CCNA Practice Test 11 — 15 Questions

Question 1

You are connected to a Multilayer Switch MLS1. Configure the switch so that interface GigabitEthernet1/0/1 is an access port for VLAN 10, with voice VLAN 110 for an IP phone, and enable PoE. Additionally, interface GigabitEthernet1/0/2 must be an access port for VLAN 20 to connect an AP. Verify the configuration using 'show interfaces switchport' and 'show power inline'.

Accepted Answer

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 110
 power inline auto
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20. It configures Gi1/0/1 as an access port in VLAN 10 with voice VLAN 110 and PoE enabled, and Gi1/0/2 as an access port in VLAN 20. Option B is wrong because it uses 'switchport mode trunk' instead of 'switchport mode access'. For a voice VLAN, the port should be an access port, not a trunk. Option C is wrong because it disables PoE with 'power inline never', but the IP phone requires power. Option D is wrong because it assigns the access VLAN as 110 and voice VLAN as 10, reversing the intended roles. Verify with 'show interfaces switchport' and 'show power inline'.

Answer

interface GigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,110
 power inline auto
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20

Answer

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 110
 power inline never
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20

Answer

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 110
 switchport voice vlan 10
 power inline auto
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20

Question 2

You are connected to R1, a multilayer switch acting as the STP root bridge. Configure Root Guard on the designated port toward R2 (G0/1), Loop Guard on the uplink port G0/2, and BPDU Guard on PortFast-enabled access port G0/3. After configuration, a superior BPDU is received on G0/1, causing it to be blocked by Root Guard; later, an unauthorized BPDU on G0/3 triggers err-disable. Troubleshoot and verify the expected port states.

Accepted Answer

G0/1 is in blocking state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).. The root guard on G0/1 correctly blocked the port when a superior BPDU was received, preventing an unauthorized root bridge. Loop Guard was applied specifically to the uplink port G0/2 to prevent forwarding loops in case of uni-directional link failure. BPDU Guard on G0/3 placed the port into err-disable state upon receiving an unexpected BPDU, which protects the PortFast edge port. To restore G0/3, you must manually shut/no shut the interface after removing the offending device.

Answer

G0/1 is in forwarding state (Root Guard), G0/2 is in blocking state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).

Answer

G0/1 is in err-disable state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in blocking state (BPDU Guard).

Answer

G0/1 is in blocking state (Root Guard), G0/2 is in loop-inconsistent state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).

Question 3

You are connected to SW1. An EtherChannel between SW1 and SW2 using LACP must be established on interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Currently, the channel is not forming. Inspect the provided configuration and output, then apply the necessary commands on SW1 to resolve the issue and bring up the Port-Channel interface.

Accepted Answer

Configure both interfaces with speed 1000, duplex full, and switchport access vlan 1.. The EtherChannel failed because the two member interfaces on SW1 have mismatched speed (Gi0/1: 1000 Mbps, Gi0/2: 100 Mbps) and duplex (Gi0/1: full, Gi0/2: half), and their native VLANs differ (Gi0/1: VLAN 1, Gi0/2: VLAN 10). LACP requires all bundled ports to have identical speed, duplex, and VLAN configuration. To fix, on SW1 configure both interfaces with consistent settings: set speed 1000, duplex full, and switchport access vlan 1 (or a common trunk native VLAN). Also ensure both sides use the same LACP mode (both active or active/passive); here SW2's Gi0/2 is passive, which is acceptable with SW1's active, so the primary issue is the mismatched physical and VLAN parameters. After correction, the channel will form.

Answer

Change the LACP mode on SW1's Gi0/2 from active to passive.

Answer

Configure both interfaces with speed 100, duplex half, and switchport access vlan 10.

Answer

Remove the switchport access vlan command from both interfaces and configure them as trunk ports with native vlan 1.

Question 4

A user says the phone connected to a switch port works, but the attached PC does not get network access. What is the most likely switch-side issue?

Accepted Answer

The access VLAN for the PC is misconfigured. An IP phone can use a voice VLAN while the attached PC uses the access VLAN. If the access VLAN is missing or wrong, the phone may still work while the PC fails.

Answer

The voice VLAN should always match the access VLAN

Answer

PortFast blocks the PC from sending traffic

Answer

The phone requires the switch to be in trunk mode

Question 5

Drag and drop the following phases into the correct order to configure gRPC streaming telemetry subscription setup and then the NetFlow data path sequence.

Accepted Answer

1. Configure gRPC telemetry subscription
2. Configure NetFlow export destination
3. Define flow monitor
4. Apply flow monitor to interface. First configure telemetry, then set up NetFlow export, define the flow monitor, and finally apply it to an interface.

