CCNA Practice Test 11 — 15 Questions

Question 1

You are connected to R1. Configure DHCP services so that hosts on VLAN 10 (192.168.10.0/24) can obtain IP addresses from R1. Additionally, configure the switch SW1 to prevent rogue DHCP server attacks on that VLAN. The current configuration has a misconfigured helper-address and an excluded-address range that is too broad.

Accepted Answer

On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as trusted.. The helper-address on R1's subinterface points to 10.0.0.2 instead of the DHCP server's IP (R1 itself, which is the server). The excluded-address range excludes all addresses in the subnet, preventing any host from getting an IP. The fix: change helper-address to 192.168.10.1 (loopback or interface IP of R1), and narrow the excluded range to the first 10 addresses (or just the gateway). On SW1, enable DHCP snooping globally and for VLAN 10, and mark the port facing R1 (G0/1) as trusted; other ports should be untrusted to block rogue servers.

Answer

On R1, change the helper-address to 192.168.10.255 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set all ports as trusted.

Answer

On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.254. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

Answer

On R1, change the helper-address to 192.168.10.1 and the excluded-address range to 192.168.10.1 192.168.10.10. On SW1, enable DHCP snooping globally and for VLAN 10, and set interface G0/1 as untrusted.

Question 2

You are connected to R1. The network has two routers (R1, R2) and a switch (SW1) in between. R1's G0/0 connects to SW1 (192.168.1.1/24), SW1 connects to R2's G0/0 (192.168.1.2/24). R2 has a loopback (Lo0: 203.0.113.1/32) used as a management address. Configure an extended ACL on R1 so that only SSH (TCP/22) traffic from the 10.0.0.0/24 network is permitted to reach R2's loopback; all other traffic to that loopback must be denied. Then apply the ACL in the correct direction on the correct interface.

Accepted Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any host 203.0.113.1
interface GigabitEthernet0/1
 ip access-group 100 in. The current configuration has no ACL restricting traffic to R2's loopback. The candidate must create an extended ACL that permits TCP from 10.0.0.0/24 to host 203.0.113.1 eq 22, then deny all other IP traffic to that host. The ACL must be applied inbound on R1's G0/1 (facing the 10.0.0.0/24 network) to filter traffic before it enters R1. Applying outbound on G0/0 would also work, but inbound on G0/1 is more efficient and typical. The implicit deny at the end of the ACL blocks all other traffic to the loopback.

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any host 203.0.113.1
interface GigabitEthernet0/0
 ip access-group 100 out

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
interface GigabitEthernet0/1
 ip access-group 100 in

Answer

access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 203.0.113.1 eq 22
access-list 100 deny ip any any
interface GigabitEthernet0/1
 ip access-group 100 in

Question 3

An administrator wants to block all Telnet access to a router’s VTY lines and allow only SSH. Which change most directly supports that goal?

Accepted Answer

Configure the VTY lines to accept SSH and not Telnet.. The most direct change is to configure the VTY lines to accept only SSH, which removes Telnet as an accepted protocol. Option B (PortFast) is a spanning-tree feature that speeds up port transition on access ports and has nothing to do with VTY access. Option C (DHCP snooping) is a Layer 2 security feature to prevent rogue DHCP servers; it does not affect VTY line protocols. Option D (OSPF hello interval) is an OSPF timer adjustment, unrelated to remote access security. Therefore, only option A directly achieves the goal.

Answer

Enable PortFast on the VTY lines.

Answer

Use DHCP snooping to protect the VTY lines.

Answer

Increase the OSPF hello interval.

Question 4

You are connected to a Multilayer Switch MLS1. Configure the switch so that interface GigabitEthernet1/0/1 is an access port for VLAN 10, with voice VLAN 110 for an IP phone, and enable PoE. Additionally, interface GigabitEthernet1/0/2 must be an access port for VLAN 20 to connect an AP. Verify the configuration using 'show interfaces switchport' and 'show power inline'.

Accepted Answer

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 110
 power inline auto
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20. It configures Gi1/0/1 as an access port in VLAN 10 with voice VLAN 110 and PoE enabled, and Gi1/0/2 as an access port in VLAN 20. Option B is wrong because it uses 'switchport mode trunk' instead of 'switchport mode access'. For a voice VLAN, the port should be an access port, not a trunk. Option C is wrong because it disables PoE with 'power inline never', but the IP phone requires power. Option D is wrong because it assigns the access VLAN as 110 and voice VLAN as 10, reversing the intended roles. Verify with 'show interfaces switchport' and 'show power inline'.

