CCNA Network Services and Security Practice Test 15 — 15 Questions

Question 1

Match each operations term to its most accurate meaning.

Accepted Answer

SLA (Service Level Agreement). Polling matches 'Repeated collection of data by the management system' because an NMS periodically requests data from devices (SNMP Get/GetNext). Traps are event notifications sent by the device without a prior request. Syslog severity indicates the importance of a logged event (0=emergency to 7=debug). NetFlow provides visibility into traffic flows by collecting metadata about communications between endpoints.

Answer

MTTR (Mean Time to Repair)

Answer

MTBF (Mean Time Between Failures)

Answer

RTO (Recovery Time Objective)

Question 2

An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?

Accepted Answer

An extended ACL that can match protocol and destination port information. The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that.

This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.

Answer

A standard ACL because source matching is enough

Answer

A wildcard mask with all zeros only

Answer

A wireless SSID ACL

Question 3

A router allows SSH management from anywhere on the internal network. A new policy requires that only the management subnet 10.50.50.0/24 be allowed to initiate SSH to the device. Which approach best enforces that requirement?

Accepted Answer

Restrict SSH access so only the 10.50.50.0/24 management subnet is permitted. The best approach is to use an access control mechanism that limits SSH access to the approved source subnet. In practical terms, SSH is the correct secure protocol, but protocol choice alone is not enough. The device should also restrict who is allowed to reach that management service. That usually means applying an ACL or equivalent source restriction focused on the management subnet.

This is a common management-plane security pattern: use a secure protocol, then limit the set of trusted sources that are allowed to use it.

Answer

Replace SSH with Telnet so the traffic is easier to identify

Answer

Enable PortFast on all access switches

Answer

Raise the Syslog severity threshold

Question 4

Match each service or visibility technology to the most appropriate use case.

Accepted Answer

SNMP for device metrics, NetFlow for traffic analysis, Syslog for logs, IP SLA for performance measurement, Wireshark for packet analysis, Nmap for discovery and security.. Syslog collects device events and messages centrally, providing a centralized log repository. SNMP reads interface status and counters from devices, offering real-time device monitoring. NetFlow analyzes network traffic to identify bandwidth usage by host, making it ideal for finding top talkers. NTP synchronizes clocks across systems to maintain consistent event timelines. Each technology is matched to its primary use case.

Answer

SNMP for traffic analysis, NetFlow for device metrics, Syslog for performance measurement, IP SLA for logs, Wireshark for discovery and security, Nmap for packet analysis.

Answer

SNMP for logs, NetFlow for performance measurement, Syslog for device metrics, IP SLA for traffic analysis, Wireshark for discovery and security, Nmap for packet analysis.

Answer

SNMP for performance measurement, NetFlow for logs, Syslog for device metrics, IP SLA for traffic analysis, Wireshark for discovery and security, Nmap for packet analysis.

Question 5

A team wants to know which internal hosts are sending the most traffic to a specific data center subnet. Which technology is most directly associated with that visibility goal?

Accepted Answer

NetFlow. NetFlow is the best fit because it provides visibility into traffic flows and conversations. In practical terms, it helps answer questions like who is talking to whom, over which protocols and ports, and how much traffic is being exchanged. That makes it useful for capacity, troubleshooting, and unusual-traffic analysis.

This is different from Syslog, which reports device events, and from general SNMP polling, which focuses more on device and interface counters.

Answer

Syslog

Answer

DHCP

Answer

PortFast

Question 6

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

Accepted Answer

NetFlow. NetFlow provides conversation-level visibility into which hosts and applications are consuming bandwidth, closing the gap left by SNMP's interface totals. A new DHCP scope assigns IP addresses but offers no traffic insight. An STP priority manages loop-free topology and does not affect monitoring. A larger OSPF metric influences routing path selection, not traffic analysis.

Answer

Another DHCP scope

Answer

A new STP priority

Answer

A larger OSPF metric

Question 7

Match each operational symptom to the technology most likely associated with investigating it.

Accepted Answer

High CPU utilization on router: Routing protocol issues or excessive routing updates.. Syslog is specifically designed to collect device-generated log messages, including warnings and interface state changes, making it the natural tool for reviewing such events. SNMP allows a management station to actively poll device data such as interface counters and operational status, providing real-time statistics and alerts. NetFlow exports flow-level records that detail source, destination, and application conversations, enabling identification of the specific flows consuming bandwidth. NTP synchronizes the clocks of network devices, ensuring that timestamps in logs, alerts, and flow data are consistent across the network for accurate correlation and troubleshooting.