Answer

1. Define flow monitor
2. Apply flow monitor to interface
3. Configure gRPC telemetry subscription
4. Configure NetFlow export destination

Answer

1. Configure NetFlow export destination
2. Define flow monitor
3. Apply flow monitor to interface
4. Configure gRPC telemetry subscription

Answer

1. Apply flow monitor to interface
2. Configure gRPC telemetry subscription
3. Define flow monitor
4. Configure NetFlow export destination

Question 6

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

Accepted Answer

NetFlow. NetFlow provides conversation-level visibility into which hosts and applications are consuming bandwidth, closing the gap left by SNMP's interface totals. A new DHCP scope assigns IP addresses but offers no traffic insight. An STP priority manages loop-free topology and does not affect monitoring. A larger OSPF metric influences routing path selection, not traffic analysis.

Answer

Another DHCP scope

Answer

A new STP priority

Answer

A larger OSPF metric

Question 7

A script authenticates to a controller API and receives a token that it presents in later requests. Which two statements about that token-based workflow are correct?

Accepted Answer

The token is often sent in an HTTP header in subsequent requests. After authentication, many APIs issue a token that the client includes in later HTTP requests. That token acts as proof that the client already authenticated successfully.

Answer

The token changes the API from REST to SNMP

Answer

The token must be stored in the router startup-config

Question 8

You are connected to R1 via the console. R1 is the DHCP server for the 192.168.50.0/24 LAN. Configure DHCP on R1 to assign addresses from 192.168.50.10 to 192.168.50.200, with default gateway 192.168.50.1 and DNS server 8.8.8.8. Also, configure R1 to act as a DHCP relay agent for the 10.0.0.0/30 link to reach a remote DHCP server at 203.0.113.10. Then, troubleshoot and fix a misconfiguration that causes clients on VLAN 50 to not receive IP addresses.

Accepted Answer

[CORRECT] The DHCP pool is misconfigured: the excluded-address range covers most of the pool (192.168.50.1 through 192.168.50.200), but leaves 192.168.50.201-254 assignable, violating the requirement. The correct configuration should exclude 192.168.50.1-9 (gateway) and 192.168.50.201-254 (upper end). The 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1.. The DHCP pool is misconfigured: the excluded-address range of 192.168.50.1 through 192.168.50.200 covers most of the pool, but leaves addresses 192.168.50.201 to 192.168.50.254 assignable, which violates the requirement to assign addresses only from 192.168.50.10 to 192.168.50.200. To meet the requirement, you must exclude both the lower range (192.168.50.1 to 192.168.50.9, reserving the gateway) and the upper range (192.168.50.201 to 192.168.50.254). Additionally, the 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1 so that broadcasts from the 10.0.0.0/30 subnet are forwarded.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9, but the helper-address on GigabitEthernet0/0 is correct because it forwards DHCP requests to the remote server. The relay agent configuration is missing on GigabitEthernet0/1.

Answer

The DHCP pool is correctly configured with excluded-address 192.168.50.1 192.168.50.9. The issue is that the 'ip helper-address' on GigabitEthernet0/1 is missing; it should be added to forward requests to the remote server. Additionally, the 'ip helper-address' on GigabitEthernet0/0 is correct because it forwards requests from VLAN 50 to the remote server.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9. The 'ip helper-address' on GigabitEthernet0/0 should be removed. The relay agent configuration is correct because 'ip helper-address 203.0.113.10' is already configured on GigabitEthernet0/1.

Question 9

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and to recover a port that enters err-disabled due to a BPDU guard violation.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, manually shut and no shut the interface.. Root Guard on designated, Loop Guard on non-designated, then BPDU Guard on PortFast; recovery requires interface reset after violation.

Answer

1. Configure BPDU Guard on PortFast ports. 2. Configure Loop Guard on non-designated ports. 3. Configure Root Guard on designated ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, re-enable BPDU Guard on the port.

Answer

1. Configure Loop Guard on non-designated ports. 2. Configure Root Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, configure errdisable recovery cause bpduguard.

Answer

1. Configure Root Guard on designated ports. 2. Configure BPDU Guard on PortFast ports. 3. Configure Loop Guard on non-designated ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, remove BPDU Guard from the port.

Question 10

You are connected to R1 via the console. R1 has two directly connected interfaces: G0/0 to R2 (IPv4 only) and G0/1 to a LAN switch (dual stack). Your task: configure IPv4 and IPv6 default routes on R1 pointing to R2 (next-hop 10.0.0.2 and 2001:db8:1::2). Also configure a floating static route to 192.0.2.0/24 via R2 with an administrative distance of 10 (so it is used only if the directly connected route fails). The current running-config shows an incorrect static route that causes recursive routing failure. Identify and fix the issue.

Accepted Answer

Remove the incorrect static route 192.0.2.0 255.255.255.0 10.0.0.1 and add ip route 192.0.2.0 255.255.255.0 10.0.0.2 10. The static route to 192.0.2.0/24 uses next-hop 10.0.0.1, which is R1's own interface IP, not R2's. This causes recursive routing failure because the router tries to reach itself. The correct next-hop should be 10.0.0.2 (R2's G0/0 IP). Additionally, the floating static route must have a higher AD (10) so it is less preferred than the directly connected route (AD 0). Remove the incorrect route and add the correct floating static route with AD 10.

