CCNA Network Services and Security Practice Test 16 — 15 Questions

Question 1

Which two statements accurately describe DNS and DHCP?

Accepted Answer

DNS resolves names to IP information, while DHCP dynamically assigns addressing information to clients.. DNS and DHCP solve very different problems, even though both are common infrastructure services. DNS helps devices and users find systems by name. In simple terms, it means people can type a hostname rather than memorizing numeric IP addresses. DHCP automatically gives clients important IP settings such as an address, subnet mask, default gateway, and often DNS server information.

The trick in comparison questions is not to blend their roles together. DHCP does not perform NAT, and it does not eliminate the need for addressing details; it actually supplies them.

Answer

DHCP is used primarily to translate private addresses into public addresses.

Answer

DHCP replaces the need for subnet masks and default gateways.

Answer

DNS and DHCP are both Layer 1 technologies.

Question 2

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry should appear first in the ACL?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The requirement is specific: block HTTP traffic from one source subnet to one server, but allow everything else. In plain terms, you do not want to shut off all communication to the server or all communication from the users. You only want to stop normal web traffic that uses TCP port 80. That means the ACL should start with a deny statement that matches TCP from 10.10.10.0/24 to host 172.16.1.10 on destination port 80.

Using `deny ip` would block every IP-based protocol to that host, which is broader than the requirement. Using UDP port 80 does not match normal HTTP. And a permit statement would do the opposite of what is needed.

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 3

A host at 192.168.50.10/24 needs to send traffic to 192.168.60.20. Which MAC address will it normally place in the Ethernet destination field for the first frame?

Accepted Answer

The MAC address of its configured default gateway. When a host wants to send traffic to a different IP subnet, it does not send the frame directly to the remote device’s MAC address. In plain language, the host knows the destination IP is off its local network, so it hands the traffic to the local router. That means the Ethernet frame is addressed to the default gateway’s MAC address, while the IP packet inside still carries the final remote IP destination.

A host uses ARP to learn MAC addresses on its own LAN. Since the remote host is not local, the sender does not ARP for the remote host’s MAC. Instead, it ARPs for the gateway interface on the same subnet.

Answer

The MAC address of the remote host at 192.168.60.20

Answer

The broadcast MAC address only

Answer

Its own source MAC address

Question 4

Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.0
 ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.10.0 0.0.0.255

Based on this configuration, which change is required to make PAT work correctly?

Accepted Answer

Swap the inside and outside NAT roles on the two interfaces.. The problem is that the router has the NAT directions backwards. In simple terms, the interface facing the private LAN should be marked as inside, and the interface facing the public or WAN side should be marked as outside. Here, GigabitEthernet0/0 uses the private address 192.168.10.1, but it is configured as outside. GigabitEthernet0/1 uses the public address 203.0.113.10, but it is configured as inside. That reverses the translation logic and breaks normal PAT behavior.

Technically, the command `ip nat inside source list 1 interface GigabitEthernet0/1 overload` is otherwise reasonable for dynamic PAT using the WAN interface address. The ACL also correctly identifies the inside local subnet. The essential fix is to mark G0/0 as `ip nat inside` and G0/1 as `ip nat outside`. Once the directions are corrected, PAT can create and track translations properly for outbound traffic and returning sessions.

Answer

Apply ip nat enable on both interfaces.

Answer

Replace overload with pool.

Answer

Change access-list 1 to a standard ACL numbered 100.

Question 5

An administrator wants to permit SSH management access but block Telnet access to a device. Which statement best reflects that design goal?

Accepted Answer

SSH is preferred because it provides encrypted remote administration, unlike Telnet. Permitting SSH while blocking Telnet is a hardening decision because SSH encrypts management traffic and Telnet does not. The administrator wants remote access to remain available with credentials and session data protected. Option A is correct: SSH provides encrypted remote administration. Option B is wrong: Telnet offers no confidentiality. Option C is wrong: SSH works on routers and Layer 3 switches, not only Layer 2 switches. Option D is wrong: blocking Telnet does not disable AAA; AAA can still function over SSH or local authentication.

