CCNA Network Services and Security Practice Test 2 — 15 Questions

Question 1

Which statement best describes the benefit of PAT compared with static NAT in a small office that has many internal users but only one public IPv4 address?

Accepted Answer

PAT lets many internal sessions share one public address using port numbers. PAT is more suitable because it lets many internal sessions share one public address by distinguishing them with transport-layer ports. In plain language, PAT allows a whole office to use one public IP for outbound access, while static NAT would require a separate permanent public mapping for each inside host or service.

This question highlights the scaling difference between translation methods. Static NAT is predictable but address-hungry. PAT is efficient because it multiplexes many conversations through one address.

Answer

PAT requires one public address for every internal host

Answer

PAT eliminates the need for a default route

Answer

PAT prevents any return traffic from reaching inside hosts

Question 2

Which statement best describes the purpose of authorization in AAA?

Accepted Answer

It determines which actions an authenticated user is allowed to perform. Authorization determines what an authenticated user is allowed to do. In plain language, once the system has verified who the user is, it then decides what level of access, commands, or resources that user may use. This is different from authentication, which verifies identity, and accounting, which records activity.

This distinction matters because many access-control problems are not about whether the user logged in successfully, but about whether the user should be permitted to perform a certain action after login. That permission decision is the role of authorization.

Answer

It records every command after the session ends

Answer

It proves the user’s identity with credentials

Answer

It assigns an IP address to the administrator’s workstation

Question 3

What is the primary reason DNS is easier for humans to use than raw IP addressing?

Accepted Answer

It lets users work with readable hostnames instead of memorizing numeric IP addresses. DNS is easier for humans because it lets users work with readable names instead of memorizing numeric IP addresses. In plain language, people remember names far more easily than long strings of numbers. DNS creates a layer of usability by mapping those names to the IP information that devices actually need for communication.

This matters because even when underlying connectivity is perfect, usability suffers without name resolution. The correct answer is the one focused on human-friendly naming rather than on routing, encryption, or automatic address assignment.

Answer

It automatically replaces subnet masks on all hosts

Answer

It encrypts all Internet traffic by default

Answer

It removes the need for default gateways

Question 4

Which statement best describes why disabling unused switch ports is considered a hardening measure?

Accepted Answer

It reduces unnecessary exposure by removing potential unauthorized connection points. Disabling unused switch ports is considered hardening because it reduces the attack surface. In plain language, every active but unused port is a potential place where an unauthorized device could be connected. By shutting those ports down, the administrator reduces unnecessary exposure and makes it harder for someone to exploit forgotten or unmanaged access points.

This is a simple but important security habit. It is not glamorous, but it is effective. The correct answer is the one that focuses on reducing unnecessary exposure rather than on routing, encryption, or unrelated services.

Answer

It automatically increases OSPF metric accuracy

Answer

It converts edge ports into routed interfaces

Answer

It replaces the need for authentication on active ports

Question 5

Which statement best explains why a DHCP client typically also needs a subnet mask in addition to an IP address?

Accepted Answer

The subnet mask tells the host which destinations are local and which require a gateway.. A host needs the subnet mask so it can determine which destinations are local and which are remote. In plain language, the IP address identifies the host, but the mask tells the host how large the local network is. Without that information, the host cannot reliably decide when to ARP locally and when to send traffic to the default gateway.

This is a core host-configuration concept because correct communication depends on more than having an address alone. The correct answer is the one focused on local-versus-remote decision making.

Answer

The subnet mask encrypts the host’s traffic.

Answer

The subnet mask replaces the need for DNS.

Answer

The subnet mask creates a trunk between the host and switch.

Question 6

What is the main security benefit of using the principle of least privilege?

Accepted Answer

It limits access to only what is necessary, reducing unnecessary exposure and potential damage.. The principle of least privilege limits users or systems to only the access they actually need. In plain language, it reduces risk by avoiding unnecessary permissions. If an account is compromised or a mistake is made, the potential damage is smaller because the account does not have broad powers it never needed in the first place.

This is a conceptual question, but it matters in many technical designs. The correct answer is the one that focuses on reducing exposure and limiting the impact of misuse rather than on convenience or performance.

Answer

It guarantees every user full administrative access when needed.

Answer

It disables all logging to improve performance.

Answer

It forces all traffic into VLAN 1.

Question 7

Which statement best describes why a management network should prefer SSH over Telnet?

Accepted Answer

SSH encrypts remote management traffic, while Telnet does not.. SSH is preferred because it protects remote administrative traffic with encryption. In plain language, that means usernames, passwords, and session contents are not exposed in clear text as they cross the network. Telnet does not offer that protection, which is why it is considered much weaker from a security perspective.

This is one of the most basic management-security choices in networking. The issue is not whether remote administration should exist. It is whether that administration should happen in a way that protects credentials and commands. That is exactly why SSH is the stronger choice.

Answer

Telnet is preferred because it is simpler to sniff and verify.

Answer

SSH works only on wireless networks.

Answer

Telnet is required for AAA authorization to work.

Question 8

Which statement best describes Syslog in a network operations context?

