CCNA Network Services and Security Practice Test 29 — 15 Questions

Question 1

Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?

Accepted Answer

The server is reachable but not the one currently selected for synchronization. In Cisco NTP output, the asterisk (*) indicates the current synchronization source. The tilde (~) specifically means the server is statically configured and reachable but has not been selected for synchronization. This differs from the plus sign (+), which denotes a candidate for synchronization. Therefore, the router is not using that server as its active time source.

Answer

That server is the current system clock source

Answer

NTP authentication has disabled the server permanently

Answer

The router is acting as an NTP master for that server

Question 2

A switch port is configured with port-security violation mode restrict. Which two statements are true when an unauthorized MAC address appears?

Accepted Answer

Frames from the unauthorized MAC are dropped. Restrict drops frames from violating MAC addresses and can increment the violation counter while keeping the port up. Shutdown would err-disable the port instead.

Answer

The interface immediately goes into err-disabled state

Answer

The switch converts the port to a trunk automatically

Answer

The violation mode changes itself to shutdown after three attempts

Question 3

A named standard ACL is configured to permit only the 192.168.30.0/24 subnet, but users from 192.168.31.0/24 are still passing traffic. What is the most likely reason?

Accepted Answer

The ACL is probably applied in the wrong place or direction for the traffic flow. Standard ACLs filter traffic based solely on the source IP address. If users from 192.168.31.0/24 are still passing traffic despite the ACL permitting only 192.168.30.0/24, the most likely reason is that the ACL is applied in the wrong place or direction. For example, if the ACL is applied inbound on an interface where traffic from 192.168.31.0/24 does not enter, or outbound on an interface where the traffic does not exit, the filter will not affect the intended flow. The implicit deny statement denies all unmatched traffic, so if the ACL were correctly placed, traffic from 192.168.31.0/24 would be denied.

Answer

Standard ACLs cannot match source addresses

Answer

Named ACLs ignore wildcard masks

Answer

The deny any line must appear before the permit

Question 4

A router is configured for PAT overload. What does the inside global address represent for an internal PC?

Accepted Answer

The public address that represents the internal PC to external networks. With NAT overload, the inside local address is the private address on the internal host. The inside global is the translated public address that represents that inside host to the outside network.

Answer

The private IP address assigned to the internal PC

Answer

The remote server address as seen from the inside host

Answer

The MAC address of the outside interface

Question 5

Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?

Accepted Answer

Configure NTP on the network devices. Option A is correct because configuring NTP on the routers synchronizes their clocks to a common, authoritative time source, which is the fundamental fix for timestamps that do not align across devices. Option B is correct because even with NTP running, mismatched timezone or timestamp service settings (for example, 'service timestamps log datetime localtime' versus UTC, or an incorrect clock timezone offset) will make log entries appear inconsistent, so these settings must be verified. Option C is wrong because raising the syslog severity threshold to debugging only increases the volume and detail of logged messages; it does nothing to correct clock skew. Option D is wrong because disabling console logging merely stops messages from being displayed on the console and does not affect timestamp accuracy. Option E is wrong because clearing the logging buffer only discards stored log entries and has no effect on the time synchronization or timestamp formatting of future messages.

Answer

Increase the syslog severity threshold to debugging

Answer

Disable console logging

Answer

Clear the logging buffer on all devices

Question 6

Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?

Accepted Answer

NetFlow can export flow data to a collector. NetFlow exports flow records to a collector and is useful for traffic analysis and accounting visibility, enabling identification of top talkers and application usage (options A and B are correct). Syslog reports events and messages, but does not replace flow records for conversation-level traffic statistics, so option C is incorrect. NetFlow does not replace routing protocols for path selection; it is a traffic monitoring tool, not a routing mechanism, so option D is incorrect. NetFlow works on routers and Layer 3 switches, not only Layer 2 switches, so option E is incorrect.

Answer

Syslog and NetFlow are the same feature with different names

Answer

NetFlow replaces routing protocols for path selection

Answer

NetFlow only works on Layer 2 switches and never on routers

Question 7

Which two statements correctly describe syslog severity levels?

Accepted Answer

Level 0 is the most severe. Syslog uses numbered severity levels where lower numbers indicate more critical events. Level 0 (Emergency) is the most severe, and Level 7 (Debugging) is the least. Option D is incorrect because severity levels are a syslog function, not specific to NTP. Option E is wrong because syslog defines eight severity levels (0–7), not four.