Answer

interface GigabitEthernet1/0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,110
 power inline auto
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20

Answer

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 110
 power inline never
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20

Answer

interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 110
 switchport voice vlan 10
 power inline auto
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20

Question 5

You are connected to R1, a multilayer switch acting as the STP root bridge. Configure Root Guard on the designated port toward R2 (G0/1), Loop Guard on the uplink port G0/2, and BPDU Guard on PortFast-enabled access port G0/3. After configuration, a superior BPDU is received on G0/1, causing it to be blocked by Root Guard; later, an unauthorized BPDU on G0/3 triggers err-disable. Troubleshoot and verify the expected port states.

Accepted Answer

G0/1 is in blocking state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).. The root guard on G0/1 correctly blocked the port when a superior BPDU was received, preventing an unauthorized root bridge. Loop Guard was applied specifically to the uplink port G0/2 to prevent forwarding loops in case of uni-directional link failure. BPDU Guard on G0/3 placed the port into err-disable state upon receiving an unexpected BPDU, which protects the PortFast edge port. To restore G0/3, you must manually shut/no shut the interface after removing the offending device.

Answer

G0/1 is in forwarding state (Root Guard), G0/2 is in blocking state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).

Answer

G0/1 is in err-disable state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in blocking state (BPDU Guard).

Answer

G0/1 is in blocking state (Root Guard), G0/2 is in loop-inconsistent state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).

Question 6

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`.

This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 7

You are connected to SW1. An EtherChannel between SW1 and SW2 using LACP must be established on interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Currently, the channel is not forming. Inspect the provided configuration and output, then apply the necessary commands on SW1 to resolve the issue and bring up the Port-Channel interface.

Accepted Answer

Configure both interfaces with speed 1000, duplex full, and switchport access vlan 1.. The EtherChannel failed because the two member interfaces on SW1 have mismatched speed (Gi0/1: 1000 Mbps, Gi0/2: 100 Mbps) and duplex (Gi0/1: full, Gi0/2: half), and their native VLANs differ (Gi0/1: VLAN 1, Gi0/2: VLAN 10). LACP requires all bundled ports to have identical speed, duplex, and VLAN configuration. To fix, on SW1 configure both interfaces with consistent settings: set speed 1000, duplex full, and switchport access vlan 1 (or a common trunk native VLAN). Also ensure both sides use the same LACP mode (both active or active/passive); here SW2's Gi0/2 is passive, which is acceptable with SW1's active, so the primary issue is the mismatched physical and VLAN parameters. After correction, the channel will form.

Answer

Change the LACP mode on SW1's Gi0/2 from active to passive.

Answer

Configure both interfaces with speed 100, duplex half, and switchport access vlan 10.

Answer

Remove the switchport access vlan command from both interfaces and configure them as trunk ports with native vlan 1.

Question 8

Two routers, R1 and R2, have been configured with HSRP for VLAN 10 to provide default gateway redundancy to hosts. The virtual IP address is 192.168.10.1. After configuration, end hosts report inconsistent connectivity to the gateway, and a failover test reveals that when the active router is shut down, connectivity is lost. The network administrator checks the HSRP status on both routers. R1 shows HSRP group 10 as Active with no standby router, and R2 shows HSRP group 20 as Active with no standby router. What is the most likely cause of the redundancy failure?

Accepted Answer

The HSRP group number is mismatched between R1 and R2.. HSRP requires all routers participating in the same virtual router to use the same group number. Because R1 is active for group 10 and R2 is active for group 20, neither router has a standby for its group. If the active router for a group fails, no standby router can take over, causing loss of connectivity. Authentication mismatch or HSRP version mismatch would typically prevent routers from forming a neighbor relationship, but the provided status showing each router active in a different group points specifically to a group mismatch.

Answer

R2 has a lower HSRP priority than R1, so it cannot become standby.

Answer

The HSRP authentication strings do not match.

Answer

HSRP version 1 is used on R1 while version 2 is used on R2.

Question 9

Why is a northbound API valuable to orchestration tools in a controller-based network?

Accepted Answer

It gives orchestration tools a defined software interface to interact with the controller.. A northbound API is valuable because it gives orchestration tools a defined way to request data and trigger changes on the controller programmatically. In plain language, the tool can interact with the controller through software rather than relying on manual device-by-device operations. That makes higher-level automation and service coordination possible.

