CCNA Network Services and Security Practice Test 11 — 15 Questions

Question 1

Match each NAT term to its most accurate description.

Accepted Answer

Inside Local: The IP address of an internal host as seen from inside the network.. NAT terms describe address perspectives: Inside Local is the internal host's IP, Inside Global is its external IP, Outside Local is the external host's IP seen internally, Outside Global is its actual external IP, Static NAT provides permanent mapping, and Dynamic NAT uses a pool.

Answer

Inside Local: The IP address of an external host as seen from inside the network.

Answer

Inside Local: The IP address of an internal host as seen from outside the network.

Answer

Inside Local: The IP address of an external host as seen from outside the network.

Question 2

A host receives its IP address automatically but cannot resolve hostnames. Which additional service information is most likely missing from its configuration?

Accepted Answer

A DNS server address. If the host receives an IP address but cannot resolve hostnames, the most likely missing information is a DNS server setting. In plain language, the device has enough configuration to join the network but not enough to ask where hostnames map in IP terms. DHCP can provide this DNS server information automatically, and if it is missing, the host may still communicate by IP while failing on names.

This is a common service-troubleshooting pattern because it separates address configuration from name resolution. The correct answer is the missing DNS-related setting rather than the IP address itself or the subnet mask.

Answer

A new MAC address

Answer

A trunk native VLAN

Answer

An OSPF router ID

Question 3

Match each security control idea to its most accurate purpose.

Accepted Answer

Firewall: Filters traffic based on security rules.. Least privilege restricts users and processes to only the access rights necessary for their tasks, reducing the attack surface. SSH provides encrypted remote management, preventing eavesdropping and credential theft during administrative sessions. BPDU Guard immediately disables an edge port if a BPDU is received, safeguarding the network from unauthorized switches and potential loops. Port security limits the number and identity of allowed MAC addresses on a switch port, blocking MAC flooding and unauthorized device access.

Answer

Firewall: Detects and blocks malicious traffic patterns using signatures.

Answer

Firewall: Prevents data loss by monitoring outbound traffic for sensitive data.

Answer

Firewall: Protects web applications from attacks like SQL injection.

Question 4

A router is configured with a static NAT mapping for an internal server. What is the main operational advantage of this design for outside clients?

Accepted Answer

The server is represented by a fixed public address that outside clients can reach predictably. The main operational advantage is predictability. In plain language, outside clients always know which public IP address represents the internal server. That stable one-to-one mapping makes the server easier to reach consistently from external networks. This is exactly why static NAT is commonly used for inside services that need outside reachability.

This differs from PAT, which is optimized for many outbound user sessions sharing fewer public addresses. Static NAT is valuable when a specific device or service must have a stable external identity.

Answer

The server automatically shares its public address with all inside users through overload

Answer

The server no longer needs an IP address on the internal network

Answer

The mapping removes the need for routing to the server

Question 5

Which two statements accurately describe DNS in normal network operation?

Accepted Answer

DNS helps resolve hostnames into IP-related information.. DNS helps translate human-friendly names into IP-related information. In plain language, it allows users and applications to work with names instead of memorizing numeric addresses. It also means that a network can change the underlying IP address of a service while keeping the public-facing name the same. DNS is therefore both a usability service and an important abstraction layer.

The wrong answers often confuse DNS with DHCP or routing protocols. The two correct answers are the ones that preserve its role in name resolution and human-friendly network use.

Answer

DNS dynamically assigns host IP addresses like DHCP.

Answer

DNS replaces the need for default gateways.

Answer

DNS is the spanning-tree protocol used on VLAN trunks.

Question 6

A switchport is configured with sticky MAC learning and a maximum secure MAC value of 2. What is the main benefit of sticky learning in this situation?

Accepted Answer

It allows secure MAC addresses to be learned dynamically and used by port security.. Sticky MAC learning allows the switch to learn secure MAC addresses dynamically and treat them as port-security entries without the administrator typing them manually. In plain language, it combines some of the convenience of automatic learning with the control of port security. If the configuration is later saved, those learned entries can become persistent.

This is a common CCNA port-security concept because it shows how sticky learning works with, not instead of, port security. The correct answer is the one focused on dynamic secure learning and convenience, not on disabling the maximum limit or turning the port into a trunk.

Answer

It removes the maximum secure MAC limit automatically.

Answer

It converts the port into a trunk after two MAC addresses are learned.

Answer

It disables port security after the first reboot.

Question 7

Match each service or protocol to the problem it most directly helps solve.

Accepted Answer

DNS: Resolves hostnames to IP addresses. Each service or protocol directly addresses a specific networking problem as described.

Question 8

Why is NTP especially useful when devices send logs to a centralized Syslog server?