Answer

Higher numbers always mean more critical issues

Answer

Severity levels are used only by NTP

Answer

Syslog has only four severity levels

Question 8

Which two actions help protect access-layer switch ports from rogue DHCP servers?

Accepted Answer

Enable DHCP snooping globally and for the needed VLANs. DHCP snooping marks trusted and untrusted interfaces and filters server-type DHCP messages on untrusted ports. Uplink ports toward the real DHCP server or relay are typically trusted, while user-facing ports stay untrusted. Option C is incorrect because PortFast does not filter DHCP messages; it only speeds up spanning tree convergence. Option D is incorrect because disabling ARP breaks normal communication and does not block DHCP. Option E is incorrect because marking all access ports as trusted would permit rogue DHCP servers on those ports.

Answer

Enable PortFast on all trunks to block rogue servers

Answer

Disable ARP on access ports

Answer

Set every access port as trusted

Question 9

Which protocol is used to resolve a hostname such as www.example.com into an IP address?

Accepted Answer

DNS. DNS resolves names to addresses. DHCP hands out addressing parameters, NTP synchronizes time, and SNMP is used for management and monitoring.

Answer

DHCP

Answer

NTP

Answer

SNMP

Question 10

A branch router is acting as a DHCP server. Which two parameters can it provide directly to clients through DHCP?

Accepted Answer

Default gateway. DHCP (Dynamic Host Configuration Protocol) is designed to automatically assign IP configuration parameters to clients. The default gateway (option 3) and DNS server address (option 6) are standard DHCP options defined in RFC 2132, which a router acting as a DHCP server can directly provide to clients to enable network connectivity and name resolution.

Answer

OSPF area number

Answer

Switch port duplex setting

Answer

STP root bridge priority

Question 11

A router is configured as a DHCP server for VLAN 20. Clients on the VLAN can reach the default gateway, but they do not receive leases. Which two configuration issues on the router would directly prevent successful address assignment?

Accepted Answer

The excluded-address range removes the entire usable subnet. The router can serve DHCP locally without an ip helper-address. The real problem is that the excluded-address range consumes every usable host address, leaving the pool with no assignable leases.

Answer

The DHCP pool is missing a dns-server statement

Answer

The subinterface lacks an ip helper-address

Question 12

A company wants all routers and switches to use a common time source so log timestamps line up during incident review. Which two statements about NTP are correct?

Accepted Answer

It helps synchronize device clocks. NTP (Network Time Protocol) is used to synchronize device clocks (option A) so that event timestamps are consistent across network devices, which improves correlation of syslog and other event data (option B). Option C is incorrect because NTP does not advertise Layer 3 reachability; that is a function of routing protocols like OSPF or EIGRP. Option D is incorrect because NTP does not encrypt data traffic by default; it only synchronizes time and does not provide encryption.

Answer

It advertises Layer 3 reachability between routers

Answer

It encrypts data traffic between endpoints by default

Question 13

Users can browse websites by IP address but not by hostname. The default gateway is reachable and general internet connectivity works. Which two causes are the most likely?

Accepted Answer

The clients are missing a valid DNS server setting. If IP connectivity works but hostnames fail, the problem is usually DNS configuration or DNS reachability, not general routing.

Answer

The routers are missing NTP configuration

Answer

The switch access ports should be changed to dynamic desirable

Question 14

A network team wants to collect flow-level traffic statistics from routers to identify top talkers and bandwidth consumers. Which two statements about NetFlow are correct?

Accepted Answer

It summarizes traffic into flows instead of capturing every packet payload. NetFlow provides visibility into who is talking to whom, with what protocols and volume, making it valuable for capacity planning, troubleshooting, and security analysis.

Answer

It is primarily used to distribute time from an authoritative clock

Answer

It replaces routing protocols by advertising reachability information

Question 15

A branch office uses PAT overload on the edge router. Inside users can reach the internet, but return traffic for a newly deployed server must be mapped to a specific inside host. Which two statements are correct?

Accepted Answer

A static NAT entry can provide a consistent public-to-private mapping for the server. PAT overload is great for many inside clients sharing a public IP for outbound sessions. A public-facing server that needs predictable inbound reachability typically requires static NAT or static PAT.

Answer

Dynamic NAT always supports inbound access without additional configuration

Answer

NAT is unrelated to whether private addresses can reach the public internet