CCNA Network Services and Security Practice Test 23 — 15 Questions

Question 1

Match each security control or idea to its most accurate purpose.

Accepted Answer

Firewall: Filters traffic based on security rules. A firewall controls incoming and outgoing network traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks. Option A correctly describes this function. Option B, detecting and alerting on suspicious activity, is the role of an Intrusion Detection System (IDS). Option C, preventing and blocking intrusions in real time, is the function of an Intrusion Prevention System (IPS). Option D, authenticating users and managing access rights, pertains to AAA (Authentication, Authorization, and Accounting) frameworks.

Answer

Firewall: Detects and alerts on suspicious activity

Answer

Firewall: Prevents and blocks intrusions in real time

Answer

Firewall: Authenticates users and manages access rights

Question 2

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

Accepted Answer

Use the narrowest possible match so only the intended traffic is denied.. The most important principle is to write the ACL as narrowly as possible so it matches only the unwanted traffic and does not overblock unrelated traffic. In practical terms, the rule should target the specific destination and service being denied rather than using a broader deny that unintentionally blocks other communication.

This is a precision-and-scope question. Good ACL design is as much about what you avoid blocking as what you intend to block.

Answer

Always deny all IP traffic to the destination subnet first.

Answer

Use a standard ACL because destination details never matter.

Answer

Place the ACL only where no routing exists.

Question 3

Which two statements accurately describe common uses of NTP in network operations?

Accepted Answer

It helps align device clocks across the network.. Option A is correct because NTP (Network Time Protocol) synchronizes the clocks of network devices to a common time reference, typically a stratum-0/1 source, keeping routers, switches, and servers aligned within milliseconds. Option B is correct because accurate, consistent timestamps from NTP make event timelines reliable and enable log correlation across multiple devices, which is essential for troubleshooting, SIEM analysis, and forensic investigations. The unmarked options do not belong: NTP does not replace Syslog (C), which is a separate logging/transport mechanism; it does not assign IP addresses (D), which is the role of DHCP; and it does not provide WLAN encryption (E), which is handled by protocols such as WPA2/WPA3.

Answer

It replaces the need for Syslog.

Answer

It assigns IP addresses to hosts.

Answer

It provides WLAN encryption.

Question 4

A monitoring system already collects Syslog and SNMP data. The network team now wants visibility into which applications or host conversations are driving link utilization. What is the strongest addition?

Accepted Answer

NetFlow. The strongest addition is NetFlow because it provides traffic-flow visibility. In practical terms, Syslog and SNMP are useful, but they do not directly answer detailed conversation-level questions such as which hosts, protocols, or flows are consuming the most bandwidth. NetFlow is designed to answer exactly that kind of question.

This is about choosing the right operational tool for the visibility gap.

Answer

Another SSID

Answer

PortFast

Answer

A larger wildcard mask

Question 5

Which two statements accurately describe why NetFlow is useful for operations teams?

Accepted Answer

It helps identify which conversations or applications contribute to link utilization.. NetFlow is useful because it helps teams move beyond simple interface utilization and see which traffic conversations are responsible for usage. In practical terms, it can reveal which hosts, protocols, or applications are contributing to the traffic profile, making it valuable for troubleshooting, capacity planning, and security investigations. Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog; Syslog provides device event logging while NetFlow provides traffic flow data, and both tools complement each other in network operations.

Answer

It replaces the need for all routing protocols.

Answer

It is the main wireless encryption protocol for guest access.

Answer

It eliminates the usefulness of Syslog.

Question 6

Which two statements accurately describe why SSH is preferred over Telnet for device administration?

Accepted Answer

SSH is generally considered the more secure choice for remote CLI administration.. SSH is preferred because it encrypts all traffic, including authentication credentials, making it secure for remote CLI administration, whereas Telnet transmits data in plaintext and is considered less secure. Option C is incorrect because SSH does not eliminate authentication; it requires authentication and often enforces stronger policies. Option D is false because SSH and Telnet are independent protocols; Telnet is not required for SSH to operate. Option E is wrong because SSH is used on routers, switches, firewalls, and many other devices, not only wireless controllers.

Answer

SSH eliminates the need for authentication and authorization policy.

Answer

Telnet is required before SSH can operate.

Answer

SSH is used only on wireless controllers and nowhere else.

Question 7

A switch is configured with DHCP snooping and Dynamic ARP Inspection. Hosts suddenly lose connectivity after changing IP settings manually. Which explanation is strongest?

Accepted Answer

DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.. DAI uses DHCP snooping binding to validate ARP messages; a manual IP change creates a mismatch, causing DAI to block ARP. Option B is incorrect because STP prevents loops and does not block based on MAC address changes. Option C is incorrect because OSPF authentication is a routing protocol feature irrelevant on an access port. Option D is incorrect because PPP authentication applies to serial links, not Ethernet ARP.

