CCNA Network Services and Security Practice Test 23 — 15 Questions

Question 1

Which two statements accurately describe the value of named administrative accounts?

Accepted Answer

They improve accountability by tying actions to specific individuals.. Named administrative accounts are valuable because they tie actions to individual identities and make access review more meaningful. In practical terms, when multiple people share one generic admin account, accountability becomes weaker. Named identities improve traceability and support auditing, investigations, and operational review.

This is a core secure-administration concept and a good reasoning item rather than just a memorization exercise.

Answer

They replace the need for authorization controls.

Answer

They can be used only with Telnet and not SSH.

Answer

They exist only for wireless guest administration.

Question 2

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Accepted Answer

The clients are missing valid DNS server information.. The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Answer

The default gateway must be removed from the DHCP scope.

Answer

The clients must use PPP before DNS works.

Answer

The VLAN must be converted to the native VLAN on all trunks.

Question 3

Which two statements accurately describe why NTP and Syslog are often configured together?

Accepted Answer

Syslog provides event visibility, while NTP helps keep timestamps consistent across devices.. NTP and Syslog are often configured together because logs become much more useful when the device clocks are aligned. In practical terms, Syslog provides the event messages, while NTP helps ensure that the timestamps on those messages are consistent across the environment. That makes troubleshooting and incident analysis more reliable.

This is a very practical operations concept and comes up often in real troubleshooting workflows.

Answer

NTP replaces the need for any event logging.

Answer

Syslog automatically assigns the NTP server address to all devices.

Answer

Both services can be used only on routers, not switches.

Question 4

Which two statements accurately describe why source restriction and logging are often used together for administrative access?

Accepted Answer

Source restriction narrows the allowed origin space for administrative sessions.. Source restriction and logging are often used together because they help answer two different security questions. In practical terms, source restriction limits where administrative sessions may originate, while logging helps show what happened once access was attempted or granted. This combination improves both exposure reduction and post-event visibility.

This is a strong layered-security reasoning item because it focuses on complementary controls rather than one-control thinking.

Answer

Logging removes the need for authentication.

Answer

Source restriction works only when Syslog is disabled.

Answer

Both controls exist only for guest wireless networks.

Question 5

Two switches are connected by an 802.1Q trunk. CDP reports a native VLAN mismatch. Which issue is most likely to appear because of this?

Accepted Answer

Untagged traffic may be placed into different VLANs on each switch.. A native VLAN mismatch can cause untagged traffic sent on one side to be placed into a different VLAN on the other side. That leads to confusing connectivity issues and can also create security concerns. It does not automatically disable the trunk.

Answer

All tagged traffic on the trunk is dropped immediately.

Answer

STP is disabled on the trunk link.

Answer

The trunk automatically converts to an access port.

Question 6

Match each REST API method to the action it most closely represents in a typical network automation workflow.

Accepted Answer

GET retrieves data, POST creates new resources, PUT updates/replaces, PATCH partially updates, DELETE removes, and OPTIONS queries available methods.. GET retrieves data, POST creates new resources, PUT updates/replaces, PATCH partially updates, DELETE removes, and OPTIONS queries available methods. These correspond to common network automation workflows.

Answer

GET retrieves data, POST creates new resources, PUT partially updates, PATCH updates/replaces, DELETE removes, and OPTIONS queries available methods.

Answer

GET retrieves data, POST updates/replaces, PUT creates new resources, PATCH partially updates, DELETE removes, and OPTIONS queries available methods.

Answer

GET retrieves data, POST creates new resources, PUT partially updates, PATCH updates/replaces, DELETE removes, and OPTIONS queries available methods.

Question 7

R1 has the following routes installed:

O    10.10.10.0/24 via 192.0.2.2
S    10.10.10.128/25 via 198.51.100.2
S*   0.0.0.0/0 via 203.0.113.1

A packet destined for 10.10.10.200 arrives at R1. Which route is used?

Accepted Answer

The static route to 10.10.10.128/25 via 198.51.100.2. Routers forward using longest prefix match first. Even though the OSPF /24 exists, the static /25 is more specific and covers 10.10.10.200, so the packet is sent via 198.51.100.2. The default route is used only when nothing more specific matches.

