CCNA Network Services and Security Practice Test 15 — 15 Questions

Question 1

Why is an extended ACL usually placed close to the source of the traffic being filtered?

Accepted Answer

To stop unwanted traffic earlier and conserve bandwidth. Extended ACLs can filter by source, destination, and protocol. Placing them near the source drops unwanted traffic before it crosses more of the network.

Answer

Because standard ACLs cannot be applied near the destination

Answer

To make NAT translation easier on inside interfaces

Answer

Because extended ACLs only work inbound on access interfaces

Question 2

A client on VLAN 20 must obtain an IPv4 lease from a DHCP server located on VLAN 100. Which feature is required on the Layer 3 interface for VLAN 20?

Accepted Answer

DHCP relay. A DHCP relay agent forwards client broadcasts as unicast to the remote server, typically using ip helper-address.

Answer

NAT overload

Answer

Port security

Answer

Private VLAN

Question 3

A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped.

What is the best fix?

Accepted Answer

Configure a static ARP inspection entry or ARP ACL for the printer.. DAI relies on trusted bindings. Static-IP devices that are not learned through DHCP often require a static ARP ACL or equivalent trusted binding mechanism.

Answer

Disable DAI on all VLANs globally.

Answer

Trust the user-facing printer access port for DHCP snooping and DAI.

Answer

Change the printer to use a larger MTU.

Question 4

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

Accepted Answer

Least privilege. Least privilege is the security principle that grants users only the specific permissions necessary to perform their job functions, minimizing potential damage from errors or malicious actions. Defense in depth is a layered security strategy using multiple controls, not a principle of limiting permissions. Segmentation divides a network into isolated segments to contain threats, but does not directly govern individual user permissions. Availability ensures systems and data are accessible when needed, which is unrelated to restricting access rights.

Answer

Defense in depth

Answer

Segmentation

Answer

Availability

Question 5

Which two statements about NTP are correct? (Choose two.)

Accepted Answer

Accurate time helps correlate log messages across multiple devices.. NTP synchronizes time across devices, which is important for logging, certificates, and event correlation.

Answer

NTP replaces the need for DNS in enterprise networks.

Answer

NTP is used to negotiate EtherChannel parameters.

Question 6

Which field is modified by each router hop in an IPv4 packet to prevent endless forwarding loops?

Accepted Answer

TTL. The Time to Live field is decremented at each hop.

Answer

Source port

Answer

Sequence number

Answer

CRC in the Ethernet trailer

Question 7

Dynamic ARP Inspection is most effective at preventing which attack?

Accepted Answer

ARP spoofing. Dynamic ARP Inspection (DAI) validates ARP packets on a per-interface basis, dropping invalid ARP replies and thus preventing ARP spoofing and poisoning attacks. Option A (SYN flood) is a Layer 4 TCP attack mitigated by TCP flood protection or SYN cookies, not DAI. Option C (route summarization error) is a routing misconfiguration unrelated to ARP security. Option D (rogue DHCP relay) is prevented by DHCP snooping, which works alongside DAI but DAI itself does not block rogue DHCP relays.

Answer

SYN flood

Answer

Route summarization error

Answer

Rogue DHCP relay

Question 8

A packet is larger than the outgoing interface MTU and the DF bit is set in the IPv4 header. What should the router do?

Accepted Answer

Drop the packet and send an ICMP message indicating fragmentation was needed.. If fragmentation is required but DF is set, the router drops the packet and returns an ICMP unreachable message indicating fragmentation was needed.

Answer

Fragment the packet anyway and forward all fragments.

Answer

Clear the DF bit and then fragment the packet.

Answer

Encapsulate the packet in GRE automatically.

Question 9

A router performing PAT is using a single public IPv4 address for many inside hosts. Which value most often distinguishes one inside flow from another on the same outside address?

Accepted Answer

TCP or UDP source port. PAT commonly multiplexes sessions by translating Layer 4 source port numbers.

