Network Associate 200-301, IT certifications, 20%

Domain 4: Network Services and Security

The services and protections that run on top of a working network: secure device login with local accounts and AAA, moving files securely, NAT and PAT, DNS records, VPN concepts, access control lists, and Layer 2 security features that stop common attacks on switch ports.

Position: 4 of 5 domains
Published weighting: 20% in the official framework
Topics covered: 5 topics in this guide

What is covered

Topics inside this domain.

These topics describe the scope students most often review for this part of Network Associate 200-301. Treat them as a study checklist rather than an exhaustive list of what a single exam form can sample.

Device access and AAA: Local user accounts and acting as a TACACS+ or RADIUS client for management login.
Secure file transfer: Copying configuration and software images with SFTP and SCP instead of clear-text protocols.
NAT, PAT, and DNS: Translating private addresses for internet access, and diagnosing A, AAAA, CNAME, MX, NS, and PTR records.
VPNs and access control lists: Remote-access and site-to-site IPsec concepts, and standard and extended IPv4 ACLs, numbered and named.
Layer 2 security: Port security, DHCP snooping, dynamic ARP inspection, storm control, and RA guard.

Study tips

How to practice Services and Security.

Section-specific guidance that follows from how this material is usually tested.

Write ACLs on paper first and check where each must be placed and in which direction.
Trace one connection through NAT and name the inside and outside addresses at each step.
Pair each Layer 2 security feature with the attack it stops, such as a rogue DHCP server for DHCP snooping.

Where this fits

Domain 4: Network Services and Security is 4 of 5 domains in the Network Associate 200-301 guide, and it carries a published weighting of 20% in the official framework. Use the full guide to balance it against everything else you have to review.

Back to the Network Associate 200-301 guide Official exam information

Sample Services and Security questions

Practice questions, not yet expert-reviewed

Original practice questions written to the published framework for this section. No expert has reviewed them, and they are not taken from any official exam. Try each one before you open the answer.

Question 1Foundational
Which AAA protocol, often used for device administration logins, runs over TCP port 49 and encrypts the entire packet body?
1. ARADIUS
2. BKerberos
3. CDiameter
4. DTACACS+
Show answer
Answer: D. TACACS+
TACACS+ runs over TCP port 49, encrypts the whole body of each packet, and separates authentication, authorization, and accounting, which suits command authorization on network devices. RADIUS uses UDP ports 1812 and 1813 and encrypts only the password field.
Key insight: TACACS+ is TCP 49 and encrypts everything; RADIUS is UDP and hides only the password.
Question 2Foundational
Which well-known TCP port do SCP and SFTP use when copying a configuration file or software image to or from a router?
1. A22
2. B21
3. C69
4. D443
Show answer
Answer: A. 22
SCP and SFTP both run inside an SSH session, so they use TCP port 22 and encrypt both the file and the login. FTP (TCP 21) and TFTP (UDP 69) send everything, including any credentials, in clear text.
Key insight: Secure copy rides on SSH: TCP port 22.
Question 3Intermediate
A host with private address 192.168.1.10 reaches an internet web server through a router running PAT. In NAT terminology, what is 192.168.1.10?
1. AThe inside global address
2. BThe outside local address
3. CThe inside local address
4. DThe outside global address
Show answer
Answer: C. The inside local address
Inside local is the inside host's address as seen on the inside network, usually a private address. PAT translates it to an inside global address, the public address the internet sees, and mixing up those two is the most common mistake.
Key insight: Inside or outside says whose host it is; local or global says which side is looking.
Question 4Intermediate
Which wildcard mask would an ACL entry use to match every address in 172.16.32.0/20?
1. A255.255.240.0
2. B0.0.15.255
3. C0.0.31.255
4. D0.0.16.255
Show answer
Answer: B. 0.0.15.255
A wildcard mask is the inverse of the subnet mask: subtracting each octet of 255.255.240.0 from 255 gives 0.0.15.255, which matches 172.16.32.0 through 172.16.47.255. 255.255.240.0 is the subnet mask itself; read as a wildcard, it would ignore the network bits and check the host bits instead.
Key insight: Wildcard mask = 255.255.255.255 minus the subnet mask.
Question 5Advanced
Which port security violation mode drops frames from unauthorized MAC addresses, logs the violation and increments its counter, and leaves the port up?
1. AShutdown
2. BSticky
3. CRestrict
4. DProtect
Show answer
Answer: C. Restrict
Restrict mode drops the offending frames, sends a syslog message and SNMP trap, and increments the violation counter while the port keeps forwarding for allowed addresses. Protect also drops them but does not log or count, shutdown (the default) puts the port into the err-disabled state, and sticky is a way of learning MAC addresses, not a violation mode.
Key insight: Protect is silent, restrict reports, shutdown err-disables the port.

Continue through Network Associate 200-301

Practice Services and Security deliberately.

Create your Arcade Academy workspace to turn this topic list into spaced-repetition reviews, linked notes, and progress you can act on.

Create your account

Domain 4: Network Services and Security