.

Last updated: June 2026

This section is your single-page revision sheet for IP Services. The blueprint weights this domain at 10% , and most of its points are won on ports, service behavior, and short troubleshooting scenarios rather than long configurations.

Complete Port Reference

  • Service Protocol Port(s) Note
  • FTP data TCP 20 Active-mode data channel
  • FTP control TCP 21 Commands
  • SSH / SCP TCP 22 Encrypted access + secure copy
  • Telnet TCP 23 Clear text — avoid
  • SMTP TCP 25 Mail sending
  • TACACS+ TCP 49 AAA, Cisco
  • DNS UDP/TCP 53 UDP query, TCP zone transfer
  • DHCP server UDP 67 Server listens here
  • DHCP client UDP 68 Client listens here
  • TFTP UDP 69 No auth
  • HTTP TCP 80 Clear-text web
  • POP3 TCP 110 Mail retrieval
  • NTP UDP 123 Time sync
  • SNMP poll UDP 161 GET / SET
  • SNMP trap UDP 162 Notifications
  • HTTPS TCP 443 Encrypted web
  • Syslog UDP 514 Log messages
  • RADIUS auth / acct UDP 1812 / 1813 AAA
  • Service-by-Service Cheat Sheet
  • Service Job One fact that wins points
  • DHCP Auto IP config DORA; ip helper-address for relay
  • DNS Name -> IP A = IPv4, AAAA = IPv6
  • NTP Clock sync Lower stratum = more accurate
  • SNMP Monitor/manage Only v3 is secure; TRAP = agent to manager
  • Syslog Central logging 0 Emergency ... 7 Debugging
  • NAT Address translation overload = PAT; inside local vs global
  • QoS Prioritize traffic EF = voice = DSCP 46
  • SSH Secure CLI access Needs hostname + domain + RSA key
  • TFTP Simple transfer UDP 69, no auth
  • FTP Full transfer TCP 20/21, authenticated
  • Secure vs Insecure Pairings

The exam repeatedly rewards choosing the encrypted option. Memorize the swaps:

SSH (22) replaces Telnet (23) — encrypted CLI.

HTTPS (443) replaces HTTP (80) — encrypted web management.

SCP / SFTP replace FTP / TFTP — encrypted file transfer.

SNMPv3 replaces v1 / v2c — adds authentication and encryption.

Four Canonical Troubleshooting Scenarios

1. "Users get no IP address." -> DHCP. Confirm the server is up, the client gateway has ip helper-address if the server is on another subnet, the pool still has free addresses, and the excluded range has not swallowed the scope.

2. "Users reach IPs but not names." -> DNS. Connectivity is proven by the IP ping, so check the client's resolver, ping that resolver, and run nslookup . This is the single most common scenario question in the chapter.

3. "Log timestamps disagree across devices." -> NTP. Verify ntp server on each device and show ntp status to confirm synchronization; pair with service timestamps log datetime msec .

4. "Inside users cannot reach the internet." -> NAT. Confirm ip nat inside/outside on the right interfaces, inspect show ip nat translations , check that the NAT ACL permits the client subnet, and verify overload for PAT.

Final Exam-Day Pointers

When a question gives a packet capture, the port number usually identifies the service faster than reading the payload — 67/68 means DHCP, 53 means DNS, 123 means NTP.

Logging and trap commands are inclusive downward in number : logging trap 4 sends levels 0-4.

For NAT labeling drag-and-drops, remember local = inside view, global = outside view; inside = your host, outside = the remote host .

Always pick the encrypted protocol when both appear as options unless the question explicitly describes a trusted, isolated management network.

Common Distractor Patterns

IP Services questions often hide the answer behind a plausible-sounding wrong option, so learn the traps. A question may offer ip dhcp relay as the relay command when the real command is ip helper-address — the relay concept is right but the syntax is invented. NAT questions dangle "Policy NAT" as a fourth type; CCNA recognizes only static, dynamic, and PAT. SNMP questions claim "all versions support encryption" — only v3 does. Syslog questions reverse the scale, suggesting level 7 is most critical when 0 (Emergency) is. And port questions swap the DHCP pair, offering 68 for the server when the server listens on 67.

Reading every option to the end, rather than picking the first that looks right, is worth several points across this domain.

A Two-Minute Self-Test Before the Exam

Run this mental checklist and you have covered the bulk of the domain. Can you (1) write the full port table from memory; (2) recite DORA and name the relay command; (3) say which DNS record maps to IPv4 versus IPv6; (4) order the NTP stratums and state that lower is better; (5) place SNMP GET/SET versus TRAP by direction and name the secure version; (6) list the syslog severities 0-7 and explain inclusive-downward logging; (7) identify EF/DSCP 46 for voice and the 150/30/1 voice budget; (8) configure SSH in the correct order; and (9) match each of the four troubleshooting scenarios to its service?

Any "no" answer is your highest-value review target.

On the exam: IP Services is 10% of the 200-301 blueprint and is heavy on recall. If you can reproduce the port table, the secure-versus-insecure pairings, the common distractor patterns, and the four scenarios above, you will capture nearly every point this domain offers.