CCNA Network Services and Security Practice Question
A host reaches websites by IP address but fails when using hostnames. Which service is the strongest suspect?
⚠ Common exam trap
A frequent exam trap is selecting NAT or PAT as the cause of hostname resolution failure because these services involve IP address translation. However, NAT and PAT affect IP connectivity and address translation between private and public networks, not the translation of hostnames to IP addresses. Another trap is choosing STP, which is unrelated to IP services and only manages Layer 2 loop prevention. Candidates might also confuse port security with DNS, but port security controls switch port access and does not resolve hostnames. The key mistake is overlooking that DNS is the sole service responsible for converting hostnames into IP addresses, which is why it is the strongest suspect when name-based access fails but IP-based access succeeds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS
The strongest suspect is DNS. In plain language, the host can already reach the remote system when given the numeric address directly, which suggests the underlying IP connectivity works. The missing piece is the translation of hostnames into IP-related information, and that is exactly the role of DNS. This is one of the most common real troubleshooting patterns because it cleanly separates connectivity problems from name-resolution problems. If IP works but names fail, DNS becomes the most likely area to investigate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS
Why this is correct
The Domain Name System resolves fully qualified domain names to IP addresses, acting as the network's directory service. When a host can reach websites by IP address but cannot by hostname, the DNS resolution process has failed—either the configured DNS server is unreachable, the resolver is misconfigured, or a DNS query is timing out. This matches the symptom exactly because only name-to-address translation is broken, while the underlying IP connectivity remains intact.
- ✗
STP
Why it's wrong here
Spanning Tree Protocol prevents Layer 2 loops by blocking redundant paths in a switched network. It operates at the data link layer and has no role in translating human-readable domain names to IP addresses. A failure in STP would cause broadcast storms or MAC address instability, not a selective inability to reach websites by name while IP access remains functional.
When this WOULD be correct
If the exam question involved a scenario where a network switch is misconfigured, causing broadcast storms that disrupt network traffic, STP could be the correct answer. In that case, the question might ask about the cause of connectivity issues affecting all network devices, including hostname resolution.
- ✗
PAT
Why it's wrong here
Port Address Translation is a form of NAT that maps multiple private IP addresses to a single public IP using unique source ports. PAT issues typically disrupt IP connectivity for many flows—such as preventing outbound sessions or breaking return traffic—rather than selectively breaking hostname resolution. If PAT were faulty, the host would likely fail to reach websites by IP as well, not just by name.
When this WOULD be correct
In a scenario where a question asks about issues related to IP address translation and connectivity for multiple devices behind a single public IP, a candidate might be asked to identify the service responsible for translating internal IPs to a public IP. In this case, PAT would be the correct answer.
- ✗
Port security
Why it's wrong here
Port security is a switchport feature that restricts ingress traffic based on MAC addresses to prevent unauthorized devices from connecting. It does not perform name resolution or any application-layer service. A port-security violation would block traffic entirely on a switchport or limit the number of learned MAC addresses, not cause a host to lose DNS lookup capability while still reaching destinations via their IP addresses.
When this WOULD be correct
If the question were about a network where a specific switch port was configured to allow only certain MAC addresses, and a device with an unrecognized MAC address was trying to access a server by hostname, port security could be the correct answer, as it would block the device's access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DNSCorrect answer▾
Why this is correct
The Domain Name System resolves fully qualified domain names to IP addresses, acting as the network's directory service. When a host can reach websites by IP address but cannot by hostname, the DNS resolution process has failed—either the configured DNS server is unreachable, the resolver is misconfigured, or a DNS query is timing out. This matches the symptom exactly because only name-to-address translation is broken, while the underlying IP connectivity remains intact.
✗STPWrong answer — click to see why▾
Why this is wrong here
STP (Spanning Tree Protocol) prevents loops in Ethernet networks and has no role in hostname resolution. A failure in STP would cause network loops or broadcast storms, not a specific inability to resolve hostnames while IP connectivity remains intact.
★ When this WOULD be the correct answer
If the exam question involved a scenario where a network switch is misconfigured, causing broadcast storms that disrupt network traffic, STP could be the correct answer. In that case, the question might ask about the cause of connectivity issues affecting all network devices, including hostname resolution.
Why candidates choose this
Students might confuse STP with DNS because both are network services, but STP operates at Layer 2 and is unrelated to name resolution. The acronym similarity to other protocols may also cause confusion.
✗PATWrong answer — click to see why▾
Why this is wrong here
PAT (Port Address Translation) is a form of NAT that translates private IP addresses to a public IP using different ports. While NAT issues can cause connectivity problems, they typically affect all traffic (including IP-based access) or cause asymmetric routing, not selectively break hostname resolution while leaving IP access working.
★ When this WOULD be the correct answer
In a scenario where a question asks about issues related to IP address translation and connectivity for multiple devices behind a single public IP, a candidate might be asked to identify the service responsible for translating internal IPs to a public IP. In this case, PAT would be the correct answer.
Why candidates choose this
Students may think that PAT is involved in name resolution because it deals with addresses and ports, but PAT does not perform DNS functions. The scenario's symptom of working IP access but failing hostnames is a classic DNS issue, not a NAT issue.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security is a Layer 2 feature that restricts which MAC addresses can access a switch port. It does not provide hostname resolution services. A port security violation would cause the port to shut down or drop frames, affecting all traffic on that port, not just hostname resolution.
★ When this WOULD be the correct answer
If the question were about a network where a specific switch port was configured to allow only certain MAC addresses, and a device with an unrecognized MAC address was trying to access a server by hostname, port security could be the correct answer, as it would block the device's access.
Why candidates choose this
Students might think port security could block DNS traffic specifically, but port security operates at the MAC layer and cannot selectively filter by protocol or service. The name 'port security' might be misinterpreted as securing DNS port 53, but that is not its function.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
Configuring AAA with TACACS+ and RADIUS on IOS XE
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
DNS
DNS is the system that translates human-friendly domain names like example.com into machine-readable IP addresses so computers can find each other on a network.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.