CCNA Practice Test 12 — 15 Questions

Question 1

A network engineer is troubleshooting OSPFv3 adjacency between two directly connected Cisco routers, R1 and R2, both running IOS-XE. The engineer configures OSPFv3 on both routers but notices that the adjacency does not form. The engineer runs 'show ospfv3 neighbor' on R1 and sees no neighbors. What is the most likely cause of this issue?

Accepted Answer

The interface GigabitEthernet0/0 is missing the 'ospfv3 1 ipv6 area 0' command.. OSPFv3 requires explicit interface-level configuration to enable the protocol on a specific interface. The correct command is 'ospfv3 1 ipv6 area 0' (or 'ipv6 ospf 1 area 0' for the traditional OSPFv3 configuration). Without this command, the interface does not participate in OSPFv3, so no Hello packets are sent or received, preventing adjacency formation.

Answer

The OSPFv3 process ID must match on both routers.

Answer

The link-local addresses are not in the same subnet.

Answer

The router ID 1.1.1.1 is duplicated on R2.

Question 2

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

Accepted Answer

PAT overload. When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.

Answer

Static NAT

Answer

Policy-based routing

Answer

Port security

Question 3

You are troubleshooting connectivity for a wireless client connected to the home network shown below. The client has obtained an APIPA address (169.254.x.x), indicating DHCP failure. Verify the DHCP server configuration on R1 and correct the issue so that the client receives a valid IP address from the 192.168.1.0/24 subnet.

Accepted Answer

Enable the DHCP service globally using the 'service dhcp' command on R1.. The client obtained an APIPA address (169.254.x.x) because DHCP was not assigning addresses. The DHCP pool is correctly configured, but the global DHCP service must be enabled with the 'service dhcp' command on R1. The excluded-address range (192.168.1.1–192.168.1.10) uses only a small fraction of the /24 subnet, so it is not the issue. Enabling 'service dhcp' allows the router to process DHCP requests and assign addresses from the pool.

Answer

Remove the 'ip dhcp excluded-address 192.168.1.1 192.168.1.10' command because it excludes too many addresses.

Answer

Change the DHCP pool network to 192.168.1.0/24 and add the default-router 192.168.1.1 command.

Answer

Configure the 'ip helper-address' command on the client's VLAN interface to forward DHCP requests to the server.

Question 4

Exhibit: R1 has learned 10.50.0.0/24 through OSPF and also has a floating static route to the same prefix with administrative distance 130. Which route is installed while OSPF is healthy?

Accepted Answer

The OSPF route because its administrative distance is lower than the floating static route. A floating static route is meant to stay out of the table until the preferred route disappears. OSPF has administrative distance 110, which is lower than the static route AD 130, so the OSPF route is installed while the OSPF path is still present.

Answer

The static route because static routes always win over dynamic routes

Answer

Both routes because the prefix length matches

Answer

Neither route until equal-cost load balancing is configured

Question 5

A network technician is troubleshooting a router that cannot be accessed via SSH. The router responds to Telnet but SSH attempts return 'connection refused'. The technician confirmed that 'ip ssh version 2' is configured and 'show ip ssh' indicates SSH is enabled. The output of 'show line vty 0 4' shows 'transport input telnet'. What should the technician do next?

Accepted Answer

Add the 'transport input ssh' command to the VTY lines.. The VTY lines are configured with 'transport input telnet', which explicitly allows only Telnet sessions. SSH is enabled globally, but because it is not listed in the VTY transport input, the router rejects SSH connection attempts. Adding 'transport input ssh' (or 'transport input all') under the VTY lines permits SSH connections without disrupting Telnet, solving the mismatch at the application layer.

Answer

Generate a new RSA key pair and restart the SSH service.

Answer

Configure 'ip ssh version 1' to enable backward compatibility.

Answer

Configure AAA authentication on the VTY lines.

Question 6

Which two statements accurately describe DNS and DHCP?

Accepted Answer

DNS resolves names to IP information, while DHCP dynamically assigns addressing information to clients.. DNS and DHCP solve very different problems, even though both are common infrastructure services. DNS helps devices and users find systems by name. In simple terms, it means people can type a hostname rather than memorizing numeric IP addresses. DHCP automatically gives clients important IP settings such as an address, subnet mask, default gateway, and often DNS server information.

The trick in comparison questions is not to blend their roles together. DHCP does not perform NAT, and it does not eliminate the need for addressing details; it actually supplies them.

Answer

DHCP is used primarily to translate private addresses into public addresses.

Answer

DHCP replaces the need for subnet masks and default gateways.

