CCNA Network Services and Security Practice Test 14 — 15 Questions

Question 1

Match each operations or assurance technology to its most accurate purpose.

Accepted Answer

NetFlow - Flow analysis; SNMP - Device management; Syslog - Logging; IP SLA - Performance measurement; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring. Each technology serves a specific assurance purpose: Syslog provides centralized event and message reporting, SNMP enables monitoring and management information exchange, NetFlow offers visibility into traffic flows and conversations, and NTP ensures clock synchronization for consistent timing across network devices.

Answer

NetFlow - Device management; SNMP - Flow analysis; Syslog - Performance measurement; IP SLA - Logging; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Logging; SNMP - Performance measurement; Syslog - Flow analysis; IP SLA - Device management; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Performance measurement; SNMP - Logging; Syslog - Device management; IP SLA - Flow analysis; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring

Question 2

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`.

This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 3

Match each ACL-related term to its most accurate description.

Accepted Answer

Standard ACL. Standard ACLs use source IP only; extended ACLs use more criteria. Named ACLs use names; inbound/outbound specify direction. Implicit deny is the default deny-all at the end of any ACL.

Answer

Extended ACL

Answer

Named ACL

Answer

Implicit deny

Question 4

A network team wants visibility into which flows are consuming the most bandwidth between internal subnets. Which technology is most directly associated with that goal?

Accepted Answer

NetFlow. NetFlow provides visibility into traffic flows, allowing administrators to identify which flows (e.g., between internal subnets) are consuming the most bandwidth by showing source/destination, protocols, and traffic volume. Syslog only records system logs and events, not flow-level data. DHCP relay forwards DHCP broadcasts across subnets but offers no traffic analysis. PortFast is an STP optimization that speeds up port transition to forwarding; it does not monitor bandwidth usage.

Answer

Syslog

Answer

DHCP relay

Answer

PortFast

Question 5

Match each security concept to its most accurate meaning.

Accepted Answer

Phishing: A social engineering attack that tricks users into revealing sensitive information such as usernames and passwords.. Confidentiality ensures data is not disclosed to unauthorized parties; integrity prevents unauthorized modification of data; availability guarantees systems and data are accessible when needed; least privilege limits access rights to the minimum necessary. The correct matches reflect these core security principles.

Answer

Phishing: A type of malware that encrypts files and demands payment for decryption.

Answer

Phishing: An attack that overwhelms a network with traffic to disrupt services.

Answer

Phishing: An attack that intercepts communications between two parties to steal data.

Question 6

An ACL is intended to block Telnet from 10.1.1.0/24 to router VTY access while still allowing SSH from the same subnet. Which statement best explains why an extended ACL is appropriate here?

Accepted Answer

Because the ACL must distinguish traffic by protocol or destination port, not just by source address.. An extended ACL is appropriate because the requirement is based not only on source address but also on the specific protocol and application port involved. In practical terms, the policy must distinguish Telnet from SSH even though both originate from the same source subnet. A standard ACL would be too limited because it mainly matches only on source address.

This is the kind of requirement that shows why extended ACLs exist. They allow more granular traffic control by matching protocol and destination details, not just who sent the packet.

Answer

Because standard ACLs can match destination TCP ports just as well.

Answer

Because extended ACLs are required for every router login policy regardless of criteria.

Answer

Because SSH and Telnet always use the same port number.

Question 7

Match each network-assurance item to its most accurate role.

Accepted Answer

Uptime: Measures the percentage of time a network device or link has been operational without failure.. Syslog provides a centralized mechanism for collecting and storing event logs and system messages from network devices, making it ideal for event and message reporting. SNMP allows network management systems to query devices and receive traps, enabling monitoring and management data exchange. NetFlow captures traffic flow details such as source, destination, and volume, offering visibility into how traffic moves through the network. NTP synchronizes device clocks to a reference source, ensuring accurate timestamps in logs and flow data for reliable correlation and troubleshooting.

Answer

Uptime: Measures the amount of data successfully transmitted over a network link in a given time period.

Answer

Uptime: Measures the variation in delay (jitter) experienced by packets traversing a network.

Answer

Uptime: Measures the average time it takes for a packet to travel from source to destination.

Question 8

A network administrator wants to receive an immediate notification from a device when a significant event occurs, rather than polling the device repeatedly. Which SNMP feature is most associated with that requirement?

Accepted Answer

SNMP traps. SNMP traps are the correct answer because they are an SNMP feature that sends unsolicited, event-driven notifications from the device to the management system when a significant event occurs, eliminating the need for polling. Option B (syslog severity 7) is incorrect because syslog is a separate protocol for logging; while syslog messages are also sent unsolicited, the question specifically asks for an SNMP feature. Options C (DHCP relay) and D (NetFlow exporters) are unrelated to immediate event notifications: DHCP relay forwards broadcast requests, and NetFlow exports traffic flow data for analysis.