Answer

Telnet is preferred because it provides stronger confidentiality than SSH

Answer

SSH can be used only on Layer 2 switches and not routers

Answer

Blocking Telnet automatically disables all AAA functions

Question 6

Match each security concept to its most accurate purpose.

Accepted Answer

Confidentiality: Ensures data is accessible only to authorized parties. These pairings correctly define core security concepts (CIA triad plus authentication and authorization).

Question 7

Which protocol is most directly responsible for keeping device clocks synchronized across a network?

Accepted Answer

NTP. The correct protocol is NTP. In plain language, NTP helps devices agree on the current time so that logs, authentication events, monitoring data, and troubleshooting records line up accurately. Without consistent time, a network team may see events from multiple devices but be unable to reconstruct the actual sequence correctly.

This matters more than many people realize because accurate time underpins many operational workflows. Syslog messages, security events, and monitoring alerts become much easier to trust when devices are synchronized. DHCP, TFTP, and CDP are useful for other purposes, but they do not exist to align device clocks. NTP is the protocol specifically associated with time synchronization.

Answer

TFTP

Answer

DHCP

Answer

CDP

Question 8

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Accepted Answer

Syslog and NTP. The right combination is Syslog plus NTP. In plain language, Syslog gives the team a central place to collect and review device messages, while NTP makes sure the timestamps on those messages are consistent across the network. Centralized logs are useful on their own, but without synchronized clocks, incident timelines can become confusing and misleading.

This pairing is a common operational best practice. Syslog handles the collection side, and NTP handles the time-correlation side. Other services such as DHCP, STP, or NAT do not solve this combination of requirements. The best answer is the one that recognizes that centralized logging and time synchronization are complementary, not competing, services.

Answer

DHCP and STP

Answer

PAT and EtherChannel

Answer

ARP and CDP

Question 9

Users in a branch office can reach internal networks but cannot browse the Internet. The router has a correct default route and PAT is configured. Which missing item is the most likely cause if inside hosts are still using private source addresses on the WAN?

Accepted Answer

A correct ACL or source match identifying inside local addresses for NAT. If inside hosts are still appearing with private source addresses on the WAN side, the most likely missing element is a correct NAT inside source match for the internal subnet. In plain language, the router knows where Internet traffic should go because the default route exists, but it is not actually translating the private addresses before sending the traffic out. That means upstream devices see RFC 1918 private addresses that are not valid on the public Internet and return traffic fails.

This is a common CCNA troubleshooting pattern: routing and NAT are separate functions. A valid default route only tells the router where to send packets. It does not automatically translate them. PAT also depends on a correct ACL or source match identifying which inside addresses should be translated. If that match is missing or wrong, the router forwards the traffic but without performing the necessary translation. That is why the missing or incorrect NAT match is the most likely root cause.

Answer

An STP root bridge election on the WAN side

Answer

A voice VLAN on the branch access switches

Answer

A loopback interface with a higher IP address

Question 10

Which security concept is most closely associated with ensuring data has not been altered in an unauthorized way?

Accepted Answer

Integrity. The concept is integrity. In plain language, integrity is about making sure data remains accurate and trustworthy and that unauthorized changes can be detected or prevented. If confidentiality is about stopping the wrong people from seeing data, integrity is about stopping the wrong people from changing it. Availability, meanwhile, focuses on access to systems and services when needed.

This distinction matters because CCNA questions often group security vocabulary together and rely on candidates to separate them cleanly. Integrity is not the same as authentication or accounting, and it is not simply about whether a service is online. It specifically focuses on the correctness and trustworthiness of data or system state. That is why integrity is the correct answer here.

Answer

Availability

Answer

Accounting

Answer

Confidentiality

Question 11

Which two statements accurately describe ACL behavior on Cisco devices?

