This 200-301 practice question tests your understanding of network services and security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: dNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A host reaches websites by IP address but fails when using hostnames. Which service is the strongest suspect?
DNS
This is correct because hostname resolution is the missing function in this scenario.
STP
Why wrong: This is wrong because STP loop prevention is unrelated to a specific hostname-resolution failure pattern.
PAT
Why wrong: This is wrong because NAT issues would usually affect IP connectivity more broadly rather than only names.
Port security
Why wrong: This is wrong because port security is not the service that resolves hostnames.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
DNS
The strongest suspect is DNS. In plain language, the host can already reach the remote system when given the numeric address directly, which suggests the underlying IP connectivity works. The missing piece is the translation of hostnames into IP-related information, and that is exactly the role of DNS. This is one of the most common real troubleshooting patterns because it cleanly separates connectivity problems from name-resolution problems. If IP works but names fail, DNS becomes the most likely area to investigate.
Key principle: DNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
DNS
STP
Why it's wrong here
This is wrong because STP loop prevention is unrelated to a specific hostname-resolution failure pattern.
When this WOULD be correct
If the exam question involved a scenario where a network switch is misconfigured, causing broadcast storms that disrupt network traffic, STP could be the correct answer. In that case, the question might ask about the cause of connectivity issues affecting all network devices, including hostname resolution.
PAT
Why it's wrong here
This is wrong because NAT issues would usually affect IP connectivity more broadly rather than only names.
When this WOULD be correct
In a scenario where a question asks about issues related to IP address translation and connectivity for multiple devices behind a single public IP, a candidate might be asked to identify the service responsible for translating internal IPs to a public IP. In this case, PAT would be the correct answer.
Port security
Why it's wrong here
This is wrong because port security is not the service that resolves hostnames.
When this WOULD be correct
If the question were about a network where a specific switch port was configured to allow only certain MAC addresses, and a device with an unrecognized MAC address was trying to access a server by hostname, port security could be the correct answer, as it would block the device's access.
Option-by-option analysis
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
Why this is correct
This is correct because hostname resolution is the missing function in this scenario.
Why this is wrong here
STP (Spanning Tree Protocol) prevents loops in Ethernet networks and has no role in hostname resolution. A failure in STP would cause network loops or broadcast storms, not a specific inability to resolve hostnames while IP connectivity remains intact.
★ When this WOULD be the correct answer
If the exam question involved a scenario where a network switch is misconfigured, causing broadcast storms that disrupt network traffic, STP could be the correct answer. In that case, the question might ask about the cause of connectivity issues affecting all network devices, including hostname resolution.
Why candidates choose this
Students might confuse STP with DNS because both are network services, but STP operates at Layer 2 and is unrelated to name resolution. The acronym similarity to other protocols may also cause confusion.
Why this is wrong here
PAT (Port Address Translation) is a form of NAT that translates private IP addresses to a public IP using different ports. While NAT issues can cause connectivity problems, they typically affect all traffic (including IP-based access) or cause asymmetric routing, not selectively break hostname resolution while leaving IP access working.
★ When this WOULD be the correct answer
In a scenario where a question asks about issues related to IP address translation and connectivity for multiple devices behind a single public IP, a candidate might be asked to identify the service responsible for translating internal IPs to a public IP. In this case, PAT would be the correct answer.
Why candidates choose this
Students may think that PAT is involved in name resolution because it deals with addresses and ports, but PAT does not perform DNS functions. The scenario's symptom of working IP access but failing hostnames is a classic DNS issue, not a NAT issue.
Why this is wrong here
Port security is a Layer 2 feature that restricts which MAC addresses can access a switch port. It does not provide hostname resolution services. A port security violation would cause the port to shut down or drop frames, affecting all traffic on that port, not just hostname resolution.
★ When this WOULD be the correct answer
If the question were about a network where a specific switch port was configured to allow only certain MAC addresses, and a device with an unrecognized MAC address was trying to access a server by hostname, port security could be the correct answer, as it would block the device's access.
