Complete question bank for CCNA 1 (ITN v7.02/v8) Modules 14 – 15 & 16 – 17: TCP/UDP, DNS/DHCP & Small Network Security Exam.
📥 Download CCNA 1 v7.02 & v8 (ITN) Modules 14 - 17: Network Application & Security Exam Answers (Full Bank) Packet Tracer (.PKA) & Verified PDF Guide
Includes complete Cisco NetAcad v7.02 / v8 topology file (.pka) and IOS CLI configuration script.
Verified Cisco NetAcad Exam Questions (9 Core Questions + Explanations)
Question 1
Which two characteristics describe UDP (User Datagram Protocol) compared to TCP? (Choose two.)
✔ Correct Answer: A. Connectionless transport with low overhead (8-byte header) & C. Best-effort delivery with no retransmission of lost datagrams
Technical Explanation: UDP is a lightweight, connectionless Layer 4 protocol with an 8-byte header that does not establish sessions or retransmit dropped packets, making it ideal for DNS, DHCP, VoIP, and TFTP.
Question 2
What are the three steps of the TCP Three-Way Handshake used to establish a reliable session?
✔ Correct Answer: B. SYN -> SYN-ACK -> ACK
Technical Explanation: The client sends a SYN segment, the server replies with a SYN-ACK segment, and the client completes the handshake with an ACK segment.
Question 3
Which well-known port numbers are used by HTTP, HTTPS, SSH, Telnet, and DNS respectively?
✔ Correct Answer: A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53
Technical Explanation: Memorizing well-known TCP/UDP ports is mandatory for CCNA: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53 TCP/UDP), DHCP (67/68 UDP), TFTP (69 UDP), HTTP (80), POP3 (110), SNMP (161/162), HTTPS (443).
Question 4
What is the correct four-step order of messages exchanged when a client obtains an IPv4 address from a DHCPv4 server?
✔ Correct Answer: A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)
Technical Explanation: DHCPv4 follows the DORA process: Discover (broadcast by client), Offer (from server), Request (broadcast by client selecting the offer), and Acknowledgment (ACK from server).
Question 5
Which three commands are required on a Cisco router before you can generate RSA keys for SSH access? (Choose three.)
✔ Correct Answer: A. Configure a non-default hostname, B. Configure a DNS domain name, C. Generate the keys using 'crypto key generate rsa'
Technical Explanation: Cisco IOS combines the router's hostname and IP domain-name (e.g., R1.cisco.com) to label the RSA key pair generated by 'crypto key generate rsa'.
Question 6
Which Cisco IOS command blocks brute-force login attempts by shutting down login access for 120 seconds if 3 failed attempts occur within 60 seconds?
✔ Correct Answer: A. login block-for 120 attempts 3 within 60
Technical Explanation: The 'login block-for [seconds] attempts [tries] within [seconds]' global configuration command mitigates dictionary/brute-force attacks against VTY and console lines.
Question 7
What is the purpose of the 'exec-timeout 5 30' command configured under 'line vty 0 4'?
✔ Correct Answer: A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.
Technical Explanation: 'exec-timeout [minutes] [seconds]' automatically logs out inactive administrative sessions to prevent unattended terminals from being hijacked.
Question 8
Which command displays the neighboring Cisco devices directly connected to a router, including their Device ID, local interface, and hardware platform?
✔ Correct Answer: B. show cdp neighbors
Technical Explanation: Cisco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol enabled by default that discovers directly connected Cisco switches, routers, and IP phones.
Question 9
When troubleshooting network connectivity from a PC, an engineer can ping 127.0.0.1 and the PC's own IP (192.168.1.50), but cannot ping the Default Gateway (192.168.1.1). Where does the problem most likely reside?
✔ Correct Answer: C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).
Technical Explanation: Pinging 127.0.0.1 proves the PC's TCP/IP stack works. Failing to reach the local default gateway indicates a physical cabling fault, wrong VLAN assignment on the switch port, or a shut-down gateway interface.
Modules 14-17 SSHv2 & Login Block-For Hardening CLI
Cisco IOS CLI - Verification & Lab Script
Router(config)# ip domain-name netacad.local Router(config)# crypto key generate rsa general-keys modulus 2048 Router(config)# username admin secret StrongPass123! Router(config)# login block-for 120 attempts 3 within 60 Router(config)# line vty 0 4 Router(config-line)# transport input ssh Router(config-line)# login local Router(config-line)# exec-timeout 5 0