Answer

STP is blocking the host because its MAC address changed.

Answer

OSPF authentication failed on the access port.

Answer

The switch requires PPP authentication before allowing ARP traffic.

Question 8

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

Accepted Answer

Authorization. Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce.

This is a good example of why authentication and authorization are not the same thing.

Answer

Authentication

Answer

Accounting

Answer

DNS

Question 9

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Accepted Answer

Users often access services by name, so failed name resolution can feel like total connectivity loss.. DNS issues can look like general connectivity problems because many users think in terms of names, not IP addresses. In practical terms, they may report that 'the network is down' when the actual routed path works but hostname resolution does not. That is why testing by IP versus name is such a useful troubleshooting step.

The distinction between transport reachability and naming is critical in user-facing support.

Answer

DNS failure automatically means the default gateway is missing.

Answer

If DNS fails, DHCP and NTP must also fail immediately.

Answer

DNS replaces the need for routing between subnets.

Question 10

Which two statements accurately describe why logs and accounting records both matter in secure operations?

Accepted Answer

They improve visibility into events and activity after access occurs.. Option A is correct because logs and accounting records capture events and activity after access has occurred, giving security teams the visibility needed to detect anomalies, trace what happened, and reconstruct timelines during investigations. Option B is correct because these records establish accountability by tying actions to identities and support incident review, allowing responders to determine who did what, when, and how during a security event. Options C, D, and E are incorrect: logging and accounting do not replace authentication (they depend on it to attribute activity to a user or process), they are valuable across all systems and networks rather than only wireless guest networks, and they do not automatically generate access policies for administrators—policy creation remains a separate administrative function.

Answer

They replace the need for authentication entirely.

Answer

They are useful only on wireless guest networks.

Answer

They automatically create access policies for administrators.

Question 11

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

Accepted Answer

Because secure transport alone does not remove the need for source restriction and accountability controls.. The decision reflects defense in depth. SSH encrypts the session and authenticates users, but it does not limit which source IPs can connect or provide audit trails. Source IP restriction reduces the attack surface by allowing only trusted hosts, and logging provides accountability and forensic evidence. Option B is incorrect because SSH is more secure than Telnet, not less. Option C is incorrect because logs record events but do not enforce ACLs. Option D is incorrect because source IP restriction complements authentication rather than replacing it.

Answer

Because SSH is less secure than Telnet and must be compensated for.

Answer

Because logs automatically enforce ACL policy.

Answer

Because source IP restriction replaces the need for authentication.

Question 12

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

Accepted Answer

ip helper-address 10.99.99.20 under interface Vlan30. The correct fix is to add an IP helper address pointing to the remote DHCP server on the Layer 3 interface for VLAN 30. In practical terms, the clients are sending DHCP discovery as a broadcast, and the server is on another subnet. The SVI for VLAN 30 is the local gateway that must relay those requests toward the server.

This is one of the most exam-realistic campus troubleshooting scenarios because it tests both subnet boundaries and the role of the local gateway interface.

Answer

switchport mode trunk under interface Vlan30

Answer

ip default-gateway 10.99.99.20 under interface Vlan30

Answer

spanning-tree portfast under interface Vlan30

Question 13

Based on the exhibit, what is the most likely reason PAT is not working correctly?

Accepted Answer

The inside and outside NAT interface roles are reversed.. PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction.

This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.

Answer

PAT requires OSPF to be enabled on the WAN link.

Answer

The ACL must be numbered 100 instead of 1.

Answer

The router must use GRE before PAT can overload.

Question 14

Which two statements accurately describe the purpose of least privilege in administration and operations?

Accepted Answer

It limits users and administrators to the permissions they actually need.. Least privilege is about limiting access to what is actually needed. In practical terms, it reduces unnecessary exposure and helps contain the impact of mistakes, misuse, or compromised accounts. It is not about refusing all access. It is about granting enough access to do the job, but not more than that.

This is a central principle in secure administration and role design.

Answer

It means no administrator should ever have any configuration access.

Answer

It replaces the need for logging and accounting.

Answer

It exists only on wireless guest networks.

Question 15

An administrator needs to configure an ACL to block HTTP traffic from subnet 10.10.10.0/24 to the web server at 172.16.1.10 while permitting all other traffic. Which ACL entry should be placed first?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The ACL needs a narrow deny statement that matches only TCP port 80 from the specified source subnet to the specific server. In practical terms, the requirement is not to block all IP traffic or all access to the host. It is to stop normal HTTP while allowing everything else. That means the entry must be precise.

This is the kind of ACL question the CCNA exam likes because it forces you to distinguish protocol, destination, and service rather than relying on vague source-only logic.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80