CCNA Network Services and Security Practice Test 21 — 15 Questions

Question 1

A user reports that websites can be opened by IP address but not by hostname. Which service is the strongest suspect?

Accepted Answer

DNS. DNS is the strongest suspect because the network path clearly works at the IP layer. In practical terms, if the user can reach the site by numeric address, then routing and basic connectivity are functioning. The missing piece is name resolution, and that is exactly what DNS provides.

This is one of the clearest troubleshooting patterns in networking. If names fail but IP works, start with DNS.

Answer

STP

Answer

PAT

Answer

Port security

Question 2

A branch office uses PAT for user Internet access. The administrator notices that inside users can browse out, but an internal server still cannot be reached consistently from outside. Which change is most appropriate?

Accepted Answer

Add a static NAT mapping for the server while leaving PAT in place for user traffic.. The most appropriate change is to add a static NAT mapping for the internal server while keeping PAT for ordinary user traffic. In practical terms, PAT solves the many-users-outbound problem by allowing shared use of a public address. But an inbound-published server needs a stable, predictable public identity. That requirement is different from the requirement for user browsing.

This is a common NAT design distinction. PAT and static NAT can coexist because they solve different problems. The best answer is the one that preserves PAT for users while giving the server a fixed public translation.

Answer

Replace PAT with DHCP relay.

Answer

Disable NAT entirely because PAT is preventing inbound routing.

Answer

Put the server in the native VLAN.

Question 3

A host can reach other devices on its local subnet, but it cannot reach remote networks. The host has a valid IP address and subnet mask. Which missing item is the strongest suspect?

Accepted Answer

Default gateway information. The strongest suspect is a missing default gateway. In practical terms, the host can still identify and reach local addresses because it has its own IP and subnet mask. But without a default gateway, it has no next hop for destinations outside the local subnet. That is why local communication works while remote communication fails.

This is one of the most common host-configuration troubleshooting patterns on the exam and in real networks.

Answer

STP priority information

Answer

A voice VLAN setting

Answer

An OSPF process ID

Question 4

Why is shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

Because it removes unused active connection points and reduces attack surface.. Shutting down unused switch ports reduces attack surface by removing unnecessary active connection points. This is a simple but effective control because it eliminates the risk of unauthorized physical access. Option B is incorrect because disabling a port does not change its mode to trunk; trunking is a separate configuration. Option C is incorrect because shutting down ports does not replace VLAN segmentation; VLANs provide logical separation, while port shutdown is a physical access control. Option D is incorrect because shutting down ports does not force devices to use SSH; SSH is an application-layer protocol for secure remote management, unrelated to port shutdown.

Answer

Because it converts all other ports into trunks.

Answer

Because it replaces VLAN segmentation.

Answer

Because it forces devices to use SSH.

Question 5

Which NAT design is most appropriate when many inside users need outbound Internet access through one public IPv4 address, but no inbound server publishing is required?

Accepted Answer

PAT overload. The most appropriate design is PAT overload. In practical terms, many internal users can share one public IPv4 address because PAT distinguishes their sessions using transport-layer ports. This is the most common solution when the requirement is outbound access for many clients rather than predictable inbound access to a specific internal server.

Static NAT would be the wrong design here because it creates fixed one-to-one mappings and consumes more public address space than needed for this use case. PAT is specifically built for many-to-one outbound translation.

Answer

Static NAT for every host

Answer

No NAT, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 6

Which two statements accurately describe DHCP?

Accepted Answer

It can automatically provide an IP address to a client.. Option A is correct because DHCP (Dynamic Host Configuration Protocol) automatically leases an IPv4 address to a client from a configured pool using the DORA process (Discover, Offer, Request, Acknowledge). Option B is correct because DHCP options, such as option 3 (default gateway/router) and option 6 (DNS servers), deliver additional configuration parameters alongside the IP address, subnet mask, and lease time. Option C is incorrect because hostname-to-IP resolution is performed by DNS, not DHCP. Option D is incorrect because OSPF elects a Designated Router (DR) and Backup Designated Router (BDR) via hello packets and priority values, which is unrelated to DHCP. Option E is incorrect because DHCP still supplies a subnet mask (option 1) as part of the lease; it does not eliminate the need for subnet masks.

Answer

It resolves hostnames into IP addresses.

Answer

It elects the designated router in OSPF.

Answer

It replaces the need for subnet masks.

Question 7

A host receives a correct IP address and subnet mask from DHCP but still cannot reach remote networks. Local subnet communication works. Which missing DHCP option is the strongest suspect?

Accepted Answer

Default gateway information. The strongest suspect is the default gateway option. In practical terms, the host can already identify local destinations because the subnet mask is present. That is why local communication still works. What it does not have is the next hop needed for off-subnet traffic. Without a default gateway, remote communication usually fails.

This is a very common host-troubleshooting scenario. It separates basic local addressing from the additional information required for off-subnet reachability.

