CCNA Network Services and Security Practice Test 23 — 15 Questions

Question 1

A DHCP client on VLAN 30 is not receiving an IP address from a DHCP server (10.99.99.20) on another subnet. The SVI for VLAN 30 is configured with an IP address and is up, but the DHCP relay command is missing. Which command should be added to the SVI configuration?

Accepted Answer

ip helper-address 10.99.99.20. DHCP Discover messages are broadcasts and do not cross routers by default. On an SVI or routed interface facing the clients, an ip helper-address relays those broadcasts to the DHCP server on another subnet.

Answer

ip directed-broadcast

Answer

service dhcp-server 10.99.99.20

Answer

default-router 10.99.99.20

Question 2

A branch router should automatically learn the IP address of a time source so logs from all devices show matching timestamps. Which service provides that function?

Accepted Answer

NTP. NTP synchronizes clocks across network devices. When timestamps line up, syslog messages and troubleshooting output become much more useful.

Answer

DNS

Answer

TFTP

Answer

NetFlow

Question 3

A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?

Accepted Answer

permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443. To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.

Answer

permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443

Answer

deny tcp any 10.1.50.0 0.0.0.255 eq 23

Answer

permit ip any any

Question 4

Exhibit: Hosts on the inside network can reach the internet, but inbound connections to a published web server fail. Static NAT is configured. What is the most likely missing piece?

Accepted Answer

An ACL permit entry allowing TCP port 80 or 443 to the translated address. Static NAT provides the address translation, but traffic still must be permitted by an inbound ACL or firewall policy on the outside interface. Option A is incorrect because a default route on the inside host affects outbound traffic, not inbound connections. Option C is wrong since PAT overload is for many-to-one translation and is not required here, and it would not block inbound traffic if static NAT is already configured. Option D is incorrect because DHCP relay does not influence inbound access to a web server; it only forwards DHCP requests from clients to a remote DHCP server.

Answer

A default route on the inside host

Answer

PAT overload on the outside interface

Answer

DHCP relay toward the web server

Question 5

Exhibit: A network engineer wants to identify which applications are consuming most WAN bandwidth over time. Which feature should be enabled on the router?

Accepted Answer

NetFlow. NetFlow records conversations and traffic characteristics so an external collector can analyze top talkers, protocols, and usage trends. Syslog and SNMP have different purposes.

Answer

NTP authentication

Answer

DNS forwarding

Answer

DHCP snooping

Question 6

Port security is enabled with a maximum of 2 MAC addresses, but a third device connected through a small hub causes a violation. Which result is expected in restrict mode?

Accepted Answer

Frames from the unknown MAC are dropped and the violation is counted. In restrict mode, the switch drops frames from unknown source MAC addresses and increments the violation counter, but the port stays up. That is less disruptive than shutdown mode.

Answer

The port goes immediately to err-disabled state

Answer

The switch learns the third MAC after 30 seconds automatically

Answer

STP blocks the port until the MAC table ages out

Question 7

An access switch port shuts down as soon as a user connects a small unmanaged switch under the desk. Which feature caused that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is meant to protect access ports by shutting them down if BPDUs are received. That usually means someone connected another switch where only an endpoint should exist.

Answer

Root Guard

Answer

Loop Guard

Answer

Storm control

Question 8

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

Accepted Answer

The outside interface is missing the ip nat outside command. NAT needs the inside and outside interfaces marked correctly. If those roles are missing or reversed, the router has no context for translating traffic and the NAT table stays empty.

Answer

The ACL used by NAT must deny inside addresses

Answer

PAT requires DHCP on the inside interface

Answer

NAT overload works only with OSPF-learned routes

Question 9

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Accepted Answer

The ACL is applied in the wrong place or direction. Option B is correct because the most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.

Answer

The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255

Answer

Standard ACLs should always be used for Telnet filtering

Answer

The router must run PAT before ACLs can filter Telnet

Question 10

Users receive addresses from the correct subnet and can reach destinations by IP address, but they cannot browse by hostname.

Accepted Answer

DNS server option. If clients get an IP address and default gateway but cannot resolve names, the usual problem is the DNS server information handed out by DHCP. Without that, hostname lookups fail even though IP connectivity may still exist.

Answer

Default-router option

Answer

Lease time option

Answer

TFTP server option

Question 11

A small office wants branch routers to automatically hand out IP addresses, default gateway values, and DNS servers to clients. Which service should be configured?

Accepted Answer

DHCP. DHCP is built for this exact job. It centrally provides addressing details so endpoints do not need to be configured by hand.

Answer

DNS

Answer

NTP

Answer

TACACS+

Question 12

Which two statements about AAA on Cisco devices are correct? Choose two.

Accepted Answer

Authentication verifies identity. AAA breaks access control into authentication, authorization, and accounting. TACACS+ is commonly preferred for device administration because it separates all three functions and encrypts the full payload.

Answer

Accounting replaces the need for local usernames entirely

Answer

AAA can only be used with RADIUS and not TACACS+

Question 13

Match each service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. DNS translates domain names into IP addresses, enabling clients to reach servers by name. DHCP automates the assignment of IP addresses, subnet masks, default gateways, and other parameters to clients. NTP synchronizes the clocks of network devices to a common time source. Syslog collects and exports log messages from network devices to a centralized server for monitoring and troubleshooting.

Answer

DNS: Automates the assignment of IP addresses to devices

Answer

DNS: Serves web pages to clients

Answer

DNS: Manages network devices via a management information base

Question 14

Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?

Accepted Answer

The server is reachable but not the one currently selected for synchronization. In Cisco NTP output, the asterisk (*) indicates the current synchronization source. The tilde (~) specifically means the server is statically configured and reachable but has not been selected for synchronization. This differs from the plus sign (+), which denotes a candidate for synchronization. Therefore, the router is not using that server as its active time source.

Answer

That server is the current system clock source

Answer

NTP authentication has disabled the server permanently

Answer

The router is acting as an NTP master for that server

Question 15

Which NAT feature allows many inside hosts to share one public IPv4 address by using unique source port numbers?

Accepted Answer

PAT. PAT, sometimes called NAT overload, keeps track of connections by using Layer 4 port numbers so many private hosts can share a single public address.

Answer

Static NAT

Answer

NTP authentication

Answer

Port security