CCNA Network Services and Security Practice Test 9 — 15 Questions

Question 1

Which security framework provides authentication, authorization, and accounting for network access control?

Accepted Answer

AAA (Authentication, Authorization, and Accounting). AAA stands for Authentication, Authorization, and Accounting. It is a framework used to verify user identity, determine what actions are permitted, and record what was done. ACLs filter traffic, port security limits MAC addresses on a switch port, and DHCP snooping prevents rogue DHCP servers.

Answer

ACL (Access Control List)

Answer

Port Security

Answer

DHCP Snooping

Question 2

Which ACL statement permits only SSH from host 10.10.10.50 to server 192.168.1.10?

Accepted Answer

permit tcp host 10.10.10.50 host 192.168.1.10 eq 22. SSH uses TCP destination port 22. The source is the single host 10.10.10.50 and the destination is the single host 192.168.1.10.

Answer

permit udp host 10.10.10.50 host 192.168.1.10 eq 22

Answer

permit tcp any host 192.168.1.10 eq 22

Answer

permit ip host 10.10.10.50 host 192.168.1.10

Question 3

Match each network service to its primary purpose.

Accepted Answer

DNS - Resolves domain names to IP addresses. DNS (Domain Name System) resolves human-readable domain names (e.g., www.example.com) into IP addresses, allowing devices to locate and communicate with each other. Option A correctly identifies this primary purpose. Option B describes DHCP, which dynamically assigns IP addresses and other configuration parameters. Option C describes secure remote access protocols like SSH or VPN. Option D describes SNMP, which manages and monitors network devices. Thus, only A matches DNS.

Answer

DNS - Assigns IP addresses to devices dynamically

Answer

DNS - Provides secure remote access to network devices

Answer

DNS - Manages network devices via SNMP

Question 4

Exhibit: After PAT is configured, inside users can browse the internet, but the engineer wants to verify that translations are actually being created. Which command is the best choice?

Accepted Answer

show ip nat translations. The NAT translation table shows the inside local and inside global addresses and confirms whether active translations are being built.

Answer

show access-lists

Answer

show ip route

Answer

debug ip packet detail

Question 5

Users in 10.20.30.0/24 should be allowed to browse the web but should not be able to open Telnet sessions to any remote device. Which access list entry best meets the requirement?

Accepted Answer

deny tcp 10.20.30.0 0.0.0.255 any eq 23. To block Telnet while allowing web browsing, the ACL must deny TCP traffic to destination port 23 from the source subnet 10.20.30.0/24. Option A correctly uses 'deny tcp 10.20.30.0 0.0.0.255 any eq 23' to block outbound Telnet. Option B is incorrect because Telnet uses TCP, not UDP. Option C is incorrect because it denies Telnet traffic coming into the subnet, not going out. Option D permits HTTP (port 80) but does not block Telnet. A subsequent permit statement would be needed to allow web traffic.

Answer

deny udp 10.20.30.0 0.0.0.255 any eq 23

Answer

deny tcp any 10.20.30.0 0.0.0.255 eq 23

Answer

permit tcp 10.20.30.0 0.0.0.255 any eq 80

Question 6

Why is SSH preferred over Telnet for device management?

Accepted Answer

SSH encrypts the session traffic. SSH encrypts the management session, including usernames, passwords, and commands. Telnet sends traffic in clear text, which makes it unsafe on modern networks.

Answer

SSH uses UDP and is therefore faster

Answer

SSH works only on Layer 2 networks

Answer

SSH does not require user authentication

Question 7

Exhibit: An engineer applies an ACL inbound on the VTY lines to permit SSH only from 10.5.5.0/24. Users from that subnet still cannot connect. What is the most likely reason?

Accepted Answer

The device may not have SSH fully enabled with keys and a valid login method. Restricting the VTY lines is not enough if SSH itself has not been enabled correctly. A missing local username, domain name, RSA keys, or transport input ssh setting can stop access even when the ACL is correct.

Answer

The ACL must be applied outbound on the VTY lines

Answer

SSH requires UDP port 22

Answer

VTY access-class can only be used with Telnet

Question 8

Match each service with the best operational purpose.

Accepted Answer

DNS: Resolves domain names to IP addresses. DNS resolves domain names to IP addresses, DHCP automatically assigns IP addresses to devices, NTP synchronizes clocks of computers over a network, and HTTP transfers web pages. Each matching pair reflects the primary function of the service without introducing unrelated protocols.

Question 9

An access switch port shuts down as soon as a user connects a small unmanaged switch under the desk. Which feature caused that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is meant to protect access ports by shutting them down if BPDUs are received. That usually means someone connected another switch where only an endpoint should exist.

Answer

Root Guard

Answer

Loop Guard

Answer

Storm control

Question 10

Which two statements about AAA on Cisco devices are correct? Choose two.

Accepted Answer

Authentication verifies identity. AAA breaks access control into authentication, authorization, and accounting. TACACS+ is commonly preferred for device administration because it separates all three functions and encrypts the full payload.

Answer

Accounting replaces the need for local usernames entirely

Answer

AAA can only be used with RADIUS and not TACACS+

Question 11

Match each network service to its correct primary function.

Accepted Answer

DNS. DNS (Domain Name System) translates domain names to IP addresses. DHCP automatically assigns IP addresses to devices. HTTP transfers web pages and related content. FTP transfers files between systems. The correct answer to the intended question is DNS.

Answer

DHCP

Answer

HTTP

Answer

FTP

Question 12

Which NAT feature allows many inside hosts to share one public IPv4 address by using unique source port numbers?

Accepted Answer

PAT. PAT, sometimes called NAT overload, keeps track of connections by using Layer 4 port numbers so many private hosts can share a single public address.

Answer

Static NAT

Answer

NTP authentication

Answer

Port security

Question 13

A security policy requires administrators to permit SSH to network devices but block insecure remote CLI access. Which two actions support that goal?

Accepted Answer

Enable SSH on the VTY lines and use local or AAA authentication. To meet the requirement, the device should allow encrypted SSH access and explicitly avoid Telnet for remote management.

Answer

Enable CDP globally

Answer

Configure the console line for transport input ssh

Question 14

A switchport connected to an employee PC must allow the normal endpoint to connect but immediately err-disable the port if a switch is plugged in. Which two features should be configured on that access port?

Accepted Answer

spanning-tree bpduguard enable. For edge access ports, PortFast brings the port up quickly for end devices, and BPDU Guard protects against someone connecting a switch by err-disabling the interface when BPDUs arrive.

Answer

switchport port-security maximum 1

Answer

storm-control broadcast level 5.00

Question 15

A standard numbered ACL is applied close to the destination, but it is blocking traffic from one host while still allowing all other users on the subnet. Which two facts about standard ACLs are relevant in this design?

Accepted Answer

They filter based on source address only. Standard ACLs only match the source IP address. For that reason, they are usually placed near the source so they do not block more traffic than intended.

Answer

They can match TCP and UDP port numbers

Answer

They automatically create a permit any at the end