CCNA Network Services and Security Practice Test 12 — 15 Questions

Question 1

Match each infrastructure service to the operational problem it most directly addresses.

Accepted Answer

DNS: Resolves domain names to IP addresses. DNS resolves names; DHCP assigns IPs; NTP syncs time; SNMP monitors devices; Syslog centralizes logs; NetFlow analyzes traffic.

Answer

DNS: Assigns IP addresses to hosts dynamically

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Monitors network device health and performance

Question 2

A host has a valid IP address and subnet mask from DHCP but cannot reach remote networks because no gateway was provided. What is the best explanation?

Accepted Answer

The host has no next-hop gateway for traffic destined outside its local subnet.. The best explanation is that the host has no next-hop path for off-subnet traffic. In plain language, the device knows what its own local network looks like, but it does not know where to send packets when the destination is outside that local range. Without a default gateway, remote communication usually fails even though local communication can still work.

This is a core host-configuration concept. The correct answer is the one focused on the absence of a next hop for remote destinations.

Answer

The host cannot use ARP on the local network anymore.

Answer

The host automatically becomes part of every remote subnet.

Answer

The host must convert its access port into a trunk.

Question 3

A router is configured with PAT for inside users. Which symptom most strongly suggests the NAT inside/outside roles are reversed on the interfaces?

Accepted Answer

Outbound traffic still shows private inside source addresses where translated public addresses should appear.. When NAT inside/outside roles are reversed, the router applies translation logic in the wrong direction, causing traffic from the inside network to leave the outside interface with untranslated private source addresses. The correct answer (A) directly demonstrates this failure: outbound traffic still shows private IPs where a public address should appear after PAT. The other options describe symptoms that could occur with other NAT misconfigurations but do not strongly indicate reversed roles: an empty translation table (B) suggests no NAT processing at all, possibly due to missing ACL or overload configuration; total lack of internet access (C) may result from many connectivity issues, not specifically reversed interface roles; and external hosts reaching internal servers by private IP (D) points more to a missing or incorrect static NAT rule rather than direction reversal.

Answer

The NAT translation table is empty even though internal users are browsing the internet.

Answer

Internal hosts cannot reach the internet at all.

Answer

External hosts can connect to internal servers using their private IP addresses.

Question 4

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

Accepted Answer

Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate activity across the environment. In plain language, one control focuses more on prevention, while the other improves visibility and accountability. Together they create a stronger security posture than either one alone.

This is an important design mindset. Security is stronger when controls complement each other instead of trying to solve every problem with one mechanism. The correct answer is the one focused on prevention plus visibility.

Answer

They are redundant because both perform exactly the same function.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for device event records.

Question 5

A host can reach remote websites by IP address but fails when using their hostnames. Which missing configuration item is the strongest suspect?

Accepted Answer

A DNS server address. When a host can reach remote websites by IP address but not by hostname, the issue is that the host cannot resolve the hostname to an IP address. DNS (Domain Name System) is responsible for this resolution, and if the DNS server address is missing or misconfigured on the host, name resolution fails. This is the strongest suspect because all other network connectivity (routing, switching) is functional, as proven by successful IP-based access.

Answer

A new MAC address

Answer

A trunk native VLAN

Answer

An OSPF router ID

Question 6

Which two statements accurately describe DNS in everyday network use?

Accepted Answer

DNS helps resolve hostnames into IP-related information.. DNS translates human-friendly hostnames into IP-related information, making network services more accessible by name rather than numeric addresses. Option A is correct because DNS resolves names to IP addresses. Option B is correct because using names improves usability and allows underlying IP changes without user disruption. Option C is incorrect because IP address assignment is a DHCP function, not DNS. Option D is incorrect because subnet masks are part of IP addressing and routing, unrelated to DNS name resolution. Option E is incorrect because STP (Spanning Tree Protocol) elects a root bridge for loop-free topology, which is unrelated to DNS.

Answer

DNS automatically assigns IP addresses to hosts.

Answer

DNS replaces the need for subnet masks.

Answer

DNS elects the STP root bridge.

Question 7

Users on the inside network can browse the web, but the company now needs an internal web server at 192.168.10.50 to be reachable consistently from outside using one public IP address. Which design is most appropriate?

Accepted Answer

Use static NAT for the server and continue using PAT for user outbound access.. The best design is static NAT for the server while continuing to use PAT for general user outbound traffic. In plain language, user browsing and server publishing are two different requirements. PAT is great for letting many inside users share one public address for outbound access. But a server that outside clients must find reliably needs a fixed one-to-one public identity. That is exactly what static NAT provides.

This is an important design distinction. PAT solves address conservation for many clients. Static NAT solves predictability for inbound access to a specific internal system. The strongest answer is the one that uses each NAT method for the job it fits best.

Answer

Use PAT only for everything, including the published server.

