CCNA Network Services and Security Practice Test 19 — 15 Questions

Question 1

A wireless site reports that users can connect to the SSID, but performance drops sharply around the conference area whenever the room fills up. Based on the exhibit, what is the most likely cause?

Accepted Answer

Adjacent-channel interference caused by overlapping 2.4 GHz channels. The 2.4 GHz radios are using overlapping channels. In 2.4 GHz, the standard non-overlapping channels are 1, 6, and 11 in many regulatory domains. Using channels 1, 3, and 6 creates adjacent-channel interference, which hurts throughput especially in dense client areas.

Answer

A DHCP exhaustion problem on the WLAN

Answer

An authentication mismatch between the APs and clients

Answer

A missing default route on the wireless controller

Question 2

Based on the JSON snippet below, which statement is correct?

{
  "device": {
    "hostname": "R1",
    "interfaces": [
      {"name": "Gig0/0", "status": "up"},
      {"name": "Gig0/1", "status": "down"}
    ]
  }
}

Accepted Answer

interfaces is a JSON array containing two objects.. The value associated with interfaces is an array because it is enclosed in square brackets and contains multiple objects. The device element itself is an object, and each interface entry inside the array is also an object.

Answer

device is a JSON array.

Answer

status is a JSON array with two strings.

Answer

hostname is a nested array under interfaces.

Question 3

Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?

Accepted Answer

The NAT inside and outside interface roles are reversed.. NAT overload requires the LAN-facing interface to be marked as ip nat inside and the WAN-facing interface as ip nat outside. The exhibit shows those roles reversed, so translations will not occur correctly. The ACL itself is fine for matching the inside subnet.

Answer

The ACL must deny RFC1918 traffic before NAT can work.

Answer

PAT cannot use an interface address for overload.

Answer

The inside subnet must be configured as /24 on both interfaces.

Question 4

An ACL on R1 contains only these entries:
access-list 101 permit tcp 10.10.10.0 0.0.0.255 any eq 443
access-list 101 permit icmp any any

What happens to an HTTP packet sourced from 10.10.10.25 and destined for 198.51.100.10 if ACL 101 is applied in the traffic path?

Accepted Answer

It is denied by the implicit deny.. HTTP uses TCP port 80, not 443. Because the ACL does not include a permit for that traffic, it is dropped by the implicit deny at the end of the ACL. The ICMP entry is irrelevant because the packet is TCP.

Answer

It is permitted because the source subnet is allowed.

Answer

It is translated by NAT before the ACL is checked.

Answer

It is converted to HTTPS automatically.

Question 5

Which Syslog severity level represents an emergency condition, the most critical level?

Accepted Answer

0. Syslog severity 0 is Emergency, the highest severity. The levels then increase numerically as urgency decreases, with 7 being Debugging.

Answer

3

Answer

5

Answer

7

Question 6

Match each IP service to the transport protocol and default port it commonly uses in a basic CCNA context.

Accepted Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: UDP 53. DNS primarily uses UDP port 53 for standard queries due to low overhead; TCP 53 is used for zone transfers but not in basic CCNA context. DHCPv4 server uses UDP port 67 because the protocol relies on broadcasts and does not require a connection-oriented transport. NTP uses UDP port 123 to keep time synchronization lightweight and efficient. Syslog uses UDP port 514 to send system messages without requiring a session, prioritizing speed over reliability.

Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 20; SSH: TCP 22; Telnet: TCP 23; DNS: TCP 53

Answer

HTTP/HTTPS: UDP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: UDP 53

Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: TCP 53

Question 7

Clients can join the Guest SSID and authenticate successfully, but they never receive an IP address. The DHCP scope for the guest network exists on the server. Based on the exhibit, what is the most likely cause?

Accepted Answer

The AP trunk is not allowing VLAN 300.. The Guest SSID is mapped to VLAN 300, but the switch trunk toward the AP allows only VLANs 10,20,30. Client traffic for the guest WLAN never reaches the correct VLAN upstream, so DHCP requests for that WLAN fail. Authentication can still succeed depending on how the WLAN is designed.

