CCNA Network Services and Security Practice Test 21 — 15 Questions

Question 1

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on the trunk.. The trunk allows only VLANs 10 and 20, so VLAN 30 traffic never crosses the uplink. Local switching inside VLAN 30 on the access switch can still work, which is why same-VLAN communication succeeds. Adding VLAN 30 to the allowed list is the direct fix.

Answer

The user ports should be configured as trunks.

Answer

The SVI for VLAN 30 must be shutdown for inter-VLAN routing to work.

Answer

The trunk native VLAN must be changed to VLAN 30.

Question 2

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

Accepted Answer

ip helper-address 172.16.1.10. When DHCP clients and the DHCP server are on different subnets, the router interface serving the client subnet must relay broadcasts to the server with the ip helper-address command.

Answer

ip dhcp excluded-address 10.40.40.1 10.40.40.10

Answer

service dhcp

Answer

ip default-gateway 172.16.1.10

Question 3

An administrator wants an access-layer interface to shut down immediately if another switch is connected accidentally. Which feature best meets that requirement?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports. If the port receives a BPDU, the switch treats that as a sign that another switch has been connected and places the interface into an err-disabled state to protect the spanning-tree topology.

Answer

Root Guard

Answer

PortFast

Answer

Loop Guard

Question 4

An engineer configures NAT overload on a router for inside users. Which resource is primarily used to let many internal hosts share one public IPv4 address?

Accepted Answer

TCP and UDP port numbers. PAT distinguishes sessions by using Layer 4 port numbers. That is what allows many inside devices to use the same outside IP address at the same time without conflicting with each other.

Answer

IPv6 extension headers

Answer

Different source MAC addresses on the WAN

Answer

Separate routing tables per client

Question 5

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Accepted Answer

NTP. Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Answer

DNS

Answer

SNMP

Answer

CDP

Question 6

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Accepted Answer

Move it outbound on the WAN-facing interface closer to the destination. A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Answer

Leave it inbound on the LAN because standard ACLs belong near the source

Answer

Convert it to a VTY access-class

Answer

Apply it inbound on all switch access ports

Question 7

Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?

Accepted Answer

DNS. The client has IP connectivity because it can reach 8.8.8.8 directly. The problem appears only when using a hostname, which points to a DNS resolution issue rather than a routing issue.

Answer

NTP

Answer

DHCP snooping

Answer

HSRP

Question 8

An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?

Accepted Answer

Extended ACL. A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.

Answer

Named standard ACL

Answer

Prefix list

Answer

MAC access-list

Question 9

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Accepted Answer

No ACL and nat overload statement identifying inside source addresses. PAT needs both the inside and outside interface roles and a NAT statement referencing an ACL that identifies the inside local addresses. Without the ACL match and NAT overload rule, translation does not occur for user traffic.

Answer

No DHCP pool on the outside interface

Answer

No CDP enabled on the router

Answer

No syslog server configured

Question 10

Exhibit: A collector is receiving traffic metadata from a router, including source IP, destination IP, protocol, and byte counts. Which feature is being used?

Accepted Answer

NetFlow. NetFlow exports flow records that summarize traffic conversations. It does not carry full packet payloads, but it does provide useful metadata for analysis and capacity planning.

Answer

Syslog

Answer

SNMP trap

Answer

NTP

Question 11

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

Accepted Answer

DNS. DNS maps hostnames to IP addresses, which is the first step when a user enters a URL. DHCP assigns IP addresses, NTP synchronizes time, and Syslog handles logging—none of these services resolve domain names to IP addresses. The web session itself uses HTTP or HTTPS later, but name resolution happens first.

Answer

DHCP

Answer

NTP

Answer

Syslog

Question 12

Which ACL statement permits only SSH from host 10.10.10.50 to server 192.168.1.10?

Accepted Answer

permit tcp host 10.10.10.50 host 192.168.1.10 eq 22. SSH uses TCP destination port 22. The source is the single host 10.10.10.50 and the destination is the single host 192.168.1.10.

Answer

permit udp host 10.10.10.50 host 192.168.1.10 eq 22

Answer

permit tcp any host 192.168.1.10 eq 22

Answer

permit ip host 10.10.10.50 host 192.168.1.10

Question 13

Match each network service to its primary purpose.

Accepted Answer

DNS - Resolves domain names to IP addresses. DNS resolves human-readable hostnames to IP addresses, enabling users to access websites by name. DHCP automatically assigns IP addresses, subnet masks, default gateways, and other parameters to clients, simplifying network configuration. NTP synchronizes clocks across network devices to ensure consistent timestamps for logs and transactions. Syslog sends event messages from network devices to a central logging server for monitoring and troubleshooting.

Answer

DNS - Assigns IP addresses to devices dynamically

Answer

DNS - Provides secure remote access to network devices

Answer

DNS - Manages network devices via SNMP

Question 14

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

Accepted Answer

The interfaces are marked with inside and outside in the wrong places. NAT overload works only when the inside and outside interfaces are identified correctly. Here the roles are reversed, so translations are not built in the right direction.

Answer

The ACL should deny 192.168.20.0/24 instead of permit it

Answer

PAT cannot be used with a /30 WAN link

Answer

NAT overload requires a route-map instead of an ACL

Question 15

Exhibit: After PAT is configured, inside users can browse the internet, but the engineer wants to verify that translations are actually being created. Which command is the best choice?

Accepted Answer

show ip nat translations. The NAT translation table shows the inside local and inside global addresses and confirms whether active translations are being built.

Answer

show access-lists

Answer

show ip route

Answer

debug ip packet detail