CCNA Network Services and Security Practice Test 17 — 15 Questions

Question 1

A router performing PAT is using a single public IPv4 address for many inside hosts. Which value most often distinguishes one inside flow from another on the same outside address?

Accepted Answer

TCP or UDP source port. PAT commonly multiplexes sessions by translating Layer 4 source port numbers.

Answer

TTL

Answer

DSCP

Answer

MAC address of the host

Question 2

Why is multifactor authentication generally stronger than password-only access?

Accepted Answer

It relies on more than one authentication factor.. MFA combines independent factors, so compromise of one factor does not automatically grant access.

Answer

It removes the need for authorization policies.

Answer

It guarantees that credentials can never be phished.

Answer

It replaces encryption on the network.

Question 3

Which two features commonly strengthen access-switch security for user-facing ports? (Choose two.)

Accepted Answer

Port security. Port security can limit learned MAC addresses, and BPDU Guard can shut down an edge port that unexpectedly receives BPDUs.

Answer

Administrative distance

Answer

Route summarization

Question 4

A switch port is configured with port security using these commands:

switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
switchport port-security mac-address sticky

A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.

Which statement best explains what happened?

Accepted Answer

Traffic from the unauthorized MAC address is being dropped while the interface remains up. With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.

Answer

The port shut down because restrict mode always causes err-disable

Answer

The switch learned the new MAC address automatically and replaced the old sticky entry

Answer

Port security affects only management traffic, not user traffic

Question 5

A host sends a packet larger than the outgoing interface MTU, and the IPv4 header has the Don't Fragment bit set.

What will a router do with the packet?

Accepted Answer

Drop it and typically return an ICMP message indicating fragmentation is needed. The router drops the packet because the packet is too large for the next link and the sender has explicitly said the packet must not be fragmented. In IPv4, the Don't Fragment bit tells routers not to break the packet into smaller pieces. If the outgoing interface MTU is smaller than the packet size, the router cannot legally forward it as-is and cannot fragment it, so the normal result is to drop the packet and usually send back an ICMP unreachable message indicating that fragmentation is needed. In plain terms, the router is telling the sender, 'This packet is too big for the path you chose, and you told me I am not allowed to split it.' This behavior is central to path MTU discovery.

Answer

Fragment it anyway and forward the pieces

Answer

Translate it to IPv6 and forward it

Answer

Broadcast it so another router can handle fragmentation

Question 6

A router is configured as follows:

interface g0/1
 ip address 172.16.1.1 255.255.255.0
 ip helper-address 10.20.20.10

Hosts on 172.16.1.0/24 are not receiving addresses from the DHCP server at 10.20.20.10. The server is reachable by ping from the router.

What is the purpose of the ip helper-address command in this scenario?

Accepted Answer

It forwards certain UDP broadcasts, including DHCP requests, to a remote server. The ip helper-address command exists to solve a broadcast-boundary problem. DHCP clients begin by sending broadcast traffic because they do not yet have a valid IP configuration. Routers normally do not forward broadcasts between subnets, so if the DHCP server lives on a different network, the client request would stop at the router. The helper-address function listens for that local broadcast and relays it as unicast traffic to the remote DHCP server. In plain language, it lets a client on one VLAN ask a DHCP server on another VLAN for an address. The command is not a routing statement and it is not a DNS feature. It is a relay mechanism for broadcast-based UDP services such as DHCP.

Answer

It converts DHCP unicast replies into broadcasts on the client segment

Answer

It provides DNS resolution for DHCP clients before they receive an address

Answer

It creates a static route to the DHCP server

Question 7

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.

Which combination of features best meets that requirement?

Accepted Answer

PortFast and BPDU Guard. PortFast and BPDU Guard are the classic edge-port combination for this requirement. PortFast helps a user-facing interface begin forwarding quickly so a PC or phone does not wait through the normal spanning-tree transition delay. BPDU Guard adds protection by monitoring that same port for BPDUs. If a switch is accidentally or intentionally connected and starts participating in spanning tree, BPDU Guard reacts by disabling the port to protect the Layer 2 topology. In plain language, users get quick connectivity when the port is used correctly, but the network still protects itself against someone plugging in a switch where only an endpoint should exist. That is exactly what the requirement asks for.

Answer

DHCP snooping and DAI

Answer

Root Guard and VTP pruning

Answer

Port security and CDP

Question 8

Which two statements accurately describe DNS and DHCP?

Accepted Answer

DNS resolves names to IP information, while DHCP dynamically assigns addressing information to clients.. DNS and DHCP solve very different problems, even though both are common infrastructure services. DNS helps devices and users find systems by name. In simple terms, it means people can type a hostname rather than memorizing numeric IP addresses. DHCP automatically gives clients important IP settings such as an address, subnet mask, default gateway, and often DNS server information.

The trick in comparison questions is not to blend their roles together. DHCP does not perform NAT, and it does not eliminate the need for addressing details; it actually supplies them.

Answer

DHCP is used primarily to translate private addresses into public addresses.

Answer

DHCP replaces the need for subnet masks and default gateways.

