CCNA Network Services and Security Practice Test 6 — 15 Questions

Question 1

A host can reach local devices but cannot reach the Internet. The host has a correct IP address and subnet mask, but no default gateway. What is the best explanation?

Accepted Answer

The host can reach only local subnet destinations because it lacks a next hop for remote networks. The host can communicate only within its own local subnet because it lacks the next-hop information needed for off-subnet traffic. A valid IP address and subnet mask are not enough to reach remote networks without a default gateway. Option D is not the best explanation because proxy ARP may allow off-subnet reachability in some cases, but it is a workaround, not the reason for the host's current failure; the immediate cause is the missing default gateway, which provides the next hop for routing.

Answer

The host automatically uses ARP to reach all Internet destinations directly

Answer

The subnet mask alone should be enough to reach all networks

Answer

The host can still reach Internet destinations if proxy ARP is enabled on the router.

Question 2

Match each AAA component or related term to its most accurate meaning.

Accepted Answer

Authentication: Verifies the identity of a user or device before granting access to the network.. All four options correctly match AAA components/related terms to their meanings: Authentication verifies identity, Authorization determines permissions, Accounting logs activities, and RADIUS is a protocol providing AAA services. Therefore, all options A, B, C, and D are correct.

Question 3

Which two statements accurately describe basic WLAN security at the CCNA level?

Accepted Answer

WPA2 is generally considered stronger than WEP for wireless security.. WPA2 uses AES-CCMP encryption and is much stronger than WEP, which uses weak RC4. Open wireless networks (no security) provide no encryption, so they are less secure than a secured WLAN. Option B is false because open networks have no default encryption. Option D is false because SSID length does not affect WEP's cryptographic strength; WEP is inherently weak regardless of SSID. Option E is false because WPA2 relies on AES-CCMP encryption, not TKIP; TKIP is used in the older WPA standard.

Answer

Open wireless access provides meaningful default encryption.

Answer

A longer SSID makes WEP cryptographically strong.

Answer

WPA2 relies on TKIP encryption

Question 4

Match each common IP service to its primary purpose.

Accepted Answer

SSH: Encrypted remote management; NTP: Time synchronization; DNS: Name resolution; AAA: Authentication, authorization, and accounting; Syslog: Event logging. SSH provides encrypted remote management of network devices, unlike Telnet which is unencrypted. NTP synchronizes clocks across network devices for consistent timestamps. DNS maps domain names to IP addresses, enabling name resolution. AAA (Authentication, Authorization, and Accounting) controls access to network resources and tracks user activities. Syslog collects and stores event messages from network devices for monitoring and troubleshooting. These services are commonly assessed in the CCNA exam.

Answer

SSH: Unencrypted remote management; NTP: File transfer; DNS: IP address assignment; AAA: Encryption; Syslog: Time synchronization

Answer

SSH: Encrypted remote management; NTP: Time synchronization; DNS: IP address assignment; AAA: Event logging; Syslog: Authentication

Answer

SSH: Unencrypted remote management; NTP: Time synchronization; DNS: Name resolution; AAA: Encryption; Syslog: Event logging

Question 5

Match each security concept to its most accurate role.

Accepted Answer

Confidentiality ensures that data is accessible only to authorized users, typically through encryption.. Confidentiality, integrity, and availability are the CIA triad, each correctly defined. Authentication is also correctly defined as verifying identity. Therefore, all options are valid.

Question 6

Match each remote-management concept to its most accurate description.

Accepted Answer

Telnet: Unencrypted remote access to network devices. Each option correctly matches a remote-management concept to its description: Telnet is unencrypted, SSH is encrypted, RDP provides GUI access to Windows desktops, and console is a physical serial connection for out-of-band management. Therefore, all options A, B, C, and D are valid matches.

Question 7

Match each security term to the question it most directly answers.

Accepted Answer

Confidentiality: Who can access the data?. Each security term is paired with the question it most directly answers. Authentication, Authorization, and Accounting form the AAA framework: Authentication verifies identity (Who are you?), Authorization determines permissions (What are you allowed to do?), and Accounting tracks user activity (What happened during the session?). Availability is part of the CIA triad (Confidentiality, Integrity, Availability) and addresses whether a system or service is accessible when needed (Can the system or service be accessed when needed?).

Question 8

Match each security control idea to its most accurate purpose.

Accepted Answer

Firewall: Filters traffic based on security rules.. A firewall filters traffic based on rules to allow or block connections, primarily using source/destination IPs and ports. Option B describes an IDS/IPS, which uses signatures to detect and block malicious patterns. Option C describes a DLP solution, which monitors outbound data for sensitive information. Option D describes a WAF, which protects web applications from attacks like SQL injection. Therefore, only option A correctly matches the firewall's purpose.

