CCNA Network Services and Security Practice Test 24 — 15 Questions

Question 1

Based on the exhibit, what is the strongest explanation for why clients can browse by IP address but not by hostname?

Accepted Answer

Name resolution is failing even though IP connectivity works.. The strongest explanation is a DNS failure or DNS configuration problem. In practical terms, successful browsing by IP address shows that the client can already reach the destination over the network path. When the same service fails only by hostname, the issue is much more likely in name resolution than in routing, switching, or raw connectivity.

This is one of the most useful support patterns because it quickly separates path problems from naming problems.

Answer

The client has the wrong default gateway.

Answer

The switch trunk native VLAN is wrong.

Answer

The server must run PPP before hostnames can work.

Question 2

Based on the exhibit, why is the ACL not meeting the requirement to block only HTTPS traffic to the server?

Accepted Answer

Because the ACL entry is too broad and blocks all IP traffic to the host.. The ACL fails because it uses 'deny ip' which blocks all IP traffic to the server, not just HTTPS. To block only HTTPS, the ACL should match TCP port 443 with 'deny tcp eq 443'. Option B is wrong because HTTPS uses TCP, not UDP. Option C is wrong because extended ACLs (not standard) are required to filter by port. Option D is wrong because a host destination is perfectly valid in extended ACLs; a wildcard subnet is not required.

Answer

Because HTTPS uses UDP, not TCP.

Answer

Because standard ACLs are required for HTTPS filtering.

Answer

Because the destination must always be a wildcarded subnet, not a host.

Question 3

Which two statements accurately describe the value of source restriction on administrative access?

Accepted Answer

It reduces the set of network locations from which administrative access is allowed.. Source restriction improves security by reducing the number of places from which administrative traffic is expected and permitted. In practical terms, this makes exposure smaller and monitoring clearer. It does not replace secure protocols or identity controls, but it strengthens the overall design.

This is a layered-management-security question because it emphasizes how source restriction complements other controls.

Answer

It removes the need for SSH or other secure transports.

Answer

It makes logging unnecessary.

Answer

It can be used only for wireless management.

Question 4

Which two statements accurately describe why least privilege and source restriction work well together for administrative access?

Accepted Answer

Least privilege reduces the scope of actions an authenticated user can perform.. Least privilege and source restriction work well together because they reduce risk in different ways. In practical terms, least privilege limits what a user can do after access is granted, while source restriction reduces where an administrative session is even allowed to originate. Together they reduce both exposure and potential impact.

This is a layered management-security concept and a strong exam-style reasoning item.

Answer

Either one by itself removes the need for logging.

Answer

Both exist only for wireless guest access policies.

Answer

They require all administrative traffic to use PPP encapsulation.

Question 5

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

Accepted Answer

Authentication succeeded, but authorization limits the user's command access.. The situation is best explained by authorization controls. In practical terms, authentication confirms who the user is, but authorization determines what that user can do after login. A successful login followed by restricted command access means the identity is valid but the permission set is limited.

This is one of the most important practical distinctions within AAA.

Answer

The device lost all routing information after login.

Answer

The subnet mask on the user workstation is incorrect.

Answer

Syslog is blocking the commands for security reasons.

Question 6

Based on the exhibit, why is the ACL blocking more traffic than intended?

Accepted Answer

Because the ACL denies all TCP traffic to the server instead of only Telnet.. The ACL is blocking more traffic than intended because it uses a broad deny against all TCP traffic to the server instead of only the one service that should be denied. In practical terms, the requirement is narrow, but the configured entry is much wider. As a result, multiple TCP-based applications to that server are blocked, not just the intended one.

This is a classic precision problem in ACL design. It tests whether you can compare what the business requirement says against what the ACL actually matches.

Answer

Because Telnet uses UDP, not TCP.

Answer

Because the ACL should be a standard ACL, not an extended ACL.

Answer

Because the host keyword can never be used with TCP statements.

Question 7

Based on the exhibit, why does the ACL still allow HTTPS traffic from the branch subnet to the server?

Accepted Answer

The ACL blocks TCP port 80 instead of TCP port 443.. The ACL still allows the HTTPS traffic because the deny statement is matching TCP port 80, not TCP port 443. In practical terms, the entry blocks HTTP, not HTTPS. Since the requirement is specifically to block encrypted web traffic on TCP 443, the current line is aimed at the wrong service.

This is a good precision question because it tests whether the candidate pays attention to the exact destination port rather than just seeing a generic web-related deny.

Answer

HTTPS uses UDP port 443, so TCP matching can never work.

Answer

The ACL must deny all IP traffic to the server to stop HTTPS.

Answer

ACLs cannot filter by destination port when a host keyword is used.

Question 8

Which two statements accurately describe the value of named administrative accounts?