Accepted Answer

It helps align device clocks so centralized log timestamps can be correlated more accurately.. NTP is especially useful because synchronized clocks make the log timestamps more meaningful and easier to correlate. In plain language, if each device thinks the current time is different, the sequence of events in the centralized log becomes confusing. NTP helps align time across devices so the logs tell a more accurate story.

This is an operational best practice. Syslog collects the messages, and NTP makes their timing consistent. The correct answer is the one focused on timestamp correlation.

Answer

It assigns the Syslog server an IP address.

Answer

It replaces the need for a Syslog server.

Answer

It encrypts every Syslog message automatically.

Question 9

Match each access-control concept to its most accurate meaning.

Accepted Answer

Subject: An entity that requests access to an object.. Authentication is correctly matched with 'Verification of identity' because it confirms who the user is. Authorization is correctly matched with 'Determination of allowed actions' because it defines what the user can do. Least privilege is correctly matched with 'Limiting access to only what is necessary' as it enforces minimal permissions. Local database is correctly matched with 'Credential store used directly on the device' as it stores credentials locally for authentication.

Answer

Subject: A resource or data that is being protected.

Answer

Subject: A set of permissions that define allowed actions.

Answer

Subject: A list of permissions associated with an object.

Question 10

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

Accepted Answer

Static NAT. A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably.

PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.

Answer

PAT overload

Answer

No NAT

Answer

DHCP relay

Question 11

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

Accepted Answer

Use transport-layer port values to distinguish multiple inside sessions behind one outside address.. PAT (Port Address Translation) distinguishes multiple inside sessions by rewriting the source port number for each connection while using the same public IP address. This transport-layer port translation allows many internal hosts to share one outside address without conflict. The correct answer identifies the use of port numbers, which is the core mechanism. Increasing the NAT pool or using static NAT would not enable sharing of a single public address. Changing private IPs to be identical or disabling routes are irrelevant to PAT's operation.

Answer

Convert all inside hosts to the same private IP address.

Answer

Increase the size of the NAT pool to include multiple public addresses.

Answer

Configure static NAT mappings for each inside host.

Question 12

A user can reach a remote web server by IP address but not by hostname. Which service should be checked first?

Accepted Answer

DNS. DNS should be checked first. In plain language, the path to the server appears to work because the user can reach it by numeric address. The missing function is the translation from hostname to IP-related information, and that is exactly what DNS provides.

This is one of the clearest service-troubleshooting patterns in networking. If IP works but the name fails, DNS becomes the strongest first suspect. The correct answer is therefore the name-resolution service rather than a routing or switching feature.

Answer

STP

Answer

PAT

Answer

Port security

Question 13

Select the options that correctly pair the security principle or control with its meaning.

Accepted Answer

Confidentiality ensures that data is accessible only to authorized users.. Confidentiality ensures data is accessible only to authorized users; integrity ensures data accuracy and trustworthiness (not availability); non-repudiation ensures accountability by preventing denial of actions; authorization grants permissions (not identity verification, which is authentication). Option B is wrong because integrity is about data correctness, not availability. Option D is wrong because authorization determines permissions, while authentication verifies identity.

Answer

Integrity ensures that data is always available when needed.

Answer

Authorization verifies the identity of a user or device.

Question 14

A company wants internal users to share one public IPv4 address for outbound Internet access, while keeping sessions separate. Which NAT approach best meets that requirement?

Accepted Answer

PAT overload. PAT is the correct approach because it allows many internal sessions to share one outside IPv4 address while distinguishing them by port numbers. In plain language, PAT gives the office an efficient many-to-one translation model that works well for ordinary user Internet access when public addresses are limited.

This is different from static NAT, which gives a fixed one-to-one mapping, and from dynamic NAT pools that usually rely on multiple public addresses. The correct answer is the translation method designed specifically for shared public-address use across many sessions.

Answer

Static NAT only

Answer

No NAT, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 15

Match each security-related term to its most accurate meaning.

Accepted Answer

Phishing: A technique that uses deceptive messages to trick individuals into revealing sensitive information.. Confidentiality ensures data is only accessible to authorized parties, directly matching 'protection against unauthorized disclosure.' Integrity safeguards data from tampering, aligning with 'protection against unauthorized modification.' Availability guarantees that systems and data are reachable when required, fitting 'ensuring systems and data can be accessed when needed.' Accounting provides a trail of user activity, corresponding to 'recording activity or usage details.' Each term maps precisely to its defined security objective in the CIA triad and operational security.

Answer

Ransomware: A type of malware that encrypts a victim's files and demands payment for the decryption key.

Answer

DDoS: An attack that overwhelms a target with traffic from multiple sources, causing service disruption.

Answer

MitM: An attack where the attacker secretly intercepts and relays communications between two parties.