CCNA Network Services and Security Practice Test 27 — 15 Questions

Question 1

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Accepted Answer

NTP. Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Answer

DNS

Answer

SNMP

Answer

CDP

Question 2

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Accepted Answer

Move it outbound on the WAN-facing interface closer to the destination. A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Answer

Leave it inbound on the LAN because standard ACLs belong near the source

Answer

Convert it to a VTY access-class

Answer

Apply it inbound on all switch access ports

Question 3

Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?

Accepted Answer

DNS. The client has IP connectivity because it can reach 8.8.8.8 directly. The problem appears only when using a hostname, which points to a DNS resolution issue rather than a routing issue.

Answer

NTP

Answer

DHCP snooping

Answer

HSRP

Question 4

An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?

Accepted Answer

Extended ACL. A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.

Answer

Named standard ACL

Answer

Prefix list

Answer

MAC access-list

Question 5

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Accepted Answer

No ACL and nat overload statement identifying inside source addresses. PAT needs both the inside and outside interface roles and a NAT statement referencing an ACL that identifies the inside local addresses. Without the ACL match and NAT overload rule, translation does not occur for user traffic.

Answer

No DHCP pool on the outside interface

Answer

No CDP enabled on the router

Answer

No syslog server configured

Question 6

Exhibit: A collector is receiving traffic metadata from a router, including source IP, destination IP, protocol, and byte counts. Which feature is being used?

Accepted Answer

NetFlow. NetFlow exports flow records that summarize traffic conversations. It does not carry full packet payloads, but it does provide useful metadata for analysis and capacity planning.

Answer

Syslog

Answer

SNMP trap

Answer

NTP

Question 7

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

Accepted Answer

DNS. DNS maps hostnames to IP addresses, which is the first step when a user enters a URL. DHCP assigns IP addresses, NTP synchronizes time, and Syslog handles logging—none of these services resolve domain names to IP addresses. The web session itself uses HTTP or HTTPS later, but name resolution happens first.

Answer

DHCP

Answer

NTP

Answer

Syslog

Question 8

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

Accepted Answer

The interfaces are marked with inside and outside in the wrong places. NAT overload works only when the inside and outside interfaces are identified correctly. Here the roles are reversed, so translations are not built in the right direction.

Answer

The ACL should deny 192.168.20.0/24 instead of permit it

Answer

PAT cannot be used with a /30 WAN link

Answer

NAT overload requires a route-map instead of an ACL

Question 9

A client receives an IP address but cannot reach remote networks. Which DHCP option is most likely missing or incorrect?

Accepted Answer

Default gateway option. The client can obtain an IP address but cannot reach remote networks, which indicates that the DHCP server is not providing the default gateway (option 3). Without a default gateway, the client has no route to destinations outside its local subnet, so traffic to remote networks is dropped. The DHCP server must be configured to supply the router's IP address as the default gateway for clients to forward inter-network traffic.

Answer

DNS server option

Answer

Lease time option

Answer

TFTP server option

Question 10

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

Accepted Answer

The ACL should match the source port 80 on returning traffic, not the destination port 80. An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.

Answer

HTTP traffic can never be filtered with a standard ACL

Answer

The ACL must be applied outbound on the inside interface only

Answer

NAT automatically bypasses interface ACLs

Question 11

Users in 10.20.30.0/24 should be allowed to browse the web but should not be able to open Telnet sessions to any remote device. Which access list entry best meets the requirement?

Accepted Answer

deny tcp 10.20.30.0 0.0.0.255 any eq 23. Option A is correct because Telnet uses TCP port 23, and the entry `deny tcp 10.20.30.0 0.0.0.255 any eq 23` blocks outbound Telnet from the 10.20.30.0/24 subnet to any remote destination while leaving other traffic (such as web browsing) unaffected. The wildcard mask 0.0.0.255 correctly matches the /24 source subnet, and placing the source before `any` reflects traffic originating from those users. Option B is wrong because Telnet is TCP-based, not UDP, so denying UDP port 23 would not stop Telnet sessions. Option C reverses the source and destination, blocking Telnet destined to the users rather than originated by them. Option D is a permit for TCP port 80 (HTTP) and does not deny Telnet at all.

Answer

deny udp 10.20.30.0 0.0.0.255 any eq 23

Answer

deny tcp any 10.20.30.0 0.0.0.255 eq 23

Answer

permit tcp 10.20.30.0 0.0.0.255 any eq 80

Question 12

Match each network service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. Each network service has a distinct primary function: DNS translates names to IPs, DHCP automates IP assignment, NTP synchronizes time, SNMP manages devices, FTP transfers files, and HTTP serves web content.

Answer

DNS: Assigns IP addresses dynamically to devices on a network

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Manages and monitors network devices

Question 13

Inside hosts can reach the internet only one at a time. What is the most likely NAT issue?

Accepted Answer

The NAT statement is missing the overload keyword. Without overload, dynamic NAT uses one public address per internal session mapping. PAT with overload is what lets many inside hosts share a single outside interface address at the same time.

Answer

The access list should deny the inside subnet

Answer

The inside and outside interface roles are reversed in the exhibit

Answer

NAT cannot be used with RFC1918 addresses

Question 14

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

Accepted Answer

ip helper-address 10.99.99.10. DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Answer

ip default-gateway 10.20.20.1

Answer

switchport trunk allowed vlan 20

Answer

spanning-tree portfast default

Question 15

On a router performing NAT, where should ip nat inside be applied?

Accepted Answer

On the interface facing the internal private network. The inside designation belongs on the interface facing the private internal network. The outside designation belongs on the interface facing the public or external network.

Answer

On the interface facing the ISP only

Answer

On every routed interface on the router

Answer

Only on loopback interfaces