CCNA Network Services and Security Practice Test 19 — 15 Questions

Question 1

A company wants unauthorized devices plugged into unused wall ports to have as little chance of gaining access as possible. Which action most directly supports that goal?

Accepted Answer

Administratively disable unused switch ports.. Administratively shutting down unused switch ports most directly supports the goal because it eliminates the access point entirely. Option B, converting unused ports into trunks, would actually increase risk by potentially allowing VLAN hopping and unauthorized traffic. Option D, removing VLAN assignments from active user ports, does not address unused ports and could disrupt legitimate users by forcing them into the default VLAN. Disabling unused ports is a simple and effective hardening measure that reduces attack surface.

Answer

Convert every unused port into a trunk.

Answer

Enable Telnet on unused ports for monitoring.

Answer

Remove all VLAN assignments from active user ports.

Question 2

Match each access-control term to its most accurate meaning.

Accepted Answer

Authentication: The process of verifying the identity of a user or device.. AAA is a framework for controlling access. Authentication verifies identity, authorization grants permissions, and accounting logs activities. Identification is the initial claim, and auditing is the review of logs.

Answer

Authorization: The process of verifying the identity of a user or device.

Answer

Accounting: The process of granting or denying access to network resources.

Answer

Identification: The process of logging and monitoring user activities.

Question 3

Why is centralized logging especially useful when combined with NTP?

Accepted Answer

Because synchronized clocks make centralized log timelines easier to analyze accurately.. Centralized logging is much more useful when device clocks are synchronized because the timestamps can be correlated properly. In practical terms, collecting messages in one place is valuable, but if one router thinks it is 9:00 and another thinks it is 9:17, the event sequence becomes confusing. NTP solves that time-alignment problem.

This is a common operations best practice. Syslog provides the central visibility, and NTP makes the timeline trustworthy.

Answer

Because NTP assigns the Syslog server its IP address.

Answer

Because Syslog replaces authentication when NTP is present.

Answer

Because centralized logging blocks unauthorized traffic automatically.

Question 4

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 5

Why is DHCP often preferred over manual addressing on larger user networks?

Accepted Answer

It automates host IP configuration and reduces manual effort and mistakes.. DHCP is often preferred because it automates host configuration and reduces both manual work and configuration mistakes. In practical terms, it is far easier to let endpoints receive addresses, masks, gateways, and DNS settings automatically than to configure each device by hand.

This improves scale, consistency, and operational efficiency. That is why DHCP is such a common service in enterprise access networks.

Answer

It replaces DNS completely.

Answer

It removes the need for default gateways.

Answer

It is required by all routing protocols.

Question 6

If a host has a valid IP address and subnet mask but no default gateway, what is the most likely result?

Accepted Answer

The host can usually reach only local-subnet destinations and not remote networks.. The host will normally reach local destinations but fail to reach remote networks. In practical terms, the subnet mask still lets the host identify what is local, but without a default gateway it has no next hop for off-subnet traffic. That means local ARP-based communication can still work, while remote communication usually fails.

This is a core host-configuration concept and a very common certification question. The missing gateway does not break all communication — it breaks off-subnet communication.

Answer

The host cannot use ARP at all.

Answer

The host automatically joins every subnet in the LAN.

Answer

The host becomes the default gateway for other devices.

Question 7

A company wants an internal web server to be reachable consistently from the Internet using one known public IPv4 address. Which NAT approach best fits that requirement?

Accepted Answer

Static NAT. Static NAT is the best fit because it creates a fixed one-to-one relationship between the inside server and the public address. In practical terms, outside clients need a stable public identity for the server. They cannot rely on a translated address that changes session by session. Static NAT gives that predictability.

This is different from PAT, which is designed for many inside users sharing fewer public addresses for outbound traffic. The question is about publishing a server, not conserving addresses for client browsing. That is why static NAT is the strongest answer.

Answer

PAT overload

Answer

No NAT, because private IPv4 addresses are publicly routable

Answer

DHCP relay

Question 8

Why is the combination of strong authentication and centralized logging better than either control by itself?

Accepted Answer

Authentication improves prevention, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate what happened across the environment. In practical terms, one control is stronger on prevention, and the other is stronger on visibility and accountability. Together they provide broader protection than either one alone.

This reflects a real security principle: mature security depends on layers of control, not one mechanism trying to do every job.

Answer

They are redundant because both perform exactly the same task.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for any event records.

Question 9

A user reports that websites can be opened by IP address but not by hostname. Which service is the strongest suspect?

