Network Services and Security practice questions

OSPF route flapping

Why wrong: OSPF behavior is unrelated to host-facing switch port security.

DNS spoofing across the enterprise

Why wrong: Port security does not solve network-wide DNS threats.

Wireless rogue APs on every VLAN

Why wrong: Rogue AP detection is a different security control.

To encrypt management traffic

Why wrong: Encrypting management traffic is handled by protocols such as SSH, TLS, or IPsec.

To resolve hostnames into IP addresses

Why wrong: DNS handles hostname resolution.

To assign IP addresses dynamically

Why wrong: DHCP handles dynamic IP addressing.

To translate MAC addresses into switchport numbers

Why wrong: Switchport mappings are handled through switching and management data, not DNS.

To assign default gateways to hosts

Why wrong: Default gateways are typically learned through DHCP or static configuration.

To maintain STP topology information

Why wrong: STP topology information is unrelated to DNS.

To allocate DHCP leases

Why wrong: DHCP leasing is unrelated to syslog.

To maintain a synchronized routing table

Why wrong: Routing tables are maintained by routing processes, not syslog servers.

To translate private addresses to public addresses

Why wrong: Address translation is the role of NAT.

It encrypts all traffic leaving the LAN

Why wrong: PAT provides translation, not encryption.

It removes the need for private IP addressing

Why wrong: Private addressing is still commonly used with PAT.

It replaces routing protocols

Why wrong: PAT does not replace routing.

Preventing unauthorized changes to data

Why wrong: That is integrity.

Ensuring systems are reachable when needed

Why wrong: That is availability.

Providing authentication and accounting only

Why wrong: Those can support security, but they are not the definition of confidentiality.

It assigns IP addresses to clients automatically.

Why wrong: That is the role of DHCP.

It encrypts application traffic end to end.

Why wrong: DNS does not provide that role by default.

It advertises default routes to routers.

Why wrong: DNS is not a routing protocol.

It allows all traffic except a few known bad flows.

Why wrong: That describes a denylist approach.

It automatically encrypts all allowed traffic.

Why wrong: Filtering policy does not imply encryption.

It disables the implicit deny at the end of the ACL.

Why wrong: The implicit deny remains part of ACL logic.

Authentication

Why wrong: This is wrong because authentication is the first “A” in AAA.

Availability

Why wrong: This is wrong because availability belongs to the CIA triad, not AAA.

Accounting

Why wrong: This is wrong because accounting is the third “A” in AAA, not the second.

DNS dynamically assigns client IP addresses

Why wrong: This is wrong because DHCP assigns addresses, not DNS.

DNS prevents switching loops on VLAN trunks

Why wrong: This is wrong because switching-loop prevention is handled by STP, not DNS.

DNS is the default metric used by OSPF

Why wrong: This is wrong because DNS has nothing to do with OSPF metrics.

To replace the host MAC address permanently

Why wrong: This is wrong because the default gateway option does not change or replace the host MAC address.

To choose the STP root bridge

Why wrong: This is wrong because STP root bridge election is unrelated to DHCP host gateway settings.

To define the NAT pool for the edge router

Why wrong: This is wrong because a host’s default gateway option is not a NAT pool configuration item.

It decides whether a user knows the correct password

Why wrong: This is wrong because that is part of authentication, not accounting.

It defines the spanning-tree topology

Why wrong: This is wrong because AAA accounting is unrelated to STP topology decisions.

It assigns IP addresses dynamically to clients

Why wrong: This is wrong because DHCP handles dynamic IP assignment.

Telnet is preferred because it is more secure than SSH

Why wrong: This is wrong because Telnet is less secure due to lack of encryption.

SSH removes the need for usernames and passwords

Why wrong: This is wrong because SSH does not remove authentication requirements.

Telnet is the required protocol for STP root election

Why wrong: This is wrong because STP root election has nothing to do with Telnet or SSH.

Ensuring systems are online at all times

Why wrong: This is wrong because that is an availability-oriented idea.

Recording every command entered on a router

Why wrong: This is wrong because that is more related to accounting.

Automatically correcting every changed file

Why wrong: This is wrong because confidentiality is not the same as automatic correction.

DHCP resolves names, while DNS assigns default gateways

Why wrong: This is wrong because it reverses the roles of the two services.

Both services exist only for IPv6

Why wrong: This is wrong because both are used in IPv4 and IPv6 environments.

Neither service is relevant when switches use VLANs

Why wrong: This is wrong because VLAN usage does not make DHCP and DNS irrelevant.

PAT requires one public address for every internal host

Why wrong: This is wrong because that is the opposite of PAT’s main benefit.

PAT eliminates the need for a default route

Why wrong: This is wrong because PAT does not replace routing requirements.

PAT prevents any return traffic from reaching inside hosts

Why wrong: This is wrong because PAT supports correct return traffic for active sessions.

It records every command after the session ends

Why wrong: This is wrong because that is closer to accounting.

It proves the user’s identity with credentials

Why wrong: This is wrong because that is authentication, not authorization.

It assigns an IP address to the administrator’s workstation

Why wrong: This is wrong because DHCP handles address assignment, not AAA authorization.

It automatically replaces subnet masks on all hosts

Why wrong: This is wrong because DNS does not assign or replace subnet masks.

It encrypts all Internet traffic by default

Why wrong: This is wrong because DNS is not the same thing as universal traffic encryption.

It removes the need for default gateways

Why wrong: This is wrong because DNS does not eliminate routing requirements.

It automatically increases OSPF metric accuracy

Why wrong: This is wrong because port hardening does not improve OSPF metrics.

It converts edge ports into routed interfaces

Why wrong: This is wrong because shutting unused ports down does not make them routed ports.

It replaces the need for authentication on active ports

Why wrong: This is wrong because authentication controls are still useful on active ports.

The subnet mask encrypts the host’s traffic.

Why wrong: This is wrong because subnet masks do not provide encryption.

The subnet mask replaces the need for DNS.

Why wrong: This is wrong because subnet masks do not perform hostname resolution.

The subnet mask creates a trunk between the host and switch.

Why wrong: This is wrong because subnet masks are unrelated to trunking.