Accepted Answer

It allows devices to send event and log messages to a centralized logging destination.. Syslog is a centralized event-reporting mechanism used by devices to send log and status messages to a logging server. In plain language, it gives administrators a way to collect warnings, errors, and informational events from many devices in one place. That makes troubleshooting and incident review much easier than checking each device manually.

Syslog does not assign IP addresses, and it does not replace time synchronization. It is specifically about event and message collection. The correct answer is the one that captures that centralized logging role.

Answer

It automatically assigns IP addresses to clients.

Answer

It acts as the default routing protocol for edge routers.

Answer

It replaces the need for NTP by correcting timestamps automatically.

Question 9

Which statement best describes integrity in the CIA triad?

Accepted Answer

Protecting information from unauthorized modification. Integrity is about protecting data from unauthorized changes and helping ensure that information remains accurate and trustworthy. In plain language, it answers the question of whether the data has been altered improperly. This is different from confidentiality, which is about preventing unauthorized disclosure, and availability, which is about access when needed.

This distinction matters because many security controls target one part of the CIA triad more directly than the others. The correct answer is the one focused on unauthorized modification rather than disclosure or uptime.

Answer

Making information available at all times

Answer

Preventing unauthorized people from seeing the data

Answer

Recording all commands for audit

Question 10

Which statement best describes why least privilege is useful even for trusted users?

Accepted Answer

It reduces potential damage by limiting access to only what is actually needed.. Least privilege is useful even for trusted users because trust does not eliminate the possibility of mistakes, misuse, or compromise. In plain language, a user can be well intentioned and still cause damage if given unnecessary access, or that user’s account could be compromised by someone else. Limiting access to what is actually needed reduces the blast radius of both accidents and attacks.

This is why least privilege is a durable security principle. It is not based on distrust alone; it is based on sensible risk reduction. The correct answer is the one that focuses on limiting potential damage and unnecessary exposure.

Answer

It guarantees that trusted users never make mistakes.

Answer

It eliminates the need for logging and monitoring.

Answer

It requires every user to have full administrative rights temporarily.

Question 11

Which statement best explains the purpose of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized disclosure of data. Confidentiality is about preventing unauthorized disclosure of information. In plain language, it focuses on keeping data away from people or systems that should not see it. This is different from integrity, which is about unauthorized change, and availability, which is about being able to access systems and information when needed.

This distinction matters because many security controls are aimed more directly at one part of the CIA triad than the others. The correct answer is the one focused on secrecy from unauthorized viewers.

Answer

Ensuring a service is reachable during business hours

Answer

Recording every administrative action in a log

Answer

Making sure data was not changed improperly

Question 12

Which statement best explains the security value of SSH for device management?

Accepted Answer

It encrypts remote administrative traffic, helping protect credentials and session data.. SSH provides encrypted remote management, which helps protect credentials and session contents from being read in transit. In plain language, administrators can still manage devices remotely, but the traffic is protected instead of being sent as clear text. That makes SSH much safer than Telnet for routine administration.

This is one of the most fundamental management-plane security decisions in networking. The correct answer is the one focused on secure remote administration through encryption.

Answer

It removes the need for usernames and passwords.

Answer

It turns every management interface into a trunk.

Answer

It prevents all routing problems automatically.

Question 13

What is the main operational difference between DHCP and DNS?

Accepted Answer

DNS resolves names, while DHCP provides automatic IP configuration.. DHCP and DNS solve different problems. In plain language, DHCP automatically gives hosts the network settings they need to join the network, such as an IP address and default gateway. DNS helps resolve hostnames into IP-related information so users and applications can find systems by name. These are both core services, but they solve different problems.

This distinction matters because many troubleshooting patterns depend on understanding whether the issue is address assignment or name resolution. The correct answer is the one that keeps those two service roles separate.

Answer

DNS assigns subnet masks, while DHCP resolves hostnames.

Answer

Both are routing protocols used only on routers.

Answer

Neither service is useful on user networks.

Question 14

Which statement best describes why DNS improves usability for people using networks?

Accepted Answer

It allows people to use memorable names instead of raw IP addresses.. DNS improves usability because it lets people work with names instead of memorizing numeric IP addresses. In plain language, it is easier for users to remember something like a server name than a long string of numbers. DNS creates that usability layer while still allowing the network to use IP addresses underneath.

This is one of the main practical reasons DNS exists. The correct answer is the one focused on human-friendly naming rather than address assignment or route calculation.

Answer

It assigns IP addresses to hosts automatically.

Answer

It replaces the need for default gateways.

Answer

It determines the STP root bridge.

Question 15

Which statement best describes why least privilege is useful for administrative accounts?

Accepted Answer

It limits unnecessary permissions so mistakes or compromise have less impact.. Least privilege is useful because even administrative or trusted users should not have more access than they actually need. In plain language, limiting permissions reduces the damage that can result from mistakes, misuse, or account compromise. It is a risk-reduction principle, not a sign that trusted users are assumed to be malicious.

This matters because broad permissions create a larger blast radius when something goes wrong. The correct answer is the one focused on limiting unnecessary exposure and impact.

Answer

It guarantees that trusted users can never make mistakes.

Answer

It replaces the need for authentication.

Answer

It requires every user to be placed in the same role.