CCNA Network Services and Security Practice Test 16 — 15 Questions

Question 1

In AAA, which function determines what an authenticated user is allowed to do after login?

Accepted Answer

Authorization. Authentication verifies identity. Authorization determines permitted actions. Accounting records activity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 2

Which protocol is preferred over Telnet for remote CLI management because it encrypts the session?

Accepted Answer

SSH. SSH encrypts credentials and management traffic, making it the standard secure replacement for Telnet.

Answer

FTP

Answer

TFTP

Answer

SNMPv1

Question 3

A PC in VLAN 30 must obtain an address from a DHCP server in VLAN 99. Which feature is required on the Layer 3 interface for VLAN 30?

Accepted Answer

DHCP relay. DHCP Discover messages are broadcasts and do not cross Layer 3 boundaries on their own. DHCP relay, commonly configured with ip helper-address, forwards the requests to a server on another subnet.

Answer

Port security

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Question 4

Why is Telnet generally discouraged for network device administration?

Accepted Answer

It sends credentials and commands in clear text. Telnet sends all data, including credentials and commands, in clear text, making it vulnerable to eavesdropping. Option A is wrong because Telnet can traverse routed networks using TCP port 23. Option C is incorrect because Telnet can use local usernames as well as external AAA servers. Option D is false because Telnet works over network interfaces, not exclusively from the console port.

Answer

It cannot cross routed networks

Answer

It supports only local usernames

Answer

It works only from the console port

Question 5

A DHCP server is located on a different VLAN from the clients. Which feature is required so the clients can still receive addresses?

Accepted Answer

DHCP relay. DHCP relay forwards client broadcasts to a remote server as unicast, typically using ip helper-address on the Layer 3 interface.

Answer

DHCP snooping

Answer

Port security

Answer

NAT overload

Question 6

As a general rule, where should an extended ACL be placed?

Accepted Answer

As close to the source as practical. Extended ACLs are commonly placed near the source to stop unwanted traffic earlier and conserve bandwidth and device resources.

Answer

As close to the destination as possible in all cases

Answer

Only on the default gateway

Answer

Only on WAN interfaces

Question 7

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

Accepted Answer

It validates authentication credentials for the supplicant.. The switch acts as the authenticator and forwards authentication requests to the RADIUS server, which validates the user or device credentials.

Answer

It provides Layer 2 trunk negotiation for the supplicant.

Answer

It replaces the need for DHCP on the access layer.

Answer

It generates ARP replies on behalf of the default gateway.

Question 8

Why is an extended ACL usually placed close to the source of the traffic being filtered?

Accepted Answer

To stop unwanted traffic earlier and conserve bandwidth. Extended ACLs can filter by source, destination, and protocol. Placing them near the source drops unwanted traffic before it crosses more of the network.

Answer

Because standard ACLs cannot be applied near the destination

Answer

To make NAT translation easier on inside interfaces

Answer

Because extended ACLs only work inbound on access interfaces

Question 9

A client on VLAN 20 must obtain an IPv4 lease from a DHCP server located on VLAN 100. Which feature is required on the Layer 3 interface for VLAN 20?

Accepted Answer

DHCP relay. A DHCP relay agent forwards client broadcasts as unicast to the remote server, typically using ip helper-address.

Answer

NAT overload

Answer

Port security

Answer

Private VLAN

Question 10

A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped.

What is the best fix?

Accepted Answer

Configure a static ARP inspection entry or ARP ACL for the printer.. DAI relies on trusted bindings. Static-IP devices that are not learned through DHCP often require a static ARP ACL or equivalent trusted binding mechanism.

Answer

Disable DAI on all VLANs globally.

Answer

Trust the user-facing printer access port for DHCP snooping and DAI.

Answer

Change the printer to use a larger MTU.

Question 11

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

Accepted Answer

Least privilege. Least privilege is the security principle that grants users only the specific permissions necessary to perform their job functions, minimizing potential damage from errors or malicious actions. Defense in depth is a layered security strategy using multiple controls, not a principle of limiting permissions. Segmentation divides a network into isolated segments to contain threats, but does not directly govern individual user permissions. Availability ensures systems and data are accessible when needed, which is unrelated to restricting access rights.

Answer

Defense in depth

Answer

Segmentation

Answer

Availability

Question 12

Which two statements about NTP are correct? (Choose two.)

Accepted Answer

Accurate time helps correlate log messages across multiple devices.. NTP synchronizes time across devices, which is important for logging, certificates, and event correlation.

Answer

NTP replaces the need for DNS in enterprise networks.

Answer

NTP is used to negotiate EtherChannel parameters.

Question 13

Which field is modified by each router hop in an IPv4 packet to prevent endless forwarding loops?

Accepted Answer

TTL. The Time to Live field is decremented at each hop.

Answer

Source port

Answer

Sequence number

Answer

CRC in the Ethernet trailer

Question 14

Dynamic ARP Inspection is most effective at preventing which attack?

Accepted Answer

ARP spoofing. Dynamic ARP Inspection (DAI) validates ARP packets on a per-interface basis, dropping invalid ARP replies and thus preventing ARP spoofing and poisoning attacks. Option A (SYN flood) is a Layer 4 TCP attack mitigated by TCP flood protection or SYN cookies, not DAI. Option C (route summarization error) is a routing misconfiguration unrelated to ARP security. Option D (rogue DHCP relay) is prevented by DHCP snooping, which works alongside DAI but DAI itself does not block rogue DHCP relays.

Answer

SYN flood

Answer

Route summarization error

Answer

Rogue DHCP relay

Question 15

A packet is larger than the outgoing interface MTU and the DF bit is set in the IPv4 header. What should the router do?

Accepted Answer

Drop the packet and send an ICMP message indicating fragmentation was needed.. If fragmentation is required but DF is set, the router drops the packet and returns an ICMP unreachable message indicating fragmentation was needed.

Answer

Fragment the packet anyway and forward all fragments.

Answer

Clear the DF bit and then fragment the packet.

Answer

Encapsulate the packet in GRE automatically.