CCNA Network Services and Security Practice Test 20 — 15 Questions

Question 1

Users on the inside network can browse the Internet through PAT, but an internal web server must now be reachable from outside on a predictable public IP. Which change best fits the requirement?

Accepted Answer

Add static NAT for the server and continue using PAT for user browsing.. The best change is to add a static NAT mapping for the internal web server while keeping PAT in place for ordinary users. In practical terms, PAT is excellent for many internal clients sharing one public address for outbound traffic, but it does not give an internal server the stable one-to-one public identity that outside clients expect for predictable inbound access.

This is a standard NAT design distinction. User browsing and published server access are different requirements, and the best design often uses PAT for one and static NAT for the other.

Answer

Replace PAT entirely with DHCP relay.

Answer

Disable NAT because the server already has a private address.

Answer

Move the server into the native VLAN.

Question 2

Why is administratively shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

It reduces the attack surface by removing unnecessary network entry points.. Unused active ports create unnecessary opportunity for unauthorized connection. Disabling them reduces the attack surface and makes opportunistic access much harder. Option B is incorrect because administratively shutting down a port does not increase backplane bandwidth; bandwidth is a fixed hardware characteristic. Option C is incorrect because shutting down ports does not enable 802.1Q trunking; trunking is configured separately. Option D is incorrect because port security must be explicitly enabled; it is not activated automatically by shutting down ports.

Answer

It increases available bandwidth on the switch backplane.

Answer

It enables 802.1Q trunking on all remaining ports.

Answer

It forces port security to activate automatically.

Question 3

Why does DNS make networks easier for people to use?

Accepted Answer

It lets people use memorable names instead of raw IP addresses.. DNS makes networks easier to use because it lets people work with names instead of memorizing numeric IP addresses. In practical terms, users can remember a server name much more easily than a string of numbers. DNS creates that naming layer while the network still uses IP underneath.

This usability benefit is one of the main reasons DNS is so important in everyday network operations.

Answer

It assigns IP addresses automatically.

Answer

It replaces the need for default gateways.

Answer

It elects the root bridge for STP.

Question 4

Why is NTP especially valuable when a company uses a centralized Syslog server?

Accepted Answer

It synchronizes device clocks so centralized log timestamps can be correlated accurately.. NTP is especially valuable because it aligns device clocks, which makes centralized log timestamps much easier to interpret. In practical terms, if devices disagree on time, the combined log stream becomes harder to trust and correlate. NTP improves the timeline accuracy of operational and security analysis.

This is why NTP and Syslog are often discussed together. One centralizes events, and the other makes those events easier to line up correctly.

Answer

It assigns the Syslog server its IP address.

Answer

It replaces the need for Syslog entirely.

Answer

It encrypts all Syslog messages automatically.

Question 5

Match each operations or assurance technology to its most accurate purpose.

Accepted Answer

NetFlow - Flow analysis; SNMP - Device management; Syslog - Logging; IP SLA - Performance measurement; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring. Each technology serves a specific assurance purpose: Syslog provides centralized event and message reporting, SNMP enables monitoring and management information exchange, NetFlow offers visibility into traffic flows and conversations, and NTP ensures clock synchronization for consistent timing across network devices.

Answer

NetFlow - Device management; SNMP - Flow analysis; Syslog - Performance measurement; IP SLA - Logging; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Logging; SNMP - Performance measurement; Syslog - Flow analysis; IP SLA - Device management; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Performance measurement; SNMP - Logging; Syslog - Device management; IP SLA - Flow analysis; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring

Question 6

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`.

This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 7

A network team wants visibility into which flows are consuming the most bandwidth between internal subnets. Which technology is most directly associated with that goal?

Accepted Answer

NetFlow. NetFlow provides visibility into traffic flows, allowing administrators to identify which flows (e.g., between internal subnets) are consuming the most bandwidth by showing source/destination, protocols, and traffic volume. Syslog only records system logs and events, not flow-level data. DHCP relay forwards DHCP broadcasts across subnets but offers no traffic analysis. PortFast is an STP optimization that speeds up port transition to forwarding; it does not monitor bandwidth usage.

Answer

Syslog

Answer

DHCP relay

Answer

PortFast

Question 8

An ACL is intended to block Telnet from 10.1.1.0/24 to router VTY access while still allowing SSH from the same subnet. Which statement best explains why an extended ACL is appropriate here?

Accepted Answer

Because the ACL must distinguish traffic by protocol or destination port, not just by source address.. An extended ACL is appropriate because the requirement is based not only on source address but also on the specific protocol and application port involved. In practical terms, the policy must distinguish Telnet from SSH even though both originate from the same source subnet. A standard ACL would be too limited because it mainly matches only on source address.

This is the kind of requirement that shows why extended ACLs exist. They allow more granular traffic control by matching protocol and destination details, not just who sent the packet.

Answer

Because standard ACLs can match destination TCP ports just as well.