Accepted Answer

DNS. DNS is the strongest suspect because the network path clearly works at the IP layer. In practical terms, if the user can reach the site by numeric address, then routing and basic connectivity are functioning. The missing piece is name resolution, and that is exactly what DNS provides.

This is one of the clearest troubleshooting patterns in networking. If names fail but IP works, start with DNS.

Answer

STP

Answer

PAT

Answer

Port security

Question 10

A branch office uses PAT for user Internet access. The administrator notices that inside users can browse out, but an internal server still cannot be reached consistently from outside. Which change is most appropriate?

Accepted Answer

Add a static NAT mapping for the server while leaving PAT in place for user traffic.. The most appropriate change is to add a static NAT mapping for the internal server while keeping PAT for ordinary user traffic. In practical terms, PAT solves the many-users-outbound problem by allowing shared use of a public address. But an inbound-published server needs a stable, predictable public identity. That requirement is different from the requirement for user browsing.

This is a common NAT design distinction. PAT and static NAT can coexist because they solve different problems. The best answer is the one that preserves PAT for users while giving the server a fixed public translation.

Answer

Replace PAT with DHCP relay.

Answer

Disable NAT entirely because PAT is preventing inbound routing.

Answer

Put the server in the native VLAN.

Question 11

A host can reach other devices on its local subnet, but it cannot reach remote networks. The host has a valid IP address and subnet mask. Which missing item is the strongest suspect?

Accepted Answer

Default gateway information. The strongest suspect is a missing default gateway. In practical terms, the host can still identify and reach local addresses because it has its own IP and subnet mask. But without a default gateway, it has no next hop for destinations outside the local subnet. That is why local communication works while remote communication fails.

This is one of the most common host-configuration troubleshooting patterns on the exam and in real networks.

Answer

STP priority information

Answer

A voice VLAN setting

Answer

An OSPF process ID

Question 12

Why is shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

Because it removes unused active connection points and reduces attack surface.. Shutting down unused switch ports reduces attack surface by removing unnecessary active connection points. This is a simple but effective control because it eliminates the risk of unauthorized physical access. Option B is incorrect because disabling a port does not change its mode to trunk; trunking is a separate configuration. Option C is incorrect because shutting down ports does not replace VLAN segmentation; VLANs provide logical separation, while port shutdown is a physical access control. Option D is incorrect because shutting down ports does not force devices to use SSH; SSH is an application-layer protocol for secure remote management, unrelated to port shutdown.

Answer

Because it converts all other ports into trunks.

Answer

Because it replaces VLAN segmentation.

Answer

Because it forces devices to use SSH.

Question 13

Which NAT design is most appropriate when many inside users need outbound Internet access through one public IPv4 address, but no inbound server publishing is required?

Accepted Answer

PAT overload. The most appropriate design is PAT overload. In practical terms, many internal users can share one public IPv4 address because PAT distinguishes their sessions using transport-layer ports. This is the most common solution when the requirement is outbound access for many clients rather than predictable inbound access to a specific internal server.

Static NAT would be the wrong design here because it creates fixed one-to-one mappings and consumes more public address space than needed for this use case. PAT is specifically built for many-to-one outbound translation.

Answer

Static NAT for every host

Answer

No NAT, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 14

Which two statements accurately describe DHCP?

Accepted Answer

It can automatically provide an IP address to a client.. DHCP is used to provide IP configuration automatically to hosts. In practical terms, it can supply an IP address, subnet mask, default gateway, and often DNS server information. This reduces manual effort and helps standardize endpoint configuration across a network.

The wrong answers often confuse DHCP with DNS or routing. The two correct answers are the ones focused on automatic host configuration.

Answer

It resolves hostnames into IP addresses.

Answer

It elects the designated router in OSPF.

Answer

It replaces the need for subnet masks.

Question 15

A host receives a correct IP address and subnet mask from DHCP but still cannot reach remote networks. Local subnet communication works. Which missing DHCP option is the strongest suspect?

Accepted Answer

Default gateway information. The strongest suspect is the default gateway option. In practical terms, the host can already identify local destinations because the subnet mask is present. That is why local communication still works. What it does not have is the next hop needed for off-subnet traffic. Without a default gateway, remote communication usually fails.

This is a very common host-troubleshooting scenario. It separates basic local addressing from the additional information required for off-subnet reachability.

Answer

An STP root bridge ID

Answer

A voice VLAN value

Answer

A router ID