Answer

Remove the incorrect static route 192.0.2.0 255.255.255.0 10.0.0.1 and add ip route 192.0.2.0 255.255.255.0 10.0.0.2 1

Answer

Keep the existing static route and add ip route 192.0.2.0 255.255.255.0 10.0.0.2 10

Answer

Remove the incorrect static route 192.0.2.0 255.255.255.0 10.0.0.1 and add ip route 192.0.2.0 255.255.255.0 g0/0

Question 11

You are connected to R1 via the console. R1 is a router that needs to provide DHCP services for hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The DHCP server is located on VLAN 10 at 192.168.10.100, but hosts on VLAN 20 cannot reach it directly. Configure R1 to forward DHCP broadcasts from VLAN 20 to the DHCP server.

Accepted Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip helper-address 192.168.10.100. The ip helper-address command enables the router to forward UDP broadcasts (including DHCP) to a specific server. Placing it on the VLAN 20 subinterface ensures that DHCP requests from VLAN 20 are unicast to the server on VLAN 10.

Answer

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip helper-address 192.168.10.100

Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip dhcp relay information option

Answer

ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1

Question 12

Why is a northbound API valuable to orchestration tools in a controller-based network?

Accepted Answer

It gives orchestration tools a defined software interface to interact with the controller.. A northbound API is valuable because it gives orchestration tools a defined way to request data and trigger changes on the controller programmatically. In plain language, the tool can interact with the controller through software rather than relying on manual device-by-device operations. That makes higher-level automation and service coordination possible.

The controller is the platform, and the northbound API is the application-facing interface into it. The correct answer is the one focused on orchestration and software-driven interaction.

Answer

It replaces the need for all physical network devices.

Answer

It is a cabling standard for data center uplinks.

Answer

It makes security controls unnecessary.

Question 13

A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?

Accepted Answer

VLAN 20 does not exist or is not active on the switch. The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.

Answer

Port security has shut down the interface

Answer

The port must be converted to a trunk

Answer

The default gateway must be configured on the physical switch port

Question 14

You are connected to R1, a router that serves as the DNS resolver for the local network 192.168.10.0/24. Users report that they cannot resolve the hostname 'webserver.internal' to its IP address (192.168.10.50), and reverse DNS lookups for that IP return a different name. Additionally, some queries to an external domain 'example.com' time out. Diagnose and fix the DNS configuration on R1 using nslookup and dig commands where applicable, ensuring proper forward and reverse resolution for internal hosts and reachability to external DNS servers.

Accepted Answer

Remove the unreachable DNS server 192.0.2.53, add an A record for webserver.internal (192.168.10.50), and correct the PTR record for 192.168.10.50 to point to webserver.internal.. The DNS server 192.0.2.53 is unreachable, causing timeouts for external queries. The primary DNS server 203.0.113.53 returns NXDOMAIN for 'webserver.internal' because no A record exists for that hostname in the internal zone. Additionally, the PTR record for 192.168.10.50 incorrectly points to 'mail.internal' instead of 'webserver.internal'. To fix, first remove the unreachable DNS server with 'no ip name-server 192.0.2.53' or replace it with a reachable one. Then, on the DNS server (or via static host entries on R1), add an A record for webserver.internal (192.168.10.50) and correct the PTR record to point to webserver.internal. Optionally, configure 'ip host webserver.internal 192.168.10.50' on R1 for local resolution.

Answer

Add an A record for webserver.internal (192.168.10.50) and correct the PTR record for 192.168.10.50 to point to webserver.internal, but leave the unreachable DNS server 192.0.2.53 in the configuration.

Answer

Remove the unreachable DNS server 192.0.2.53 and add an A record for webserver.internal (192.168.10.50), but do not correct the PTR record for 192.168.10.50.

Answer

Replace the unreachable DNS server 192.0.2.53 with a reachable one, and correct the PTR record for 192.168.10.50 to point to webserver.internal, but do not add an A record for webserver.internal.

Question 15

A router learns 172.16.40.0/24 from OSPF with AD 110 and metric 20. It also learns the same prefix from EIGRP with AD 90 and feasible distance 30720. Which route is installed?

Accepted Answer

The EIGRP route because its administrative distance is lower. When the same prefix is learned from different routing protocols, the router compares administrative distance first. EIGRP internal routes have AD 90, which beats OSPF AD 110, so the EIGRP path goes into the table.

Answer

The OSPF route because metric 20 is lower than 30720

Answer

Both routes because ECMP is automatic across different protocols

Answer

Neither route until one is redistributed into the other protocol

CCNA Practice Test 11 — 15 Questions

Exhibit

CCNA Practice Test 11 — 15 Questions

Exhibit