Answer

The DHCP server must use TCP instead of UDP.

Answer

The SSID name must match the DHCP pool name.

Answer

The AP should be configured as an access port for VLAN 1.

Question 8

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

Accepted Answer

Change the helper address on interface Vlan20 to 10.50.0.10.. The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here. DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Answer

Convert the VLAN 20 user ports to trunk mode.

Answer

Configure a default gateway on the user PCs manually.

Answer

Disable DHCP snooping on VLAN 20.

Question 9

Two switches are configured to form an EtherChannel, but the bundle never comes up. Which explanation best describes this scenario?

Accepted Answer

LACP active on one side is incompatible with mode on on the other side.. One side is using LACP active mode and the other side is forcing a static channel-group with mode on. Those modes are not compatible. LACP needs active or passive on both sides, while PAgP uses desirable or auto, and static mode on expects a manual bundle on the other side.

Answer

The switches are using different native VLANs.

Answer

Both sides must use PAgP desirable mode.

Answer

The interfaces must be configured as routed ports first.

Question 10

Which OSPF neighbor state indicates that the routers have already exchanged full link-state databases?

Accepted Answer

FULL. FULL means the adjacency is complete and database synchronization has finished. States such as INIT, 2-WAY, EXSTART, and EXCHANGE all occur earlier in the process.

Answer

2-WAY

Answer

EXSTART

Answer

INIT

Question 11

Match each route source to its default administrative distance on a Cisco router.

Accepted Answer

Connected: 0, Static: 1, EIGRP summary: 5, OSPF: 110, IS-IS: 115, RIP: 120. Default administrative distances on Cisco routers: connected=0, static=1, EIGRP summary=5, OSPF=110, IS-IS=115, RIP=120. Lower value indicates higher preference.

Answer

Connected: 0, Static: 1, EIGRP summary: 90, OSPF: 110, IS-IS: 115, RIP: 120

Answer

Connected: 0, Static: 1, EIGRP summary: 5, OSPF: 110, IS-IS: 115, RIP: 130

Answer

Connected: 0, Static: 1, EIGRP summary: 5, OSPF: 100, IS-IS: 115, RIP: 120

Question 12

R1 learns the route 192.0.2.0/24 via OSPF, RIP, and a static route configured with an administrative distance of 130. Based on this information, which two statements are correct?

Accepted Answer

The OSPF route is installed because its administrative distance is lower than RIP and the floating static route.. The router installs the OSPF route because it has the lowest administrative distance among the routes shown. The static route with AD 130 is intentionally floating, and the RIP route has a higher AD than OSPF. Route selection first prefers longest match, then lower AD among routes to the same prefix length.

Answer

The static route will be preferred because static routes always beat dynamic routes.

Answer

RIP wins because its metric is lower than OSPF cost.

Answer

All three routes should load-balance because the prefix length is the same.

Question 13

Match each management or monitoring technology to its primary purpose.

Accepted Answer

SNMP: Collects and organizes information about managed devices on IP networks. Syslog is designed to export event and log messages from network devices. NTP synchronizes device clocks across the network. NetFlow collects and summarizes traffic flows for analysis. SNMP traps are unsolicited alerts sent from an agent to a management station to notify of events.

Question 14

A switch interface connected to a Cisco IP phone with a PC behind it must carry voice and data correctly. Which two switchport commands are appropriate on that access port?

Accepted Answer

switchport access vlan 10. The access VLAN carries the workstation data traffic, and the voice VLAN carries tagged voice traffic for the IP phone. That is the standard campus switchport design for a phone with a PC behind it. The port itself remains an access port, but the two most directly relevant commands here are the access VLAN and voice VLAN assignments.

Answer

switchport mode trunk

Answer

channel-group 1 mode active

Answer

spanning-tree cost 1

Question 15

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

Accepted Answer

In the HTTP Authorization header. Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.

Answer

In the Ethernet trailer

Answer

In the DNS response section

Answer

In the TCP checksum field

CCNA Network Services and Security Practice Test 19 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 19 — 15 Questions

Exhibit