CCNA Network Services and Security Practice Question
Exhibit
PC output: C:\> ping 8.8.8.8 -> success C:\> ping www.example.com -> Ping request could not find host www.example.com
Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?
⚠ Common exam trap
A frequent exam trap is assuming that successful ping to an IP address means all network services are functioning correctly. Candidates often overlook that ping uses numeric IP addresses and does not test DNS resolution. This leads to the incorrect conclusion that the network is fully operational, causing them to eliminate DNS as a problem. The trap is reinforced by the presence of other options like DHCP snooping or HSRP, which are unrelated to hostname resolution but may seem plausible. Recognizing that DNS specifically enables hostname-to-IP translation is essential to avoid this mistake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DNS
The client has IP connectivity because it can reach 8.8.8.8 directly. The problem appears only when using a hostname, which points to a DNS resolution issue rather than a routing issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NTP
Why it's wrong here
NTP (Network Time Protocol) is used to synchronize clocks between network devices. Incorrect time settings can affect authentication protocols like Kerberos or TLS certificate validation, which could cause HTTPS browsing to fail in some cases. However, the question states the client cannot browse to any website, and a proper DNS failure is a more direct cause. NTP would not affect the ability to resolve hostnames or perform an HTTP request to an IP, and the ping to 8.8.8.8 would still succeed regardless of NTP state.
When this WOULD be correct
If the question were about a scenario where a device is unable to synchronize its time with an NTP server, and this time discrepancy causes issues with time-sensitive applications or protocols, then NTP would be the correct answer. For example, if a client can access IP addresses but fails to authenticate to a time-sensitive service due to incorrect timestamps, NTP would be the failing service.
- ✓
DNS
Why this is correct
The client can ping 8.8.8.8, proving IP connectivity and routing are operational, but it cannot browse to www.example.com. Browsing requires resolving the hostname to an IP address via DNS. Since the ping to a public IP succeeds, the failure is isolated to name resolution, meaning the DNS query is failing, the DNS server is unreachable, or the client's DNS settings are incorrect.
- ✗
DHCP snooping
Why it's wrong here
DHCP snooping is a security feature that filters DHCP messages on untrusted ports to prevent rogue DHCP servers. If DHCP snooping were misconfigured, the client might fail to obtain an IP address, netmask, gateway, or DNS servers during DHCP negotiation. But the client can ping 8.8.8.8, meaning it already has a valid IP configuration and gateway; the issue is name resolution only. DHCP snooping would not actively block DNS traffic after the client has successfully received a lease, so it is not the root cause.
When this WOULD be correct
If the question were framed to ask about a network where clients are unable to obtain IP addresses due to DHCP snooping being misconfigured, leading to connectivity issues, then selecting DHCP snooping would be correct. For example, if clients could ping known IPs but not access any domain names due to IP assignment issues, it would fit.
- ✗
HSRP
Why it's wrong here
HSRP (Hot Standby Router Protocol) provides first-hop redundancy by allowing two or more routers to share a virtual IP and MAC address for gateway failover. In a scenario where a client can ping a public IP but cannot browse, HSRP would not cause this symptom because HSRP failure would break all IP forwarding, not just DNS-based traffic. Since the ping to 8.8.8.8 succeeds, the default gateway and routing path are functioning, so HSRP is not a plausible cause.
When this WOULD be correct
If the question were framed around a scenario where a client is unable to reach a default gateway due to a failure in HSRP, such as when two routers are configured for HSRP and one fails, causing loss of redundancy, then HSRP would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓DNSCorrect answer▾
Why this is correct
The client can ping 8.8.8.8, proving IP connectivity and routing are operational, but it cannot browse to www.example.com. Browsing requires resolving the hostname to an IP address via DNS. Since the ping to a public IP succeeds, the failure is isolated to name resolution, meaning the DNS query is failing, the DNS server is unreachable, or the client's DNS settings are incorrect.
✗NTPWrong answer — click to see why▾
Why this is wrong here
NTP (Network Time Protocol) is responsible for time synchronization across devices and does not affect the ability to resolve domain names or browse websites. Since the client can ping an IP address, it indicates that basic connectivity is intact, making NTP unrelated to the browsing issue.
★ When this WOULD be the correct answer
If the question were about a scenario where a device is unable to synchronize its time with an NTP server, and this time discrepancy causes issues with time-sensitive applications or protocols, then NTP would be the correct answer. For example, if a client can access IP addresses but fails to authenticate to a time-sensitive service due to incorrect timestamps, NTP would be the failing service.
Why candidates choose this
Candidates may confuse the importance of synchronized time in network operations with general connectivity issues, leading them to incorrectly associate NTP with browsing problems when they see a network-related question.
✗DHCP snoopingWrong answer — click to see why▾
Why this is wrong here
DHCP snooping is not relevant in this scenario because the client can successfully ping an IP address, indicating that it has a valid IP configuration. DHCP snooping primarily protects against rogue DHCP servers and does not affect DNS resolution directly.
★ When this WOULD be the correct answer
If the question were framed to ask about a network where clients are unable to obtain IP addresses due to DHCP snooping being misconfigured, leading to connectivity issues, then selecting DHCP snooping would be correct. For example, if clients could ping known IPs but not access any domain names due to IP assignment issues, it would fit.
Why candidates choose this
Candidates might confuse DHCP snooping with general connectivity issues, thinking that any network-related problem could be attributed to DHCP configurations, especially if they have limited experience with DNS and its role in name resolution.
✗HSRPWrong answer — click to see why▾
Why this is wrong here
HSRP (Hot Standby Router Protocol) is used for network redundancy and does not directly affect the ability to resolve domain names. Since the client can ping an IP address but cannot browse a website, the issue is likely related to DNS resolution, not HSRP.
★ When this WOULD be the correct answer
If the question were framed around a scenario where a client is unable to reach a default gateway due to a failure in HSRP, such as when two routers are configured for HSRP and one fails, causing loss of redundancy, then HSRP would be the correct answer.
Why candidates choose this
Candidates may confuse HSRP with general network connectivity issues, thinking that if redundancy fails, it could impact the ability to access web resources, leading them to select this option.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
RA Guard — IPv6 First-Hop Security
Key term
Ping
Ping is a network utility used to test whether a remote computer or device is reachable across an IP network and to measure the round-trip time of data packets.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.