CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  DNS

  Why this is correct

  DNS (Domain Name System) is the service responsible for translating human-friendly hostnames into IP addresses. When a website opens by IP but not by hostname, it indicates the client cannot resolve the name to an IP, so DNS resolution is failing. This can be due to a misconfigured DNS server, incorrect resolver settings on the host, or a missing DNS record for the site. Since direct IP access bypasses DNS, the rest of Layer 3 connectivity is intact.

• ✗

  STP

  Why it's wrong here

  Spanning Tree Protocol (STP) operates at Layer 2 to maintain a loop-free topology in bridged networks by blocking redundant paths. It has no role in hostname resolution or in the IP-to-name mapping process. An STP failure would produce forwarding loops and broadcast storms, affecting all traffic, not just domain name lookups. Since IP-based access still works, the issue is not related to STP.

  When this WOULD be correct

  If the question were about a network topology where a loop is causing broadcast storms and preventing devices from communicating properly, a question could ask which protocol is responsible for maintaining a loop-free environment. In that case, STP would be the correct answer.

• ✗

  PAT

  Why it's wrong here

  Port Address Translation (PAT) is a form of NAT that maps multiple private IP addresses to a single public IP by using unique source ports. While PAT issues can break outbound Internet connectivity or disrupt application sessions, they would not selectively prevent hostname resolution while leaving IP-based web access functional. In fact, if PAT were failing, traffic to destination IPs would also fail, because translation affects all IP packets. Thus, a hostname-specific failure points away from PAT.

  When this WOULD be correct

  If the question were to ask about a scenario where users can access services using IP addresses but not through specific port numbers due to address translation issues, PAT would be the correct answer. For example, if a user can connect to a web server using its IP but cannot access it via a specific service port due to misconfigured PAT rules.

• ✗

  Port security

  Why it's wrong here

  Port security is a switchport-level feature that limits which MAC addresses are allowed to communicate through that port. It does not interact with DNS or hostname resolution; its operation is below the IP layer. If port security were violated, the port would shut down or drop frames from unauthorized MACs, causing total loss of connectivity for the attached device, not a selective inability to resolve hostnames. Since IP connectivity is intact, port security is not the cause.

  When this WOULD be correct

  If the question were about a network where users were unable to connect to devices on the network due to unauthorized MAC addresses being blocked by port security, then port security would be the correct answer. In this scenario, the inability to access devices would be due to port security settings.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question