CCNA Network Services and Security Practice Test 27 — 15 Questions

Question 1

Exhibit: Hosts on the inside network can reach the internet, but inbound connections to a published web server fail. Static NAT is configured. What is the most likely missing piece?

Accepted Answer

An ACL permit entry allowing TCP port 80 or 443 to the translated address. Static NAT provides the address translation, but traffic still must be permitted by an inbound ACL or firewall policy on the outside interface. Option A is incorrect because a default route on the inside host affects outbound traffic, not inbound connections. Option C is wrong since PAT overload is for many-to-one translation and is not required here, and it would not block inbound traffic if static NAT is already configured. Option D is incorrect because DHCP relay does not influence inbound access to a web server; it only forwards DHCP requests from clients to a remote DHCP server.

Answer

A default route on the inside host

Answer

PAT overload on the outside interface

Answer

DHCP relay toward the web server

Question 2

Exhibit: A network engineer wants to identify which applications are consuming most WAN bandwidth over time. Which feature should be enabled on the router?

Accepted Answer

NetFlow. NetFlow records conversations and traffic characteristics so an external collector can analyze top talkers, protocols, and usage trends. Syslog and SNMP have different purposes.

Answer

NTP authentication

Answer

DNS forwarding

Answer

DHCP snooping

Question 3

Port security is enabled with a maximum of 2 MAC addresses, but a third device connected through a small hub causes a violation. Which result is expected in restrict mode?

Accepted Answer

Frames from the unknown MAC are dropped and the violation is counted. In restrict mode, the switch drops frames from unknown source MAC addresses and increments the violation counter, but the port stays up. That is less disruptive than shutdown mode.

Answer

The port goes immediately to err-disabled state

Answer

The switch learns the third MAC after 30 seconds automatically

Answer

STP blocks the port until the MAC table ages out

Question 4

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

Accepted Answer

The outside interface is missing the ip nat outside command. NAT needs the inside and outside interfaces marked correctly. If those roles are missing or reversed, the router has no context for translating traffic and the NAT table stays empty.

Answer

The ACL used by NAT must deny inside addresses

Answer

PAT requires DHCP on the inside interface

Answer

NAT overload works only with OSPF-learned routes

Question 5

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Accepted Answer

The ACL is applied in the wrong place or direction. The most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.

Answer

The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255

Answer

Standard ACLs should always be used for Telnet filtering

Answer

The router must run PAT before ACLs can filter Telnet

Question 6

Users receive addresses from the correct subnet and can reach destinations by IP address, but they cannot browse by hostname.

Accepted Answer

DNS server option. If clients get an IP address and default gateway but cannot resolve names, the usual problem is the DNS server information handed out by DHCP. Without that, hostname lookups fail even though IP connectivity may still exist.

Answer

Default-router option

Answer

Lease time option

Answer

TFTP server option

Question 7

A small office wants branch routers to automatically hand out IP addresses, default gateway values, and DNS servers to clients. Which service should be configured?

Accepted Answer

DHCP. DHCP is built for this exact job. It centrally provides addressing details so endpoints do not need to be configured by hand.

Answer

DNS

Answer

NTP

Answer

TACACS+

Question 8

Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?

Accepted Answer

The server is reachable but not the one currently selected for synchronization. In Cisco NTP output, the asterisk (*) indicates the current synchronization source. The tilde (~) specifically means the server is statically configured and reachable but has not been selected for synchronization. This differs from the plus sign (+), which denotes a candidate for synchronization. Therefore, the router is not using that server as its active time source.

Answer

That server is the current system clock source

Answer

NTP authentication has disabled the server permanently

Answer

The router is acting as an NTP master for that server

Question 9

A switch port is configured with port-security violation mode restrict. Which two statements are true when an unauthorized MAC address appears?

Accepted Answer

Frames from the unauthorized MAC are dropped. Restrict drops frames from violating MAC addresses and can increment the violation counter while keeping the port up. Shutdown would err-disable the port instead.

