CCNA Practice Test 14 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the interface facing the source.

Accepted Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.. First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.

Answer

Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.

Answer

Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.

Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.

Question 2

Which Cisco IOS command configures a default static route pointing to next hop 203.0.113.1?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.1. A default static route uses the all-zero network and mask, followed by the next-hop IP address or exit interface.

Answer

ip default-gateway 203.0.113.1

Answer

default-information originate 203.0.113.1

Answer

route add 0.0.0.0 203.0.113.1

Question 3

A router has a static route configured: ip route 10.200.0.0 255.255.0.0 GigabitEthernet0/1. The output of show ip interface brief shows that interface GigabitEthernet0/1 is administratively down. Why is the route to 10.200.0.0/16 present in the running configuration but absent from the routing table?

Accepted Answer

Because the route points to an interface that is administratively down.. The static route is absent because the outgoing interface is down. In practical terms, when a static route depends on an interface that is not operational, the router cannot use that path, so the route is not installed as usable forwarding state. The configuration line alone is not enough; the forwarding path also has to be viable.

This is a realistic static-route troubleshooting pattern because it distinguishes between configured intent and operational state.

Answer

Because static routes cannot reference exit interfaces.

Answer

Because the destination must be a /24, not a /16.

Answer

Because static routes require NTP before installation.

Question 4

You are connected to R1, a Cisco IOS-XE router that provides connectivity for the 192.168.10.0/24 network. The network operations team uses a Python script with netmiko to push configuration changes. However, the script fails to connect to R1. You need to verify the SSH configuration on R1.

Accepted Answer

The VTY lines are configured for telnet only; SSH requires 'transport input ssh'.. The VTY lines are configured for telnet only. SSH requires 'transport input ssh' (or 'transport input all'). Additionally, the SSH server may not be enabled if the crypto key is missing or the ip ssh command is not present. The commands show that transport input is telnet, so the script cannot connect via SSH. Changing to 'transport input ssh' resolves the issue.

Answer

The SSH server is not enabled because the crypto key is missing or 'ip ssh' is not configured.

Answer

The SSH version is set to version 1, which is not supported by the Python script.

Answer

The domain name is not configured, which is required for SSH key generation.

Question 5

Which two statements accurately describe OSPF passive interfaces?

Accepted Answer

It prevents OSPF from sending hello packets on that interface.. An OSPF passive interface stops hello packet exchange on that interface while still allowing the connected network to be advertised into OSPF through other active adjacencies. In plain language, it tells the router not to try to form neighbors on that interface, but not to forget that the network exists. This is very useful on user-facing or stub-like interfaces where no routing neighbor should appear.

The wrong answers often treat passive as if it disables OSPF globally or removes the network completely. The two correct answers are the ones that preserve the suppression of adjacency on that interface and the continued advertisement of the connected network.

Answer

It changes OSPF into a static route on that interface.

Answer

It forces the interface to become the router ID.

Answer

It disables OSPF on every interface in the router automatically.

Question 6

Which two statements accurately describe longest-prefix match in routing?

Accepted Answer

The most specific matching route is preferred over broader matching routes.. Longest-prefix match means a router prefers the most specific route that matches the destination. In plain language, if several entries could apply to a packet, the router chooses the one that narrows the destination range most precisely. This is why a /25 can beat a /24, and a /24 can beat a /16, even if all three technically contain the same destination address.

The common mistake is to assume the router always begins with protocol trust or metric. Those factors matter, but only after the router has determined which matching routes share the same prefix length.

Answer

A default route is preferred over a matching /24 because it is simpler.

Answer

Routers ignore subnet masks and choose only by administrative distance.

Answer

A /16 is always more specific than a /24.

Question 7

You are connected to SW1, a multilayer switch. Configure DHCP snooping and an IP helper-address so that clients in VLAN 20 receive IP addresses from the DHCP server at 10.0.0.2. The DHCP server is already configured with a pool for 192.168.20.0/24, but clients are not getting addresses. Identify and correct the issues in the current configuration.

Accepted Answer

Enable DHCP snooping globally and on VLAN 20, configure interface G0/0 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.. The DHCP relay helper-address was pointing to 10.0.0.3 instead of the actual server at 10.0.0.2. Also, DHCP snooping was not enabled. After enabling DHCP snooping globally and on VLAN 20, configure the uplink to the DHCP server as a trusted port (G0/0) and the access port (G0/1) as untrusted (default). Finally, correct the helper-address to 10.0.0.2. These steps allow DHCP broadcasts from VLAN 20 to be relayed to the server and prevent rogue DHCP attacks.

Answer

Enable DHCP snooping globally and on VLAN 20, configure interface G0/1 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

Answer

Enable DHCP snooping globally and on VLAN 20, configure interface G0/0 as trusted, and keep the ip helper-address as 10.0.0.3 because that is the correct server address.

Answer

Enable DHCP snooping globally and on VLAN 20, configure both interfaces G0/0 and G0/1 as trusted, and change the ip helper-address on the SVI for VLAN 20 from 10.0.0.3 to 10.0.0.2.

Question 8

Drag and drop the following steps into the correct order to configure and apply an extended IPv4 ACL on a Cisco router to block Telnet traffic from subnet 192.168.1.0/24 to host 10.0.0.1 and permit all other IP traffic.

Accepted Answer

Identify the traffic to filter (deny Telnet from 192.168.1.0/24 to 10.0.0.1) and determine that the ACL should be applied inbound on interface GigabitEthernet0/1.. Correct order: 1) Identify the traffic to filter and the interface/direction because this planning determines all subsequent configuration choices. 2) Enter global configuration mode to access ACL definition. 3) Configure the deny statement first — ACLs are processed top-down, so the specific deny must precede the general permit to actually block the unwanted traffic. 4) Add the permit statement after the deny to allow everything else. 5) Enter interface configuration mode to attach the ACL to a specific port. 6) Apply the ACL with the correct direction (inbound) using the ip access-group command, which activates the filtering. 7) Verify the ACL is correctly applied to confirm the configuration is functioning as intended.

