CCNA Network Services and Security Practice Test 20 — 15 Questions

Question 1

A company wants internal users to share one public IPv4 address for outbound Internet access, while keeping sessions separate. Which NAT approach best meets that requirement?

Accepted Answer

PAT overload. PAT is the correct approach because it allows many internal sessions to share one outside IPv4 address while distinguishing them by port numbers. In plain language, PAT gives the office an efficient many-to-one translation model that works well for ordinary user Internet access when public addresses are limited.

This is different from static NAT, which gives a fixed one-to-one mapping, and from dynamic NAT pools that usually rely on multiple public addresses. The correct answer is the translation method designed specifically for shared public-address use across many sessions.

Answer

Static NAT only

Answer

No NAT, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 2

A host has a valid IP address and subnet mask from DHCP but cannot reach remote networks because no gateway was provided. What is the best explanation?

Accepted Answer

The host has no next-hop gateway for traffic destined outside its local subnet.. The best explanation is that the host has no next-hop path for off-subnet traffic. In plain language, the device knows what its own local network looks like, but it does not know where to send packets when the destination is outside that local range. Without a default gateway, remote communication usually fails even though local communication can still work.

This is a core host-configuration concept. The correct answer is the one focused on the absence of a next hop for remote destinations.

Answer

The host cannot use ARP on the local network anymore.

Answer

The host automatically becomes part of every remote subnet.

Answer

The host must convert its access port into a trunk.

Question 3

A router is configured with PAT for inside users. Which symptom most strongly suggests the NAT inside/outside roles are reversed on the interfaces?

Accepted Answer

Outbound traffic still shows private inside source addresses where translated public addresses should appear.. When NAT inside/outside roles are reversed, the router applies translation logic in the wrong direction, causing traffic from the inside network to leave the outside interface with untranslated private source addresses. The correct answer (A) directly demonstrates this failure: outbound traffic still shows private IPs where a public address should appear after PAT. The other options describe symptoms that could occur with other NAT misconfigurations but do not strongly indicate reversed roles: an empty translation table (B) suggests no NAT processing at all, possibly due to missing ACL or overload configuration; total lack of internet access (C) may result from many connectivity issues, not specifically reversed interface roles; and external hosts reaching internal servers by private IP (D) points more to a missing or incorrect static NAT rule rather than direction reversal.

Answer

The NAT translation table is empty even though internal users are browsing the internet.

Answer

Internal hosts cannot reach the internet at all.

Answer

External hosts can connect to internal servers using their private IP addresses.

Question 4

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

Accepted Answer

Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate activity across the environment. In plain language, one control focuses more on prevention, while the other improves visibility and accountability. Together they create a stronger security posture than either one alone.

This is an important design mindset. Security is stronger when controls complement each other instead of trying to solve every problem with one mechanism. The correct answer is the one focused on prevention plus visibility.

Answer

They are redundant because both perform exactly the same function.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for device event records.

Question 5

A host can reach remote websites by IP address but fails when using their hostnames. Which missing configuration item is the strongest suspect?

Accepted Answer

A DNS server address. When a host can reach remote websites by IP address but not by hostname, the issue is that the host cannot resolve the hostname to an IP address. DNS (Domain Name System) is responsible for this resolution, and if the DNS server address is missing or misconfigured on the host, name resolution fails. This is the strongest suspect because all other network connectivity (routing, switching) is functional, as proven by successful IP-based access.

Answer

A new MAC address

Answer

A trunk native VLAN

Answer

An OSPF router ID

Question 6

Which two statements accurately describe DNS in everyday network use?

Accepted Answer

DNS helps resolve hostnames into IP-related information.. Option A is correct because DNS is fundamentally a name-resolution service: a resolver queries name servers for records such as A (IPv4 address), AAAA (IPv6 address), CNAME (alias), and PTR (reverse lookup), returning IP-related information for a hostname. Option B is correct because this resolution lets users and applications reference friendly names like www.example.com instead of remembering raw IP addresses, which is the core usability benefit of DNS in everyday networking. The remaining options do not belong: IP address assignment is handled by DHCP (or static configuration), not DNS; subnet masks are part of IP addressing and routing and are unaffected by DNS; and STP root bridge election is a Layer 2 switching function determined by bridge ID (priority plus MAC address), entirely unrelated to DNS.

Answer

DNS automatically assigns IP addresses to hosts.

Answer

DNS replaces the need for subnet masks.

Answer

DNS elects the STP root bridge.

Question 7

Users on the inside network can browse the web, but the company now needs an internal web server at 192.168.10.50 to be reachable consistently from outside using one public IP address. Which design is most appropriate?

Accepted Answer

Use static NAT for the server and continue using PAT for user outbound access.. The best design is static NAT for the server while continuing to use PAT for general user outbound traffic. In plain language, user browsing and server publishing are two different requirements. PAT is great for letting many inside users share one public address for outbound access. But a server that outside clients must find reliably needs a fixed one-to-one public identity. That is exactly what static NAT provides.

