Free Network Services and Servers practice questions
10 free 220-1201 questions on Network Services and Servers, each with a full explanation — no account needed. This section sits in the Networking part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
An organization investigates a suspected insider incident involving privileged changes on a firewall. The security team confirms the administrator successfully authenticated, but the audit trail does not show which commands were executed or how long the session lasted. Which AAA function is MOST directly missing from this investigation?
Accounting is responsible for tracking and recording user activity such as which actions were performed and how long a session lasted. Without accounting logs, there is no reliable audit trail to determine what commands were executed during the privileged session.
A network team is choosing an AAA protocol for administering its routers and switches. They want the whole packet payload encrypted and separate control of authentication, authorization, and accounting so that individual commands can be authorized and audited. Which protocol BEST meets these requirements?
TACACS+ was built for device administration: it encrypts the entire packet body and treats authentication, authorization, and accounting as separate exchanges, which is what allows per-command authorization and auditing. RADIUS encrypts only the password field and bundles authentication and authorization into one reply, which is why it is the usual choice for network access (Wi-Fi, VPN) rather than device administration. Kerberos is a ticket-based sign-in protocol for domains, not a device-administration AAA protocol. LDAP is a directory lookup protocol; it stores accounts but does not by itself provide accounting or command authorization.
A company enables WPA3-Enterprise on its wireless network using a centralized AAA server. Users report that their credentials are accepted, but they are consistently placed into the wrong VLAN and cannot reach the resources required for their job role. Which AAA component is MOST likely misconfigured?
Successful credential acceptance indicates identity verification is working. Being placed into an incorrect VLAN and denied expected access points to an access-rights or policy decision problem, which is handled by authorization after the user is authenticated.
A web application suddenly cannot connect to its database after a firewall policy change. The application uses a MySQL-compatible backend and its connection string still specifies the correct server name and database. Network tests confirm basic IP connectivity to the database host. Which firewall rule change is MOST likely required to restore service?
MySQL and MariaDB use TCP port 3306 by default. If IP connectivity works but the application cannot establish the database connection after a firewall change, the most direct fix is to permit traffic on the database service port used by the platform.
After a weekend power outage, every point-of-sale workstation shows "Unable to connect to database server" when the sales application starts. The workstations can ping the database server by name, and the server’s file share is reachable. Which cause should the technician check FIRST?
A database server is just a service listening on a port (1433 for SQL Server, 3306 for MySQL, and so on). The server answers pings and serves files, so the machine and the network are fine; the one thing that stops every client at once after a reboot is the database service failing to start, so checking the service is the first and cheapest step. DNS cannot be the problem because the name already resolves for the ping. An expired password would produce an authentication error rather than a connection failure, and it would not coincide with an outage. Backups have nothing to do with whether the live service accepts connections.
A Linux server refuses to synchronize time using NTP and reports that the time difference is too large for automatic correction. The system clock is several hours off. What action is REQUIRED before NTP can successfully synchronize?
NTP will refuse to synchronize when the time difference exceeds a defined threshold, such as when the clock is off by a very large amount. Manually setting the clock closer to the correct time allows NTP to resume normal fine-grained adjustments.
Users in an Active Directory environment suddenly cannot log in, and event logs show Kerberos errors indicating excessive clock skew. Network connectivity between clients and domain controllers is confirmed to be working. Which underlying issue is MOST likely causing this failure?
Kerberos authentication depends on tightly synchronized time and allows only a small clock difference by default. If NTP traffic on UDP port 123 is blocked, domain members and controllers cannot synchronize time, leading to clock skew errors that prevent authentication.
A security team discovers that an internal NTP server is responding to requests from any external host. They are concerned about its potential misuse in amplification attacks. Which mitigation BEST reduces this risk?
Open NTP servers can be abused for amplification attacks. Restricting access so that only authorized internal hosts can query the server significantly reduces the attack surface while preserving time synchronization for trusted devices.
A workstation reports TLS certificate errors stating that certificates are not yet valid, even though the certificates were just issued. Other systems do not show this problem. Which issue MOST likely explains the discrepancy?
TLS certificates include defined validity periods. If a client’s system clock is behind the correct time, it may interpret a valid certificate as not yet valid, even though the certificate itself is correct.
An organization wants to ensure highly accurate and trustworthy time synchronization for critical systems without relying on unauthenticated public servers. Which configuration BEST meets this goal?
Operating internal NTP servers provides consistent, controlled time synchronization across the organization. Synchronizing those servers with multiple trusted external sources adds redundancy and accuracy while reducing dependence on unauthenticated public servers.
Study this section
Every lesson that covers Network Services and Servers on the 220-1201 exam.