CCNA Network Services and Security Practice Test 5 — 15 Questions

Question 1

Which statement best explains why secure transport, identity verification, permission control, and logging are all useful together in device administration?

Accepted Answer

Because they address different parts of the administrative-security problem and work better together than alone.. They are useful together because each addresses a different aspect of administrative security. In practical terms, secure transport protects the session, authentication verifies identity, authorization limits actions, and logging provides accountability and visibility. No single one of these solves the whole problem by itself.

This is the practical meaning of layered control in management-plane security.

Answer

Because any one of them automatically replaces the others.

Answer

Because they are required only on wireless controllers.

Answer

Because they convert all APIs into CLI commands.

Question 2

Which statement best describes why engineers often compare 'works by IP' versus 'works by name' during troubleshooting?

Accepted Answer

Because it helps distinguish IP-path problems from DNS name-resolution problems.. Engineers compare those two tests because the difference helps separate raw IP reachability from name-resolution problems. In practical terms, if access works by IP but fails by name, the path probably exists and the fault is more likely in DNS. That comparison quickly narrows the problem space.

This is one of the most practical troubleshooting shortcuts in user-facing network support.

Answer

Because hostnames can be routed without IP addresses.

Answer

Because DNS replaces the need for routing tables.

Answer

Because named access requires PPP on the host.

Question 3

Which statement best describes why NetFlow, SNMP, and Syslog are often used together rather than treated as substitutes?

Accepted Answer

Because each provides a different kind of operational visibility and they complement one another.. They are often used together because each gives a different operational view. In practical terms, SNMP provides counters and monitored values, Syslog provides event messages, and NetFlow provides traffic-conversation visibility. One does not fully replace the others. Together they provide a more complete operating picture.

This is an important operations maturity concept because real troubleshooting usually needs multiple perspectives.

Answer

Because they are just three names for the same protocol family.

Answer

Because NetFlow automatically replaces both SNMP and Syslog once enabled.

Answer

Because only one of them can run at a time on a device.

Question 4

Which statement best describes why named accounts plus logging are stronger together than either control alone?

Accepted Answer

Because identity and event history together improve accountability and reviewability.. Named accounts plus logging are stronger together because identity without records leaves you with less visibility, while records without individual identity leave you with weak accountability. In practical terms, named accounts tell you who acted, and logs help show what happened and when. Together they support stronger auditability and incident response.

This is a practical security-operations principle, not just an abstract policy idea.

Answer

Because logging automatically creates named accounts.

Answer

Because named accounts eliminate the need for logs.

Answer

Because both controls exist only for wireless guest users.

Question 5

Which statement best describes why source restriction does not replace the need for strong authentication?

Accepted Answer

Because an allowed source location does not prove the identity of the person or system using it.. Source restriction does not replace strong authentication because knowing where a connection comes from is not the same as knowing who is actually using it. In practical terms, an allowed source network may still contain unauthorized users or compromised devices. Authentication is still needed to verify identity. These controls complement one another rather than replacing one another.

This is an important management-plane security concept because it emphasizes layered control rather than false trade-offs.

Answer

Because source restriction works only on IPv6 and authentication works only on IPv4.

Answer

Because authentication can be used only after OSPF adjacency forms.

Answer

Because source restriction automatically logs all device changes.

Question 6

Which statement best describes why a host might receive a correct IP address from DHCP but still fail to reach websites by name?

Accepted Answer

Because DNS service may still be missing, wrong, or unreachable even if DHCP addressing succeeds.. The host may still fail by name because DHCP-provided addressing is only part of the connectivity picture. In practical terms, the client can have a valid IP address and even a valid gateway, but if DNS information is missing, wrong, or unreachable, name-based access still fails. That means DHCP success does not guarantee application usability by hostname.

This is an important user-facing troubleshooting distinction because many people treat 'got an IP address' as if it means every service should work automatically.

Answer

Because DHCP automatically disables DNS on modern hosts.

Answer

Because websites by name require PPP authentication on the host.

Answer

Because a DHCP address can be used only for local subnet traffic.

Question 7

What is the main purpose of a YANG data model in network automation?

Accepted Answer

To define a structured data model for network configuration and state. YANG provides a structured way to model configuration and operational data so devices and controllers can exchange information consistently. It is not a transport protocol by itself and it does not replace IP routing.

