CCNA Network Services and Security — 30 Questions

Question 1

What does switchport port-security primarily protect against on an access port?

Accepted Answer

Unauthorized MAC addresses appearing on the port. Port security limits which MAC addresses can use an access port, helping prevent rogue endpoint attachment and simple CAM table abuse.

Answer

OSPF route flapping

Answer

DNS spoofing across the enterprise

Answer

Wireless rogue APs on every VLAN

Question 2

What is the primary purpose of NTP in a routed network?

Accepted Answer

To synchronize device clocks. Network Time Protocol is used to keep device clocks synchronized. Accurate time is especially important for logs, troubleshooting, certificates, and coordinated events across devices.

Answer

To encrypt management traffic

Answer

To resolve hostnames into IP addresses

Answer

To assign IP addresses dynamically

Question 3

What is the primary function of DNS?

Accepted Answer

To map hostnames to IP addresses. DNS resolves hostnames to IP addresses and can also support reverse lookups and other naming records. It is a foundational naming service for IP networks.

Answer

To translate MAC addresses into switchport numbers

Answer

To assign default gateways to hosts

Answer

To maintain STP topology information

Question 4

What is the main purpose of a syslog server in a network?

Accepted Answer

To collect and store log messages from devices. A syslog server centralizes event and log messages from network devices, which helps with monitoring, troubleshooting, auditing, and incident response.

Answer

To allocate DHCP leases

Answer

To maintain a synchronized routing table

Answer

To translate private addresses to public addresses

Question 5

What is the main benefit of Port Address Translation (PAT)?

Accepted Answer

It allows many internal hosts to share one public IPv4 address. PAT conserves public IPv4 space by translating multiple inside hosts to a single public address, distinguishing sessions by port numbers.

Answer

It encrypts all traffic leaving the LAN

Answer

It removes the need for private IP addressing

Answer

It replaces routing protocols

Question 6

What does the confidentiality objective of the CIA triad focus on?

Accepted Answer

Preventing unauthorized disclosure of information. Confidentiality is about preventing unauthorized disclosure of information.

Answer

Preventing unauthorized changes to data

Answer

Ensuring systems are reachable when needed

Answer

Providing authentication and accounting only

Question 7

What is the main function of DNS in an IP network?

Accepted Answer

It resolves hostnames to IP addresses.. DNS resolves human-readable names to IP addresses and can also store related records.

Answer

It assigns IP addresses to clients automatically.

Answer

It encrypts application traffic end to end.

Answer

It advertises default routes to routers.

Question 8

What is the main purpose of an allowlist-based firewall policy compared with a denylist-based one?

Accepted Answer

It permits only explicitly approved traffic patterns.. An allowlist permits only explicitly approved traffic and denies everything else by default, which is generally more restrictive.

Answer

It allows all traffic except a few known bad flows.

Answer

It automatically encrypts all allowed traffic.

Answer

It disables the implicit deny at the end of the ACL.

Question 9

What does the second 'A' in AAA stand for?

Accepted Answer

Authorization. AAA stands for Authentication, Authorization, and Accounting. The second “A” is Authorization. In plain language, authentication answers the question “Who are you?” Authorization answers “What are you allowed to do?” and accounting answers “What did you do?” Those three ideas work together to control and track access to devices and services.

This question is simple, but it matters because many security designs depend on keeping those functions separate in your mind.

Answer

Authentication

Answer

Availability

Answer

Accounting

Question 10

Which statement best describes the role of DNS in a network?

Accepted Answer

DNS resolves names into IP-related information. DNS helps devices and users resolve names into IP-related information. In plain language, it means people can use easy-to-remember hostnames instead of typing numeric IP addresses every time they want to reach a server or service. This makes networks more usable and easier to manage, especially when addresses change but names remain stable.

DNS does not assign addresses the way DHCP does, and it does not synchronize time like NTP. It also is not a routing protocol. Its job is name resolution. That is a fundamental service concept and a very common CCNA test point because many practical network symptoms can be traced back to name-resolution failures even when basic IP connectivity still works.

Answer

DNS dynamically assigns client IP addresses

Answer

DNS prevents switching loops on VLAN trunks

Answer

DNS is the default metric used by OSPF

Question 11

What is the primary purpose of a DHCP default gateway option provided to a host?

Accepted Answer

To identify the next-hop router or Layer 3 device for off-subnet traffic. The default gateway option tells the host where to send traffic destined for other IP networks. In plain language, the host needs to know which local router or Layer 3 interface can forward packets off the subnet. Without that gateway information, the host may still communicate with local devices on its own subnet, but it will struggle to reach remote networks unless the gateway is configured manually.

This is one of the key reasons DHCP is so useful: it can deliver not just an IP address, but also the supporting information a host needs to function normally in a routed environment.

Answer

To replace the host MAC address permanently

Answer

To choose the STP root bridge

Answer

To define the NAT pool for the edge router

Question 12

Which statement best describes the purpose of accounting in AAA?

Accepted Answer

It records activity or usage details related to access. Accounting in AAA is about recording what happened during access or use of the system. In plain language, once a user logs in and begins working, accounting can keep track of actions, sessions, commands, or usage details so administrators have a record for review and auditing. This is especially useful for troubleshooting, compliance, and understanding who did what.

Accounting is not the same as authentication, which verifies identity, or authorization, which decides permissions. It is the record-keeping part of the AAA model.