Answer

DNS and DHCP are both Layer 1 technologies.

Question 7

You are connected to R1. Configure NTP client so that R1 synchronizes with the NTP server at 198.51.100.10, using its Loopback0 (10.0.0.1/32) as the source interface. Also configure syslog to send messages of severity 5 (notifications) and above to 192.0.2.20. The current configuration shows a misconfigured NTP server address and an incorrect logging trap level. Verify with 'show ntp status' (stratum should not be 16) and 'show logging'.

Accepted Answer

ntp server 198.51.100.10 source Loopback0
logging trap notifications. The misconfigured NTP server address (203.0.113.5) and the debug-level logging trap (7) must be corrected to meet requirements. The correct commands are 'ntp server 198.51.100.10 source Loopback0' to use the specified server and Loopback0 as source, and 'logging trap notifications' (severity 5) to send only notifications and more severe messages. Option B is wrong because 'logging trap 4' sets the trap level to warning, which would not forward notifications. Option C misses the source interface, and Option D uses the wrong NTP server and an overly verbose trap level.

Answer

ntp server 198.51.100.10 source Loopback0
logging trap 4

Answer

ntp server 198.51.100.10
logging trap notifications

Answer

ntp server 203.0.113.5 source Loopback0
logging trap 7

Question 8

A branch router has only one WAN link connected to an Ethernet handoff from the provider. Which static default route is generally the better choice?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 198.51.100.1. On multiaccess Ethernet, pointing the default route to a next-hop IP address is usually cleaner because the router can resolve the next hop with ARP. Using only the exit interface on Ethernet can make the router treat many destinations as directly connected and trigger unnecessary ARP behavior.

Answer

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0

Answer

ip route 255.255.255.255 255.255.255.255 198.51.100.1

Answer

No static default route should ever be used on Ethernet.

Question 9

You are connected to SW1 via the console. The network has three switches connected in a triangle: SW1 (G0/1 to SW2 G0/1), SW1 (G0/2 to SW3 G0/1), and SW2 (G0/2 to SW3 G0/2). SW1 is the root bridge. A PC is connected to SW3's G0/3 port, which should be an edge port. However, the PC has been sending BPDUs, causing the port to go err-disabled. Configure SW3 to prevent this in the future: enable PortFast and BPDU Guard on G0/3. Then, verify that the port recovers from err-disabled state and that a specific blocked port on SW2 is identified. Use the provided show output to determine the current state and necessary commands.

Accepted Answer

interface g0/3
 spanning-tree portfast
 spanning-tree bpduguard enable
 shutdown
 no shutdown. The PC connected to SW3's G0/3 was sending BPDUs, causing the port to go err-disabled due to BPDU Guard. To prevent this, enable PortFast and BPDU Guard on that interface. First, move to interface configuration mode for G0/3, then issue 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After configuration, the port will remain err-disabled until manually recovered by issuing 'shutdown' followed by 'no shutdown'. The blocked port on SW2 is G0/2, as shown by the 'Altn BLK' role/status in its spanning-tree output.

Answer

interface g0/3
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown

Answer

interface g0/3
 spanning-tree portfast
 spanning-tree bpduguard enable
 end
 copy running-config startup-config

Answer

interface g0/3
 spanning-tree portfast
 spanning-tree bpduguard enable
 shutdown

Question 10

Which two statements about ARP on an IPv4 Ethernet network are correct? (Choose two.)

Accepted Answer

An ARP request is sent as a Layer 2 broadcast.. ARP resolves an IPv4 address to a MAC address on the local segment. ARP requests are broadcast; ARP replies are typically unicast.

Answer

ARP is used to map IPv6 addresses to MAC addresses.

Answer

ARP is forwarded by routers across subnets by default.

Question 11

Which command enables IPv6 routing on a Cisco router?

Accepted Answer

ipv6 unicast-routing. The global configuration command 'ipv6 unicast-routing' enables IPv6 forwarding on a Cisco router. 'ipv6 enable' is an interface-level command used to enable IPv6 on a specific interface, not globally. 'ip routing ipv6' and 'ipv6 route enable' are syntactically invalid commands that do not exist in Cisco IOS.

Answer

ipv6 enable

Answer

ip routing ipv6

Answer

ipv6 route enable

Question 12

You are connected to R1. Configure HSRP on R1 and R2 so that R1 is the active gateway for VLAN 100 with a virtual IP of 192.0.2.254. R1 should preempt and track its G0/1 interface to decrement priority by 20 if it goes down. Currently, both routers show active for the group, and the virtual IP is incorrectly set. Troubleshoot and fix the configuration on R1 only.