Question 9

Which TWO statements about interpreting routing table output are true? (Choose two.)

Accepted Answer

A route with a longer prefix length is always preferred over a route with a shorter prefix length, regardless of administrative distance.. Longest-prefix match always wins regardless of AD or route source (A correct), and directly connected routes have AD 0 (B correct). C is incorrect because among equal prefix lengths, lower AD wins. D is wrong because metric only compares same-protocol routes, while AD compares across protocols. E fails because a higher AD (200) is less preferred than OSPF's 110.

Answer

If two routes have the same prefix length, the route with the higher administrative distance is preferred.

Answer

The metric is used to compare routes from different routing protocols.

Answer

A static route configured with an administrative distance of 200 will be preferred over an OSPF route with AD 110 for the same network.

Question 10

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

Accepted Answer

Devices can send log messages to a remote syslog server for central storage. Syslog provides centralized event reporting by allowing devices to send log messages to a remote server (option A is correct). Severity levels enable filtering based on event seriousness (option B is correct). Option C is incorrect because syslog does not assign IP addresses dynamically—that is the role of DHCP. Option D is incorrect because syslog logs events and does not replace SNMP counters, which remain the primary method for collecting interface statistics.

Answer

Syslog is used to assign IP addresses dynamically to endpoints

Answer

Syslog entries replace SNMP counters for interface statistics

Question 11

Which STP port state on a classic 802.1D switch listens for BPDUs and prepares to participate in the topology, but does not yet learn MAC addresses?

Accepted Answer

Listening. In classic STP, the listening state processes BPDUs and waits before learning begins. The learning state is when the switch starts populating the MAC table.

Answer

Learning

Answer

Forwarding

Answer

Disabled

Question 12

Which HTTP method is commonly used to retrieve information from a REST API without modifying the resource?

Accepted Answer

GET. GET is the standard HTTP method for retrieving a resource representation without changing the resource.

Answer

POST

Answer

PUT

Answer

DELETE

Question 13

You are connected to SW1. Two switches, SW1 and SW2, are connected via four GigabitEthernet links. Configure LACP EtherChannel between them using interfaces GigabitEthernet0/1 through GigabitEthernet0/4 on SW1. Set the channel-group mode to active on SW1. The port-channel interface must be configured as a trunk, allowing VLANs 10, 20, 30. However, the EtherChannel is not forming. The current configuration is shown below. Identify and fix the issue, then verify the EtherChannel is operational.

Accepted Answer

Remove 'no switchport' and IP address from Port-channel1, then configure 'switchport mode trunk' and 'switchport trunk allowed vlan 10,20,30'.. The EtherChannel is not forming because the Port-channel1 interface is configured as a Layer 3 interface (no switchport, IP address), while the member interfaces are Layer 2 switchports (switchport mode trunk). This mismatch prevents the channel from bundling. To fix this, configure Port-channel1 as a Layer 2 trunk interface with the same allowed VLANs. The solution: remove the no switchport command and the IP address, then apply switchport mode trunk and switchport trunk allowed vlan 10,20,30. After correction, the ports should bundle and the show etherchannel summary will show the ports as bundled (P) and the port-channel as Layer 2 (S).

Answer

Change the channel-group mode on the member interfaces from active to passive.

Answer

Add the 'switchport nonegotiate' command to the member interfaces.

Answer

Configure the member interfaces with 'channel-group 1 mode on' instead of active.

Question 14

You are connected to R1, a Cisco IOS-XE router that serves as the DNS resolver for the local network. The router can reach the DNS server at 198.51.100.53, but internal hosts cannot resolve the hostname 'fileserver.courseiva.com' (expected IP 203.0.113.10). Which configuration will resolve the issue?

Accepted Answer

Add a static host entry: ip host fileserver.courseiva.com 203.0.113.10. The DNS server is reachable but does not have an A record for fileserver.courseiva.com, so NXDOMAIN is returned. The router can resolve the name locally by adding a static host entry with `ip host`. This bypasses the external DNS and directly maps the hostname to the correct IP. Changing the DNS server to another unknown IP does not guarantee resolution, and static routes or external public DNS are irrelevant for this internal name.

Answer

Change the DNS server to 203.0.113.53 using the command 'ip name-server 203.0.113.53'

Answer

Add a static route to 198.51.100.53 via the next-hop interface

Answer

Configure the router to use the DNS server at 8.8.8.8 using 'ip name-server 8.8.8.8'

Question 15

Which two statements accurately describe controller-based networking at the CCNA level?

Accepted Answer

A controller can centralize management and policy logic.. A software-defined networking (SDN) controller centralizes management, policy logic, and network intelligence, reducing manual per-device configuration. Option B is correct because northbound APIs (e.g., REST APIs) allow external applications, orchestration tools, and automation scripts to interact with the controller for dynamic network control. Option C is wrong because controllers do not eliminate switches and routers; these devices still forward packets based on instructions from the controller. Option D is wrong because controllers are fundamental to network automation—they provide programmable interfaces and centralized logic that enable automated provisioning and policy enforcement. Option E is wrong because modern controllers use secure communication channels such as HTTPS, SSH, or TLS, not Telnet (which is insecure and rarely used in controller architectures).

Answer

Controllers eliminate all need for switches and routers.

Answer

Controllers are unrelated to automation.

Answer

Controllers require Telnet for all communication.