CCNA Network Services and Security Practice Test 28 — 15 Questions

Question 1

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Accepted Answer

The NTP server is unsynchronized or unreachable. NTP requires IP reachability to the time source. If the NTP server is unreachable due to routing or ACL issues, the switch falls back to its local clock, causing drift. Option A is correct. Option B is wrong because Syslog has no effect on NTP synchronization. Option C is incorrect because NTP does not require a trunk port; it can operate over any VLAN with IP connectivity. Option D is false because DNS is only needed if the NTP server is specified by hostname; the server can be reached by IP address without DNS.

Answer

The device must run Syslog before NTP can sync

Answer

NTP requires a trunk port on the management VLAN

Answer

The clock can sync only if DNS is configured

Question 2

Exhibit: An engineer wants a device to send only warning messages and more critical events to a syslog server. Which logging level should be configured?

Accepted Answer

logging trap warnings. Syslog severity levels include lower numbers for more severe events. Warning is level 4, so setting logging trap warnings sends level 4, 3, 2, 1, and 0 messages.

Answer

logging trap debugging

Answer

logging trap notifications

Answer

logging trap informational

Question 3

Exhibit: A user can ping 8.8.8.8 successfully but cannot browse to www.example.com by name. Which service is the most likely failing component?

Accepted Answer

DNS. If connectivity to an IP address works but name-based access fails, the path is up and the problem is usually name resolution. DNS is the service that translates hostnames into IP addresses.

Answer

NTP

Answer

Syslog

Answer

CDP

Question 4

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

Accepted Answer

PAT overload. When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.

Answer

Static NAT

Answer

Policy-based routing

Answer

Port security

Question 5

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Accepted Answer

logging host 10.10.10.50. One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Answer

ip helper-address 10.10.10.50

Answer

snmp-server host 10.10.10.60

Answer

service timestamps log localtime

Question 6

A DHCP client on VLAN 30 is not receiving an IP address from a DHCP server (10.99.99.20) on another subnet. The SVI for VLAN 30 is configured with an IP address and is up, but the DHCP relay command is missing. Which command should be added to the SVI configuration?

Accepted Answer

ip helper-address 10.99.99.20. DHCP Discover messages are broadcasts and do not cross routers by default. On an SVI or routed interface facing the clients, an ip helper-address relays those broadcasts to the DHCP server on another subnet.

Answer

ip directed-broadcast

Answer

service dhcp-server 10.99.99.20

Answer

default-router 10.99.99.20

Question 7

A branch router should automatically learn the IP address of a time source so logs from all devices show matching timestamps. Which service provides that function?

Accepted Answer

NTP. NTP synchronizes clocks across network devices. When timestamps line up, syslog messages and troubleshooting output become much more useful.

Answer

DNS

Answer

TFTP

Answer

NetFlow

Question 8

A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?

Accepted Answer

permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443. To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.

Answer

permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443

Answer

deny tcp any 10.1.50.0 0.0.0.255 eq 23

Answer

permit ip any any

Question 9

Exhibit: Hosts on the inside network can reach the internet, but inbound connections to a published web server fail. Static NAT is configured. What is the most likely missing piece?

Accepted Answer

An ACL permit entry allowing TCP port 80 or 443 to the translated address. Static NAT provides the address translation, but traffic still must be permitted by an inbound ACL or firewall policy on the outside interface. Option A is incorrect because a default route on the inside host affects outbound traffic, not inbound connections. Option C is wrong since PAT overload is for many-to-one translation and is not required here, and it would not block inbound traffic if static NAT is already configured. Option D is incorrect because DHCP relay does not influence inbound access to a web server; it only forwards DHCP requests from clients to a remote DHCP server.

Answer

A default route on the inside host

Answer

PAT overload on the outside interface

Answer

DHCP relay toward the web server

Question 10

Exhibit: A network engineer wants to identify which applications are consuming most WAN bandwidth over time. Which feature should be enabled on the router?

Accepted Answer

NetFlow. NetFlow records conversations and traffic characteristics so an external collector can analyze top talkers, protocols, and usage trends. Syslog and SNMP have different purposes.

Answer

NTP authentication

Answer

DNS forwarding

Answer

DHCP snooping

Question 11

Port security is enabled with a maximum of 2 MAC addresses, but a third device connected through a small hub causes a violation. Which result is expected in restrict mode?

Accepted Answer

Frames from the unknown MAC are dropped and the violation is counted. In restrict mode, the switch drops frames from unknown source MAC addresses and increments the violation counter, but the port stays up. That is less disruptive than shutdown mode.

Answer

The port goes immediately to err-disabled state

Answer

The switch learns the third MAC after 30 seconds automatically

Answer

STP blocks the port until the MAC table ages out

Question 12

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

Accepted Answer

The outside interface is missing the ip nat outside command. NAT needs the inside and outside interfaces marked correctly. If those roles are missing or reversed, the router has no context for translating traffic and the NAT table stays empty.

Answer

The ACL used by NAT must deny inside addresses

Answer

PAT requires DHCP on the inside interface

Answer

NAT overload works only with OSPF-learned routes

Question 13

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Accepted Answer

The ACL is applied in the wrong place or direction. The most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.

Answer

The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255

Answer

Standard ACLs should always be used for Telnet filtering

Answer

The router must run PAT before ACLs can filter Telnet

Question 14

Users receive addresses from the correct subnet and can reach destinations by IP address, but they cannot browse by hostname.

Accepted Answer

DNS server option. If clients get an IP address and default gateway but cannot resolve names, the usual problem is the DNS server information handed out by DHCP. Without that, hostname lookups fail even though IP connectivity may still exist.

Answer

Default-router option

Answer

Lease time option

Answer

TFTP server option

Question 15

A small office wants branch routers to automatically hand out IP addresses, default gateway values, and DNS servers to clients. Which service should be configured?

Accepted Answer

DHCP. DHCP is built for this exact job. It centrally provides addressing details so endpoints do not need to be configured by hand.

Answer

DNS

Answer

NTP

Answer

TACACS+