CCNA Network Services and Security Practice Test 20 — 15 Questions

Question 1

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Accepted Answer

Configure spanning-tree mode rapid-pvst.. The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Answer

Increase the bridge priority on SW2 for VLAN 40.

Answer

Disable PortFast on all access ports.

Answer

Convert the uplink to a routed port.

Question 2

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

Accepted Answer

The ISP-B route has a lower administrative distance.. The route via ISP-B has a lower administrative distance, so it wins for the identical /24 prefix. For routes to the same destination and mask, the router compares AD before considering anything else between different route sources.

Answer

Static routes with a higher next-hop IP are preferred.

Answer

The router always prefers the route configured last.

Answer

The route names force policy-based routing.

Question 3

A controller-based WLAN uses 5 GHz in an open office. Clients keep disconnecting when users roam between APs, but signal strength remains strong. Based on the exhibit, what is the most likely problem?

Accepted Answer

A transmit power mismatch is creating asymmetric coverage around AP-3.. The APs are transmitting at much higher power than the clients, creating a coverage imbalance. Clients may hear the AP well enough to stay associated too long, while the AP cannot reliably hear the weaker client at the same cell edge. That leads to sticky-client and roaming issues even when RSSI looks strong.

Answer

The SSID must use 2.4 GHz only for roaming to work.

Answer

WPA2 cannot support roaming between APs.

Answer

The WLAN needs a different DHCP scope on each AP.

Question 4

A collector is not receiving flow records from a branch router. Based on the exhibit, what is the most likely issue?

Accepted Answer

The exporter source interface does not match what the collector expects.. The exporter is configured to send records out the wrong interface. NetFlow exports must use a source interface that has a valid path to the collector and typically matches the interface the collector expects. The collector IP itself is correct in the example, but the source interface selection is wrong.

Answer

The export destination port 2055 is invalid for flow export.

Answer

NetFlow can run only on serial interfaces.

Answer

The router must use TCP instead of UDP to export flows.

Question 5

A branch router is configured for NAT overload. The inside interface Gi0/0 is correctly marked ip nat inside, and the outside interface Gi0/1 is ip nat outside. The NAT statement uses access-list 1 permit 10.1.1.0 0.0.0.255 with ip nat inside source list 1 interface Gi0/1 overload. Inside hosts are in the 192.168.1.0/24 subnet and still reach the ISP with their private addresses. What is the most likely reason?

Accepted Answer

The ACL used for NAT does not match the inside client subnet.. The ACL matches the wrong inside subnet. NAT overload will only translate traffic that matches the source list or route map tied to the NAT statement. The interfaces are marked inside and outside correctly, so the bad match criteria is the most likely failure point.

Answer

GigabitEthernet0/0 should be configured as ip nat inside.

Answer

PAT cannot use an interface address as the translated source.

Answer

The router must run OSPF before NAT overload can function.

Question 6

Which two statements about standard and extended IPv4 ACLs are correct?

Accepted Answer

A standard ACL matches only the source IPv4 address.. Standard ACLs match only the source IPv4 address, while extended ACLs can match protocol and source and destination details including ports. Because standard ACLs are less granular, they are usually placed closer to the destination. Extended ACLs are usually placed closer to the source.

Answer

A standard ACL is normally placed as close to the source as possible.

Answer

An extended ACL cannot filter ICMP traffic.

Answer

Both ACL types require named ACL syntax to match traffic.

Question 7

Clients on a network can browse the internet by IP address but fail when using hostnames. What is the most likely problem?

Accepted Answer

The client is using the wrong DNS server address.. The client can browse by IP address but not by hostname, which indicates that IP connectivity and routing are functional, but name resolution is failing. Since DNS translates hostnames to IP addresses, the most likely fault is that the client is configured with an incorrect DNS server address, preventing it from resolving domain names.

Answer

The default gateway on the PC is incorrect.

Answer

NAT overload is failing on the edge router.

Answer

The switchport must be converted to a routed port.

Question 8

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.

Answer

Root Guard

Answer

Loop Guard

Answer

PortFast

Question 9

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

Accepted Answer

The switches are using different EtherChannel negotiation protocols.. The two switches are using different negotiation protocols: LACP (active) on one side and PAgP (desirable) on the other. EtherChannel requires both sides to use the same protocol, so this protocol mismatch prevents the bundle from forming. The other settings—trunking, VLAN configuration, and channel-group number—are correctly configured and do not cause the failure.

Answer

A Layer 2 EtherChannel cannot carry trunk links.

Answer

The channel-group number must be different on each switch.

Answer

The member interfaces must be in access mode before the bundle can form.

Question 10

A network team wants all devices to timestamp logs consistently so event correlation works across routers, switches, and firewalls. Which service should they configure first?

Accepted Answer

NTP. NTP provides consistent time across the infrastructure. Syslog carries log messages, but if device clocks are wrong, the log entries will still be hard to correlate. Accurate time is a foundational service for troubleshooting and forensics.

Answer

DNS

Answer

DHCP

Answer

TFTP

Question 11

Match each security concept to its description.

Accepted Answer

AAA (Authentication, Authorization, and Accounting). Authentication is the process of verifying that the user or device is who they claim to be, which matches 'Verifies identity'. Authorization determines what actions an authenticated entity is allowed to perform, matching 'Determines permitted actions'. Accounting tracks and records the activities of authenticated users, corresponding to 'Records activity'. Least privilege grants only the minimum access needed for a task, aligning with 'Grants only required access'. These are foundational security principles for access control.

Answer

ACL (Access Control List)

Answer

Port Security

Answer

DHCP Snooping

Question 12

An engineer applies this command on an access interface connected to a user PC: switchport port-security violation restrict. What happens if a second unauthorized MAC address appears on the port?

Accepted Answer

Frames from the unauthorized MAC are dropped and the violation is counted while the port stays up.. With restrict mode, the switch drops frames from the violating MAC, increments the violation counter, and can generate notifications. Unlike shutdown mode, the interface stays up. Unlike protect mode, the switch records the violation.

Answer

The port immediately goes err-disabled.

Answer

The switch forwards the traffic but logs a warning.

Answer

The port transitions to listening and learning states.

Question 13

Match each HTTP method to its common REST API action.

Accepted Answer

GET - Retrieve data. GET retrieves data; POST creates; PUT replaces; PATCH partially updates; DELETE removes; OPTIONS queries available methods.

Answer

GET - Create data

Answer

POST - Retrieve data

Answer

PUT - Partially update data

Question 14

R1 receives an OSPF route to 10.55.0.0/16 and already has a static route to 10.55.10.0/24. Which route will be used for traffic sent to 10.55.10.25?

Accepted Answer

The static /24 route, because it is the longest-prefix match.. The static /24 route is more specific than the OSPF /16 route, so longest-prefix match wins. Administrative distance is only compared among routes to the same prefix length.

Answer

The OSPF /16 route, because dynamic routes override static routes learned later.

Answer

Both routes equally, because they point to the same major network.

Answer

Neither route, because overlapping routes are invalid.

Question 15

Which STP role identifies the port on a non-root switch that has the best path back to the root bridge?

Accepted Answer

Root port. The root port is the single port on a non-root switch that provides the lowest-cost path toward the root bridge. Designated ports forward away from the root for a segment, and alternate ports are backup paths.

Answer

Designated port

Answer

Alternate port

Answer

Disabled port

CCNA Network Services and Security Practice Test 20 — 15 Questions

Exhibit

CCNA Network Services and Security Practice Test 20 — 15 Questions

Exhibit