Answer

Firewall: Detects and blocks malicious traffic patterns using signatures.

Answer

Firewall: Prevents data loss by monitoring outbound traffic for sensitive data.

Answer

Firewall: Protects web applications from attacks like SQL injection.

Question 9

Match each service or protocol to the problem it most directly helps solve.

Accepted Answer

DNS: Resolves hostnames to IP addresses. Each service or protocol listed directly solves a specific networking problem as described. DNS resolves names to IPs, DHCP automates IP assignment, NTP synchronizes clocks, and SNMP monitors devices. All options are correctly matched.

Question 10

Match each access-control concept to its most accurate meaning.

Accepted Answer

Subject: An entity that requests access to an object.. In access control, the 'subject' is the active entity (user, device, process) that requests access to a resource (the 'object'). Option A correctly defines this. Option B describes an object, not a subject. Option C describes permissions or authorization rules. Option D describes an access control list (ACL), which associates permissions with an object. Therefore, only A is correct.

Answer

Subject: A resource or data that is being protected.

Answer

Subject: A set of permissions that define allowed actions.

Answer

Subject: A list of permissions associated with an object.

Question 11

Match each security-related term to its most accurate meaning.

Accepted Answer

Phishing: A technique that uses deceptive messages to trick individuals into revealing sensitive information.. Phishing is a social engineering technique that uses deceptive emails or messages to trick recipients into revealing sensitive information such as passwords. Ransomware is a type of malware that encrypts files and demands payment for the decryption key. DDoS (Distributed Denial of Service) attacks overwhelm a target with traffic from multiple sources, causing service disruption. MitM (Man-in-the-Middle) attacks occur when an attacker secretly intercepts and relays communications between two parties, potentially stealing data or injecting malicious content. Each term is correctly matched to its description.

Answer

Ransomware: A type of malware that encrypts a victim's files and demands payment for the decryption key.

Answer

DDoS: An attack that overwhelms a target with traffic from multiple sources, causing service disruption.

Answer

MitM: An attack where the attacker secretly intercepts and relays communications between two parties.

Question 12

Match each infrastructure service to the operational problem it most directly addresses.

Accepted Answer

DNS: Resolves domain names to IP addresses. DNS (Domain Name System) resolves human-readable domain names to IP addresses. Option A is correct because it accurately describes this function. Options B, C, and D are incorrect because they describe the functions of DHCP (dynamic IP assignment), NTP (time synchronization), and SNMP (network monitoring), respectively.

Answer

DNS: Assigns IP addresses to hosts dynamically

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Monitors network device health and performance

Question 13

Match each basic security term to its most accurate meaning.

Accepted Answer

Vulnerability: A weakness in a system or its design that could be exploited.. The correct definition of a vulnerability is a weakness in a system or its design that could be exploited. A threat is a potential danger that might exploit a weakness. Risk is the likelihood and potential impact of a threat exploiting a weakness. An exploit is an action or code that takes advantage of a weakness. Option A correctly matches 'weakness' to vulnerability, while options B, C, and D describe threat, risk, and exploit respectively.

Answer

Vulnerability: A potential danger that might exploit a weakness to cause harm.

Answer

Vulnerability: The likelihood and potential impact of a threat exploiting a weakness.

Answer

Vulnerability: An action or code that takes advantage of a weakness to cause harm.

Question 14

Match each management or monitoring concept to its most accurate role.

Accepted Answer

SIEM: Centralizes and correlates log data from multiple sources for security analysis.. SIEM (Security Information and Event Management) systems aggregate and correlate log data from various sources such as servers, network devices, and applications. They provide real-time analysis of security alerts generated by hardware and software. Option A correctly describes this role. Option B is incorrect because managing network device configurations and monitoring device health via SNMP is the function of Network Management Systems (NMS), not SIEM. Option C is incorrect because analyzing network traffic flows for bandwidth and performance is typically done by flow analysis tools like NetFlow or sFlow, not SIEM. Option D is incorrect because controlling user access based on roles is the function of AAA (Authentication, Authorization, and Accounting) or RBAC (Role-Based Access Control) systems, not SIEM.

Answer

SIEM: Manages network device configurations and monitors device health via SNMP.

Answer

SIEM: Analyzes network traffic flows to identify bandwidth usage and application performance.

Answer

SIEM: Controls user access to network resources based on roles and policies.

Question 15

Match each service to the issue it most directly addresses.

Accepted Answer

DNS: Resolves domain names to IP addresses. Each service directly addresses a specific network issue: DNS resolves names, DHCP assigns IPs, NTP syncs time, SNMP manages devices, Syslog collects logs, and NetFlow analyzes traffic.

Answer

DHCP: Synchronizes time across network devices

Answer

NTP: Collects and stores system logs

Answer

SNMP: Analyzes network traffic flows