CCNA Network Services and Security Practice Question
A user can reach a remote web server by IP address but not by hostname. Which service should be checked first?
⚠ Common exam trap
A frequent exam trap is selecting PAT or STP as the cause when a user cannot reach a server by hostname but can by IP address. Candidates may mistakenly associate PAT with all IP-related issues, but PAT only translates IP addresses and ports for outbound traffic and does not resolve hostnames. Similarly, STP manages Layer 2 loop prevention and does not affect Layer 3 name resolution. Confusing these services with DNS leads to incorrect troubleshooting steps. The key is to recognize that DNS is the only service responsible for translating hostnames to IP addresses, so it must be checked first when name resolution fails but IP connectivity succeeds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS
DNS should be checked first. In plain language, the path to the server appears to work because the user can reach it by numeric address. The missing function is the translation from hostname to IP-related information, and that is exactly what DNS provides. This is one of the clearest service-troubleshooting patterns in networking. If IP works but the name fails, DNS becomes the strongest first suspect. The correct answer is therefore the name-resolution service rather than a routing or switching feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DNS
Why this is correct
The symptom — reachable by IP but not by hostname — is the classic signature of a name-resolution failure. DNS is the protocol that maps a human-friendly hostname to the numeric IP address; if the client cannot contact a DNS server, has an incorrect server configuration, or receives a negative reply, the browser will fail to resolve even though the underlying IP path is healthy. Because IP connectivity is already proven, the fault is isolated to DNS lookup logic rather than routing or switching.
- ✗
STP
Why it's wrong here
Spanning Tree Protocol (STP) operates at Layer 2 to prevent loops by blocking redundant switch ports; it has no role in translating names to addresses. Even if STP were misconfigured and caused a temporary blocking state, the user could still not reach the server via IP because the data path itself would be broken. Since the user reaches the server by IP, the Layer 2 forwarding plane is functioning, so STP cannot be the cause of a hostname-specific failure.
When this WOULD be correct
If the question were about a network topology issue where a switch is misconfigured and causing broadcast storms, leading to connectivity problems, then checking STP would be appropriate to ensure that the network topology is stable and loops are not affecting communication.
- ✗
PAT
Why it's wrong here
Port Address Translation (PAT) is a NAT variant that maps many private addresses to one public IP using different source ports. A PAT misconfiguration would typically break all IP communications — both by IP and by name — because packets would not be translated correctly to reach the external network. The fact that the user succeeds with the raw IP address proves that Layer 3 translation and routing are working, so PAT cannot selectively prevent hostname resolution while allowing IP traffic.
When this WOULD be correct
If the exam question stated that users could not access a web server by its public IP address but could access it by hostname, then PAT would be relevant. In this scenario, the question would focus on translating the public IP to the correct internal address, making PAT the correct answer.
- ✗
Port security
Why it's wrong here
Port security is a Layer 2 switch feature that restricts traffic based on MAC addresses, limiting which devices can send frames through a port. A violation would shut down the port or drop frames, preventing any IP communication — including a ping to the server's IP address — not just name resolution. Since the user can reach the remote web server by its IP address, port security is not interfering, and it has no mechanism to filter DNS queries while permitting other traffic.
When this WOULD be correct
If the question were about a scenario where a user is unable to connect to a network device due to unauthorized MAC addresses being blocked by port security, then checking port security settings would be the correct approach to diagnose the issue.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DNSCorrect answer▾
Why this is correct
The symptom — reachable by IP but not by hostname — is the classic signature of a name-resolution failure. DNS is the protocol that maps a human-friendly hostname to the numeric IP address; if the client cannot contact a DNS server, has an incorrect server configuration, or receives a negative reply, the browser will fail to resolve even though the underlying IP path is healthy. Because IP connectivity is already proven, the fault is isolated to DNS lookup logic rather than routing or switching.
✗STPWrong answer — click to see why▾
Why this is wrong here
STP (Spanning Tree Protocol) is used for preventing loops in Ethernet networks and does not relate to hostname resolution issues. Since the problem involves accessing a server by hostname, STP is not relevant.
★ When this WOULD be the correct answer
If the question were about a network topology issue where a switch is misconfigured and causing broadcast storms, leading to connectivity problems, then checking STP would be appropriate to ensure that the network topology is stable and loops are not affecting communication.
Why candidates choose this
Candidates may confuse STP with general network connectivity issues, thinking that any network protocol might be relevant when troubleshooting access problems, leading them to select this option without fully understanding the specific context of hostname resolution.
✗PATWrong answer — click to see why▾
Why this is wrong here
PAT (Port Address Translation) is used for translating private IP addresses to a public IP address, allowing multiple devices on a local network to share a single public IP. It does not directly relate to hostname resolution issues, which are typically handled by DNS.
★ When this WOULD be the correct answer
If the exam question stated that users could not access a web server by its public IP address but could access it by hostname, then PAT would be relevant. In this scenario, the question would focus on translating the public IP to the correct internal address, making PAT the correct answer.
Why candidates choose this
Candidates might choose PAT due to a misunderstanding of network address translation concepts, thinking that any connectivity issue involving IP addresses could be related to address translation mechanisms.
✗Port securityWrong answer — click to see why▾
Why this is wrong here
Port security is a feature used to restrict access to a switch port based on MAC addresses, and it does not directly affect the resolution of hostnames to IP addresses. Therefore, it is not relevant when a user can reach a server by IP but not by hostname.
★ When this WOULD be the correct answer
If the question were about a scenario where a user is unable to connect to a network device due to unauthorized MAC addresses being blocked by port security, then checking port security settings would be the correct approach to diagnose the issue.
Why candidates choose this
Candidates may confuse port security with network access issues, thinking that if a user cannot access a resource, it might be due to security settings on the switch, leading them to select this option.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Fully Qualified Domain Name
A Fully Qualified Domain Name is the complete and unambiguous website or server name that includes the host, domain, and top-level domain, leaving no room for guesswork.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.