CCNA Network Services and Security Practice Test 14 — 15 Questions

Question 1

Which DHCP message does the client send to formally accept an offered address?

Accepted Answer

REQUEST. In the DORA process, the client sends DHCPREQUEST after receiving an offer. The server then responds with DHCPACK if the lease is granted.

Answer

DISCOVER

Answer

OFFER

Answer

ACK

Question 2

Which switch security feature uses DHCP snooping bindings to validate ARP packets and help stop ARP spoofing?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection compares ARP information to trusted bindings, often learned through DHCP snooping, to block forged ARP packets.

Answer

PortFast

Answer

UDLD

Answer

HSRP preemption

Question 3

An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?

Accepted Answer

It is denied by the implicit deny. ACLs end with an implicit deny. Since the only explicit permit is for HTTPS traffic, the ICMP packet is denied.

Answer

It is permitted because the destination matches

Answer

It is permitted because the packet matches the source network stated in the ACE.

Answer

It is permitted only if the source port is 443

Question 4

Users can reach a server by IP address but not by hostname. Which service should be checked first?

Accepted Answer

DNS. If the server is reachable by IP but not by name, the likely issue is name resolution, which points to DNS.

Answer

NTP

Answer

QoS

Answer

HSRP

Question 5

What problem does DHCP snooping help prevent?

Accepted Answer

Unauthorized DHCP server responses from user-facing ports. DHCP snooping marks interfaces as trusted or untrusted and blocks rogue DHCP server messages arriving on untrusted ports.

Answer

Layer 3 route loops

Answer

Trunk encapsulation mismatch

Answer

Weak SSH ciphers

Question 6

A show ip nat translations command displays this entry:

Inside global 203.0.113.10:30001
Inside local 192.168.10.25:51514
Outside local 198.51.100.20:443
Outside global 198.51.100.20:443

Which statement is correct?

Accepted Answer

192.168.10.25 is the inside local address of the host. Inside local is the actual address assigned to the inside host before translation. The inside global address is the public representation used after NAT, and the port values show PAT is in use.

Answer

203.0.113.10 is the inside local address of the host

Answer

198.51.100.20 is the translated private address of the internal client

Answer

The entry proves static NAT is being used without port translation

Question 7

Which port-security violation mode drops frames from unauthorized MAC addresses but keeps the interface up and does not send an SNMP trap or syslog message?

Accepted Answer

protect. Protect silently drops frames from unauthorized sources while leaving the interface up. Restrict also drops frames but increments the violation counter and can generate notifications.

Answer

restrict

Answer

shutdown

Answer

shutdown vlan

Question 8

Why is SSH preferred over Telnet for remote device administration?

Accepted Answer

SSH encrypts management traffic, while Telnet sends data in clear text. SSH protects credentials and management traffic by encrypting the session. Telnet does not provide encryption, so usernames, passwords, and commands can be exposed in transit.

Answer

SSH uses less bandwidth because it removes the TCP header

Answer

SSH works only on console ports, which are more secure

Answer

SSH does not require user authentication

Question 9

In AAA, which function determines what an authenticated user is allowed to do after login?

Accepted Answer

Authorization. Authentication verifies identity. Authorization determines permitted actions. Accounting records activity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 10

Which protocol is preferred over Telnet for remote CLI management because it encrypts the session?

Accepted Answer

SSH. SSH encrypts credentials and management traffic, making it the standard secure replacement for Telnet.

Answer

FTP

Answer

TFTP

Answer

SNMPv1

Question 11

A PC in VLAN 30 must obtain an address from a DHCP server in VLAN 99. Which feature is required on the Layer 3 interface for VLAN 30?

Accepted Answer

DHCP relay. DHCP Discover messages are broadcasts and do not cross Layer 3 boundaries on their own. DHCP relay, commonly configured with ip helper-address, forwards the requests to a server on another subnet.

Answer

Port security

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Question 12

Why is Telnet generally discouraged for network device administration?

Accepted Answer

It sends credentials and commands in clear text. Telnet sends all data, including credentials and commands, in clear text, making it vulnerable to eavesdropping. Option A is wrong because Telnet can traverse routed networks using TCP port 23. Option C is incorrect because Telnet can use local usernames as well as external AAA servers. Option D is false because Telnet works over network interfaces, not exclusively from the console port.

Answer

It cannot cross routed networks

Answer

It supports only local usernames

Answer

It works only from the console port

Question 13

A DHCP server is located on a different VLAN from the clients. Which feature is required so the clients can still receive addresses?

Accepted Answer

DHCP relay. DHCP relay forwards client broadcasts to a remote server as unicast, typically using ip helper-address on the Layer 3 interface.

Answer

DHCP snooping

Answer

Port security

Answer

NAT overload

Question 14

As a general rule, where should an extended ACL be placed?

Accepted Answer

As close to the source as practical. Extended ACLs are commonly placed near the source to stop unwanted traffic earlier and conserve bandwidth and device resources.

Answer

As close to the destination as possible in all cases

Answer

Only on the default gateway

Answer

Only on WAN interfaces

Question 15

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

Accepted Answer

It validates authentication credentials for the supplicant.. The switch acts as the authenticator and forwards authentication requests to the RADIUS server, which validates the user or device credentials.

Answer

It provides Layer 2 trunk negotiation for the supplicant.

Answer

It replaces the need for DHCP on the access layer.

Answer

It generates ARP replies on behalf of the default gateway.