CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  NTP

  Why it's wrong here

  NTP (Network Time Protocol) synchronizes clocks between devices over UDP/123, but web browsing and DNS name resolution do not require accurate time. While HTTPS connections to servers with strict certificate validity checks can fail when a client's clock is significantly skewed, that would produce certificate errors, not a complete inability to browse. More importantly, the symptom here is that ping to an IP succeeds, indicating connectivity, but browsing fails—this points to name resolution, which is a DNS function, and NTP has no mechanism to participate in or block DNS lookups.

  When this WOULD be correct

  In a question where the focus is on time synchronization issues, such as a scenario where a user is unable to authenticate to a time-sensitive application due to incorrect timestamps, NTP would be the correct answer. For example, if a user cannot log into a secure service because their device's clock is out of sync, NTP would be the failing component.

• ✓

  DNS

  Why this is correct

  Ping to 8.8.8.8 succeeds because it uses an IP address directly, bypassing any name resolution. Browsing a website normally requires translating a domain name (like www.example.com) into an IP address via DNS queries sent to a configured resolver, typically over UDP/53. If DNS is misconfigured, unreachable, or the resolver is down, the browser cannot resolve the hostname and will report a name resolution failure or server not found, while ICMP ping to a known IP remains unaffected.

• ✗

  Syslog

  Why it's wrong here

  Syslog is a logging protocol used to transport event messages from network devices to a syslog server, typically over UDP/514. It is a background monitoring and troubleshooting tool and has no role in the data path for client-to-server name resolution or HTTP requests. Even if syslog is misconfigured, flooding the network with log messages, or the syslog server is down, these events would not prevent a client from resolving a domain name or loading a web page; the symptoms described are unrelated to syslog operations.

  When this WOULD be correct

  If the question were to ask about issues related to logging or monitoring network events, such as 'What service is failing if logs are not being recorded from network devices?', then Syslog would be the correct answer as it directly relates to log management.

• ✗

  CDP

  Why it's wrong here

  CDP (Cisco Discovery Protocol) is a Layer 2 proprietary protocol used by Cisco devices to discover directly connected neighbors and exchange device information such as hostname, IP addresses, and platform capabilities. It operates at the data link layer and is completely independent of the IP layer or application-layer services like DNS and HTTP. A CDP misconfiguration or even a CDP attack would not interfere with name resolution or web browsing, so it cannot explain why ping to an IP works but browsing fails.

  When this WOULD be correct

  In a question asking about network topology issues where devices are not discovering each other or communicating effectively due to misconfigured CDP settings, CDP would be the correct answer. For example, if the question stated that devices are unable to identify each other on the same VLAN, CDP would be relevant.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question