CCNA Network Services and Security Practice Test 21 — 15 Questions

Question 1

A router allows SSH management from anywhere on the internal network. A new policy requires that only the management subnet 10.50.50.0/24 be allowed to initiate SSH to the device. Which approach best enforces that requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restrict SSH access so only the 10.50.50.0/24 management subnet is permitted. The best approach is to use an access control mechanism that limits SSH access to the approved source subnet. In practical terms, SSH is the correct secure protocol, but protocol choice alone is not enough. The device should also restrict who is allowed to reach that management service. That usually means applying an ACL or equivalent source restriction focused on the management subnet.

This is a common management-plane security pattern: use a secure protocol, then limit the set of trusted sources that are allowed to use it.

Answer

Replace SSH with Telnet so the traffic is easier to identify

Answer

Enable PortFast on all access switches

Answer

Raise the Syslog severity threshold

Question 2

Match each service or visibility technology to the most appropriate use case.

Accepted Answer

SNMP for device metrics, NetFlow for traffic analysis, Syslog for logs, IP SLA for performance measurement, Wireshark for packet analysis, Nmap for discovery and security.. Syslog collects device events and messages centrally, providing a centralized log repository. SNMP reads interface status and counters from devices, offering real-time device monitoring. NetFlow analyzes network traffic to identify bandwidth usage by host, making it ideal for finding top talkers. NTP synchronizes clocks across systems to maintain consistent event timelines. Each technology is matched to its primary use case.

Answer

SNMP for traffic analysis, NetFlow for device metrics, Syslog for performance measurement, IP SLA for logs, Wireshark for discovery and security, Nmap for packet analysis.

Answer

SNMP for logs, NetFlow for performance measurement, Syslog for device metrics, IP SLA for traffic analysis, Wireshark for discovery and security, Nmap for packet analysis.

Answer

SNMP for performance measurement, NetFlow for logs, Syslog for device metrics, IP SLA for traffic analysis, Wireshark for discovery and security, Nmap for packet analysis.

Question 3

A team wants to know which internal hosts are sending the most traffic to a specific data center subnet. Which technology is most directly associated with that visibility goal?

Accepted Answer

NetFlow. NetFlow is the best fit because it provides visibility into traffic flows and conversations. In practical terms, it helps answer questions like who is talking to whom, over which protocols and ports, and how much traffic is being exchanged. That makes it useful for capacity, troubleshooting, and unusual-traffic analysis.

This is different from Syslog, which reports device events, and from general SNMP polling, which focuses more on device and interface counters.

Answer

Syslog

Answer

DHCP

Answer

PortFast

Question 4

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

Accepted Answer

NetFlow. NetFlow provides conversation-level visibility into which hosts and applications are consuming bandwidth, closing the gap left by SNMP's interface totals. A new DHCP scope assigns IP addresses but offers no traffic insight. An STP priority manages loop-free topology and does not affect monitoring. A larger OSPF metric influences routing path selection, not traffic analysis.

Answer

Another DHCP scope

Answer

A new STP priority

Answer

A larger OSPF metric

Question 5

Which two statements accurately describe good management-plane security practice on network devices?

Accepted Answer

Use secure management protocols such as SSH instead of less secure remote-access methods.. Good management-plane security combines multiple layers of control. In practical terms, using secure protocols such as SSH is important, but so is restricting which sources may connect, controlling who is authorized, and maintaining visibility into administrative activity. Strong management security is not usually one setting by itself.

This is a layered-control question rather than a single-technology question.

Answer

Prefer shared generic admin accounts for convenience.

Answer

Disable all logging to reduce device workload.

Answer

Rely only on SSID names to protect router management.

Question 6

An administrator wants to prevent a specific subnet from using Telnet to reach network devices, while still allowing SSH from that same subnet. What is the strongest reason a standard ACL is not enough by itself?

Accepted Answer

Because the policy must distinguish Telnet from SSH, which requires protocol or port-level matching.. A standard ACL is not enough by itself because the policy depends on distinguishing different protocols or destination ports, not just source address. In practical terms, the source subnet is the same for both Telnet and SSH. The ACL therefore needs to tell those two management protocols apart, which requires more granular matching than source-only logic.

This is one of the clearest examples of why extended ACL capability matters.

Answer

Because standard ACLs are valid only on wireless networks.

Answer

Because Telnet and SSH always use the same destination port.

Answer

Because SSH can never be filtered with ACLs.

Question 7

A security team wants device administrators to log in with individual named accounts instead of sharing one generic admin account. Which security objective does that most directly improve?

Accepted Answer

Accountability for administrative actions. It most directly improves accountability. In practical terms, when each administrator has an individual account, the organization can tie actions to specific people rather than to one shared identity. That makes investigation, auditing, and operational review much more meaningful.

This also supports better access-control hygiene overall, but the clearest direct benefit is being able to identify who actually performed an administrative action.

Answer

Automatic VLAN assignment for management traffic

Answer

Route summarization efficiency

Answer

Wireless roaming performance

Question 8

Match each security control or idea to its most accurate purpose.