Answer

The OSPF route to 10.10.10.0/24 via 192.0.2.2

Answer

The default route via 203.0.113.1

Answer

The packet is dropped because OSPF routes cannot overlap with static routes.

Question 8

A branch router has only one WAN link connected to an Ethernet handoff from the provider. Which static default route is generally the better choice?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 198.51.100.1. On multiaccess Ethernet, pointing the default route to a next-hop IP address is usually cleaner because the router can resolve the next hop with ARP. Using only the exit interface on Ethernet can make the router treat many destinations as directly connected and trigger unnecessary ARP behavior.

Answer

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0

Answer

ip route 255.255.255.255 255.255.255.255 198.51.100.1

Answer

No static default route should ever be used on Ethernet.

Question 9

Match each DHCPv4 message in the DORA process to its role.

Accepted Answer

Discover: Client broadcasts to locate DHCP servers. The DORA process includes Discover (client broadcast), Offer (server response), Request (client accepts), and Ack (server confirms). Additional messages like NAK and Decline handle errors.

Answer

Discover: Server responds with an IP lease offer

Answer

Discover: Client requests the offered IP address

Answer

Discover: Server acknowledges the lease

Question 10

An engineer successfully authenticates to a controller and receives a token. What is the usual reason for including that token in later API requests?

Accepted Answer

To identify and authorize the client without resending full login credentials each time. The token proves the client has already authenticated and is authorized to continue interacting with the API for the lifetime of that token or session. It is commonly sent in an HTTP header such as Authorization. It does not replace the need for IP routing or DNS resolution.

Answer

To convert HTTP requests into SNMP traps

Answer

To elect the active controller in the cluster

Answer

To compress JSON payloads before transport

Question 11

A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?

Accepted Answer

The port received a BPDU and BPDU Guard shut it down.. BPDU Guard is commonly enabled on PortFast access ports to protect the topology. If the port receives a BPDU, the switch assumes another switch may have been connected and places the port into err-disabled state. That is exactly the protective behavior you want at the edge.

Answer

DHCP snooping blocked the user's ARP requests.

Answer

Port security moved the port to protect mode.

Answer

The trunk native VLAN matched incorrectly.

Question 12

An ACL entry reads:

access-list 25 permit 192.168.8.0 0.0.0.15

Which address range does this statement match?

Accepted Answer

192.168.8.0 through 192.168.8.15. A wildcard of 0.0.0.15 means the last 4 bits can vary, which corresponds to a block size of 16 addresses. Starting at 192.168.8.0, the range is 192.168.8.0 through 192.168.8.15.

Answer

192.168.8.0 through 192.168.8.31

Answer

192.168.8.0 through 192.168.8.7

Answer

Only host 192.168.8.15

Question 13

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

Accepted Answer

Gi0/1 on SW2 is the root port.. The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Answer

SW2 is the root bridge for VLAN 10.

Answer

All SW2 ports in VLAN 10 must be designated ports.

Answer

STP is disabled because the priorities are equal.

Question 14

R1 and R2 should form an OSPF adjacency on their shared GigabitEthernet link, but they remain stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU values do not match.. The MTU values do not match. OSPF neighbors can discover each other and even move through earlier states, but an MTU mismatch commonly leaves them stuck in EXSTART or EXCHANGE because the routers do not agree on database description packet sizing. Area mismatch, network mismatch, and passive-interface issues usually prevent a much earlier stage of adjacency formation.

Answer

The routers are using different OSPF areas.

Answer

One side is configured as passive-interface.

Answer

The subnet mask on the link is incorrect.

Question 15

R1 learns three OSPF routes to different destinations:

O 10.10.10.0/24
O IA 10.20.20.0/24
O E2 10.30.30.0/24

Which statement is correct about these route types?

Accepted Answer

O E2 is an OSPF external type 2 route.. An O route is intra-area, O IA is interarea, and O E2 is an external type 2 route redistributed into OSPF. The codes describe route origin, not just preference. CCNA expects you to identify them quickly when reading the routing table.

Answer

O IA is an external route redistributed from another routing protocol.

Answer

O means the route was learned through EIGRP.

Answer

All three routes were learned from the same OSPF area type.