Answer

To encrypt API traffic between the controller and device

Answer

To replace JSON with a Layer 2 framing standard

Answer

To elect a controller as the root bridge

Question 8

Which statement best describes model-driven telemetry compared with traditional SNMP polling?

Accepted Answer

It streams subscribed operational data from the device to a collector.. Model-driven telemetry streams selected operational data from the device to a collector, often at higher frequency and with less poll overhead than repeated SNMP queries. SNMP polling is still useful, but telemetry is designed for more efficient and near-real-time data collection at scale.

Answer

It relies on repeatedly polling OIDs one by one from the collector.

Answer

It can be used only when the device is managed through a console cable.

Answer

It replaces the need for APIs and data models such as YANG.

Question 9

Which statement accurately describes JSON in a network automation workflow?

Accepted Answer

It is a data-interchange format commonly used to represent structured API data.. JSON is a lightweight data-interchange format that represents data as key-value pairs and arrays. It is commonly used in REST APIs because it is easy for both machines and humans to parse. It is not a transport protocol or a data model language like YANG.

Answer

It is a secure transport protocol that replaces HTTPS for APIs.

Answer

It is a Cisco-specific scripting language for device configuration.

Answer

It is the same thing as YANG, just written with braces instead of XML tags.

Question 10

Which statement about DHCP address exclusion is correct?

Accepted Answer

It reserves part of the pool so those addresses are not leased dynamically. Excluded addresses define IPs that the DHCP server must not lease to clients. They are commonly used for devices that need static addresses such as printers, gateways, or servers within the same subnet.

Answer

It prevents the router from acting as a DHCP relay agent

Answer

It forces clients to renew their leases every time they reboot

Answer

It converts a dynamic pool into a static mapping table

Question 11

Which statement about NetFlow is correct?

Accepted Answer

It provides flow-based traffic visibility and usage information. NetFlow records metadata about traffic flows, such as source and destination addresses, ports, protocols, and counters. It is used for visibility and traffic analysis, not for carrying user packets.

Answer

It encrypts traffic between branch routers

Answer

It replaces routing protocols on WAN links

Answer

It synchronizes clocks for telemetry exports

Question 12

Which syslog severity is more critical: level 2 or level 5?

Accepted Answer

Level 5. In syslog, higher numeric values indicate higher severity. Level 5 is therefore more critical than level 2.

Answer

Level 2

Answer

They are equal

Answer

It depends on platform model

Question 13

Match each IP service to its primary function.

Accepted Answer

DHCP: Automatically assigns IP addresses to hosts. DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and other network configuration parameters to hosts, simplifying IP address management. DNS (Domain Name System) resolves human-readable domain names (e.g., www.example.com) into IP addresses, enabling devices to locate resources using names. NAT (Network Address Translation) translates private IP addresses to public IP addresses, allowing multiple devices on a local network to share a single public IP for internet access. SNMP (Simple Network Management Protocol) monitors and manages network devices by collecting and organizing information about device performance and status.

Question 14

Which option accurately describes static NAT?

Accepted Answer

A one-to-one mapping between a private IP address and a public IP address, configured manually and remaining constant.. Inside local is the private IP address assigned to a host inside the internal network. Inside global is the public IP address that represents that internal host to external networks. Static NAT creates a permanent one-to-one mapping between an inside local and an inside global address. PAT (Port Address Translation) extends NAT by using port numbers to map multiple inside local addresses to a single inside global address.

Answer

A many-to-one mapping where multiple private IP addresses share a single public IP address, distinguished by port numbers.

Answer

A dynamic mapping where private IP addresses are translated to public IP addresses from a pool, without port translation.

Answer

A special IP address (127.0.0.1) used by a host to send traffic to itself for testing and loopback purposes.

Question 15

Match each security term to its most accurate meaning.

Accepted Answer

Phishing: An attack that uses deceptive emails or websites to trick users into revealing sensitive information.. Phishing is a social engineering attack where attackers use deceptive emails or websites to trick users into revealing sensitive information such as login credentials or credit card numbers. This is the correct match for the term 'Phishing'. The other options are incorrect because they describe ransomware (encrypts data and demands payment), DDoS (overwhelms a server with traffic), and man-in-the-middle (intercepts communication).

Answer

Phishing: An attack that encrypts a victim's data and demands payment for the decryption key.

Answer

Phishing: An attack that overwhelms a server with traffic to make it unavailable to users.

Answer

Phishing: An attack that intercepts communication between two parties to eavesdrop or alter data.