Accepted Answer

Firewall: Filters traffic based on security rules. A firewall controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks. Option A correctly describes this function. Option B, detecting and alerting on suspicious activity, is the role of an Intrusion Detection System (IDS). Option C, preventing and blocking intrusions in real time, is the function of an Intrusion Prevention System (IPS). Option D, authenticating users and managing access rights, pertains to AAA (Authentication, Authorization, and Accounting) frameworks.

Answer

Firewall: Detects and alerts on suspicious activity

Answer

Firewall: Prevents and blocks intrusions in real time

Answer

Firewall: Authenticates users and manages access rights

Question 9

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

Accepted Answer

Use the narrowest possible match so only the intended traffic is denied.. The most important principle is to write the ACL as narrowly as possible so it matches only the unwanted traffic and does not overblock unrelated traffic. In practical terms, the rule should target the specific destination and service being denied rather than using a broader deny that unintentionally blocks other communication.

This is a precision-and-scope question. Good ACL design is as much about what you avoid blocking as what you intend to block.

Answer

Always deny all IP traffic to the destination subnet first.

Answer

Use a standard ACL because destination details never matter.

Answer

Place the ACL only where no routing exists.

Question 10

Which two statements accurately describe common uses of NTP in network operations?

Accepted Answer

It helps align device clocks across the network.. NTP is widely used to keep device clocks aligned, which improves the reliability of event timelines and log correlation because timestamps from different systems can be compared meaningfully. NTP does not replace Syslog, assign IP addresses (DHCP), or provide WLAN encryption; those are separate functions. Its sole purpose is time synchronization.

Answer

It replaces the need for Syslog.

Answer

It assigns IP addresses to hosts.

Answer

It provides WLAN encryption.

Question 11

A monitoring system already collects Syslog and SNMP data. The network team now wants visibility into which applications or host conversations are driving link utilization. What is the strongest addition?

Accepted Answer

NetFlow. The strongest addition is NetFlow because it provides traffic-flow visibility. In practical terms, Syslog and SNMP are useful, but they do not directly answer detailed conversation-level questions such as which hosts, protocols, or flows are consuming the most bandwidth. NetFlow is designed to answer exactly that kind of question.

This is about choosing the right operational tool for the visibility gap.

Answer

Another SSID

Answer

PortFast

Answer

A larger wildcard mask

Question 12

Which two statements accurately describe why NetFlow is useful for operations teams?

Accepted Answer

It helps identify which conversations or applications contribute to link utilization.. NetFlow is useful because it helps teams move beyond simple interface utilization and see which traffic conversations are responsible for usage. In practical terms, it can reveal which hosts, protocols, or applications are contributing to the traffic profile, making it valuable for troubleshooting, capacity planning, and security investigations. Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog; Syslog provides device event logging while NetFlow provides traffic flow data, and both tools complement each other in network operations.

Answer

It replaces the need for all routing protocols.

Answer

It is the main wireless encryption protocol for guest access.

Answer

It eliminates the usefulness of Syslog.

Question 13

Users can reach an internal server by IP address but not by hostname. What is the most likely cause?

Accepted Answer

Name resolution is failing even though IP connectivity to the server works.. The strongest explanation is a DNS problem rather than a raw IP connectivity problem. In practical terms, successful access by IP address shows that Layer 3 reachability to the server exists. Failure only when using the hostname strongly suggests name resolution is missing, incorrect, or unavailable.

This is a classic symptom-based troubleshooting question. The network path works, but the naming service does not.

Answer

The server must be in the wrong VLAN because IP works.

Answer

The default gateway is missing on the client.

Answer

A GRE tunnel is required for hostname access.

Question 14

Which two statements accurately describe why SSH is preferred over Telnet for device administration?

Accepted Answer

SSH is generally considered the more secure choice for remote CLI administration.. SSH is preferred because it encrypts all traffic, including authentication credentials, making it secure for remote CLI administration, whereas Telnet transmits data in plaintext and is considered less secure. Option C is incorrect because SSH does not eliminate authentication; it requires authentication and often enforces stronger policies. Option D is false because SSH and Telnet are independent protocols; Telnet is not required for SSH to operate. Option E is wrong because SSH is used on routers, switches, firewalls, and many other devices, not only wireless controllers.

Answer

SSH eliminates the need for authentication and authorization policy.

Answer

Telnet is required before SSH can operate.

Answer

SSH is used only on wireless controllers and nowhere else.

Question 15

A switch is configured with DHCP snooping and Dynamic ARP Inspection. Hosts suddenly lose connectivity after changing IP settings manually. Which explanation is strongest?

Accepted Answer

DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.. DAI uses DHCP snooping binding to validate ARP messages; a manual IP change creates a mismatch, causing DAI to block ARP. Option B is incorrect because STP prevents loops and does not block based on MAC address changes. Option C is incorrect because OSPF authentication is a routing protocol feature irrelevant on an access port. Option D is incorrect because PPP authentication applies to serial links, not Ethernet ARP.

Answer

STP is blocking the host because its MAC address changed.

Answer

OSPF authentication failed on the access port.

Answer

The switch requires PPP authentication before allowing ARP traffic.