Answer

TTL

Answer

DSCP

Answer

MAC address of the host

Question 10

Why is multifactor authentication generally stronger than password-only access?

Accepted Answer

It relies on more than one authentication factor.. MFA combines independent factors, so compromise of one factor does not automatically grant access.

Answer

It removes the need for authorization policies.

Answer

It guarantees that credentials can never be phished.

Answer

It replaces encryption on the network.

Question 11

Which two features commonly strengthen access-switch security for user-facing ports? (Choose two.)

Accepted Answer

Port security. Port security can limit learned MAC addresses, and BPDU Guard can shut down an edge port that unexpectedly receives BPDUs.

Answer

Administrative distance

Answer

Route summarization

Question 12

A switch port is configured with port security using these commands:

switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
switchport port-security mac-address sticky

A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.

Which statement best explains what happened?

Accepted Answer

Traffic from the unauthorized MAC address is being dropped while the interface remains up. With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.

Answer

The port shut down because restrict mode always causes err-disable

Answer

The switch learned the new MAC address automatically and replaced the old sticky entry

Answer

Port security affects only management traffic, not user traffic

Question 13

A host sends a packet larger than the outgoing interface MTU, and the IPv4 header has the Don't Fragment bit set.

What will a router do with the packet?

Accepted Answer

Drop it and typically return an ICMP message indicating fragmentation is needed. The router drops the packet because the packet is too large for the next link and the sender has explicitly said the packet must not be fragmented. In IPv4, the Don't Fragment bit tells routers not to break the packet into smaller pieces. If the outgoing interface MTU is smaller than the packet size, the router cannot legally forward it as-is and cannot fragment it, so the normal result is to drop the packet and usually send back an ICMP unreachable message indicating that fragmentation is needed. In plain terms, the router is telling the sender, 'This packet is too big for the path you chose, and you told me I am not allowed to split it.' This behavior is central to path MTU discovery.

Answer

Fragment it anyway and forward the pieces

Answer

Translate it to IPv6 and forward it

Answer

Broadcast it so another router can handle fragmentation

Question 14

A router is configured as follows:

interface g0/1
 ip address 172.16.1.1 255.255.255.0
 ip helper-address 10.20.20.10

Hosts on 172.16.1.0/24 are not receiving addresses from the DHCP server at 10.20.20.10. The server is reachable by ping from the router.

What is the purpose of the ip helper-address command in this scenario?

Accepted Answer

It forwards certain UDP broadcasts, including DHCP requests, to a remote server. The ip helper-address command exists to solve a broadcast-boundary problem. DHCP clients begin by sending broadcast traffic because they do not yet have a valid IP configuration. Routers normally do not forward broadcasts between subnets, so if the DHCP server lives on a different network, the client request would stop at the router. The helper-address function listens for that local broadcast and relays it as unicast traffic to the remote DHCP server. In plain language, it lets a client on one VLAN ask a DHCP server on another VLAN for an address. The command is not a routing statement and it is not a DNS feature. It is a relay mechanism for broadcast-based UDP services such as DHCP.

Answer

It converts DHCP unicast replies into broadcasts on the client segment

Answer

It provides DNS resolution for DHCP clients before they receive an address

Answer

It creates a static route to the DHCP server

Question 15

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.

Which combination of features best meets that requirement?

Accepted Answer

PortFast and BPDU Guard. PortFast and BPDU Guard are the classic edge-port combination for this requirement. PortFast helps a user-facing interface begin forwarding quickly so a PC or phone does not wait through the normal spanning-tree transition delay. BPDU Guard adds protection by monitoring that same port for BPDUs. If a switch is accidentally or intentionally connected and starts participating in spanning tree, BPDU Guard reacts by disabling the port to protect the Layer 2 topology. In plain language, users get quick connectivity when the port is used correctly, but the network still protects itself against someone plugging in a switch where only an endpoint should exist. That is exactly what the requirement asks for.

Answer

DHCP snooping and DAI

Answer

Root Guard and VTP pruning

Answer

Port security and CDP