Accepted Answer

ACL entries are processed from top to bottom until a match is found.. ACL questions often depend on understanding how Cisco devices process entries line by line. In plain language, ACL entries are evaluated from top to bottom, and the first matching statement decides the result. If traffic reaches the end without matching a permit, it is denied by the implicit deny. These two ideas explain many real ACL troubleshooting cases.

The wrong answers often sound plausible because they borrow language from other parts of networking. But ACLs do not normally evaluate all lines before choosing, and they do not end with an implicit permit. Once you remember “first match wins” and “implicit deny at the end,” many access-list questions become much easier.

Answer

ACLs always evaluate every line before deciding the action.

Answer

ACLs end with an implicit permit unless configured otherwise.

Answer

ACLs apply only to Layer 1 traffic and not IP packets.

Question 12

Which two statements accurately describe Syslog in a Cisco network environment?

Accepted Answer

Syslog can send device event messages to a centralized logging server.. Syslog is used to centralize device event messages such as warnings, errors, and informational entries. In plain language, it gives administrators one place to review what devices are reporting rather than checking each device individually. This makes troubleshooting and incident review easier, especially in larger environments. Syslog does not replace time synchronization, but it becomes much more useful when paired with NTP so timestamps are consistent.

A common trap is to assume Syslog is a routing protocol or a DHCP-like service. It is neither. It is about event reporting and centralized logging.

Answer

Syslog is primarily used to assign IP addresses to hosts.

Answer

Syslog automatically prevents switching loops.

Answer

Syslog replaces the need for any monitoring system.

Question 13

A company wants to reduce the chance that unused switch ports can be exploited. Which action best aligns with that goal?

Accepted Answer

Administratively shut down unused switch ports. The best action is to administratively disable unused ports and apply hardening where appropriate. In plain language, an unused port is still a possible entry point if it remains active and unmonitored. Shutting it down reduces exposure and aligns with the broader principle of minimizing unnecessary attack surface. This is a simple but effective part of switch hardening.

Leaving unused ports active may feel convenient, but it creates opportunities for unauthorized connections. The correct answer is the one focused on disabling resources that are not needed rather than on unrelated technologies.

Answer

Convert all unused ports into trunk ports

Answer

Enable Telnet on all unused ports

Answer

Advertise every unused port into OSPF

Question 14

A switch should disable an edge port immediately if a BPDU is received on it. Which feature is intended for that specific behavior?

Accepted Answer

BPDU Guard. The feature is BPDU Guard. In plain language, the administrator is treating the port as an end-device-only edge interface and wants the switch to react aggressively if it ever sees spanning-tree control traffic there. BPDU Guard does exactly that: if a BPDU appears on a protected edge port, the switch places the interface into an err-disabled state to help prevent accidental loops or rogue switch connections.

This is different from root guard and loop guard, which solve other spanning-tree control problems. BPDU Guard is the specific answer when the requirement is “if you ever hear a BPDU here, shut the port down quickly.”

Answer

Loop Guard

Answer

Root Guard

Answer

UDLD

Question 15

A router has this command configured: `ip nat inside source static 192.168.1.50 203.0.113.50`. What is the main effect of this configuration?

Accepted Answer

It creates a permanent one-to-one translation between the inside host and a public address. This command creates a static NAT mapping between one inside local address and one inside global address. In plain language, the internal device at 192.168.1.50 will always appear as 203.0.113.50 to the outside world. That fixed relationship is useful when a particular internal host or service must be reachable consistently from outside networks.

This is different from PAT, which shares one public address across many sessions using ports. Static NAT is one-to-one and predictable. It does not dynamically pull from a pool in this syntax. The key idea is permanence: the same inside device is always mapped to the same outside address.

Answer

It enables PAT overload for all internal users

Answer

It blocks inbound access to the inside host permanently

Answer

It changes the host subnet mask to a public prefix