The controller is the platform, and the northbound API is the application-facing interface into it. The correct answer is the one focused on orchestration and software-driven interaction.

Answer

It replaces the need for all physical network devices.

Answer

It is a cabling standard for data center uplinks.

Answer

It makes security controls unnecessary.

Question 10

A network engineer notices that after issuing the no shutdown command on interface GigabitEthernet0/0 of a router, the interface remains down. The output of show interfaces GigabitEthernet0/0 displays 'GigabitEthernet0/0 is down, line protocol is down'. The physically connected switch port is also administratively down. What is the most likely cause?

Accepted Answer

The connected switch port is administratively down.. The output 'GigabitEthernet0/0 is down, line protocol is down' indicates that both Layer 1 and Layer 2 are down. Since the directly connected switch port is administratively down, the router interface detects no carrier and remains down/down even after the local no shutdown command. Therefore, option A is the most likely cause.

Answer

Mismatched encapsulation types on the router and switch.

Answer

Speed and duplex mismatch between the router and switch.

Answer

Incorrect native VLAN configuration on the trunk link.

Question 11

A network administrator configures PAT on a router to allow internal hosts in the 10.10.10.0/24 subnet to access the Internet. Afterward, users report that they can ping public IP addresses but cannot access any websites. The administrator verifies that the access list for NAT matches the correct subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command is applied. What is the most likely cause of this issue?

Accepted Answer

The router's DNS proxy is misconfigured, preventing resolution of website names.. The ability to ping public IP addresses confirms that IP routing and PAT are working for ICMP traffic. However, the failure to access websites by name while ping works indicates a DNS resolution problem. If the PAT translation table were full, new ICMP echo requests would also be dropped because they require new NAT translations. Therefore, the most likely cause is a misconfigured DNS proxy or DNS server, preventing name resolution for HTTP/HTTPS sessions.

Answer

The PAT translation table is full, causing new TCP connection requests to be dropped.

Answer

The 'overload' keyword was omitted, causing the router to use dynamic NAT with a single-address pool.

Answer

A static NAT entry for a web server is using the same public IP address as the PAT overload.

Question 12

A user says the phone connected to a switch port works, but the attached PC does not get network access. What is the most likely switch-side issue?

Accepted Answer

The access VLAN for the PC is misconfigured. An IP phone can use a voice VLAN while the attached PC uses the access VLAN. If the access VLAN is missing or wrong, the phone may still work while the PC fails.

Answer

The voice VLAN should always match the access VLAN

Answer

PortFast blocks the PC from sending traffic

Answer

The phone requires the switch to be in trunk mode

Question 13

Drag and drop the following phases into the correct order to configure gRPC streaming telemetry subscription setup and then the NetFlow data path sequence.

Accepted Answer

1. Configure gRPC telemetry subscription
2. Configure NetFlow export destination
3. Define flow monitor
4. Apply flow monitor to interface. First configure telemetry, then set up NetFlow export, define the flow monitor, and finally apply it to an interface.

Answer

1. Define flow monitor
2. Apply flow monitor to interface
3. Configure gRPC telemetry subscription
4. Configure NetFlow export destination

Answer

1. Configure NetFlow export destination
2. Define flow monitor
3. Apply flow monitor to interface
4. Configure gRPC telemetry subscription

Answer

1. Apply flow monitor to interface
2. Configure gRPC telemetry subscription
3. Define flow monitor
4. Configure NetFlow export destination

Question 14

An administrator sees high interface utilization through SNMP graphs but wants to identify which conversations are responsible. Which addition best closes that visibility gap?

Accepted Answer

NetFlow. NetFlow provides conversation-level visibility into which hosts and applications are consuming bandwidth, closing the gap left by SNMP's interface totals. A new DHCP scope assigns IP addresses but offers no traffic insight. An STP priority manages loop-free topology and does not affect monitoring. A larger OSPF metric influences routing path selection, not traffic analysis.

Answer

Another DHCP scope

Answer

A new STP priority

Answer

A larger OSPF metric

Question 15

A script authenticates to a controller API and receives a token that it presents in later requests. Which two statements about that token-based workflow are correct?

Accepted Answer

The token is often sent in an HTTP header in subsequent requests. After authentication, many APIs issue a token that the client includes in later HTTP requests. That token acts as proof that the client already authenticated successfully.

Answer

The token changes the API from REST to SNMP

Answer

The token must be stored in the router startup-config

CCNA Practice Test 11 — 15 Questions

Exhibit

CCNA Practice Test 11 — 15 Questions

Exhibit