Accepted Answer

Change the virtual IP to 192.0.2.254 and set priority to 110.. The issue is that both routers are active because the virtual IP on R1 was 192.168.100.254, which is not in the same subnet as the interface IP (192.0.2.1/24), so HSRP couldn't form a common group. Changing the virtual IP to 192.0.2.254 fixes the subnet mismatch. Additionally, setting R1's priority to 110 ensures it becomes the active router because it has preempt configured, and the higher priority overrides R2's default 100. The track command remains correct as it reduces priority if G0/1 fails.

Answer

Change the virtual IP to 192.0.2.254 and remove the track command.

Answer

Change the virtual IP to 192.0.2.254 and configure preempt on R2.

Answer

Change the virtual IP to 192.0.2.254 and set priority to 100.

Question 13

Exhibit: A router has the following routes in its routing table:
- OSPF: 10.1.1.0/24
- Static: 10.1.1.128/25
- Default: 0.0.0.0/0

A packet is destined for 10.1.1.130. Which route does the router use?

Accepted Answer

The static 10.1.1.128/25 route. Routers use longest-prefix match before they think about metrics. The /25 route for 10.1.1.128/25 is more specific than the /24 or the default route, so traffic for 10.1.1.130 follows that path.

Answer

The OSPF 10.1.1.0/24 route

Answer

The default route

Answer

The router load-balances across all three

Question 14

You are connected to a multilayer switch MLS1. Configure Root Guard on the designated port facing another switch SW2 to prevent it from becoming root, configure Loop Guard on the uplink port to the core, and configure BPDU Guard on a PortFast-enabled access port. After configuration, a superior BPDU arrives on the designated port—confirm it is blocked by Root Guard. Then, simulate a BPDU on the access port to verify it goes err-disabled due to BPDU Guard.

Accepted Answer

Root Guard on Gi0/2, Loop Guard on Gi0/1, BPDU Guard on Gi0/0. First, Root Guard was applied on Gi0/2 (the designated port) with 'spanning-tree guard root' to prevent SW2 from becoming root. Second, Loop Guard was applied on the uplink Gi0/1 with 'spanning-tree guard loop' to protect against unidirectional links. Third, BPDU Guard was applied on the PortFast-enabled access port Gi0/0 with 'spanning-tree bpduguard enable'. When a superior BPDU arrives on Gi0/2, Root Guard transitions it to a root-inconsistent (blocked) state. If a BPDU is received on Gi0/0, BPDU Guard err-disables the port. Verification shows the blocked state on Gi0/2 and err-disabled on Gi0/0.

Answer

Root Guard on Gi0/1, Loop Guard on Gi0/2, BPDU Guard on Gi0/0

Answer

Root Guard on Gi0/0, Loop Guard on Gi0/1, BPDU Guard on Gi0/2

Answer

Root Guard on Gi0/2, Loop Guard on Gi0/0, BPDU Guard on Gi0/1

Question 15

You are connected to R1 via the console. Configure single-area OSPFv2 on R1 and R2 so that they form a full adjacency. The link between R1 and R2 uses 203.0.113.0/30. R1 has G0/0 203.0.113.1/30 and R2 has G0/0 203.0.113.2/30. R1's router-id must be 1.1.1.1, and R2's router-id must be 2.2.2.2. R1's GigabitEthernet0/0 interface is configured as a passive interface under OSPF, preventing OSPF hello messages from being sent out of that interface. Ensure that R1 does not send OSPF hellos out of its loopback0 interface (203.0.113.129/32). After configuration, verify the adjacency is established and OSPF routes are exchanged.

Accepted Answer

The adjacency fails because R1's GigabitEthernet0/0 interface is configured as passive-interface. Remove the passive-interface command for G0/0.. The adjacency fails because R1's GigabitEthernet0/0 interface is configured as passive-interface (the 'No Hellos' line in show ip ospf interface). This prevents R1 from sending OSPF hellos to R2. To fix, remove the passive-interface command for G0/0. The loopback0 interface should remain passive. After removal, verify with 'show ip ospf neighbor' to see the neighbor state change to FULL and 'show ip route ospf' to see routes.

Answer

The adjacency fails because the router-id 1.1.1.1 is not reachable from R2. Configure a static route for 1.1.1.1/32 on R2.

Answer

The adjacency fails because the subnet mask on the link is /30 but OSPF expects a /24. Change the mask to /24 on both interfaces.

Answer

The adjacency fails because OSPF is not enabled on R2's GigabitEthernet0/0 interface. Configure 'ip ospf 1 area 0' on R2's G0/0.