CCNA Network Services and Security Practice Test 22 — 15 Questions

Question 1

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

Accepted Answer

Authorization. Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce.

This is a good example of why authentication and authorization are not the same thing.

Answer

Authentication

Answer

Accounting

Answer

DNS

Question 2

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Accepted Answer

Users often access services by name, so failed name resolution can feel like total connectivity loss.. DNS issues can look like general connectivity problems because many users think in terms of names, not IP addresses. In practical terms, they may report that 'the network is down' when the actual routed path works but hostname resolution does not. That is why testing by IP versus name is such a useful troubleshooting step.

The distinction between transport reachability and naming is critical in user-facing support.

Answer

DNS failure automatically means the default gateway is missing.

Answer

If DNS fails, DHCP and NTP must also fail immediately.

Answer

DNS replaces the need for routing between subnets.

Question 3

Which two statements accurately describe why logs and accounting records both matter in secure operations?

Accepted Answer

They improve visibility into events and activity after access occurs.. Logs and accounting records both matter because security is not only about preventing access, but also about understanding what happened. In practical terms, logs can provide event visibility and system context, while accounting records can add traceability for user activity and access sessions. Together they improve incident review and operational accountability.

This is a visibility-and-traceability question, not a pure prevention question.

Answer

They replace the need for authentication entirely.

Answer

They are useful only on wireless guest networks.

Answer

They automatically create access policies for administrators.

Question 4

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

Accepted Answer

Because secure transport alone does not remove the need for source restriction and accountability controls.. The decision reflects defense in depth. SSH encrypts the session and authenticates users, but it does not limit which source IPs can connect or provide audit trails. Source IP restriction reduces the attack surface by allowing only trusted hosts, and logging provides accountability and forensic evidence. Option B is incorrect because SSH is more secure than Telnet, not less. Option C is incorrect because logs record events but do not enforce ACLs. Option D is incorrect because source IP restriction complements authentication rather than replacing it.

Answer

Because SSH is less secure than Telnet and must be compensated for.

Answer

Because logs automatically enforce ACL policy.

Answer

Because source IP restriction replaces the need for authentication.

Question 5

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

Accepted Answer

ip helper-address 10.99.99.20 under interface Vlan30. The correct fix is to add an IP helper address pointing to the remote DHCP server on the Layer 3 interface for VLAN 30. In practical terms, the clients are sending DHCP discovery as a broadcast, and the server is on another subnet. The SVI for VLAN 30 is the local gateway that must relay those requests toward the server.

This is one of the most exam-realistic campus troubleshooting scenarios because it tests both subnet boundaries and the role of the local gateway interface.

Answer

switchport mode trunk under interface Vlan30

Answer

ip default-gateway 10.99.99.20 under interface Vlan30

Answer

spanning-tree portfast under interface Vlan30

Question 6

Based on the exhibit, what is the most likely reason PAT is not working correctly?

Accepted Answer

The inside and outside NAT interface roles are reversed.. PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction.

This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.

Answer

PAT requires OSPF to be enabled on the WAN link.

Answer

The ACL must be numbered 100 instead of 1.

Answer

The router must use GRE before PAT can overload.

Question 7

Which two statements accurately describe the purpose of least privilege in administration and operations?

Accepted Answer

It limits users and administrators to the permissions they actually need.. Least privilege is about limiting access to what is actually needed. In practical terms, it reduces unnecessary exposure and helps contain the impact of mistakes, misuse, or compromised accounts. It is not about refusing all access. It is about granting enough access to do the job, but not more than that.

This is a central principle in secure administration and role design.

Answer

It means no administrator should ever have any configuration access.

Answer

It replaces the need for logging and accounting.

Answer

It exists only on wireless guest networks.

Question 8

An administrator needs to configure an ACL to block HTTP traffic from subnet 10.10.10.0/24 to the web server at 172.16.1.10 while permitting all other traffic. Which ACL entry should be placed first?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The ACL needs a narrow deny statement that matches only TCP port 80 from the specified source subnet to the specific server. In practical terms, the requirement is not to block all IP traffic or all access to the host. It is to stop normal HTTP while allowing everything else. That means the entry must be precise.

This is the kind of ACL question the CCNA exam likes because it forces you to distinguish protocol, destination, and service rather than relying on vague source-only logic.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 9

Based on the exhibit, what is the strongest explanation for why clients can browse by IP address but not by hostname?