Why candidates choose this
Students might think port security could block DNS traffic specifically, but port security operates at the MAC layer and cannot selectively filter by protocol or service. The name 'port security' might be misinterpreted as securing DNS port 53, but that is not its function.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
A frequent exam trap is selecting NAT or PAT as the cause of hostname resolution failure because these services involve IP address translation. However, NAT and PAT affect IP connectivity and address translation between private and public networks, not the translation of hostnames to IP addresses. Another trap is choosing STP, which is unrelated to IP services and only manages Layer 2 loop prevention. Candidates might also confuse port security with DNS, but port security controls switch port access and does not resolve hostnames. The key mistake is overlooking that DNS is the sole service responsible for converting hostnames into IP addresses, which is why it is the strongest suspect when name-based access fails but IP-based access succeeds.
Detailed technical explanation
Domain Name System (DNS) is a critical IP service that translates human-readable hostnames into IP addresses, enabling users and devices to access resources using easy-to-remember names instead of numeric IP addresses. In Cisco networking and the CCNA context, DNS operates by querying configured DNS servers to resolve these names, which is essential for most network applications and services. Without DNS, devices must rely solely on IP addresses, which is impractical for everyday use and troubleshooting. When a host can reach websites by IP address but fails when using hostnames, the problem typically lies in the DNS resolution process. This indicates that the underlying IP routing, switching, and connectivity are functioning correctly, but the host cannot translate domain names into IP addresses. Cisco devices rely on DNS servers configured via DHCP or manually to perform this translation. If DNS is misconfigured, unreachable, or the DNS server itself is down, hostname resolution fails, causing access issues to websites and other network resources. A common exam trap is confusing DNS failure with other network services like NAT or STP. For example, PAT (Port Address Translation) affects IP address translation for outbound traffic but does not impact hostname resolution directly. Similarly, STP (Spanning Tree Protocol) prevents Layer 2 loops but does not influence IP or DNS functionality. Understanding that DNS specifically handles name-to-IP translation helps avoid misdiagnosing connectivity issues. In practical Cisco environments, verifying DNS server reachability and configuration is a key step when hostname resolution fails but IP connectivity works.
Key takeaway
DNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Review dNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs., then practise related 200-301 questions on the same topic to reinforce the concept.
Network Services and Security — study guide chapter
Learn the concepts, then practise the questions
Network Services and Security practice questions
Targeted practice on this topic area only
All 200-301 questions
1,819 questions across all exam domains
CCNA 200-301 v2 study guide
Full concept coverage aligned to exam objectives
200-301 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise 200-301 questions linked to Network Infrastructure and Connectivity.
Practise 200-301 questions linked to Switching and Network Access.
Practise 200-301 questions linked to IP Routing.
Practise 200-301 questions linked to Network Services and Security.
Practise 200-301 questions linked to AI and Network Operations.
Practise IPv4 subnetting, CIDR, masks, host ranges and subnet selection.
Practise OSPF neighbours, router IDs, metrics, areas and routing-table interpretation.
Practise VLANs, access ports, trunks, allowed VLANs and switching scenarios.
Practise spanning tree, root bridge election, port roles and STP troubleshooting.
Practise LACP, PAgP, port-channel behaviour and bundle requirements.
Practise standard and extended ACLs, permit/deny logic and traffic filtering.
Practise static NAT, dynamic NAT, PAT and inside/outside address translation.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Network Services and Security — This question tests Network Services and Security — DNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs..
The correct answer is: DNS — The strongest suspect is DNS. In plain language, the host can already reach the remote system when given the numeric address directly, which suggests the underlying IP connectivity works. The missing piece is the translation of hostnames into IP-related information, and that is exactly the role of DNS. This is one of the most common real troubleshooting patterns because it cleanly separates connectivity problems from name-resolution problems. If IP works but names fail, DNS becomes the most likely area to investigate.
Review dNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs., then practise related 200-301 questions on the same topic to reinforce the concept.
DNS translates human-readable hostnames into IP addresses, enabling devices to access network resources using names instead of numeric IPs.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: May 17, 2026
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.