Answer

An STP root bridge ID

Answer

A voice VLAN value

Answer

A router ID

Question 8

Users on the inside network can browse the Internet through PAT, but an internal web server must now be reachable from outside on a predictable public IP. Which change best fits the requirement?

Accepted Answer

Add static NAT for the server and continue using PAT for user browsing.. The best change is to add a static NAT mapping for the internal web server while keeping PAT in place for ordinary users. In practical terms, PAT is excellent for many internal clients sharing one public address for outbound traffic, but it does not give an internal server the stable one-to-one public identity that outside clients expect for predictable inbound access.

This is a standard NAT design distinction. User browsing and published server access are different requirements, and the best design often uses PAT for one and static NAT for the other.

Answer

Replace PAT entirely with DHCP relay.

Answer

Disable NAT because the server already has a private address.

Answer

Move the server into the native VLAN.

Question 9

Why is administratively shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

It reduces the attack surface by removing unnecessary network entry points.. Unused active ports create unnecessary opportunity for unauthorized connection. Disabling them reduces the attack surface and makes opportunistic access much harder. Option B is incorrect because administratively shutting down a port does not increase backplane bandwidth; bandwidth is a fixed hardware characteristic. Option C is incorrect because shutting down ports does not enable 802.1Q trunking; trunking is configured separately. Option D is incorrect because port security must be explicitly enabled; it is not activated automatically by shutting down ports.

Answer

It increases available bandwidth on the switch backplane.

Answer

It enables 802.1Q trunking on all remaining ports.

Answer

It forces port security to activate automatically.

Question 10

Why does DNS make networks easier for people to use?

Accepted Answer

It lets people use memorable names instead of raw IP addresses.. DNS makes networks easier to use because it lets people work with names instead of memorizing numeric IP addresses. In practical terms, users can remember a server name much more easily than a string of numbers. DNS creates that naming layer while the network still uses IP underneath.

This usability benefit is one of the main reasons DNS is so important in everyday network operations.

Answer

It assigns IP addresses automatically.

Answer

It replaces the need for default gateways.

Answer

It elects the root bridge for STP.

Question 11

Why is NTP especially valuable when a company uses a centralized Syslog server?

Accepted Answer

It synchronizes device clocks so centralized log timestamps can be correlated accurately.. NTP is especially valuable because it aligns device clocks, which makes centralized log timestamps much easier to interpret. In practical terms, if devices disagree on time, the combined log stream becomes harder to trust and correlate. NTP improves the timeline accuracy of operational and security analysis.

This is why NTP and Syslog are often discussed together. One centralizes events, and the other makes those events easier to line up correctly.

Answer

It assigns the Syslog server its IP address.

Answer

It replaces the need for Syslog entirely.

Answer

It encrypts all Syslog messages automatically.

Question 12

Match each operations or assurance technology to its most accurate purpose.

Accepted Answer

NetFlow - Flow analysis; SNMP - Device management; Syslog - Logging; IP SLA - Performance measurement; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring. Each technology serves a specific assurance purpose: Syslog provides centralized event and message reporting, SNMP enables monitoring and management information exchange, NetFlow offers visibility into traffic flows and conversations, and NTP ensures clock synchronization for consistent timing across network devices.

Answer

NetFlow - Device management; SNMP - Flow analysis; Syslog - Performance measurement; IP SLA - Logging; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Logging; SNMP - Performance measurement; Syslog - Flow analysis; IP SLA - Device management; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Performance measurement; SNMP - Logging; Syslog - Device management; IP SLA - Flow analysis; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring

Question 13

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`.

This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 14

A network team wants visibility into which flows are consuming the most bandwidth between internal subnets. Which technology is most directly associated with that goal?

Accepted Answer

NetFlow. NetFlow provides visibility into traffic flows, allowing administrators to identify which flows (e.g., between internal subnets) are consuming the most bandwidth by showing source/destination, protocols, and traffic volume. Syslog only records system logs and events, not flow-level data. DHCP relay forwards DHCP broadcasts across subnets but offers no traffic analysis. PortFast is an STP optimization that speeds up port transition to forwarding; it does not monitor bandwidth usage.

Answer

Syslog

Answer

DHCP relay

Answer

PortFast

Question 15

Match each security concept to its most accurate meaning.

Accepted Answer

Phishing: A social engineering attack that tricks users into revealing sensitive information such as usernames and passwords.. In this matching exercise, each security concept is paired with its correct definition. Phishing is a social engineering attack using deceptive emails or messages to trick users into revealing sensitive information. Ransomware is malware that encrypts data and demands payment for decryption. DDoS (Distributed Denial-of-Service) overwhelms a target with traffic from multiple sources to disrupt service. Man-in-the-Middle (MitM) intercepts communication between two parties. SQL Injection inserts malicious SQL queries into input fields to manipulate databases. Zero-Day Exploit attacks a previously unknown vulnerability. The correct pairs are as given.

Answer

Phishing: A type of malware that encrypts files and demands payment for decryption.

Answer

Phishing: An attack that overwhelms a network with traffic to disrupt services.

Answer

Phishing: An attack that intercepts communications between two parties to steal data.