Answer

It decides whether a user knows the correct password

Answer

It defines the spanning-tree topology

Answer

It assigns IP addresses dynamically to clients

Question 13

Which statement best explains why SSH is preferred over Telnet for remote administration?

Accepted Answer

SSH encrypts the management session, while Telnet does not. SSH is preferred because it encrypts remote administration traffic, including credentials and session data, while Telnet sends that information in clear text. In plain language, SSH helps protect administrative access from interception on the network. This makes it the safer and more modern choice for remote device management.

This distinction is one of the most basic but important management-plane security lessons in CCNA. The goal is not to eliminate remote management but to perform it in a safer way. That is why the correct answer focuses on encryption and protection of remote sessions, not on unrelated behavior such as VLAN tagging or routing protocol participation.

Answer

Telnet is preferred because it is more secure than SSH

Answer

SSH removes the need for usernames and passwords

Answer

Telnet is the required protocol for STP root election

Question 14

Which statement best describes confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized disclosure of information. Confidentiality is about preventing unauthorized disclosure of information. In plain language, it means making sure the wrong people cannot see data they are not supposed to access. This is different from integrity, which focuses on preventing unauthorized changes, and availability, which focuses on keeping systems usable.

That is why confidentiality is the best answer here.

Answer

Ensuring systems are online at all times

Answer

Recording every command entered on a router

Answer

Automatically correcting every changed file

Question 15

Which statement best describes the difference between DHCP and DNS?

Accepted Answer

DHCP provides addressing information, while DNS resolves names into IP-related information. DHCP and DNS solve different problems. In plain language, DHCP automatically gives hosts the network settings they need to join the network, such as an IP address and default gateway. DNS helps resolve hostnames into IP-related information so users and applications can find systems by name.

They often work together, but they do not perform the same job.

Answer

DHCP resolves names, while DNS assigns default gateways

Answer

Both services exist only for IPv6

Answer

Neither service is relevant when switches use VLANs

Question 16

Which statement best describes the benefit of PAT compared with static NAT in a small office that has many internal users but only one public IPv4 address?

Accepted Answer

PAT lets many internal sessions share one public address using port numbers. PAT is more suitable because it lets many internal sessions share one public address by distinguishing them with transport-layer ports. In plain language, PAT allows a whole office to use one public IP for outbound access, while static NAT would require a separate permanent public mapping for each inside host or service.

This question highlights the scaling difference between translation methods. Static NAT is predictable but address-hungry. PAT is efficient because it multiplexes many conversations through one address.

Answer

PAT requires one public address for every internal host

Answer

PAT eliminates the need for a default route

Answer

PAT prevents any return traffic from reaching inside hosts

Question 17

Which statement best describes the purpose of authorization in AAA?

Accepted Answer

It determines which actions an authenticated user is allowed to perform. Authorization determines what an authenticated user is allowed to do. In plain language, once the system has verified who the user is, it then decides what level of access, commands, or resources that user may use. This is different from authentication, which verifies identity, and accounting, which records activity.

This distinction matters because many access-control problems are not about whether the user logged in successfully, but about whether the user should be permitted to perform a certain action after login. That permission decision is the role of authorization.

Answer

It records every command after the session ends

Answer

It proves the user’s identity with credentials

Answer

It assigns an IP address to the administrator’s workstation

Question 18

What is the primary reason DNS is easier for humans to use than raw IP addressing?

Accepted Answer

It lets users work with readable hostnames instead of memorizing numeric IP addresses. DNS is easier for humans because it lets users work with readable names instead of memorizing numeric IP addresses. In plain language, people remember names far more easily than long strings of numbers. DNS creates a layer of usability by mapping those names to the IP information that devices actually need for communication.

This matters because even when underlying connectivity is perfect, usability suffers without name resolution. The correct answer is the one focused on human-friendly naming rather than on routing, encryption, or automatic address assignment.

Answer

It automatically replaces subnet masks on all hosts

Answer

It encrypts all Internet traffic by default

Answer

It removes the need for default gateways

Question 19

Which statement best describes why disabling unused switch ports is considered a hardening measure?

Accepted Answer

It reduces unnecessary exposure by removing potential unauthorized connection points. Disabling unused switch ports is considered hardening because it reduces the attack surface. In plain language, every active but unused port is a potential place where an unauthorized device could be connected. By shutting those ports down, the administrator reduces unnecessary exposure and makes it harder for someone to exploit forgotten or unmanaged access points.

This is a simple but important security habit. It is not glamorous, but it is effective. The correct answer is the one that focuses on reducing unnecessary exposure rather than on routing, encryption, or unrelated services.

Answer

It automatically increases OSPF metric accuracy

Answer

It converts edge ports into routed interfaces

Answer

It replaces the need for authentication on active ports

Question 20

Which statement best explains why a DHCP client typically also needs a subnet mask in addition to an IP address?

Accepted Answer

The subnet mask tells the host which destinations are local and which require a gateway.. A host needs the subnet mask so it can determine which destinations are local and which are remote. In plain language, the IP address identifies the host, but the mask tells the host how large the local network is. Without that information, the host cannot reliably decide when to ARP locally and when to send traffic to the default gateway.

This is a core host-configuration concept because correct communication depends on more than having an address alone. The correct answer is the one focused on local-versus-remote decision making.

Answer

The subnet mask encrypts the host’s traffic.

Answer

The subnet mask replaces the need for DNS.

Answer

The subnet mask creates a trunk between the host and switch.