Accepted Answer

They improve accountability by tying actions to specific individuals.. Named administrative accounts are valuable because they tie actions to individual identities and make access review more meaningful. In practical terms, when multiple people share one generic admin account, accountability becomes weaker. Named identities improve traceability and support auditing, investigations, and operational review.

This is a core secure-administration concept and a good reasoning item rather than just a memorization exercise.

Answer

They replace the need for authorization controls.

Answer

They can be used only with Telnet and not SSH.

Answer

They exist only for wireless guest administration.

Question 9

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Accepted Answer

The clients are missing valid DNS server information.. The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Answer

The default gateway must be removed from the DHCP scope.

Answer

The clients must use PPP before DNS works.

Answer

The VLAN must be converted to the native VLAN on all trunks.

Question 10

Which two statements accurately describe why NTP and Syslog are often configured together?

Accepted Answer

Syslog provides event visibility, while NTP helps keep timestamps consistent across devices.. NTP and Syslog are often configured together because logs become much more useful when the device clocks are aligned. In practical terms, Syslog provides the event messages, while NTP helps ensure that the timestamps on those messages are consistent across the environment. That makes troubleshooting and incident analysis more reliable.

This is a very practical operations concept and comes up often in real troubleshooting workflows.

Answer

NTP replaces the need for any event logging.

Answer

Syslog automatically assigns the NTP server address to all devices.

Answer

Both services can be used only on routers, not switches.

Question 11

Which two statements accurately describe why source restriction and logging are often used together for administrative access?

Accepted Answer

Source restriction narrows the allowed origin space for administrative sessions.. Source restriction and logging are often used together because they help answer two different security questions. In practical terms, source restriction limits where administrative sessions may originate, while logging helps show what happened once access was attempted or granted. This combination improves both exposure reduction and post-event visibility.

This is a strong layered-security reasoning item because it focuses on complementary controls rather than one-control thinking.

Answer

Logging removes the need for authentication.

Answer

Source restriction works only when Syslog is disabled.

Answer

Both controls exist only for guest wireless networks.

Question 12

Two switches are connected by an 802.1Q trunk. CDP reports a native VLAN mismatch. Which issue is most likely to appear because of this?

Accepted Answer

Untagged traffic may be placed into different VLANs on each switch.. A native VLAN mismatch can cause untagged traffic sent on one side to be placed into a different VLAN on the other side. That leads to confusing connectivity issues and can also create security concerns. It does not automatically disable the trunk.

Answer

All tagged traffic on the trunk is dropped immediately.

Answer

STP is disabled on the trunk link.

Answer

The trunk automatically converts to an access port.

Question 13

Match each REST API method to the action it most closely represents in a typical network automation workflow.

Accepted Answer

GET retrieves data, POST creates new resources, PUT updates/replaces, PATCH partially updates, DELETE removes, and OPTIONS queries available methods.. GET retrieves data, POST creates new resources, PUT updates/replaces, PATCH partially updates, DELETE removes, and OPTIONS queries available methods. These correspond to common network automation workflows.

Answer

GET retrieves data, POST creates new resources, PUT partially updates, PATCH updates/replaces, DELETE removes, and OPTIONS queries available methods.

Answer

GET retrieves data, POST updates/replaces, PUT creates new resources, PATCH partially updates, DELETE removes, and OPTIONS queries available methods.

Answer

GET retrieves data, POST creates new resources, PUT partially updates, PATCH updates/replaces, DELETE removes, and OPTIONS queries available methods.

Question 14

R1 has the following routes installed:

O    10.10.10.0/24 via 192.0.2.2
S    10.10.10.128/25 via 198.51.100.2
S*   0.0.0.0/0 via 203.0.113.1

A packet destined for 10.10.10.200 arrives at R1. Which route is used?

Accepted Answer

The static route to 10.10.10.128/25 via 198.51.100.2. Routers forward using longest prefix match first. Even though the OSPF /24 exists, the static /25 is more specific and covers 10.10.10.200, so the packet is sent via 198.51.100.2. The default route is used only when nothing more specific matches.

Answer

The OSPF route to 10.10.10.0/24 via 192.0.2.2

Answer

The default route via 203.0.113.1

Answer

The packet is dropped because OSPF routes cannot overlap with static routes.

Question 15

A branch router has only one WAN link connected to an Ethernet handoff from the provider. Which static default route is generally the better choice?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 198.51.100.1. On multiaccess Ethernet, pointing the default route to a next-hop IP address is usually cleaner because the router can resolve the next hop with ARP. Using only the exit interface on Ethernet can make the router treat many destinations as directly connected and trigger unnecessary ARP behavior.

Answer

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0

Answer

ip route 255.255.255.255 255.255.255.255 198.51.100.1

Answer

No static default route should ever be used on Ethernet.