CCNA Network Services and Security Practice Test 22 — 15 Questions

Question 1

A client receives an IP address but cannot reach remote networks. Which DHCP option is most likely missing or incorrect?

Accepted Answer

Default gateway option. The client can obtain an IP address but cannot reach remote networks, which indicates that the DHCP server is not providing the default gateway (option 3). Without a default gateway, the client has no route to destinations outside its local subnet, so traffic to remote networks is dropped. The DHCP server must be configured to supply the router's IP address as the default gateway for clients to forward inter-network traffic.

Answer

DNS server option

Answer

Lease time option

Answer

TFTP server option

Question 2

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

Accepted Answer

The ACL should match the source port 80 on returning traffic, not the destination port 80. An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.

Answer

HTTP traffic can never be filtered with a standard ACL

Answer

The ACL must be applied outbound on the inside interface only

Answer

NAT automatically bypasses interface ACLs

Question 3

Users in 10.20.30.0/24 should be allowed to browse the web but should not be able to open Telnet sessions to any remote device. Which access list entry best meets the requirement?

Accepted Answer

deny tcp 10.20.30.0 0.0.0.255 any eq 23. To block Telnet while still allowing web traffic, the ACL should deny TCP destination port 23 from that source subnet and then permit the rest of the needed traffic. Telnet uses TCP port 23, not UDP and not source port 23.

Answer

deny udp 10.20.30.0 0.0.0.255 any eq 23

Answer

deny tcp any 10.20.30.0 0.0.0.255 eq 23

Answer

permit tcp 10.20.30.0 0.0.0.255 any eq 80

Question 4

Match each network service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. Each network service has a distinct primary function: DNS translates names to IPs, DHCP automates IP assignment, NTP synchronizes time, SNMP manages devices, FTP transfers files, and HTTP serves web content.

Answer

DNS: Assigns IP addresses dynamically to devices on a network

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Manages and monitors network devices

Question 5

Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?

Accepted Answer

The NAT statement is missing the overload keyword. Without overload, dynamic NAT uses one public address per internal session mapping. PAT with overload is what lets many inside hosts share a single outside interface address at the same time.

Answer

The access list should deny the inside subnet

Answer

The inside and outside interface roles are reversed in the exhibit

Answer

NAT cannot be used with RFC1918 addresses

Question 6

Why is SSH preferred over Telnet for device management?

Accepted Answer

SSH encrypts the session traffic. SSH encrypts the management session, including usernames, passwords, and commands. Telnet sends traffic in clear text, which makes it unsafe on modern networks.

Answer

SSH uses UDP and is therefore faster

Answer

SSH works only on Layer 2 networks

Answer

SSH does not require user authentication

Question 7

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

Accepted Answer

ip helper-address 10.99.99.10. DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Answer

ip default-gateway 10.20.20.1

Answer

switchport trunk allowed vlan 20

Answer

spanning-tree portfast default

Question 8

On a router performing NAT, where should ip nat inside be applied?

Accepted Answer

On the interface facing the internal private network. The inside designation belongs on the interface facing the private internal network. The outside designation belongs on the interface facing the public or external network.

Answer

On the interface facing the ISP only

Answer

On every routed interface on the router

Answer

Only on loopback interfaces

Question 9

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Accepted Answer

The NTP server is unsynchronized or unreachable. NTP requires IP reachability to the time source. If the NTP server is unreachable due to routing or ACL issues, the switch falls back to its local clock, causing drift. Option A is correct. Option B is wrong because Syslog has no effect on NTP synchronization. Option C is incorrect because NTP does not require a trunk port; it can operate over any VLAN with IP connectivity. Option D is false because DNS is only needed if the NTP server is specified by hostname; the server can be reached by IP address without DNS.

Answer

The device must run Syslog before NTP can sync

Answer

NTP requires a trunk port on the management VLAN

Answer

The clock can sync only if DNS is configured

Question 10

Exhibit: An engineer wants a device to send only warning messages and more critical events to a syslog server. Which logging level should be configured?

Accepted Answer

logging trap warnings. Syslog severity levels include lower numbers for more severe events. Warning is level 4, so setting logging trap warnings sends level 4, 3, 2, 1, and 0 messages.

Answer

logging trap debugging

Answer

logging trap notifications

Answer

logging trap informational

Question 11

Exhibit: An engineer applies an ACL inbound on the VTY lines to permit SSH only from 10.5.5.0/24. Users from that subnet still cannot connect. What is the most likely reason?

Accepted Answer

The device may not have SSH fully enabled with keys and a valid login method. Restricting the VTY lines is not enough if SSH itself has not been enabled correctly. A missing local username, domain name, RSA keys, or transport input ssh setting can stop access even when the ACL is correct.

Answer

The ACL must be applied outbound on the VTY lines

Answer

SSH requires UDP port 22

Answer

VTY access-class can only be used with Telnet

Question 12

Exhibit: A user can ping 8.8.8.8 successfully but cannot browse to www.example.com by name. Which service is the most likely failing component?

Accepted Answer

DNS. If connectivity to an IP address works but name-based access fails, the path is up and the problem is usually name resolution. DNS is the service that translates hostnames into IP addresses.

Answer

NTP

Answer

Syslog

Answer

CDP

Question 13

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

Accepted Answer

PAT overload. When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.

Answer

Static NAT

Answer

Policy-based routing

Answer

Port security

Question 14

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Accepted Answer

logging host 10.10.10.50. One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Answer

ip helper-address 10.10.10.50

Answer

snmp-server host 10.10.10.60

Answer

service timestamps log localtime

Question 15

Match each service with the best operational purpose.

Accepted Answer

DNS: Resolves domain names to IP addresses. DNS resolves hostnames to IP addresses, DHCP automatically assigns IP addressing information, Syslog forwards event and log messages to a central collector, and SNMP monitors and manages network devices using managed objects. Each matching pair reflects the primary function of the service without introducing unrelated protocols.