Answer

DNS and DHCP are both Layer 1 technologies.

Question 9

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry should appear first in the ACL?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The requirement is specific: block HTTP traffic from one source subnet to one server, but allow everything else. In plain terms, you do not want to shut off all communication to the server or all communication from the users. You only want to stop normal web traffic that uses TCP port 80. That means the ACL should start with a deny statement that matches TCP from 10.10.10.0/24 to host 172.16.1.10 on destination port 80.

Using `deny ip` would block every IP-based protocol to that host, which is broader than the requirement. Using UDP port 80 does not match normal HTTP. And a permit statement would do the opposite of what is needed.

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 10

A host at 192.168.50.10/24 needs to send traffic to 192.168.60.20. Which MAC address will it normally place in the Ethernet destination field for the first frame?

Accepted Answer

The MAC address of its configured default gateway. When a host wants to send traffic to a different IP subnet, it does not send the frame directly to the remote device’s MAC address. In plain language, the host knows the destination IP is off its local network, so it hands the traffic to the local router. That means the Ethernet frame is addressed to the default gateway’s MAC address, while the IP packet inside still carries the final remote IP destination.

A host uses ARP to learn MAC addresses on its own LAN. Since the remote host is not local, the sender does not ARP for the remote host’s MAC. Instead, it ARPs for the gateway interface on the same subnet.

Answer

The MAC address of the remote host at 192.168.60.20

Answer

The broadcast MAC address only

Answer

Its own source MAC address

Question 11

Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.0
 ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.10.0 0.0.0.255

Based on this configuration, which change is required to make PAT work correctly?

Accepted Answer

Swap the inside and outside NAT roles on the two interfaces.. The problem is that the router has the NAT directions backwards. In simple terms, the interface facing the private LAN should be marked as inside, and the interface facing the public or WAN side should be marked as outside. Here, GigabitEthernet0/0 uses the private address 192.168.10.1, but it is configured as outside. GigabitEthernet0/1 uses the public address 203.0.113.10, but it is configured as inside. That reverses the translation logic and breaks normal PAT behavior.

Technically, the command `ip nat inside source list 1 interface GigabitEthernet0/1 overload` is otherwise reasonable for dynamic PAT using the WAN interface address. The ACL also correctly identifies the inside local subnet. The essential fix is to mark G0/0 as `ip nat inside` and G0/1 as `ip nat outside`. Once the directions are corrected, PAT can create and track translations properly for outbound traffic and returning sessions.

Answer

Apply ip nat enable on both interfaces.

Answer

Replace overload with pool.

Answer

Change access-list 1 to a standard ACL numbered 100.

Question 12

An administrator wants to permit SSH management access but block Telnet access to a device. Which statement best reflects that design goal?

Accepted Answer

SSH is preferred because it provides encrypted remote administration, unlike Telnet. Permitting SSH while blocking Telnet is a hardening decision because SSH encrypts management traffic and Telnet does not. The administrator wants remote access to remain available with credentials and session data protected. Option A is correct: SSH provides encrypted remote administration. Option B is wrong: Telnet offers no confidentiality. Option C is wrong: SSH works on routers and Layer 3 switches, not only Layer 2 switches. Option D is wrong: blocking Telnet does not disable AAA; AAA can still function over SSH or local authentication.

Answer

Telnet is preferred because it provides stronger confidentiality than SSH

Answer

SSH can be used only on Layer 2 switches and not routers

Answer

Blocking Telnet automatically disables all AAA functions

Question 13

Match each security concept to its most accurate purpose.

Accepted Answer

Confidentiality: Ensures data is accessible only to authorized parties. These pairings correctly define core security concepts (CIA triad plus authentication and authorization).

Question 14

Which protocol is most directly responsible for keeping device clocks synchronized across a network?

Accepted Answer

NTP. The correct protocol is NTP. In plain language, NTP helps devices agree on the current time so that logs, authentication events, monitoring data, and troubleshooting records line up accurately. Without consistent time, a network team may see events from multiple devices but be unable to reconstruct the actual sequence correctly.

This matters more than many people realize because accurate time underpins many operational workflows. Syslog messages, security events, and monitoring alerts become much easier to trust when devices are synchronized. DHCP, TFTP, and CDP are useful for other purposes, but they do not exist to align device clocks. NTP is the protocol specifically associated with time synchronization.

Answer

TFTP

Answer

DHCP

Answer

CDP

Question 15

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Accepted Answer

Syslog and NTP. The right combination is Syslog plus NTP. In plain language, Syslog gives the team a central place to collect and review device messages, while NTP makes sure the timestamps on those messages are consistent across the network. Centralized logs are useful on their own, but without synchronized clocks, incident timelines can become confusing and misleading.

This pairing is a common operational best practice. Syslog handles the collection side, and NTP handles the time-correlation side. Other services such as DHCP, STP, or NAT do not solve this combination of requirements. The best answer is the one that recognizes that centralized logging and time synchronization are complementary, not competing, services.

Answer

DHCP and STP

Answer

PAT and EtherChannel

Answer

ARP and CDP