CCNA Network Services and Security Practice Test 8 — 15 Questions

Question 1

Match each observation to the service area it most strongly suggests first.

Accepted Answer

High CPU utilization on a router. High CPU utilization on a router most strongly suggests a network infrastructure issue, such as routing process overload, high traffic, or resource exhaustion. CRC errors on an interface point to a physical layer problem, such as faulty cabling or hardware. Authentication failures in logs indicate a security issue, such as unauthorized access attempts. High latency on a link suggests a transport layer or network congestion issue.

Question 2

Match each user or host symptom to the service most directly suggested first.

Accepted Answer

Cannot access any websites. The most direct cause of a user being unable to access any websites is a DNS resolution failure. DNS translates domain names (e.g., www.example.com) into IP addresses; without it, the device cannot resolve any website names. Option B (cannot access specific websites) suggests a firewall or proxy issue, not DNS. Option C (intermittent connectivity) points to physical or network layer problems. Option D (duplicate IP address) indicates a DHCP or static configuration conflict.

Answer

Cannot access specific websites

Answer

Intermittent connectivity loss

Answer

Duplicate IP address error

Question 3

What is the strongest explanation for why hosts in VLAN 40 are receiving addresses from the wrong DHCP scope?

Accepted Answer

The relay path is sending requests to the wrong DHCP scope or server target.. The DHCP relay agent (typically configured on the VLAN 40 SVI with the 'ip helper-address' command) is forwarding client broadcast requests to a DHCP server that either has no scope for VLAN 40 or has a scope configured for a different subnet. This causes the server to assign an address from the wrong scope, as the relay agent does not filter by scope—it simply forwards the packet to the configured server IP.

Answer

The VLAN 40 SVI must be changed to a trunk port.

Answer

DHCP can provide only one scope in the entire network.

Answer

The clients must use static addresses before DHCP relay can work.

Question 4

On a user access port, port security is configured with a maximum of 2 MAC addresses and violation mode restrict. A third unauthorized device is connected through a small unmanaged switch. What happens?

Accepted Answer

Traffic from the unauthorized MAC is dropped, but the interface stays up.. In restrict mode, frames from unknown MAC addresses are dropped, the violation counter increments, and logging or SNMP traps can be generated. Unlike shutdown mode, the interface does not go err-disabled.

Answer

The port goes err-disabled immediately.

Answer

The switch learns the third MAC after aging out the first one instantly.

Answer

All traffic from the port is flooded to the VLAN for analysis.

Question 5

R1 has the following static routes configured:

ip route 172.16.50.0 255.255.255.0 10.1.1.2
ip route 172.16.50.0 255.255.255.0 10.2.2.2 5
ip route 0.0.0.0 0.0.0.0 10.3.3.2

When the primary WAN path is up, which route will be installed in the routing table for traffic to 172.16.50.0/24?

Accepted Answer

The route via 10.1.1.2. The route with the lowest administrative distance wins when multiple routes to the same prefix exist. The route via 10.1.1.2 has AD 1, so it is preferred over the floating static route with AD 5. The default route is less specific and does not beat an exact /24 match.

Answer

The route via 10.2.2.2

Answer

The default route via 10.3.3.2

Answer

Both routes load-balance automatically because the prefix is identical.

Question 6

Based on the JSON snippet below, which statement is correct?

{
  "device": {
    "hostname": "R1",
    "interfaces": [
      {"name": "Gig0/0", "status": "up"},
      {"name": "Gig0/1", "status": "down"}
    ]
  }
}

Accepted Answer

interfaces is a JSON array containing two objects.. The value associated with interfaces is an array because it is enclosed in square brackets and contains multiple objects. The device element itself is an object, and each interface entry inside the array is also an object.

Answer

device is a JSON array.

Answer

status is a JSON array with two strings.

Answer

hostname is a nested array under interfaces.

Question 7

Which Syslog severity level represents an emergency condition, the most critical level?

Accepted Answer

0. Syslog severity 0 is Emergency, the highest severity. The levels then increase numerically as urgency decreases, with 7 being Debugging.

Answer

3

Answer

5

Answer

7

Question 8

Match each IP service to the transport protocol and default port it commonly uses in a basic CCNA context.

Accepted Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: UDP 53. Each IP service has a well-known default transport protocol and port number. HTTP and HTTPS always use TCP for reliable web traffic (ports 80 and 443 respectively). FTP control uses TCP port 21 (the data channel uses TCP 20, but that is not part of this matching). SSH and Telnet both use TCP for remote access, on ports 22 and 23 respectively. DNS primarily uses UDP port 53 for standard queries because it is faster and has low overhead; TCP 53 is reserved for zone transfers and is not considered in a basic CCNA context. Therefore, option A correctly matches all services.

Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 20; SSH: TCP 22; Telnet: TCP 23; DNS: TCP 53

Answer

HTTP/HTTPS: UDP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: UDP 53

Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: TCP 53

Question 9

Clients can join the Guest SSID and authenticate successfully, but they never receive an IP address. The DHCP scope for the guest network exists on the server. Based on the exhibit, what is the most likely cause?

Accepted Answer

The AP trunk is not allowing VLAN 300.. The Guest SSID is mapped to VLAN 300, but the switch trunk toward the AP allows only VLANs 10,20,30. Client traffic for the guest WLAN never reaches the correct VLAN upstream, so DHCP requests for that WLAN fail. Authentication can still succeed depending on how the WLAN is designed.

Answer

The DHCP server must use TCP instead of UDP.

Answer

The SSID name must match the DHCP pool name.

Answer

The AP should be configured as an access port for VLAN 1.

Question 10

Match each route source to its default administrative distance on a Cisco router.

Accepted Answer

Connected: 0, Static: 1, EIGRP summary: 5, OSPF: 110, IS-IS: 115, RIP: 120. Default administrative distances on Cisco routers: connected=0, static=1, EIGRP summary=5, OSPF=110, IS-IS=115, RIP=120. Lower value indicates higher preference.

Answer

Connected: 0, Static: 1, EIGRP summary: 90, OSPF: 110, IS-IS: 115, RIP: 120

Answer

Connected: 0, Static: 1, EIGRP summary: 5, OSPF: 110, IS-IS: 115, RIP: 130

Answer

Connected: 0, Static: 1, EIGRP summary: 5, OSPF: 100, IS-IS: 115, RIP: 120

Question 11

R1 learns the route 192.0.2.0/24 via OSPF, RIP, and a static route configured with an administrative distance of 130. Based on this information, which statement is correct?

Accepted Answer

The OSPF route is installed because its administrative distance is lower than RIP and the floating static route.. Cisco routers use administrative distance to select the best route among routes to the same prefix from different protocols. Default ADs: OSPF=110, RIP=120, floating static=130. OSPF has the lowest AD, so it is installed. If OSPF disappears, RIP would be installed next, and the static would only be used if both OSPF and RIP disappear. Therefore, statement C is not accurate.

Answer

The static route will be preferred because static routes always beat dynamic routes.

Answer

The static route acts as a backup and can be installed if the OSPF route disappears.

Answer

RIP wins because its metric is lower than OSPF cost.

Answer

All three routes should load-balance because the prefix length is the same.

Question 12

Match each management or monitoring technology to its primary purpose.

Accepted Answer

SNMP: Collects and organizes information about managed devices on IP networks. SNMP (Simple Network Management Protocol) is used for collecting and organizing information about managed devices on IP networks, often via polling. Syslog is a standard for message logging used for system management and security auditing, where devices send log messages to a central server. NetFlow provides visibility into network traffic flows by capturing metadata about IP traffic for analysis and monitoring. WMI (Windows Management Instrumentation) is Microsoft's implementation of management standards that allows for managing Windows systems through scripts and tools.

Question 13

A collector is not receiving flow records from a branch router. Based on the exhibit, what is the most likely issue?

Accepted Answer

The exporter source interface does not match what the collector expects.. The exporter is configured to send records out the wrong interface. NetFlow exports must use a source interface that has a valid path to the collector and typically matches the interface the collector expects. The collector IP itself is correct in the example, but the source interface selection is wrong.

Answer

The export destination port 2055 is invalid for flow export.

Answer

NetFlow can run only on serial interfaces.

Answer

The router must use TCP instead of UDP to export flows.

Question 14

A branch router is configured for NAT overload. The inside interface Gi0/0 is correctly marked ip nat inside, and the outside interface Gi0/1 is ip nat outside. The NAT statement uses access-list 1 permit 10.1.1.0 0.0.0.255 with ip nat inside source list 1 interface Gi0/1 overload. Inside hosts are in the 192.168.1.0/24 subnet and still reach the ISP with their private addresses. What is the most likely reason?

Accepted Answer

The ACL used for NAT does not match the inside client subnet.. The ACL matches the wrong inside subnet. NAT overload will only translate traffic that matches the source list or route map tied to the NAT statement. The interfaces are marked inside and outside correctly, so the bad match criteria is the most likely failure point.

Answer

GigabitEthernet0/0 should be configured as ip nat inside.

Answer

PAT cannot use an interface address as the translated source.

Answer

The router must run OSPF before NAT overload can function.

Question 15

A network team wants all devices to timestamp logs consistently so event correlation works across routers, switches, and firewalls. Which service should they configure first?

Accepted Answer

NTP. NTP provides consistent time across the infrastructure. Syslog carries log messages, but if device clocks are wrong, the log entries will still be hard to correlate. Accurate time is a foundational service for troubleshooting and forensics.

Answer

DNS

Answer

DHCP

Answer

TFTP