CCNA Network Services and Security Practice Test 18 — 15 Questions

Question 1

Users in a branch office can reach internal networks but cannot browse the Internet. The router has a correct default route and PAT is configured. Which missing item is the most likely cause if inside hosts are still using private source addresses on the WAN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A correct ACL or source match identifying inside local addresses for NAT. If inside hosts are still appearing with private source addresses on the WAN side, the most likely missing element is a correct NAT inside source match for the internal subnet. In plain language, the router knows where Internet traffic should go because the default route exists, but it is not actually translating the private addresses before sending the traffic out. That means upstream devices see RFC 1918 private addresses that are not valid on the public Internet and return traffic fails.

This is a common CCNA troubleshooting pattern: routing and NAT are separate functions. A valid default route only tells the router where to send packets. It does not automatically translate them. PAT also depends on a correct ACL or source match identifying which inside addresses should be translated. If that match is missing or wrong, the router forwards the traffic but without performing the necessary translation. That is why the missing or incorrect NAT match is the most likely root cause.

Answer

An STP root bridge election on the WAN side

Answer

A voice VLAN on the branch access switches

Answer

A loopback interface with a higher IP address

Question 2

Which security concept is most closely associated with ensuring data has not been altered in an unauthorized way?

Accepted Answer

Integrity. The concept is integrity. In plain language, integrity is about making sure data remains accurate and trustworthy and that unauthorized changes can be detected or prevented. If confidentiality is about stopping the wrong people from seeing data, integrity is about stopping the wrong people from changing it. Availability, meanwhile, focuses on access to systems and services when needed.

This distinction matters because CCNA questions often group security vocabulary together and rely on candidates to separate them cleanly. Integrity is not the same as authentication or accounting, and it is not simply about whether a service is online. It specifically focuses on the correctness and trustworthiness of data or system state. That is why integrity is the correct answer here.

Answer

Availability

Answer

Accounting

Answer

Confidentiality

Question 3

Which two statements accurately describe ACL behavior on Cisco devices?

Accepted Answer

ACL entries are processed from top to bottom until a match is found.. ACL questions often depend on understanding how Cisco devices process entries line by line. In plain language, ACL entries are evaluated from top to bottom, and the first matching statement decides the result. If traffic reaches the end without matching a permit, it is denied by the implicit deny. These two ideas explain many real ACL troubleshooting cases.

The wrong answers often sound plausible because they borrow language from other parts of networking. But ACLs do not normally evaluate all lines before choosing, and they do not end with an implicit permit. Once you remember “first match wins” and “implicit deny at the end,” many access-list questions become much easier.

Answer

ACLs always evaluate every line before deciding the action.

Answer

ACLs end with an implicit permit unless configured otherwise.

Answer

ACLs apply only to Layer 1 traffic and not IP packets.

Question 4

Which two statements accurately describe Syslog in a Cisco network environment?

Accepted Answer

Syslog can send device event messages to a centralized logging server.. Syslog is used to centralize device event messages such as warnings, errors, and informational entries. In plain language, it gives administrators one place to review what devices are reporting rather than checking each device individually. This makes troubleshooting and incident review easier, especially in larger environments. Syslog does not replace time synchronization, but it becomes much more useful when paired with NTP so timestamps are consistent.

A common trap is to assume Syslog is a routing protocol or a DHCP-like service. It is neither. It is about event reporting and centralized logging.

Answer

Syslog is primarily used to assign IP addresses to hosts.

Answer

Syslog automatically prevents switching loops.

Answer

Syslog replaces the need for any monitoring system.

Question 5

A company wants to reduce the chance that unused switch ports can be exploited. Which action best aligns with that goal?

Accepted Answer

Administratively shut down unused switch ports. The best action is to administratively disable unused ports and apply hardening where appropriate. In plain language, an unused port is still a possible entry point if it remains active and unmonitored. Shutting it down reduces exposure and aligns with the broader principle of minimizing unnecessary attack surface. This is a simple but effective part of switch hardening.

Leaving unused ports active may feel convenient, but it creates opportunities for unauthorized connections. The correct answer is the one focused on disabling resources that are not needed rather than on unrelated technologies.