Answer

Syslog severity 7

Answer

DHCP relay

Answer

NetFlow exporters

Question 9

A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?

Accepted Answer

The policy must distinguish traffic by destination, protocol, or port.. An extended ACL is most strongly indicated when the policy must match not just on source address, but also on destination, protocol, or port information. In practical terms, if the requirement is something like “block HTTP but allow SSH” or “deny traffic to one server but not another,” a standard ACL is too limited because it mainly matches only the source. Option B (matching only one source subnet) can be done with a standard ACL, so it does not demand an extended ACL. Option C (placement near destination) is a guideline for standard ACLs, not a reason to choose an extended ACL. Option D (IPv6) is irrelevant because the scenario explicitly states both ACL types are available and standard ACLs do not exist for IPv6—this question is about IPv4 ACLs.

Answer

The policy needs to match only one source subnet.

Answer

The ACL must be placed near the destination.

Answer

The network uses IPv6 instead of IPv4.

Question 10

A security policy requires that only one management subnet be able to initiate SSH to a router. Which approach most directly supports that requirement?

Accepted Answer

Use an ACL to permit SSH access only from the approved management subnet.. The most direct approach is to use an ACL that restricts which source subnet is permitted to reach SSH management access on the router. In practical terms, SSH can remain enabled as the secure protocol, but access to it should still be limited to trusted management sources. That is a classic example of combining secure protocol choice with source restriction. Options B and C are incorrect because PortFast is a spanning-tree feature unrelated to access control, and disabling logging does not restrict who can initiate SSH. Option D is wrong because Telnet does not filter by subnet and is less secure than SSH.

Answer

Enable PortFast on the router interfaces.

Answer

Disable all logging on the router.

Answer

Replace SSH with Telnet for easier filtering.

Question 11

Why is disabling unused services on network devices considered a sound security practice?

Accepted Answer

Because it reduces unnecessary attack surface and exposure on the device.. It is considered sound because every enabled service is a potential attack surface or management exposure point. In practical terms, if a service is not needed, leaving it enabled creates unnecessary risk without business value. Reducing what is listening or available on a device helps limit opportunities for misuse or exploitation. Option B is incorrect because disabling unused services does not affect routing protocol convergence; that is a routing protocol function. Option C is wrong because no single security practice can guarantee the device cannot be misconfigured; misconfiguration remains possible through other means. Option D is nonsensical because disabling services does not turn the device into a controller.

Answer

Because it automatically improves routing convergence.

Answer

Because it guarantees the device cannot be misconfigured.

Answer

Because it converts the device into a controller.

Question 12

An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?

Accepted Answer

Configure the VTY lines to accept SSH and not Telnet.. The most direct change is to configure the VTY lines to accept only SSH, which removes Telnet as an accepted protocol. Option B (PortFast) is a spanning-tree feature that speeds up port transition on access ports and has nothing to do with VTY access. Option C (DHCP snooping) is a Layer 2 security feature to prevent rogue DHCP servers; it does not affect VTY line protocols. Option D (OSPF hello interval) is an OSPF timer adjustment, unrelated to remote access security. Therefore, only option A directly achieves the goal.

Answer

Enable PortFast on the VTY lines.

Answer

Use DHCP snooping to protect the VTY lines.

Answer

Increase the OSPF hello interval.

Question 13

Match each service to the symptom it most directly relates to when troubleshooting.

Accepted Answer

DNS: Users cannot access the website by name but can by IP. Each service is paired with a symptom directly related to its malfunction.

Question 14

Match each management-plane security item to its most accurate purpose.

Accepted Answer

SSH encrypts remote access to prevent eavesdropping and unauthorized command interception.. SSH provides encrypted remote administration, ensuring confidentiality of management traffic. AAA is a framework that handles authentication, authorization, and accounting for user access. Syslog enables centralized logging and event visibility from network devices. ACLs can filter traffic and be used to restrict which source IPs are allowed for management access. Each item directly maps to its described purpose without overlapping concepts.

Answer

AAA manages authentication, authorization, and accounting to control user access and track activities.

Answer

ACLs filter traffic to permit or deny packets based on IP addresses and protocols.

Answer

RBAC restricts commands to specific users based on roles to enforce least privilege.

Question 15

An operations team wants a monitoring platform to periodically read interface counters and CPU statistics from routers. Which technology is most closely associated with that requirement?

Accepted Answer

SNMP. SNMP is the best fit for that requirement. In practical terms, periodic reading of counters and statistics is polling-style monitoring, which is one of the classic SNMP use cases. A management system can query devices for interface status, utilization data, and other measurable values over time.

This is different from Syslog, which is event-message oriented, and from NetFlow, which focuses on traffic-flow visibility rather than general device statistics. The question is really about routine monitoring and polling.

Answer

Syslog

Answer

NetFlow

Answer

Port security