Answer

The interface immediately goes into err-disabled state

Answer

The switch converts the port to a trunk automatically

Answer

The violation mode changes itself to shutdown after three attempts

Question 10

A named standard ACL is configured to permit only the 192.168.30.0/24 subnet, but users from 192.168.31.0/24 are still passing traffic. What is the most likely reason?

Accepted Answer

The ACL is probably applied in the wrong place or direction for the traffic flow. Standard ACLs filter traffic based solely on the source IP address. If users from 192.168.31.0/24 are still passing traffic despite the ACL permitting only 192.168.30.0/24, the most likely reason is that the ACL is applied in the wrong place or direction. For example, if the ACL is applied inbound on an interface where traffic from 192.168.31.0/24 does not enter, or outbound on an interface where the traffic does not exit, the filter will not affect the intended flow. The implicit deny statement denies all unmatched traffic, so if the ACL were correctly placed, traffic from 192.168.31.0/24 would be denied.

Answer

Standard ACLs cannot match source addresses

Answer

Named ACLs ignore wildcard masks

Answer

The deny any line must appear before the permit

Question 11

A router is configured for PAT overload. What does the inside global address represent for an internal PC?

Accepted Answer

The public address that represents the internal PC to external networks. With NAT overload, the inside local address is the private address on the internal host. The inside global is the translated public address that represents that inside host to the outside network.

Answer

The private IP address assigned to the internal PC

Answer

The remote server address as seen from the inside host

Answer

The MAC address of the outside interface

Question 12

Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?

Accepted Answer

Configure NTP on the network devices. When timestamps disagree, the first fix is time synchronization. NTP should be configured consistently, and devices should have correct timezone or clock settings so syslog messages can be correlated across the network.

Answer

Increase the syslog severity threshold to debugging

Answer

Disable console logging

Answer

Clear the logging buffer on all devices

Question 13

Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?

Accepted Answer

NetFlow can export flow data to a collector. NetFlow exports flow records to a collector and is useful for traffic analysis and accounting visibility, enabling identification of top talkers and application usage (options A and B are correct). Syslog reports events and messages, but does not replace flow records for conversation-level traffic statistics, so option C is incorrect. NetFlow does not replace routing protocols for path selection; it is a traffic monitoring tool, not a routing mechanism, so option D is incorrect. NetFlow works on routers and Layer 3 switches, not only Layer 2 switches, so option E is incorrect.

Answer

Syslog and NetFlow are the same feature with different names

Answer

NetFlow replaces routing protocols for path selection

Answer

NetFlow only works on Layer 2 switches and never on routers

Question 14

Which two statements correctly describe syslog severity levels?

Accepted Answer

Level 0 is the most severe. Syslog uses numbered severity levels where lower numbers indicate more critical events. Level 0 (Emergency) is the most severe, and Level 7 (Debugging) is the least. Option D is incorrect because severity levels are a syslog function, not specific to NTP. Option E is wrong because syslog defines eight severity levels (0–7), not four.

Answer

Higher numbers always mean more critical issues

Answer

Severity levels are used only by NTP

Answer

Syslog has only four severity levels

Question 15

Which two actions help protect access-layer switch ports from rogue DHCP servers?

Accepted Answer

Enable DHCP snooping globally and for the needed VLANs. DHCP snooping marks trusted and untrusted interfaces and filters server-type DHCP messages on untrusted ports. Uplink ports toward the real DHCP server or relay are typically trusted, while user-facing ports stay untrusted. Option C is incorrect because PortFast does not filter DHCP messages; it only speeds up spanning tree convergence. Option D is incorrect because disabling ARP breaks normal communication and does not block DHCP. Option E is incorrect because marking all access ports as trusted would permit rogue DHCP servers on those ports.

Answer

Enable PortFast on all trunks to block rogue servers

Answer

Disable ARP on access ports

Answer

Set every access port as trusted