This is an important design distinction. PAT solves address conservation for many clients. Static NAT solves predictability for inbound access to a specific internal system. The strongest answer is the one that uses each NAT method for the job it fits best.

Answer

Use PAT only for everything, including the published server.

Answer

Disable NAT because private IPv4 addresses are Internet-routable.

Answer

Use DHCP relay for the server to make it reachable from outside.

Question 8

A company wants unauthorized devices plugged into unused wall ports to have as little chance of gaining access as possible. Which action most directly supports that goal?

Accepted Answer

Administratively disable unused switch ports.. Administratively shutting down unused switch ports most directly supports the goal because it eliminates the access point entirely. Option B, converting unused ports into trunks, would actually increase risk by potentially allowing VLAN hopping and unauthorized traffic. Option D, removing VLAN assignments from active user ports, does not address unused ports and could disrupt legitimate users by forcing them into the default VLAN. Disabling unused ports is a simple and effective hardening measure that reduces attack surface.

Answer

Convert every unused port into a trunk.

Answer

Enable Telnet on unused ports for monitoring.

Answer

Remove all VLAN assignments from active user ports.

Question 9

Match each access-control term to its most accurate meaning.

Accepted Answer

Authentication: The process of verifying the identity of a user or device.. AAA is a framework for controlling access. Authentication verifies identity, authorization grants permissions, and accounting logs activities. Identification is the initial claim, and auditing is the review of logs.

Answer

Authorization: The process of verifying the identity of a user or device.

Answer

Accounting: The process of granting or denying access to network resources.

Answer

Identification: The process of logging and monitoring user activities.

Question 10

Why is centralized logging especially useful when combined with NTP?

Accepted Answer

Because synchronized clocks make centralized log timelines easier to analyze accurately.. Centralized logging is much more useful when device clocks are synchronized because the timestamps can be correlated properly. In practical terms, collecting messages in one place is valuable, but if one router thinks it is 9:00 and another thinks it is 9:17, the event sequence becomes confusing. NTP solves that time-alignment problem.

This is a common operations best practice. Syslog provides the central visibility, and NTP makes the timeline trustworthy.

Answer

Because NTP assigns the Syslog server its IP address.

Answer

Because Syslog replaces authentication when NTP is present.

Answer

Because centralized logging blocks unauthorized traffic automatically.

Question 11

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 12

Why is DHCP often preferred over manual addressing on larger user networks?

Accepted Answer

It automates host IP configuration and reduces manual effort and mistakes.. DHCP is often preferred because it automates host configuration and reduces both manual work and configuration mistakes. In practical terms, it is far easier to let endpoints receive addresses, masks, gateways, and DNS settings automatically than to configure each device by hand.

This improves scale, consistency, and operational efficiency. That is why DHCP is such a common service in enterprise access networks.

Answer

It replaces DNS completely.

Answer

It removes the need for default gateways.

Answer

It is required by all routing protocols.

Question 13

If a host has a valid IP address and subnet mask but no default gateway, what is the most likely result?

Accepted Answer

The host can usually reach only local-subnet destinations and not remote networks.. The host will normally reach local destinations but fail to reach remote networks. In practical terms, the subnet mask still lets the host identify what is local, but without a default gateway it has no next hop for off-subnet traffic. That means local ARP-based communication can still work, while remote communication usually fails.

This is a core host-configuration concept and a very common certification question. The missing gateway does not break all communication — it breaks off-subnet communication.

Answer

The host cannot use ARP at all.

Answer

The host automatically joins every subnet in the LAN.

Answer

The host becomes the default gateway for other devices.

Question 14

A company wants an internal web server to be reachable consistently from the Internet using one known public IPv4 address. Which NAT approach best fits that requirement?

Accepted Answer

Static NAT. Static NAT is the best fit because it creates a fixed one-to-one relationship between the inside server and the public address. In practical terms, outside clients need a stable public identity for the server. They cannot rely on a translated address that changes session by session. Static NAT gives that predictability.

This is different from PAT, which is designed for many inside users sharing fewer public addresses for outbound traffic. The question is about publishing a server, not conserving addresses for client browsing. That is why static NAT is the strongest answer.

Answer

PAT overload

Answer

No NAT, because private IPv4 addresses are publicly routable

Answer

DHCP relay

Question 15

Why is the combination of strong authentication and centralized logging better than either control by itself?

Accepted Answer

Authentication improves prevention, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate what happened across the environment. In practical terms, one control is stronger on prevention, and the other is stronger on visibility and accountability. Together they provide broader protection than either one alone.

This reflects a real security principle: mature security depends on layers of control, not one mechanism trying to do every job.

Answer

They are redundant because both perform exactly the same task.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for any event records.