Answer

Convert all unused ports into trunk ports

Answer

Enable Telnet on all unused ports

Answer

Advertise every unused port into OSPF

Question 6

A switch should disable an edge port immediately if a BPDU is received on it. Which feature is intended for that specific behavior?

Accepted Answer

BPDU Guard. The feature is BPDU Guard. In plain language, the administrator is treating the port as an end-device-only edge interface and wants the switch to react aggressively if it ever sees spanning-tree control traffic there. BPDU Guard does exactly that: if a BPDU appears on a protected edge port, the switch places the interface into an err-disabled state to help prevent accidental loops or rogue switch connections.

This is different from root guard and loop guard, which solve other spanning-tree control problems. BPDU Guard is the specific answer when the requirement is “if you ever hear a BPDU here, shut the port down quickly.”

Answer

Loop Guard

Answer

Root Guard

Answer

UDLD

Question 7

A router has this command configured: `ip nat inside source static 192.168.1.50 203.0.113.50`. What is the main effect of this configuration?

Accepted Answer

It creates a permanent one-to-one translation between the inside host and a public address. This command creates a static NAT mapping between one inside local address and one inside global address. In plain language, the internal device at 192.168.1.50 will always appear as 203.0.113.50 to the outside world. That fixed relationship is useful when a particular internal host or service must be reachable consistently from outside networks.

This is different from PAT, which shares one public address across many sessions using ports. Static NAT is one-to-one and predictable. It does not dynamically pull from a pool in this syntax. The key idea is permanence: the same inside device is always mapped to the same outside address.

Answer

It enables PAT overload for all internal users

Answer

It blocks inbound access to the inside host permanently

Answer

It changes the host subnet mask to a public prefix

Question 8

Why is NTP especially valuable when a network uses centralized Syslog servers?

Accepted Answer

Because synchronized clocks make log timestamps easier to correlate across devices. NTP is especially valuable because centralized logs are much easier to interpret when device clocks are synchronized. In plain language, if multiple routers and switches send messages to one logging server but each device believes a different time, the event sequence becomes confusing. NTP helps align those clocks so the timestamps in the logs are consistent and the team can reconstruct incidents more accurately.

This is a practical operations concept rather than a syntax question. Syslog solves the collection problem, and NTP solves the time-correlation problem. Together they make logs more useful than either one alone. That is why the best answer focuses on timestamp consistency rather than on routing, VLAN, or NAT behavior.

Answer

Because NTP converts Syslog into a routing protocol

Answer

Because NTP automatically creates DHCP pools

Answer

Because NTP eliminates the need for a Syslog server

Question 9

A router is performing PAT for inside users. Which detail allows multiple inside sessions to share one public IPv4 address at the same time?

Accepted Answer

Use of transport-layer port numbers to distinguish sessions. PAT works because it uses transport-layer port numbers to keep different conversations distinct even when they share the same public IP address. In plain language, the router rewrites and tracks port information so that return traffic can be matched back to the correct inside host and application session. That is what makes one public address usable for many simultaneous internal users.

This is a key difference between PAT and simple static NAT. Static NAT creates a fixed one-to-one relationship, while PAT creates many simultaneous translations differentiated by port values. The correct answer is the one that identifies port-based tracking as the reason the design scales beyond a single host.

Answer

Replacement of all MAC addresses with broadcast addresses

Answer

Automatic conversion of every subnet into a /32

Answer

Requirement that every inside host use the same private IP address

Question 10

Which two actions are reasonable examples of basic device-hardening practice?

Accepted Answer

Disable unused services or interfaces where practical. Basic hardening is about reducing unnecessary exposure and making administrative access safer. In plain language, this usually means disabling services or interfaces that are not needed and preferring secure management protocols such as SSH. These choices shrink the attack surface and improve the security of routine device administration without requiring advanced security products.

The wrong answers in hardening questions often suggest convenience at the expense of security, such as leaving insecure access methods enabled or removing authentication. CCNA-level security expects you to recognize that strong fundamentals often come from disciplined configuration choices rather than from complex tools alone.