Accepted Answer

Name resolution is failing even though IP connectivity works.. The strongest explanation is a DNS failure or DNS configuration problem. In practical terms, successful browsing by IP address shows that the client can already reach the destination over the network path. When the same service fails only by hostname, the issue is much more likely in name resolution than in routing, switching, or raw connectivity.

This is one of the most useful support patterns because it quickly separates path problems from naming problems.

Answer

The client has the wrong default gateway.

Answer

The switch trunk native VLAN is wrong.

Answer

The server must run PPP before hostnames can work.

Question 10

Based on the exhibit, why is the ACL not meeting the requirement to block only HTTPS traffic to the server?

Accepted Answer

Because the ACL entry is too broad and blocks all IP traffic to the host.. The ACL fails because it uses 'deny ip' which blocks all IP traffic to the server, not just HTTPS. To block only HTTPS, the ACL should match TCP port 443 with 'deny tcp eq 443'. Option B is wrong because HTTPS uses TCP, not UDP. Option C is wrong because extended ACLs (not standard) are required to filter by port. Option D is wrong because a host destination is perfectly valid in extended ACLs; a wildcard subnet is not required.

Answer

Because HTTPS uses UDP, not TCP.

Answer

Because standard ACLs are required for HTTPS filtering.

Answer

Because the destination must always be a wildcarded subnet, not a host.

Question 11

Which two statements accurately describe the value of source restriction on administrative access?

Accepted Answer

It reduces the set of network locations from which administrative access is allowed.. Source restriction improves security by reducing the number of places from which administrative traffic is expected and permitted. In practical terms, this makes exposure smaller and monitoring clearer. It does not replace secure protocols or identity controls, but it strengthens the overall design.

This is a layered-management-security question because it emphasizes how source restriction complements other controls.

Answer

It removes the need for SSH or other secure transports.

Answer

It makes logging unnecessary.

Answer

It can be used only for wireless management.

Question 12

Which two statements accurately describe why least privilege and source restriction work well together for administrative access?

Accepted Answer

Least privilege reduces the scope of actions an authenticated user can perform.. Least privilege and source restriction work well together because they reduce risk in different ways. In practical terms, least privilege limits what a user can do after access is granted, while source restriction reduces where an administrative session is even allowed to originate. Together they reduce both exposure and potential impact.

This is a layered management-security concept and a strong exam-style reasoning item.

Answer

Either one by itself removes the need for logging.

Answer

Both exist only for wireless guest access policies.

Answer

They require all administrative traffic to use PPP encapsulation.

Question 13

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

Accepted Answer

Authentication succeeded, but authorization limits the user's command access.. The situation is best explained by authorization controls. In practical terms, authentication confirms who the user is, but authorization determines what that user can do after login. A successful login followed by restricted command access means the identity is valid but the permission set is limited.

This is one of the most important practical distinctions within AAA.

Answer

The device lost all routing information after login.

Answer

The subnet mask on the user workstation is incorrect.

Answer

Syslog is blocking the commands for security reasons.

Question 14

Based on the exhibit, why is the ACL blocking more traffic than intended?

Accepted Answer

Because the ACL denies all TCP traffic to the server instead of only Telnet.. The ACL is blocking more traffic than intended because it uses a broad deny against all TCP traffic to the server instead of only the one service that should be denied. In practical terms, the requirement is narrow, but the configured entry is much wider. As a result, multiple TCP-based applications to that server are blocked, not just the intended one.

This is a classic precision problem in ACL design. It tests whether you can compare what the business requirement says against what the ACL actually matches.

Answer

Because Telnet uses UDP, not TCP.

Answer

Because the ACL should be a standard ACL, not an extended ACL.

Answer

Because the host keyword can never be used with TCP statements.

Question 15

Based on the exhibit, why does the ACL still allow HTTPS traffic from the branch subnet to the server?

Accepted Answer

The ACL blocks TCP port 80 instead of TCP port 443.. The ACL still allows the HTTPS traffic because the deny statement is matching TCP port 80, not TCP port 443. In practical terms, the entry blocks HTTP, not HTTPS. Since the requirement is specifically to block encrypted web traffic on TCP 443, the current line is aimed at the wrong service.

This is a good precision question because it tests whether the candidate pays attention to the exact destination port rather than just seeing a generic web-related deny.

Answer

HTTPS uses UDP port 443, so TCP matching can never work.

Answer

The ACL must deny all IP traffic to the server to stop HTTPS.

Answer

ACLs cannot filter by destination port when a host keyword is used.