Answer

Disable NAT because private IPv4 addresses are Internet-routable.

Answer

Use DHCP relay for the server to make it reachable from outside.

Question 8

A company wants unauthorized devices plugged into unused wall ports to have as little chance of gaining access as possible. Which action most directly supports that goal?

Accepted Answer

Administratively disable unused switch ports.. Administratively shutting down unused switch ports most directly supports the goal because it eliminates the access point entirely. Option B, converting unused ports into trunks, would actually increase risk by potentially allowing VLAN hopping and unauthorized traffic. Option D, removing VLAN assignments from active user ports, does not address unused ports and could disrupt legitimate users by forcing them into the default VLAN. Disabling unused ports is a simple and effective hardening measure that reduces attack surface.

Answer

Convert every unused port into a trunk.

Answer

Enable Telnet on unused ports for monitoring.

Answer

Remove all VLAN assignments from active user ports.

Question 9

Match each basic security term to its most accurate meaning.

Accepted Answer

Vulnerability: A weakness in a system or its design that could be exploited.. Authentication is the process of verifying the claimed identity of a user or device, confirming 'who you are'. Authorization determines what resources or actions an authenticated entity is allowed to access, essentially 'what you can do'. Confidentiality ensures that sensitive information is not disclosed to unauthorized individuals, protecting data from being read. Integrity guarantees that data has not been altered in an unauthorized manner, preserving its accuracy and trustworthiness.

Answer

Vulnerability: A potential danger that might exploit a weakness to cause harm.

Answer

Vulnerability: The likelihood and potential impact of a threat exploiting a weakness.

Answer

Vulnerability: An action or code that takes advantage of a weakness to cause harm.

Question 10

Match each access-control term to its most accurate meaning.

Accepted Answer

Authentication: The process of verifying the identity of a user or device.. AAA is a framework for controlling access. Authentication verifies identity, authorization grants permissions, and accounting logs activities. Identification is the initial claim, and auditing is the review of logs.

Answer

Authorization: The process of verifying the identity of a user or device.

Answer

Accounting: The process of granting or denying access to network resources.

Answer

Identification: The process of logging and monitoring user activities.

Question 11

Why is centralized logging especially useful when combined with NTP?

Accepted Answer

Because synchronized clocks make centralized log timelines easier to analyze accurately.. Centralized logging is much more useful when device clocks are synchronized because the timestamps can be correlated properly. In practical terms, collecting messages in one place is valuable, but if one router thinks it is 9:00 and another thinks it is 9:17, the event sequence becomes confusing. NTP solves that time-alignment problem.

This is a common operations best practice. Syslog provides the central visibility, and NTP makes the timeline trustworthy.

Answer

Because NTP assigns the Syslog server its IP address.

Answer

Because Syslog replaces authentication when NTP is present.

Answer

Because centralized logging blocks unauthorized traffic automatically.

Question 12

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 13

Why is DHCP often preferred over manual addressing on larger user networks?

Accepted Answer

It automates host IP configuration and reduces manual effort and mistakes.. DHCP is often preferred because it automates host configuration and reduces both manual work and configuration mistakes. In practical terms, it is far easier to let endpoints receive addresses, masks, gateways, and DNS settings automatically than to configure each device by hand.

This improves scale, consistency, and operational efficiency. That is why DHCP is such a common service in enterprise access networks.

Answer

It replaces DNS completely.

Answer

It removes the need for default gateways.

Answer

It is required by all routing protocols.

Question 14

If a host has a valid IP address and subnet mask but no default gateway, what is the most likely result?

Accepted Answer

The host can usually reach only local-subnet destinations and not remote networks.. The host will normally reach local destinations but fail to reach remote networks. In practical terms, the subnet mask still lets the host identify what is local, but without a default gateway it has no next hop for off-subnet traffic. That means local ARP-based communication can still work, while remote communication usually fails.

This is a core host-configuration concept and a very common certification question. The missing gateway does not break all communication — it breaks off-subnet communication.

Answer

The host cannot use ARP at all.

Answer

The host automatically joins every subnet in the LAN.

Answer

The host becomes the default gateway for other devices.

Question 15

A company wants an internal web server to be reachable consistently from the Internet using one known public IPv4 address. Which NAT approach best fits that requirement?

Accepted Answer

Static NAT. Static NAT is the best fit because it creates a fixed one-to-one relationship between the inside server and the public address. In practical terms, outside clients need a stable public identity for the server. They cannot rely on a translated address that changes session by session. Static NAT gives that predictability.

This is different from PAT, which is designed for many inside users sharing fewer public addresses for outbound traffic. The question is about publishing a server, not conserving addresses for client browsing. That is why static NAT is the strongest answer.

Answer

PAT overload

Answer

No NAT, because private IPv4 addresses are publicly routable

Answer

DHCP relay