Answer

Because extended ACLs are required for every router login policy regardless of criteria.

Answer

Because SSH and Telnet always use the same port number.

Question 9

A network administrator wants to receive an immediate notification from a device when a significant event occurs, rather than polling the device repeatedly. Which SNMP feature is most associated with that requirement?

Accepted Answer

SNMP traps. SNMP traps are the correct answer because they are an SNMP feature that sends unsolicited, event-driven notifications from the device to the management system when a significant event occurs, eliminating the need for polling. Option B (syslog severity 7) is incorrect because syslog is a separate protocol for logging; while syslog messages are also sent unsolicited, the question specifically asks for an SNMP feature. Options C (DHCP relay) and D (NetFlow exporters) are unrelated to immediate event notifications: DHCP relay forwards broadcast requests, and NetFlow exports traffic flow data for analysis.

Answer

Syslog severity 7

Answer

DHCP relay

Answer

NetFlow exporters

Question 10

A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?

Accepted Answer

The policy must distinguish traffic by destination, protocol, or port.. An extended ACL is most strongly indicated when the policy must match not just on source address, but also on destination, protocol, or port information. In practical terms, if the requirement is something like “block HTTP but allow SSH” or “deny traffic to one server but not another,” a standard ACL is too limited because it mainly matches only the source. Option B (matching only one source subnet) can be done with a standard ACL, so it does not demand an extended ACL. Option C (placement near destination) is a guideline for standard ACLs, not a reason to choose an extended ACL. Option D (IPv6) is irrelevant because the scenario explicitly states both ACL types are available and standard ACLs do not exist for IPv6—this question is about IPv4 ACLs.

Answer

The policy needs to match only one source subnet.

Answer

The ACL must be placed near the destination.

Answer

The network uses IPv6 instead of IPv4.

Question 11

A security policy requires that only one management subnet be able to initiate SSH to a router. Which approach most directly supports that requirement?

Accepted Answer

Use an ACL to permit SSH access only from the approved management subnet.. The most direct approach is to use an ACL that restricts which source subnet is permitted to reach SSH management access on the router. In practical terms, SSH can remain enabled as the secure protocol, but access to it should still be limited to trusted management sources. That is a classic example of combining secure protocol choice with source restriction. Options B and C are incorrect because PortFast is a spanning-tree feature unrelated to access control, and disabling logging does not restrict who can initiate SSH. Option D is wrong because Telnet does not filter by subnet and is less secure than SSH.

Answer

Enable PortFast on the router interfaces.

Answer

Disable all logging on the router.

Answer

Replace SSH with Telnet for easier filtering.

Question 12

Why is disabling unused services on network devices considered a sound security practice?

Accepted Answer

Because it reduces unnecessary attack surface and exposure on the device.. It is considered sound because every enabled service is a potential attack surface or management exposure point. In practical terms, if a service is not needed, leaving it enabled creates unnecessary risk without business value. Reducing what is listening or available on a device helps limit opportunities for misuse or exploitation. Option B is incorrect because disabling unused services does not affect routing protocol convergence; that is a routing protocol function. Option C is wrong because no single security practice can guarantee the device cannot be misconfigured; misconfiguration remains possible through other means. Option D is nonsensical because disabling services does not turn the device into a controller.

Answer

Because it automatically improves routing convergence.

Answer

Because it guarantees the device cannot be misconfigured.

Answer

Because it converts the device into a controller.

Question 13

An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?

Accepted Answer

Configure the VTY lines to accept SSH and not Telnet.. The most direct change is to configure the VTY lines to accept only SSH, which removes Telnet as an accepted protocol. Option B (PortFast) is a spanning-tree feature that speeds up port transition on access ports and has nothing to do with VTY access. Option C (DHCP snooping) is a Layer 2 security feature to prevent rogue DHCP servers; it does not affect VTY line protocols. Option D (OSPF hello interval) is an OSPF timer adjustment, unrelated to remote access security. Therefore, only option A directly achieves the goal.

Answer

Enable PortFast on the VTY lines.

Answer

Use DHCP snooping to protect the VTY lines.

Answer

Increase the OSPF hello interval.

Question 14

An operations team wants a monitoring platform to periodically read interface counters and CPU statistics from routers. Which technology is most closely associated with that requirement?

Accepted Answer

SNMP. SNMP is the best fit for that requirement. In practical terms, periodic reading of counters and statistics is polling-style monitoring, which is one of the classic SNMP use cases. A management system can query devices for interface status, utilization data, and other measurable values over time.

This is different from Syslog, which is event-message oriented, and from NetFlow, which focuses on traffic-flow visibility rather than general device statistics. The question is really about routine monitoring and polling.

Answer

Syslog

Answer

NetFlow

Answer

Port security

Question 15

An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?

Accepted Answer

An extended ACL that can match protocol and destination port information. The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that.

This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.

Answer

A standard ACL because source matching is enough

Answer

A wildcard mask with all zeros only

Answer

A wireless SSID ACL