Question 8

Which two statements accurately describe good management-plane security practice on network devices?

Accepted Answer

Use secure management protocols such as SSH instead of less secure remote-access methods.. Good management-plane security combines multiple layers of control. In practical terms, using secure protocols such as SSH is important, but so is restricting which sources may connect, controlling who is authorized, and maintaining visibility into administrative activity. Strong management security is not usually one setting by itself.

This is a layered-control question rather than a single-technology question.

Answer

Prefer shared generic admin accounts for convenience.

Answer

Disable all logging to reduce device workload.

Answer

Rely only on SSID names to protect router management.

Question 9

An administrator wants to prevent a specific subnet from using Telnet to reach network devices, while still allowing SSH from that same subnet. What is the strongest reason a standard ACL is not enough by itself?

Accepted Answer

Because the policy must distinguish Telnet from SSH, which requires protocol or port-level matching.. A standard ACL is not enough by itself because the policy depends on distinguishing different protocols or destination ports, not just source address. In practical terms, the source subnet is the same for both Telnet and SSH. The ACL therefore needs to tell those two management protocols apart, which requires more granular matching than source-only logic.

This is one of the clearest examples of why extended ACL capability matters.

Answer

Because standard ACLs are valid only on wireless networks.

Answer

Because Telnet and SSH always use the same destination port.

Answer

Because SSH can never be filtered with ACLs.

Question 10

A security team wants device administrators to log in with individual named accounts instead of sharing one generic admin account. Which security objective does that most directly improve?

Accepted Answer

Accountability for administrative actions. It most directly improves accountability. In practical terms, when each administrator has an individual account, the organization can tie actions to specific people rather than to one shared identity. That makes investigation, auditing, and operational review much more meaningful.

This also supports better access-control hygiene overall, but the clearest direct benefit is being able to identify who actually performed an administrative action.

Answer

Automatic VLAN assignment for management traffic

Answer

Route summarization efficiency

Answer

Wireless roaming performance

Question 11

Match each security control or idea to its most accurate purpose.

Accepted Answer

Firewall: Filters traffic based on security rules. SSH encrypts remote CLI sessions, ensuring secure management access. AAA is a framework that defines how users are authenticated, what they are authorized to do, and how their actions are accounted for. The least privilege principle restricts users to only the permissions essential for their role, minimizing potential damage. Syslog collects and centralizes log messages from devices, providing visibility into network events and aiding in troubleshooting and security monitoring.

Answer

Firewall: Detects and alerts on suspicious activity

Answer

Firewall: Prevents and blocks intrusions in real time

Answer

Firewall: Authenticates users and manages access rights

Question 12

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

Accepted Answer

Use the narrowest possible match so only the intended traffic is denied.. The most important principle is to write the ACL as narrowly as possible so it matches only the unwanted traffic and does not overblock unrelated traffic. In practical terms, the rule should target the specific destination and service being denied rather than using a broader deny that unintentionally blocks other communication.

This is a precision-and-scope question. Good ACL design is as much about what you avoid blocking as what you intend to block.

Answer

Always deny all IP traffic to the destination subnet first.

Answer

Use a standard ACL because destination details never matter.

Answer

Place the ACL only where no routing exists.

Question 13

Which two statements accurately describe common uses of NTP in network operations?

Accepted Answer

It helps align device clocks across the network.. NTP is widely used to keep device clocks aligned, which improves the reliability of event timelines and log correlation because timestamps from different systems can be compared meaningfully. NTP does not replace Syslog, assign IP addresses (DHCP), or provide WLAN encryption; those are separate functions. Its sole purpose is time synchronization.

Answer

It replaces the need for Syslog.

Answer

It assigns IP addresses to hosts.

Answer

It provides WLAN encryption.

Question 14

Match each technology to the kind of visibility or function it most directly provides.

Accepted Answer

SIEM: Provides centralized log analysis and correlation.. Each technology is matched to the primary visibility or function it provides in a security architecture.

Question 15

A monitoring system already collects Syslog and SNMP data. The network team now wants visibility into which applications or host conversations are driving link utilization. What is the strongest addition?

Accepted Answer

NetFlow. The strongest addition is NetFlow because it provides traffic-flow visibility. In practical terms, Syslog and SNMP are useful, but they do not directly answer detailed conversation-level questions such as which hosts, protocols, or flows are consuming the most bandwidth. NetFlow is designed to answer exactly that kind of question.

This is about choosing the right operational tool for the visibility gap.

Answer

Another SSID

Answer

PortFast

Answer

A larger wildcard mask