CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  DHCP

  Why it's wrong here

  DHCP dynamically assigns IP configuration—address, subnet mask, default gateway, DNS servers—to hosts on a network. It operates at the application layer and is used during initial client configuration, not during URL lookups. While DHCP can supply DNS server addresses, it does not translate names to IPs, so it is irrelevant at the moment the browser processes a typed domain.

  When this WOULD be correct

  If the question were about which service is responsible for providing IP addresses to devices on a local network, then DHCP would be the correct answer. For example, a question asking, 'Which service assigns IP addresses to clients in a network?' would make this option valid.

• ✓

  DNS

  Why this is correct

  The Domain Name System resolves human-readable hostnames like www.example.com to routable IP addresses. When a user types a URL, the browser first queries a DNS resolver (often via recursive lookup) to obtain the destination's A/AAAA record before establishing a TCP connection. Without DNS, the browser would need the literal numeric IP address, so this service is essential at the start of web navigation.

• ✗

  NTP

  Why it's wrong here

  NTP synchronizes system clocks across network devices using UDP port 123. Time accuracy is important for TLS certificates and security protocols, but it does not map a domain name to an IP address. The browser's first task is to find the destination's address, and NTP plays no role in that DNS lookup.

  When this WOULD be correct

  In a question asking about time synchronization protocols and their role in network services, such as 'Which protocol is used to synchronize time across devices in a network?', NTP would be the correct answer, as it directly relates to time management rather than name resolution.

• ✗

  Syslog

  Why it's wrong here

  Syslog is a logging protocol used to collect and forward event messages from network devices and servers to a central log server. It has no function in the browsing or name-resolution process; a user typing a URL triggers an HTTP request, which requires address resolution but generates no syslog traffic. Thus, Syslog is unrelated to resolving www.example.com to an IP.

  When this WOULD be correct

  If the exam question asked about which service is responsible for logging network events related to domain name resolution, then Syslog would be the correct answer. In this scenario, the focus would be on monitoring and logging rather than name resolution.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”