Answer

Allow anonymous administrative login for convenience

Answer

Place all traffic in VLAN 1 so it is easier to remember

Answer

Remove authentication from VTY lines

Question 11

Which service would a client most directly rely on to convert `server.example.com` into an IP address?

Accepted Answer

DNS. The client relies on DNS for name resolution. In plain language, DNS is the service that lets devices and users use readable names instead of memorizing numeric IP addresses. When the client needs to reach `server.example.com`, DNS helps translate that hostname into the IP-related information needed for actual communication.

This is different from DHCP, which supplies address configuration, and from NTP, which synchronizes time. It is also different from ARP, which resolves local IPv4 addresses to MAC addresses. The correct answer is the one associated specifically with hostname resolution.

Answer

ARP

Answer

NTP

Answer

CDP

Question 12

Match each service to the kind of problem it most directly helps solve.

Accepted Answer

DNS - remembering IP addresses; DHCP - manual IP configuration; FTP - file transfers; SSH - encrypted remote access; RADIUS - network access; TACACS+ - device administration. DNS solves the problem of remembering IP addresses. DHCP eliminates manual IP configuration. FTP enables file transfers. SSH provides encrypted remote access. RADIUS and TACACS+ are AAA protocols, with RADIUS commonly used for network access and TACACS+ for device administration.

Answer

DNS - file transfers; DHCP - encrypted remote access; FTP - remembering IP addresses; SSH - manual IP configuration; RADIUS - device administration; TACACS+ - network access

Answer

DNS - encrypted remote access; DHCP - file transfers; FTP - manual IP configuration; SSH - remembering IP addresses; RADIUS - device administration; TACACS+ - network access

Answer

DNS - manual IP configuration; DHCP - remembering IP addresses; FTP - encrypted remote access; SSH - file transfers; RADIUS - network access; TACACS+ - device administration

Question 13

Which term in the CIA triad refers to ensuring systems and data remain accessible when needed?

Accepted Answer

Availability. The term is availability. In plain language, availability means that authorized users should be able to reach systems, services, and data when they actually need them. If a service is down, overwhelmed, or otherwise unreachable, availability has been affected. This is different from confidentiality, which focuses on preventing unauthorized disclosure, and integrity, which focuses on preventing unauthorized change.

This distinction matters because the CIA triad appears often in security foundations and exam questions. Availability is not about whether data is secret or whether it has been altered; it is about whether the service is usable. That is why availability is the best answer here.

Answer

Integrity

Answer

Accounting

Answer

Confidentiality

Question 14

Which two statements accurately describe basic WLAN security at the CCNA level?

Accepted Answer

WPA2 is generally considered stronger than WEP for wireless security.. Option A is correct because WPA2 uses AES-CCMP encryption, which is cryptographically far stronger than WEP's flawed RC4-based implementation with its weak IVs and easily cracked keys. Option C is correct because an open WLAN transmits frames without any encryption or authentication, so any nearby client can capture and read the traffic, unlike a WLAN protected by WPA2/WPA3. Option B is wrong because open wireless access provides no encryption at all, only association without credentials. Option D is wrong because SSID length is just a network name and has no cryptographic role; WEP's weakness lies in its RC4/IV design, not the SSID. Option E is wrong because WPA2 mandates AES-CCMP, while TKIP is associated with the older WPA (and WPA2's optional TKIP compatibility mode), not WPA2's standard encryption.

Answer

Open wireless access provides meaningful default encryption.

Answer

A longer SSID makes WEP cryptographically strong.

Answer

WPA2 relies on TKIP encryption

Question 15

A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?

Accepted Answer

Use stronger or additional authentication controls to improve remote administrative access security. The goal is to strengthen authentication beyond a simple password. Cisco AAA (Authentication, Authorization, and Accounting) using TACACS+ or RADIUS provides stronger, centralized authentication. Secure Shell (SSH) with key-based or two-factor authentication also enhances security. Option A correctly describes this concept, while the other options either weaken security (B, D) or address access control via ACLs, which does not improve the authentication factor itself (C).

Answer

Replace SSH with Telnet to simplify troubleshooting

Answer

Configure an extended ACL to limit remote access to specific source IP addresses

Answer

Disable password authentication and rely solely on device location in the network